@jackwener/opencli 1.3.3 → 1.4.0

package/dist/clis/xueqiu/danjuan-utils.js

@@ -0,0 +1,126 @@
+/**
+ * Shared helpers for Danjuan (蛋卷基金) adapters.
+ *
+ * Core design: a single page.evaluate call fetches the gain overview AND
+ * all per-account holdings in parallel (Promise.all), minimising Node↔Browser
+ * round-trips to exactly one.
+ */
+export const DANJUAN_DOMAIN = 'danjuanfunds.com';
+export const DANJUAN_ASSET_PAGE = `https://${DANJUAN_DOMAIN}/my-money`;
+const GAIN_URL = `https://${DANJUAN_DOMAIN}/djapi/fundx/profit/assets/gain?gains=%5B%22private%22%5D`;
+const SUMMARY_URL = `https://${DANJUAN_DOMAIN}/djapi/fundx/profit/assets/summary?invest_account_id=`;
+// ---------------------------------------------------------------------------
+// Single-evaluate fetcher
+// ---------------------------------------------------------------------------
+/**
+ * Fetch the complete Danjuan fund picture in ONE browser round-trip.
+ *
+ * Inside the browser context we:
+ *   1. Fetch the gain/assets overview (contains account list)
+ *   2. Promise.all → fetch every account's holdings in parallel
+ *   3. Return the combined result to Node
+ */
+export async function fetchDanjuanAll(page) {
+    const raw = await page.evaluate(`
+    (async () => {
+      const f = async (u) => {
+        const r = await fetch(u, { credentials: 'include' });
+        if (!r.ok) return { _err: r.status };
+        try { return await r.json(); } catch { return { _err: 'parse' }; }
+      };
+      const n = (v) => { const x = Number(v); return Number.isFinite(x) ? x : null; };
+
+      const gain = await f(${JSON.stringify(GAIN_URL)});
+      if (gain._err) return { _httpError: gain._err };
+
+      const root = gain.data || {};
+      const fundSec = (root.items || []).find(i => i && i.summary_type === 'FUND');
+      const rawAccs = fundSec && Array.isArray(fundSec.invest_account_list)
+        ? fundSec.invest_account_list : [];
+
+      const accounts = rawAccs.map(a => ({
+        accountId:   String(a.invest_account_id || ''),
+        accountName: a.invest_account_name || '',
+        accountType: a.invest_account_type || '',
+        accountCode: a.invest_account_code || '',
+        marketValue: n(a.market_value),
+        dailyGain:   n(a.daily_gain),
+        mainFlag:    !!a.main_flag,
+      }));
+
+      if (!accounts.length) {
+        return { _emptyAccounts: true };
+      }
+
+      const details = await Promise.all(
+        accounts.map(a => f(${JSON.stringify(SUMMARY_URL)} + encodeURIComponent(a.accountId)))
+      );
+
+      const holdings = [];
+      const detailErrors = [];
+      for (let i = 0; i < accounts.length; i++) {
+        const d = details[i];
+        if (d._err) {
+          detailErrors.push({
+            accountId: accounts[i].accountId,
+            accountName: accounts[i].accountName,
+            error: d._err,
+          });
+          continue;
+        }
+        const data = d.data || {};
+        const funds = Array.isArray(data.items) ? data.items : [];
+        const acc = accounts[i];
+        for (const fd of funds) {
+          holdings.push({
+            accountId:        acc.accountId,
+            accountName:      data.invest_account_name || acc.accountName,
+            accountType:      data.invest_account_type || acc.accountType,
+            fdCode:           fd.fd_code || '',
+            fdName:           fd.fd_name || '',
+            category:         fd.category_text || fd.category || '',
+            marketValue:      n(fd.market_value),
+            volume:           n(fd.volume),
+            usableRemainShare:n(fd.usable_remain_share),
+            dailyGain:        n(fd.daily_gain),
+            holdGain:         n(fd.hold_gain),
+            holdGainRate:     n(fd.hold_gain_rate),
+            totalGain:        n(fd.total_gain),
+            nav:              n(fd.nav),
+            marketPercent:    n(fd.market_percent),
+          });
+        }
+      }
+
+      return {
+        asOf:                root.daily_gain_date || null,
+        totalAssetAmount:    n(root.amount),
+        totalAssetDailyGain: n(root.daily_gain),
+        totalAssetHoldGain:  n(root.hold_gain),
+        totalAssetTotalGain: n(root.total_gain),
+        totalFundMarketValue:n(fundSec && fundSec.amount),
+        accounts,
+        holdings,
+        detailErrors,
+      };
+    })()
+  `);
+    if (raw?._httpError) {
+        throw new Error(`HTTP ${raw._httpError} — Hint: not logged in to ${DANJUAN_DOMAIN}?`);
+    }
+    if (raw?._emptyAccounts) {
+        throw new Error(`No fund accounts found — Hint: not logged in to ${DANJUAN_DOMAIN}?`);
+    }
+    if (Array.isArray(raw?.detailErrors) && raw.detailErrors.length > 0) {
+        const failedAccounts = raw.detailErrors
+            .map((item) => {
+            const label = item.accountName && item.accountId
+                ? `${item.accountName} (${item.accountId})`
+                : item.accountName || item.accountId || 'unknown account';
+            return `${label}: ${item.error}`;
+        })
+            .join(', ');
+        throw new Error(`Failed to fetch Danjuan account details: ${failedAccounts}`);
+    }
+    return raw;
+}

package/dist/clis/xueqiu/danjuan-utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/clis/xueqiu/danjuan-utils.test.js

@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from 'vitest';
+import { fetchDanjuanAll } from './danjuan-utils.js';
+describe('fetchDanjuanAll', () => {
+    it('throws when no Danjuan accounts are visible', async () => {
+        const mockPage = {
+            evaluate: vi.fn().mockResolvedValue({ _emptyAccounts: true }),
+        };
+        await expect(fetchDanjuanAll(mockPage)).rejects.toThrow('No fund accounts found');
+    });
+    it('throws when any account detail request fails', async () => {
+        const mockPage = {
+            evaluate: vi.fn().mockResolvedValue({
+                detailErrors: [
+                    { accountName: '默认账户', accountId: 'acc-1', error: 403 },
+                ],
+            }),
+        };
+        await expect(fetchDanjuanAll(mockPage)).rejects.toThrow('Failed to fetch Danjuan account details: 默认账户 (acc-1): 403');
+    });
+    it('returns the combined snapshot when all account details succeed', async () => {
+        const snapshot = {
+            asOf: '2026-03-25',
+            totalAssetAmount: 100,
+            totalAssetDailyGain: 1,
+            totalAssetHoldGain: 2,
+            totalAssetTotalGain: 3,
+            totalFundMarketValue: 80,
+            accounts: [{ accountId: 'acc-1', accountName: '默认账户' }],
+            holdings: [{ accountId: 'acc-1', fdCode: '000001', fdName: '示例基金' }],
+            detailErrors: [],
+        };
+        const mockPage = {
+            evaluate: vi.fn().mockResolvedValue(snapshot),
+        };
+        await expect(fetchDanjuanAll(mockPage)).resolves.toMatchObject({
+            asOf: '2026-03-25',
+            accounts: [{ accountId: 'acc-1', accountName: '默认账户' }],
+            holdings: [{ accountId: 'acc-1', fdCode: '000001', fdName: '示例基金' }],
+        });
+    });
+});

package/dist/clis/xueqiu/fund-holdings.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/clis/xueqiu/fund-holdings.js

@@ -0,0 +1,28 @@
+import { cli, Strategy } from '../../registry.js';
+import { fetchDanjuanAll } from './danjuan-utils.js';
+cli({
+    site: 'xueqiu',
+    name: 'fund-holdings',
+    description: '获取蛋卷基金持仓明细（可用 --account 按子账户过滤）',
+    domain: 'danjuanfunds.com',
+    strategy: Strategy.COOKIE,
+    navigateBefore: 'https://danjuanfunds.com/my-money',
+    args: [
+        { name: 'account', type: 'str', default: '', help: '按子账户名称或 ID 过滤' },
+    ],
+    columns: ['accountName', 'fdCode', 'fdName', 'marketValue', 'volume', 'dailyGain', 'holdGain', 'holdGainRate', 'marketPercent'],
+    func: async (page, args) => {
+        const snapshot = await fetchDanjuanAll(page);
+        if (!snapshot.accounts.length) {
+            throw new Error('No fund accounts found — Hint: not logged in to danjuanfunds.com?');
+        }
+        const filter = String(args.account ?? '').trim();
+        const rows = filter
+            ? snapshot.holdings.filter(h => h.accountId === filter || h.accountName.includes(filter))
+            : snapshot.holdings;
+        if (!rows.length) {
+            throw new Error(filter ? `No holdings matched account filter: ${filter}` : 'No holdings found.');
+        }
+        return rows;
+    },
+});

package/dist/clis/xueqiu/fund-snapshot.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/clis/xueqiu/fund-snapshot.js

@@ -0,0 +1,25 @@
+import { cli, Strategy } from '../../registry.js';
+import { fetchDanjuanAll } from './danjuan-utils.js';
+cli({
+    site: 'xueqiu',
+    name: 'fund-snapshot',
+    description: '获取蛋卷基金快照（总资产、子账户、持仓，推荐 -f json 输出）',
+    domain: 'danjuanfunds.com',
+    strategy: Strategy.COOKIE,
+    navigateBefore: 'https://danjuanfunds.com/my-money',
+    args: [],
+    columns: ['asOf', 'totalAssetAmount', 'totalFundMarketValue', 'accountCount', 'holdingCount'],
+    func: async (page) => {
+        const s = await fetchDanjuanAll(page);
+        return [{
+                asOf: s.asOf,
+                totalAssetAmount: s.totalAssetAmount,
+                totalAssetDailyGain: s.totalAssetDailyGain,
+                totalFundMarketValue: s.totalFundMarketValue,
+                accountCount: s.accounts.length,
+                holdingCount: s.holdings.length,
+                accounts: s.accounts,
+                holdings: s.holdings,
+            }];
+    },
+});

package/dist/clis/youtube/transcript.js

@@ -12,6 +12,7 @@
 import { cli, Strategy } from '../../registry.js';
 import { parseVideoId } from './utils.js';
 import { groupTranscriptSegments, formatGroupedTranscript, } from './transcript-group.js';
+import { CommandExecutionError, EmptyResultError } from '../../errors.js';
 cli({
     site: 'youtube',
     name: 'transcript',
@@ -82,10 +83,10 @@ cli({
       })()
     `);
         if (!captionData || typeof captionData === 'string') {
-            throw new Error(`Failed to get caption info: ${typeof captionData === 'string' ? captionData : 'null response'}`);
+            throw new CommandExecutionError(`Failed to get caption info: ${typeof captionData === 'string' ? captionData : 'null response'}`);
         }
         if (captionData.error) {
-            throw new Error(`${captionData.error}${captionData.available ? ' (available: ' + captionData.available.join(', ') + ')' : ''}`);
+            throw new CommandExecutionError(`${captionData.error}${captionData.available ? ' (available: ' + captionData.available.join(', ') + ')' : ''}`);
         }
         // Warn if --lang was specified but not matched
         if (captionData.requestedLang && !captionData.langMatched && !captionData.langPrefixMatched) {
@@ -164,10 +165,10 @@ cli({
       })()
     `);
         if (!Array.isArray(segments)) {
-            throw new Error(segments?.error || 'Failed to parse caption segments');
+            throw new CommandExecutionError(segments?.error || 'Failed to parse caption segments');
         }
         if (segments.length === 0) {
-            throw new Error('No caption segments found');
+            throw new EmptyResultError('youtube transcript');
         }
         // Step 3: Fetch chapters (for grouped mode)
         let chapters = [];

package/dist/clis/youtube/video.js

@@ -3,6 +3,7 @@
  */
 import { cli, Strategy } from '../../registry.js';
 import { parseVideoId } from './utils.js';
+import { CommandExecutionError } from '../../errors.js';
 cli({
     site: 'youtube',
     name: 'video',
@@ -102,9 +103,9 @@ cli({
       })()
     `);
         if (!data || typeof data !== 'object')
-            throw new Error('Failed to extract video metadata from page');
+            throw new CommandExecutionError('Failed to extract video metadata from page');
         if (data.error)
-            throw new Error(data.error);
+            throw new CommandExecutionError(data.error);
         // Return as field/value pairs for table display
         return Object.entries(data).map(([field, value]) => ({
             field,

package/dist/daemon.js

@@ -49,17 +49,21 @@ function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
         let size = 0;
+        let aborted = false;
         req.on('data', (c) => {
             size += c.length;
             if (size > MAX_BODY) {
+                aborted = true;
                 req.destroy();
                 reject(new Error('Body too large'));
                 return;
             }
             chunks.push(c);
         });
-        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
-        req.on('error', reject);
+        req.on('end', () => { if (!aborted)
+            resolve(Buffer.concat(chunks).toString('utf-8')); });
+        req.on('error', (err) => { if (!aborted)
+            reject(err); });
     });
 }
 function jsonResponse(res, status, data) {
@@ -237,7 +241,7 @@ httpServer.listen(PORT, '127.0.0.1', () => {
 httpServer.on('error', (err) => {
     if (err.code === 'EADDRINUSE') {
         console.error(`[daemon] Port ${PORT} already in use — another daemon is likely running. Exiting.`);
-        process.exit(0);
+        process.exit(1);
     }
     console.error('[daemon] Server error:', err.message);
     process.exit(1);

package/dist/discovery.js

@@ -17,16 +17,15 @@ import { getErrorMessage } from './errors.js';
 import { log } from './logger.js';
 /** Plugins directory: ~/.opencli/plugins/ */
 export const PLUGINS_DIR = path.join(os.homedir(), '.opencli', 'plugins');
-const CLI_MODULE_PATTERN = /\bcli\s*\(/;
+/** Matches files that register commands via cli() or lifecycle hooks */
+const PLUGIN_MODULE_PATTERN = /\b(?:cli|onStartup|onBeforeExecute|onAfterExecute)\s*\(/;
 function parseStrategy(rawStrategy, fallback = Strategy.COOKIE) {
     if (!rawStrategy)
         return fallback;
     const key = rawStrategy.toUpperCase();
     return Strategy[key] ?? fallback;
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from './utils.js';
 /**
  * Discover and register CLI commands.
  * Uses pre-compiled manifest when available for instant startup.
@@ -37,13 +36,14 @@ export async function discoverClis(...dirs) {
         const manifestPath = path.resolve(dir, '..', 'cli-manifest.json');
         try {
             await fs.promises.access(manifestPath);
-            await loadFromManifest(manifestPath, dir);
-            continue; // Skip filesystem scan for this directory
+            const loaded = await loadFromManifest(manifestPath, dir);
+            if (loaded)
+                continue; // Skip filesystem scan only when manifest is usable
         }
         catch {
-            // Fallback: runtime filesystem scan (development)
-            await discoverClisFromFs(dir);
+            // Fall through to filesystem scan
         }
+        await discoverClisFromFs(dir);
     }
 }
 /**
@@ -98,9 +98,11 @@ async function loadFromManifest(manifestPath, clisDir) {
                 registerCommand(cmd);
             }
         }
+        return true;
     }
     catch (err) {
         log.warn(`Failed to load manifest ${manifestPath}: ${getErrorMessage(err)}`);
+        return false;
     }
 }
 /**
@@ -113,7 +115,6 @@ async function discoverClisFromFs(dir) {
     catch {
         return;
     }
-    const promises = [];
     const entries = await fs.promises.readdir(dir, { withFileTypes: true });
     const sitePromises = entries
         .filter(entry => entry.isDirectory())
@@ -242,7 +243,7 @@ async function discoverPluginDir(dir, site) {
 async function isCliModule(filePath) {
     try {
         const source = await fs.promises.readFile(filePath, 'utf-8');
-        return CLI_MODULE_PATTERN.test(source);
+        return PLUGIN_MODULE_PATTERN.test(source);
     }
     catch (err) {
         log.warn(`Failed to inspect module ${filePath}: ${getErrorMessage(err)}`);

package/dist/doctor.js

@@ -9,6 +9,7 @@ import { DEFAULT_DAEMON_PORT } from './constants.js';
 import { checkDaemonStatus } from './browser/discover.js';
 import { BrowserBridge } from './browser/index.js';
 import { listSessions } from './browser/daemon-client.js';
+import { getErrorMessage } from './errors.js';
 /**
  * Test connectivity by attempting a real browser command.
  */
@@ -23,7 +24,7 @@ export async function checkConnectivity(opts) {
         return { ok: true, durationMs: Date.now() - start };
     }
     catch (err) {
-        return { ok: false, error: err?.message ?? String(err), durationMs: Date.now() - start };
+        return { ok: false, error: getErrorMessage(err), durationMs: Date.now() - start };
     }
 }
 export async function runBrowserDoctor(opts = {}) {

package/dist/download/index.d.ts

@@ -1,11 +1,14 @@
 /**
  * Download utilities: HTTP downloads, yt-dlp wrapper, format conversion.
  */
+import type { BrowserCookie } from '../types.js';
+export type { BrowserCookie } from '../types.js';
 export interface DownloadOptions {
     cookies?: string;
     headers?: Record<string, string>;
     timeout?: number;
     onProgress?: (received: number, total: number) => void;
+    maxRedirects?: number;
 }
 export interface YtdlpOptions {
     cookies?: string;
@@ -14,19 +17,8 @@ export interface YtdlpOptions {
     extraArgs?: string[];
     onProgress?: (percent: number) => void;
 }
-export interface BrowserCookie {
-    name: string;
-    value: string;
-    domain: string;
-    path?: string;
-    secure?: boolean;
-    httpOnly?: boolean;
-    expirationDate?: number;
-}
 /** Check if yt-dlp is available in PATH. */
 export declare function checkYtdlp(): boolean;
-/** Check if ffmpeg is available in PATH. */
-export declare function checkFfmpeg(): boolean;
 /**
  * Detect content type from URL and optional headers.
  */
@@ -38,7 +30,7 @@ export declare function requiresYtdlp(url: string): boolean;
 /**
  * HTTP download with progress callback.
  */
-export declare function httpDownload(url: string, destPath: string, options?: DownloadOptions): Promise<{
+export declare function httpDownload(url: string, destPath: string, options?: DownloadOptions, redirectCount?: number): Promise<{
     success: boolean;
     size: number;
     error?: string;

package/dist/download/index.js

@@ -9,14 +9,11 @@ import * as http from 'node:http';
 import * as os from 'node:os';
 import { URL } from 'node:url';
 import { isBinaryInstalled } from '../external.js';
+import { getErrorMessage } from '../errors.js';
 /** Check if yt-dlp is available in PATH. */
 export function checkYtdlp() {
     return isBinaryInstalled('yt-dlp');
 }
-/** Check if ffmpeg is available in PATH. */
-export function checkFfmpeg() {
-    return isBinaryInstalled('ffmpeg');
-}
 /** Domains that host video content and can be downloaded via yt-dlp. */
 const VIDEO_PLATFORM_DOMAINS = [
     'youtube.com', 'youtu.be', 'bilibili.com', 'twitter.com',
@@ -59,13 +56,13 @@ export function requiresYtdlp(url) {
 /**
  * HTTP download with progress callback.
  */
-export async function httpDownload(url, destPath, options = {}) {
-    const { cookies, headers = {}, timeout = 30000, onProgress } = options;
+export async function httpDownload(url, destPath, options = {}, redirectCount = 0) {
+    const { cookies, headers = {}, timeout = 30000, onProgress, maxRedirects = 10 } = options;
     return new Promise((resolve) => {
         const parsedUrl = new URL(url);
         const protocol = parsedUrl.protocol === 'https:' ? https : http;
         const requestHeaders = {
-            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36',
             ...headers,
         };
         if (cookies) {
@@ -82,7 +79,18 @@ export async function httpDownload(url, destPath, options = {}) {
                 file.close();
                 if (fs.existsSync(tempPath))
                     fs.unlinkSync(tempPath);
-                httpDownload(resolveRedirectUrl(url, response.headers.location), destPath, options).then(resolve);
+                if (redirectCount >= maxRedirects) {
+                    resolve({ success: false, size: 0, error: `Too many redirects (> ${maxRedirects})` });
+                    return;
+                }
+                const redirectUrl = resolveRedirectUrl(url, response.headers.location);
+                const originalHost = new URL(url).hostname;
+                const redirectHost = new URL(redirectUrl).hostname;
+                // Do not forward cookies when a redirect crosses host boundaries.
+                const redirectOptions = originalHost === redirectHost
+                    ? options
+                    : { ...options, cookies: undefined, headers: stripCookieHeaders(options.headers) };
+                httpDownload(redirectUrl, destPath, redirectOptions, redirectCount + 1).then(resolve);
                 return;
             }
             if (response.statusCode !== 200) {
@@ -125,6 +133,11 @@ export async function httpDownload(url, destPath, options = {}) {
 export function resolveRedirectUrl(currentUrl, location) {
     return new URL(location, currentUrl).toString();
 }
+function stripCookieHeaders(headers) {
+    if (!headers)
+        return headers;
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => key.toLowerCase() !== 'cookie'));
+}
 /**
  * Export cookies to Netscape format for yt-dlp.
  */
@@ -141,7 +154,9 @@ export function exportCookiesToNetscape(cookies, filePath) {
         const cookiePath = cookie.path || '/';
         const secure = cookie.secure ? 'TRUE' : 'FALSE';
         const expiry = Math.floor(Date.now() / 1000) + 86400 * 365; // 1 year from now
-        lines.push(`${domain}\t${includeSubdomains}\t${cookiePath}\t${secure}\t${expiry}\t${cookie.name}\t${cookie.value}`);
+        const safeName = cookie.name.replace(/[\t\n\r]/g, '');
+        const safeValue = cookie.value.replace(/[\t\n\r]/g, '');
+        lines.push(`${domain}\t${includeSubdomains}\t${cookiePath}\t${secure}\t${expiry}\t${safeName}\t${safeValue}`);
     }
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, lines.join('\n'));
@@ -168,8 +183,14 @@ export async function ytdlpDownload(url, destPath, options = {}) {
             '--no-playlist',
             '--progress',
         ];
-        if (cookiesFile && fs.existsSync(cookiesFile)) {
-            args.push('--cookies', cookiesFile);
+        if (cookiesFile) {
+            if (fs.existsSync(cookiesFile)) {
+                args.push('--cookies', cookiesFile);
+            }
+            else {
+                console.error(`[download] Cookies file not found: ${cookiesFile}, falling back to browser cookies`);
+                args.push('--cookies-from-browser', 'chrome');
+            }
         }
         else {
             // Try to use browser cookies
@@ -251,7 +272,7 @@ export async function saveDocument(content, destPath, format = 'markdown', metad
         return { success: true, size: Buffer.byteLength(output, 'utf-8') };
     }
     catch (err) {
-        return { success: false, size: 0, error: err.message };
+        return { success: false, size: 0, error: getErrorMessage(err) };
     }
 }
 /**

package/dist/download/index.test.js

@@ -1,5 +1,26 @@
-import { describe, expect, it } from 'vitest';
-import { formatCookieHeader, resolveRedirectUrl } from './index.js';
+import * as fs from 'node:fs';
+import * as http from 'node:http';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { formatCookieHeader, httpDownload, resolveRedirectUrl } from './index.js';
+const servers = [];
+afterEach(async () => {
+    await Promise.all(servers.map((server) => new Promise((resolve, reject) => {
+        server.close((err) => (err ? reject(err) : resolve()));
+    })));
+    servers.length = 0;
+});
+async function startServer(handler, hostname = '127.0.0.1') {
+    const server = http.createServer(handler);
+    servers.push(server);
+    await new Promise((resolve) => server.listen(0, hostname, resolve));
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Failed to start test server');
+    }
+    return `http://${hostname}:${address.port}`;
+}
 describe('download helpers', () => {
     it('resolves relative redirects against the original URL', () => {
         expect(resolveRedirectUrl('https://example.com/a/file', '/cdn/file.bin')).toBe('https://example.com/cdn/file.bin');
@@ -11,4 +32,60 @@ describe('download helpers', () => {
             { name: 'ct0', value: 'def', domain: 'example.com' },
         ])).toBe('sid=abc; ct0=def');
     });
+    it('fails after exceeding the redirect limit', async () => {
+        const baseUrl = await startServer((_req, res) => {
+            res.statusCode = 302;
+            res.setHeader('Location', '/loop');
+            res.end();
+        });
+        const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+        const destPath = path.join(tempDir, 'file.txt');
+        const result = await httpDownload(`${baseUrl}/loop`, destPath, { maxRedirects: 2 });
+        expect(result).toEqual({
+            success: false,
+            size: 0,
+            error: 'Too many redirects (> 2)',
+        });
+        expect(fs.existsSync(destPath)).toBe(false);
+    });
+    it('does not forward cookies across cross-domain redirects', async () => {
+        let forwardedCookie;
+        const targetUrl = await startServer((req, res) => {
+            forwardedCookie = req.headers.cookie;
+            res.statusCode = 200;
+            res.end('ok');
+        }, 'localhost');
+        const redirectUrl = await startServer((_req, res) => {
+            res.statusCode = 302;
+            res.setHeader('Location', targetUrl);
+            res.end();
+        });
+        const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+        const destPath = path.join(tempDir, 'redirect.txt');
+        const result = await httpDownload(`${redirectUrl}/start`, destPath, { cookies: 'sid=abc' });
+        expect(result).toEqual({ success: true, size: 2 });
+        expect(forwardedCookie).toBeUndefined();
+        expect(fs.readFileSync(destPath, 'utf8')).toBe('ok');
+    });
+    it('does not forward cookie headers across cross-domain redirects', async () => {
+        let forwardedCookie;
+        const targetUrl = await startServer((req, res) => {
+            forwardedCookie = req.headers.cookie;
+            res.statusCode = 200;
+            res.end('ok');
+        }, 'localhost');
+        const redirectUrl = await startServer((_req, res) => {
+            res.statusCode = 302;
+            res.setHeader('Location', targetUrl);
+            res.end();
+        });
+        const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+        const destPath = path.join(tempDir, 'redirect-header.txt');
+        const result = await httpDownload(`${redirectUrl}/start`, destPath, {
+            headers: { Cookie: 'sid=header-cookie' },
+        });
+        expect(result).toEqual({ success: true, size: 2 });
+        expect(forwardedCookie).toBeUndefined();
+        expect(fs.readFileSync(destPath, 'utf8')).toBe('ok');
+    });
 });

package/dist/download/media-download.js

@@ -8,6 +8,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { getErrorMessage } from '../errors.js';
 import { httpDownload, ytdlpDownload, checkYtdlp, getTempDir, exportCookiesToNetscape, } from './index.js';
 import { DownloadProgressTracker, formatBytes } from './progress.js';
 // ============================================================
@@ -89,14 +90,15 @@ export async function downloadMedia(items, options) {
                 });
             }
             catch (err) {
+                const msg = getErrorMessage(err);
                 if (progressBar)
-                    progressBar.fail(err.message);
+                    progressBar.fail(msg);
                 tracker.onFileComplete(false);
                 results.push({
                     index: i + 1,
                     type: media.type,
                     status: 'failed',
-                    size: err.message,
+                    size: msg,
                 });
             }
         }