@jackwener/opencli 1.3.3 → 1.4.0

package/src/clis/xueqiu/danjuan-utils.ts

@@ -0,0 +1,176 @@
+/**
+ * Shared helpers for Danjuan (蛋卷基金) adapters.
+ *
+ * Core design: a single page.evaluate call fetches the gain overview AND
+ * all per-account holdings in parallel (Promise.all), minimising Node↔Browser
+ * round-trips to exactly one.
+ */
+
+import type { IPage } from '../../types.js';
+
+export const DANJUAN_DOMAIN = 'danjuanfunds.com';
+export const DANJUAN_ASSET_PAGE = `https://${DANJUAN_DOMAIN}/my-money`;
+
+const GAIN_URL = `https://${DANJUAN_DOMAIN}/djapi/fundx/profit/assets/gain?gains=%5B%22private%22%5D`;
+const SUMMARY_URL = `https://${DANJUAN_DOMAIN}/djapi/fundx/profit/assets/summary?invest_account_id=`;
+
+// ---------------------------------------------------------------------------
+// Types — keep everything explicit so TS consumers get autocomplete.
+// ---------------------------------------------------------------------------
+
+export interface DanjuanAccount {
+  accountId: string;
+  accountName: string;
+  accountType: string;
+  accountCode: string;
+  marketValue: number | null;
+  dailyGain: number | null;
+  mainFlag: boolean;
+}
+
+export interface DanjuanHolding {
+  accountId: string;
+  accountName: string;
+  accountType: string;
+  fdCode: string;
+  fdName: string;
+  category: string;
+  marketValue: number | null;
+  volume: number | null;
+  usableRemainShare: number | null;
+  dailyGain: number | null;
+  holdGain: number | null;
+  holdGainRate: number | null;
+  totalGain: number | null;
+  nav: number | null;
+  marketPercent: number | null;
+}
+
+export interface DanjuanSnapshot {
+  asOf: string | null;
+  totalAssetAmount: number | null;
+  totalAssetDailyGain: number | null;
+  totalAssetHoldGain: number | null;
+  totalAssetTotalGain: number | null;
+  totalFundMarketValue: number | null;
+  accounts: DanjuanAccount[];
+  holdings: DanjuanHolding[];
+}
+
+// ---------------------------------------------------------------------------
+// Single-evaluate fetcher
+// ---------------------------------------------------------------------------
+
+/**
+ * Fetch the complete Danjuan fund picture in ONE browser round-trip.
+ *
+ * Inside the browser context we:
+ *   1. Fetch the gain/assets overview (contains account list)
+ *   2. Promise.all → fetch every account's holdings in parallel
+ *   3. Return the combined result to Node
+ */
+export async function fetchDanjuanAll(page: IPage): Promise<DanjuanSnapshot> {
+  const raw: any = await page.evaluate(`
+    (async () => {
+      const f = async (u) => {
+        const r = await fetch(u, { credentials: 'include' });
+        if (!r.ok) return { _err: r.status };
+        try { return await r.json(); } catch { return { _err: 'parse' }; }
+      };
+      const n = (v) => { const x = Number(v); return Number.isFinite(x) ? x : null; };
+
+      const gain = await f(${JSON.stringify(GAIN_URL)});
+      if (gain._err) return { _httpError: gain._err };
+
+      const root = gain.data || {};
+      const fundSec = (root.items || []).find(i => i && i.summary_type === 'FUND');
+      const rawAccs = fundSec && Array.isArray(fundSec.invest_account_list)
+        ? fundSec.invest_account_list : [];
+
+      const accounts = rawAccs.map(a => ({
+        accountId:   String(a.invest_account_id || ''),
+        accountName: a.invest_account_name || '',
+        accountType: a.invest_account_type || '',
+        accountCode: a.invest_account_code || '',
+        marketValue: n(a.market_value),
+        dailyGain:   n(a.daily_gain),
+        mainFlag:    !!a.main_flag,
+      }));
+
+      if (!accounts.length) {
+        return { _emptyAccounts: true };
+      }
+
+      const details = await Promise.all(
+        accounts.map(a => f(${JSON.stringify(SUMMARY_URL)} + encodeURIComponent(a.accountId)))
+      );
+
+      const holdings = [];
+      const detailErrors = [];
+      for (let i = 0; i < accounts.length; i++) {
+        const d = details[i];
+        if (d._err) {
+          detailErrors.push({
+            accountId: accounts[i].accountId,
+            accountName: accounts[i].accountName,
+            error: d._err,
+          });
+          continue;
+        }
+        const data = d.data || {};
+        const funds = Array.isArray(data.items) ? data.items : [];
+        const acc = accounts[i];
+        for (const fd of funds) {
+          holdings.push({
+            accountId:        acc.accountId,
+            accountName:      data.invest_account_name || acc.accountName,
+            accountType:      data.invest_account_type || acc.accountType,
+            fdCode:           fd.fd_code || '',
+            fdName:           fd.fd_name || '',
+            category:         fd.category_text || fd.category || '',
+            marketValue:      n(fd.market_value),
+            volume:           n(fd.volume),
+            usableRemainShare:n(fd.usable_remain_share),
+            dailyGain:        n(fd.daily_gain),
+            holdGain:         n(fd.hold_gain),
+            holdGainRate:     n(fd.hold_gain_rate),
+            totalGain:        n(fd.total_gain),
+            nav:              n(fd.nav),
+            marketPercent:    n(fd.market_percent),
+          });
+        }
+      }
+
+      return {
+        asOf:                root.daily_gain_date || null,
+        totalAssetAmount:    n(root.amount),
+        totalAssetDailyGain: n(root.daily_gain),
+        totalAssetHoldGain:  n(root.hold_gain),
+        totalAssetTotalGain: n(root.total_gain),
+        totalFundMarketValue:n(fundSec && fundSec.amount),
+        accounts,
+        holdings,
+        detailErrors,
+      };
+    })()
+  `);
+
+  if (raw?._httpError) {
+    throw new Error(`HTTP ${raw._httpError} — Hint: not logged in to ${DANJUAN_DOMAIN}?`);
+  }
+  if (raw?._emptyAccounts) {
+    throw new Error(`No fund accounts found — Hint: not logged in to ${DANJUAN_DOMAIN}?`);
+  }
+  if (Array.isArray(raw?.detailErrors) && raw.detailErrors.length > 0) {
+    const failedAccounts = raw.detailErrors
+      .map((item: { accountName?: string; accountId?: string; error?: string | number }) => {
+        const label = item.accountName && item.accountId
+          ? `${item.accountName} (${item.accountId})`
+          : item.accountName || item.accountId || 'unknown account';
+        return `${label}: ${item.error}`;
+      })
+      .join(', ');
+    throw new Error(`Failed to fetch Danjuan account details: ${failedAccounts}`);
+  }
+  return raw as DanjuanSnapshot;
+}

package/src/clis/xueqiu/fund-holdings.ts

@@ -0,0 +1,32 @@
+import { cli, Strategy } from '../../registry.js';
+import type { IPage } from '../../types.js';
+import { fetchDanjuanAll } from './danjuan-utils.js';
+
+cli({
+  site: 'xueqiu',
+  name: 'fund-holdings',
+  description: '获取蛋卷基金持仓明细（可用 --account 按子账户过滤）',
+  domain: 'danjuanfunds.com',
+  strategy: Strategy.COOKIE,
+  navigateBefore: 'https://danjuanfunds.com/my-money',
+  args: [
+    { name: 'account', type: 'str', default: '', help: '按子账户名称或 ID 过滤' },
+  ],
+  columns: ['accountName', 'fdCode', 'fdName', 'marketValue', 'volume', 'dailyGain', 'holdGain', 'holdGainRate', 'marketPercent'],
+  func: async (page: IPage, args) => {
+    const snapshot = await fetchDanjuanAll(page);
+    if (!snapshot.accounts.length) {
+      throw new Error('No fund accounts found — Hint: not logged in to danjuanfunds.com?');
+    }
+
+    const filter = String(args.account ?? '').trim();
+    const rows = filter
+      ? snapshot.holdings.filter(h => h.accountId === filter || h.accountName.includes(filter))
+      : snapshot.holdings;
+
+    if (!rows.length) {
+      throw new Error(filter ? `No holdings matched account filter: ${filter}` : 'No holdings found.');
+    }
+    return rows;
+  },
+});

package/src/clis/xueqiu/fund-snapshot.ts

@@ -0,0 +1,27 @@
+import { cli, Strategy } from '../../registry.js';
+import type { IPage } from '../../types.js';
+import { fetchDanjuanAll } from './danjuan-utils.js';
+
+cli({
+  site: 'xueqiu',
+  name: 'fund-snapshot',
+  description: '获取蛋卷基金快照（总资产、子账户、持仓，推荐 -f json 输出）',
+  domain: 'danjuanfunds.com',
+  strategy: Strategy.COOKIE,
+  navigateBefore: 'https://danjuanfunds.com/my-money',
+  args: [],
+  columns: ['asOf', 'totalAssetAmount', 'totalFundMarketValue', 'accountCount', 'holdingCount'],
+  func: async (page: IPage) => {
+    const s = await fetchDanjuanAll(page);
+    return [{
+      asOf: s.asOf,
+      totalAssetAmount: s.totalAssetAmount,
+      totalAssetDailyGain: s.totalAssetDailyGain,
+      totalFundMarketValue: s.totalFundMarketValue,
+      accountCount: s.accounts.length,
+      holdingCount: s.holdings.length,
+      accounts: s.accounts,
+      holdings: s.holdings,
+    }];
+  },
+});

package/src/clis/youtube/transcript.ts

@@ -17,6 +17,7 @@ import {
   type RawSegment,
   type Chapter,
 } from './transcript-group.js';
+import { CommandExecutionError, EmptyResultError } from '../../errors.js';
 
 cli({
   site: 'youtube',
@@ -91,10 +92,10 @@ cli({
     `);
 
     if (!captionData || typeof captionData === 'string') {
-      throw new Error(`Failed to get caption info: ${typeof captionData === 'string' ? captionData : 'null response'}`);
+      throw new CommandExecutionError(`Failed to get caption info: ${typeof captionData === 'string' ? captionData : 'null response'}`);
     }
     if (captionData.error) {
-      throw new Error(`${captionData.error}${captionData.available ? ' (available: ' + captionData.available.join(', ') + ')' : ''}`);
+      throw new CommandExecutionError(`${captionData.error}${captionData.available ? ' (available: ' + captionData.available.join(', ') + ')' : ''}`);
     }
 
     // Warn if --lang was specified but not matched
@@ -176,10 +177,10 @@ cli({
     `);
 
     if (!Array.isArray(segments)) {
-      throw new Error((segments as any)?.error || 'Failed to parse caption segments');
+      throw new CommandExecutionError((segments as any)?.error || 'Failed to parse caption segments');
     }
     if (segments.length === 0) {
-      throw new Error('No caption segments found');
+      throw new EmptyResultError('youtube transcript');
     }
 
     // Step 3: Fetch chapters (for grouped mode)

package/src/clis/youtube/video.ts

@@ -3,6 +3,7 @@
  */
 import { cli, Strategy } from '../../registry.js';
 import { parseVideoId } from './utils.js';
+import { CommandExecutionError } from '../../errors.js';
 
 cli({
   site: 'youtube',
@@ -104,8 +105,8 @@ cli({
       })()
     `);
 
-    if (!data || typeof data !== 'object') throw new Error('Failed to extract video metadata from page');
-    if (data.error) throw new Error(data.error);
+    if (!data || typeof data !== 'object') throw new CommandExecutionError('Failed to extract video metadata from page');
+    if (data.error) throw new CommandExecutionError(data.error);
 
     // Return as field/value pairs for table display
     return Object.entries(data).map(([field, value]) => ({

package/src/daemon.ts

@@ -64,13 +64,14 @@ function readBody(req: IncomingMessage): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
     let size = 0;
+    let aborted = false;
     req.on('data', (c: Buffer) => {
       size += c.length;
-      if (size > MAX_BODY) { req.destroy(); reject(new Error('Body too large')); return; }
+      if (size > MAX_BODY) { aborted = true; req.destroy(); reject(new Error('Body too large')); return; }
       chunks.push(c);
     });
-    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
-    req.on('error', reject);
+    req.on('end', () => { if (!aborted) resolve(Buffer.concat(chunks).toString('utf-8')); });
+    req.on('error', (err) => { if (!aborted) reject(err); });
   });
 }
 
@@ -271,7 +272,7 @@ httpServer.listen(PORT, '127.0.0.1', () => {
 httpServer.on('error', (err: NodeJS.ErrnoException) => {
   if (err.code === 'EADDRINUSE') {
     console.error(`[daemon] Port ${PORT} already in use — another daemon is likely running. Exiting.`);
-    process.exit(0);
+    process.exit(1);
   }
   console.error('[daemon] Server error:', err.message);
   process.exit(1);

package/src/discovery.ts

@@ -20,31 +20,10 @@ import type { ManifestEntry } from './build-manifest.js';
 
 /** Plugins directory: ~/.opencli/plugins/ */
 export const PLUGINS_DIR = path.join(os.homedir(), '.opencli', 'plugins');
-const CLI_MODULE_PATTERN = /\bcli\s*\(/;
+/** Matches files that register commands via cli() or lifecycle hooks */
+const PLUGIN_MODULE_PATTERN = /\b(?:cli|onStartup|onBeforeExecute|onAfterExecute)\s*\(/;
 
-interface YamlArgDefinition {
-  type?: string;
-  default?: unknown;
-  required?: boolean;
-  positional?: boolean;
-  description?: string;
-  help?: string;
-  choices?: string[];
-}
-
-interface YamlCliDefinition {
-  site?: string;
-  name?: string;
-  description?: string;
-  domain?: string;
-  strategy?: string;
-  browser?: boolean;
-  args?: Record<string, YamlArgDefinition>;
-  columns?: string[];
-  pipeline?: Record<string, unknown>[];
-  timeout?: number;
-  navigateBefore?: boolean | string;
-}
+import type { YamlCliDefinition } from './yaml-schema.js';
 
 function parseStrategy(rawStrategy: string | undefined, fallback: Strategy = Strategy.COOKIE): Strategy {
   if (!rawStrategy) return fallback;
@@ -52,9 +31,7 @@ function parseStrategy(rawStrategy: string | undefined, fallback: Strategy = Str
   return Strategy[key] ?? fallback;
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from './utils.js';
 
 /**
  * Discover and register CLI commands.
@@ -66,12 +43,12 @@ export async function discoverClis(...dirs: string[]): Promise<void> {
     const manifestPath = path.resolve(dir, '..', 'cli-manifest.json');
     try {
       await fs.promises.access(manifestPath);
-      await loadFromManifest(manifestPath, dir);
-      continue; // Skip filesystem scan for this directory
+      const loaded = await loadFromManifest(manifestPath, dir);
+      if (loaded) continue; // Skip filesystem scan only when manifest is usable
     } catch {
-      // Fallback: runtime filesystem scan (development)
-      await discoverClisFromFs(dir);
+      // Fall through to filesystem scan
     }
+    await discoverClisFromFs(dir);
   }
 }
 
@@ -80,7 +57,7 @@ export async function discoverClis(...dirs: string[]): Promise<void> {
  * YAML pipelines are inlined — zero YAML parsing at runtime.
  * TS modules are deferred — loaded lazily on first execution.
  */
-async function loadFromManifest(manifestPath: string, clisDir: string): Promise<void> {
+async function loadFromManifest(manifestPath: string, clisDir: string): Promise<boolean> {
   try {
     const raw = await fs.promises.readFile(manifestPath, 'utf-8');
     const manifest = JSON.parse(raw) as ManifestEntry[];
@@ -126,8 +103,10 @@ async function loadFromManifest(manifestPath: string, clisDir: string): Promise<
         registerCommand(cmd);
       }
     }
+    return true;
   } catch (err) {
     log.warn(`Failed to load manifest ${manifestPath}: ${getErrorMessage(err)}`);
+    return false;
   }
 }
 
@@ -136,7 +115,6 @@ async function loadFromManifest(manifestPath: string, clisDir: string): Promise<
  */
 async function discoverClisFromFs(dir: string): Promise<void> {
   try { await fs.promises.access(dir); } catch { return; }
-  const promises: Promise<unknown>[] = [];
   const entries = await fs.promises.readdir(dir, { withFileTypes: true });
   
   const sitePromises = entries
@@ -269,7 +247,7 @@ async function discoverPluginDir(dir: string, site: string): Promise<void> {
 async function isCliModule(filePath: string): Promise<boolean> {
   try {
     const source = await fs.promises.readFile(filePath, 'utf-8');
-    return CLI_MODULE_PATTERN.test(source);
+    return PLUGIN_MODULE_PATTERN.test(source);
   } catch (err) {
     log.warn(`Failed to inspect module ${filePath}: ${getErrorMessage(err)}`);
     return false;

package/src/doctor.ts

@@ -10,6 +10,7 @@ import { DEFAULT_DAEMON_PORT } from './constants.js';
 import { checkDaemonStatus } from './browser/discover.js';
 import { BrowserBridge } from './browser/index.js';
 import { listSessions } from './browser/daemon-client.js';
+import { getErrorMessage } from './errors.js';
 
 export type DoctorOptions = {
   fix?: boolean;
@@ -46,8 +47,8 @@ export async function checkConnectivity(opts?: { timeout?: number }): Promise<Co
     await page.evaluate('1 + 1');
     await mcp.close();
     return { ok: true, durationMs: Date.now() - start };
-  } catch (err: any) {
-    return { ok: false, error: err?.message ?? String(err), durationMs: Date.now() - start };
+  } catch (err) {
+    return { ok: false, error: getErrorMessage(err), durationMs: Date.now() - start };
   }
 }
 

package/src/download/index.test.ts

@@ -1,5 +1,29 @@
-import { describe, expect, it } from 'vitest';
-import { formatCookieHeader, resolveRedirectUrl } from './index.js';
+import * as fs from 'node:fs';
+import * as http from 'node:http';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { formatCookieHeader, httpDownload, resolveRedirectUrl } from './index.js';
+
+const servers: http.Server[] = [];
+
+afterEach(async () => {
+  await Promise.all(servers.map((server) => new Promise<void>((resolve, reject) => {
+    server.close((err) => (err ? reject(err) : resolve()));
+  })));
+  servers.length = 0;
+});
+
+async function startServer(handler: http.RequestListener, hostname = '127.0.0.1'): Promise<string> {
+  const server = http.createServer(handler);
+  servers.push(server);
+  await new Promise<void>((resolve) => server.listen(0, hostname, resolve));
+  const address = server.address();
+  if (!address || typeof address === 'string') {
+    throw new Error('Failed to start test server');
+  }
+  return `http://${hostname}:${address.port}`;
+}
 
 describe('download helpers', () => {
   it('resolves relative redirects against the original URL', () => {
@@ -13,4 +37,71 @@ describe('download helpers', () => {
       { name: 'ct0', value: 'def', domain: 'example.com' },
     ])).toBe('sid=abc; ct0=def');
   });
+
+  it('fails after exceeding the redirect limit', async () => {
+    const baseUrl = await startServer((_req, res) => {
+      res.statusCode = 302;
+      res.setHeader('Location', '/loop');
+      res.end();
+    });
+
+    const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+    const destPath = path.join(tempDir, 'file.txt');
+    const result = await httpDownload(`${baseUrl}/loop`, destPath, { maxRedirects: 2 });
+
+    expect(result).toEqual({
+      success: false,
+      size: 0,
+      error: 'Too many redirects (> 2)',
+    });
+    expect(fs.existsSync(destPath)).toBe(false);
+  });
+
+  it('does not forward cookies across cross-domain redirects', async () => {
+    let forwardedCookie: string | undefined;
+    const targetUrl = await startServer((req, res) => {
+      forwardedCookie = req.headers.cookie;
+      res.statusCode = 200;
+      res.end('ok');
+    }, 'localhost');
+
+    const redirectUrl = await startServer((_req, res) => {
+      res.statusCode = 302;
+      res.setHeader('Location', targetUrl);
+      res.end();
+    });
+
+    const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+    const destPath = path.join(tempDir, 'redirect.txt');
+    const result = await httpDownload(`${redirectUrl}/start`, destPath, { cookies: 'sid=abc' });
+
+    expect(result).toEqual({ success: true, size: 2 });
+    expect(forwardedCookie).toBeUndefined();
+    expect(fs.readFileSync(destPath, 'utf8')).toBe('ok');
+  });
+
+  it('does not forward cookie headers across cross-domain redirects', async () => {
+    let forwardedCookie: string | undefined;
+    const targetUrl = await startServer((req, res) => {
+      forwardedCookie = req.headers.cookie;
+      res.statusCode = 200;
+      res.end('ok');
+    }, 'localhost');
+
+    const redirectUrl = await startServer((_req, res) => {
+      res.statusCode = 302;
+      res.setHeader('Location', targetUrl);
+      res.end();
+    });
+
+    const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'opencli-download-'));
+    const destPath = path.join(tempDir, 'redirect-header.txt');
+    const result = await httpDownload(`${redirectUrl}/start`, destPath, {
+      headers: { Cookie: 'sid=header-cookie' },
+    });
+
+    expect(result).toEqual({ success: true, size: 2 });
+    expect(forwardedCookie).toBeUndefined();
+    expect(fs.readFileSync(destPath, 'utf8')).toBe('ok');
+  });
 });

package/src/download/index.ts

@@ -11,12 +11,17 @@ import * as os from 'node:os';
 import { URL } from 'node:url';
 import type { ProgressBar } from './progress.js';
 import { isBinaryInstalled } from '../external.js';
+import type { BrowserCookie } from '../types.js';
+import { getErrorMessage } from '../errors.js';
+
+export type { BrowserCookie } from '../types.js';
 
 export interface DownloadOptions {
   cookies?: string;
   headers?: Record<string, string>;
   timeout?: number;
   onProgress?: (received: number, total: number) => void;
+  maxRedirects?: number;
 }
 
 export interface YtdlpOptions {
@@ -27,26 +32,11 @@ export interface YtdlpOptions {
   onProgress?: (percent: number) => void;
 }
 
-export interface BrowserCookie {
-  name: string;
-  value: string;
-  domain: string;
-  path?: string;
-  secure?: boolean;
-  httpOnly?: boolean;
-  expirationDate?: number;
-}
-
 /** Check if yt-dlp is available in PATH. */
 export function checkYtdlp(): boolean {
   return isBinaryInstalled('yt-dlp');
 }
 
-/** Check if ffmpeg is available in PATH. */
-export function checkFfmpeg(): boolean {
-  return isBinaryInstalled('ffmpeg');
-}
-
 /** Domains that host video content and can be downloaded via yt-dlp. */
 const VIDEO_PLATFORM_DOMAINS = [
   'youtube.com', 'youtu.be', 'bilibili.com', 'twitter.com',
@@ -92,15 +82,16 @@ export async function httpDownload(
   url: string,
   destPath: string,
   options: DownloadOptions = {},
+  redirectCount = 0,
 ): Promise<{ success: boolean; size: number; error?: string }> {
-  const { cookies, headers = {}, timeout = 30000, onProgress } = options;
+  const { cookies, headers = {}, timeout = 30000, onProgress, maxRedirects = 10 } = options;
 
   return new Promise((resolve) => {
     const parsedUrl = new URL(url);
     const protocol = parsedUrl.protocol === 'https:' ? https : http;
 
     const requestHeaders: Record<string, string> = {
-      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36',
       ...headers,
     };
 
@@ -120,7 +111,23 @@ export async function httpDownload(
       if (response.statusCode && response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
         file.close();
         if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
-        httpDownload(resolveRedirectUrl(url, response.headers.location), destPath, options).then(resolve);
+        if (redirectCount >= maxRedirects) {
+          resolve({ success: false, size: 0, error: `Too many redirects (> ${maxRedirects})` });
+          return;
+        }
+        const redirectUrl = resolveRedirectUrl(url, response.headers.location);
+        const originalHost = new URL(url).hostname;
+        const redirectHost = new URL(redirectUrl).hostname;
+        // Do not forward cookies when a redirect crosses host boundaries.
+        const redirectOptions = originalHost === redirectHost
+          ? options
+          : { ...options, cookies: undefined, headers: stripCookieHeaders(options.headers) };
+        httpDownload(
+          redirectUrl,
+          destPath,
+          redirectOptions,
+          redirectCount + 1,
+        ).then(resolve);
         return;
       }
 
@@ -168,6 +175,13 @@ export function resolveRedirectUrl(currentUrl: string, location: string): string
   return new URL(location, currentUrl).toString();
 }
 
+function stripCookieHeaders(headers?: Record<string, string>): Record<string, string> | undefined {
+  if (!headers) return headers;
+  return Object.fromEntries(
+    Object.entries(headers).filter(([key]) => key.toLowerCase() !== 'cookie'),
+  );
+}
+
 /**
  * Export cookies to Netscape format for yt-dlp.
  */
@@ -188,7 +202,9 @@ export function exportCookiesToNetscape(
     const cookiePath = cookie.path || '/';
     const secure = cookie.secure ? 'TRUE' : 'FALSE';
     const expiry = Math.floor(Date.now() / 1000) + 86400 * 365; // 1 year from now
-    lines.push(`${domain}\t${includeSubdomains}\t${cookiePath}\t${secure}\t${expiry}\t${cookie.name}\t${cookie.value}`);
+    const safeName = cookie.name.replace(/[\t\n\r]/g, '');
+    const safeValue = cookie.value.replace(/[\t\n\r]/g, '');
+    lines.push(`${domain}\t${includeSubdomains}\t${cookiePath}\t${secure}\t${expiry}\t${safeName}\t${safeValue}`);
   }
 
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -226,8 +242,13 @@ export async function ytdlpDownload(
       '--progress',
     ];
 
-    if (cookiesFile && fs.existsSync(cookiesFile)) {
-      args.push('--cookies', cookiesFile);
+    if (cookiesFile) {
+      if (fs.existsSync(cookiesFile)) {
+        args.push('--cookies', cookiesFile);
+      } else {
+        console.error(`[download] Cookies file not found: ${cookiesFile}, falling back to browser cookies`);
+        args.push('--cookies-from-browser', 'chrome');
+      }
     } else {
       // Try to use browser cookies
       args.push('--cookies-from-browser', 'chrome');
@@ -319,8 +340,8 @@ export async function saveDocument(
 
     fs.writeFileSync(destPath, output, 'utf-8');
     return { success: true, size: Buffer.byteLength(output, 'utf-8') };
-  } catch (err: any) {
-    return { success: false, size: 0, error: err.message };
+  } catch (err) {
+    return { success: false, size: 0, error: getErrorMessage(err) };
   }
 }