@jackwener/opencli 1.4.1 → 1.5.1

package/src/clis/twitter/shared.ts

@@ -0,0 +1,45 @@
+import type { IPage } from '../../types.js';
+
+const QUERY_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+
+export function sanitizeQueryId(resolved: unknown, fallbackId: string): string {
+  return typeof resolved === 'string' && QUERY_ID_PATTERN.test(resolved) ? resolved : fallbackId;
+}
+
+export async function resolveTwitterQueryId(
+  page: Pick<IPage, 'evaluate'>,
+  operationName: string,
+  fallbackId: string,
+): Promise<string> {
+  const resolved = await page.evaluate(`async () => {
+    const operationName = ${JSON.stringify(operationName)};
+    try {
+      const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
+      if (ghResp.ok) {
+        const data = await ghResp.json();
+        const entry = data?.[operationName];
+        if (entry && entry.queryId) return entry.queryId;
+      }
+    } catch {}
+    try {
+      const scripts = performance.getEntriesByType('resource')
+        .filter(r => r.name.includes('client-web') && r.name.endsWith('.js'))
+        .map(r => r.name);
+      for (const scriptUrl of scripts.slice(0, 15)) {
+        try {
+          const text = await (await fetch(scriptUrl)).text();
+          const re = new RegExp('queryId:"([A-Za-z0-9_-]+)"[^}]{0,200}operationName:"' + operationName + '"');
+          const match = text.match(re);
+          if (match) return match[1];
+        } catch {}
+      }
+    } catch {}
+    return null;
+  }`);
+
+  return sanitizeQueryId(resolved, fallbackId);
+}
+
+export const __test__ = {
+  sanitizeQueryId,
+};

package/src/clis/twitter/timeline.ts

@@ -1,5 +1,6 @@
 import { AuthRequiredError, CommandExecutionError } from '../../errors.js';
 import { cli, Strategy } from '../../registry.js';
+import { resolveTwitterQueryId } from './shared.js';
 
 // ── Twitter GraphQL constants ──────────────────────────────────────────
 
@@ -198,19 +199,7 @@ cli({
     if (!ct0) throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
 
     // Dynamically resolve queryId for the selected endpoint
-    const resolved = await page.evaluate(`async () => {
-      try {
-        const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
-        if (ghResp.ok) {
-          const data = await ghResp.json();
-          const entry = data['${endpoint}'];
-          if (entry && entry.queryId) return entry.queryId;
-        }
-      } catch {}
-      return null;
-    }`);
-    // Validate queryId format to prevent injection from untrusted upstream
-    const queryId = typeof resolved === 'string' && /^[A-Za-z0-9_-]+$/.test(resolved) ? resolved : fallbackQueryId;
+    const queryId = await resolveTwitterQueryId(page, endpoint, fallbackQueryId);
 
     // Build auth headers
     const headers = JSON.stringify({

package/src/clis/twitter/trending.ts

@@ -1,19 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import { AuthRequiredError, EmptyResultError } from '../../errors.js';
 
-// ── Twitter GraphQL constants ──────────────────────────────────────────
-
-const BEARER_TOKEN = 'AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA';
-
-// ── Types ──────────────────────────────────────────────────────────────
-
-interface TrendItem {
-  rank: number;
-  topic: string;
-  tweets: string;
-  category: string;
-}
-
 // ── CLI definition ────────────────────────────────────────────────────
 
 cli({
@@ -34,79 +21,44 @@ cli({
     await page.goto('https://x.com/explore/tabs/trending');
     await page.wait(3);
 
-    // Extract CSRF token to verify login
+    // Verify login via CSRF cookie
     const ct0 = await page.evaluate(`(() => {
       return document.cookie.split(';').map(c=>c.trim()).find(c=>c.startsWith('ct0='))?.split('=')[1] || null;
     })()`);
     if (!ct0) throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
 
-    // Try legacy guide.json API first (faster than DOM scraping)
-    let trends: TrendItem[] = [];
-
-    const apiData = await page.evaluate(`(async () => {
-      const ct0 = document.cookie.split(';').map(c=>c.trim()).find(c=>c.startsWith('ct0='))?.split('=')[1] || '';
-      const r = await fetch('/i/api/2/guide.json?include_page_configuration=true', {
-        credentials: 'include',
-        headers: {
-          'x-twitter-active-user': 'yes',
-          'x-csrf-token': ct0,
-          'authorization': 'Bearer AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA'
+    // Scrape trends from DOM (consistent with what the user sees on the page)
+    // DOM children: [0] rank + category, [1] topic, optional post count,
+    // and a caret menu button identified by [data-testid="caret"].
+    await page.wait(2);
+    const trends = await page.evaluate(`(() => {
+      const items = [];
+      const cells = document.querySelectorAll('[data-testid="trend"]');
+      cells.forEach((cell) => {
+        const text = cell.textContent || '';
+        if (text.includes('Promoted')) return;
+        const container = cell.querySelector(':scope > div');
+        if (!container) return;
+        const divs = container.children;
+        if (divs.length < 2) return;
+        const topic = divs[1].textContent.trim();
+        if (!topic) return;
+        const catText = divs[0].textContent.trim();
+        const category = catText.replace(/^\\d+\\s*/, '').replace(/^\\xB7\\s*/, '').trim();
+        // Find post count: skip rank, topic, and the caret menu button
+        let tweets = 'N/A';
+        for (let j = 2; j < divs.length; j++) {
+          if (divs[j].matches('[data-testid="caret"]') || divs[j].querySelector('[data-testid="caret"]')) continue;
+          const t = divs[j].textContent.trim();
+          if (t && /\\d/.test(t)) { tweets = t; break; }
         }
+        items.push({ rank: items.length + 1, topic, tweets, category });
       });
-      return r.ok ? await r.json() : null;
+      return items;
     })()`);
 
-    if (apiData) {
-      const instructions = apiData?.timeline?.instructions || [];
-      const entries = instructions.flatMap((inst: any) => inst?.addEntries?.entries || inst?.entries || []);
-      const apiTrends = entries
-        .filter((e: any) => e.content?.timelineModule)
-        .flatMap((e: any) => e.content.timelineModule.items || [])
-        .map((t: any) => t?.item?.content?.trend)
-        .filter(Boolean);
-
-      trends = apiTrends.map((t: any, i: number) => ({
-        rank: i + 1,
-        topic: t.name,
-        tweets: t.tweetCount ? String(t.tweetCount) : 'N/A',
-        category: t.trendMetadata?.domainContext || '',
-      }));
-    }
-
-    // Fallback: scrape from the loaded DOM
-    if (trends.length === 0) {
-      await page.wait(2);
-      const domTrends = await page.evaluate(`(() => {
-        const items = [];
-        const cells = document.querySelectorAll('[data-testid="trend"]');
-        cells.forEach((cell) => {
-          const text = cell.textContent || '';
-          if (text.includes('Promoted')) return;
-          const container = cell.querySelector(':scope > div');
-          if (!container) return;
-          const divs = container.children;
-          // Structure: divs[0] = rank + category, divs[1] = topic name, divs[2] = extra
-          const topicEl = divs.length >= 2 ? divs[1] : null;
-          const topic = topicEl ? topicEl.textContent.trim() : '';
-          const catEl = divs.length >= 1 ? divs[0] : null;
-          const catText = catEl ? catEl.textContent.trim() : '';
-          const category = catText.replace(/^\\d+\\s*/, '').replace(/^\\xB7\\s*/, '').trim();
-          const extraEl = divs.length >= 3 ? divs[2] : null;
-          const extra = extraEl ? extraEl.textContent.trim() : '';
-          if (topic) {
-            items.push({ rank: items.length + 1, topic, tweets: extra || 'N/A', category });
-          }
-        });
-        return items;
-      })()`);
-
-      if (Array.isArray(domTrends) && domTrends.length > 0) {
-        trends = domTrends;
-      }
-    }
-
-    if (trends.length === 0) {
-      throw new EmptyResultError('twitter trending', 'API may have changed or login may be required.');
+    if (!Array.isArray(trends) || trends.length === 0) {
+      throw new EmptyResultError('twitter trending', 'No trends found. The page structure may have changed.');
     }
 
     return trends.slice(0, limit);

package/src/clis/v2ex/hot.yaml

@@ -3,7 +3,7 @@ name: hot
 description: V2EX 热门话题
 domain: www.v2ex.com
 strategy: public
-browser: false
+browser: true
 
 args:
   limit:
@@ -12,8 +12,22 @@ args:
     description: Number of topics
 
 pipeline:
-  - fetch:
-      url: https://www.v2ex.com/api/topics/hot.json
+  - navigate: https://www.v2ex.com/
+
+  - evaluate: |
+      (async () => {
+        const response = await fetch('/api/topics/hot.json', {
+          credentials: 'include',
+          headers: {
+            accept: 'application/json, text/plain, */*',
+            'x-requested-with': 'XMLHttpRequest',
+          },
+        });
+        if (!response.ok) {
+          throw new Error(`V2EX hot API request failed: ${response.status}`);
+        }
+        return await response.json();
+      })()
 
   - map:
       rank: ${{ index + 1 }}

package/src/clis/weixin/download.ts

@@ -54,6 +54,113 @@ export function normalizeWechatUrl(raw: string): string {
   return s;
 }
 
+/**
+ * Format a WeChat article timestamp as a UTC+8 datetime string.
+ * Accepts either Unix seconds or milliseconds.
+ */
+export function formatWechatTimestamp(rawTimestamp: string): string {
+  const ts = Number.parseInt(rawTimestamp, 10);
+  if (!Number.isFinite(ts) || ts <= 0) return '';
+
+  const timestampMs = rawTimestamp.length === 13 ? ts : ts * 1000;
+  const d = new Date(timestampMs);
+  const pad = (n: number): string => String(n).padStart(2, '0');
+  const utc8 = new Date(d.getTime() + 8 * 3600 * 1000);
+
+  return (
+    `${utc8.getUTCFullYear()}-` +
+    `${pad(utc8.getUTCMonth() + 1)}-` +
+    `${pad(utc8.getUTCDate())} ` +
+    `${pad(utc8.getUTCHours())}:` +
+    `${pad(utc8.getUTCMinutes())}:` +
+    `${pad(utc8.getUTCSeconds())}`
+  );
+}
+
+/**
+ * Extract the raw create_time value from supported WeChat inline script formats.
+ */
+export function extractWechatCreateTimeValue(htmlStr: string): string {
+  const jsDecodeMatch = htmlStr.match(
+    /create_time\s*:\s*JsDecode\('([^']+)'\)(?=[\s,;}]|$)/,
+  );
+  if (jsDecodeMatch) return jsDecodeMatch[1];
+
+  const directValueMatch = htmlStr.match(
+    /create_time\s*[:=]\s*(?:"([^"]+)"|'([^']+)'|([0-9A-Za-z]+))(?=[\s,;}]|$)/,
+  );
+  if (!directValueMatch) return '';
+
+  return directValueMatch[1] || directValueMatch[2] || directValueMatch[3] || '';
+}
+
+/**
+ * Extract the publish time from DOM text first, then fall back to numeric create_time values.
+ */
+export function extractWechatPublishTime(
+  publishTimeText: string | null | undefined,
+  htmlStr: string,
+): string {
+  const normalizedPublishTime = (publishTimeText || '').trim();
+  if (normalizedPublishTime) return normalizedPublishTime;
+
+  const rawCreateTime = extractWechatCreateTimeValue(htmlStr);
+  if (!/^\d{10}$|^\d{13}$/.test(rawCreateTime)) return '';
+
+  return formatWechatTimestamp(rawCreateTime);
+}
+
+/**
+ * Build a self-contained helper for execution inside page.evaluate().
+ */
+export function buildExtractWechatPublishTimeJs(): string {
+  return `(${function extractWechatPublishTimeInPage(
+    publishTimeText: string | null | undefined,
+    htmlStr: string,
+  ) {
+    function formatWechatTimestamp(rawTimestamp: string) {
+      const ts = Number.parseInt(rawTimestamp, 10);
+      if (!Number.isFinite(ts) || ts <= 0) return '';
+
+      const timestampMs = rawTimestamp.length === 13 ? ts : ts * 1000;
+      const d = new Date(timestampMs);
+      const pad = (n: number) => String(n).padStart(2, '0');
+      const utc8 = new Date(d.getTime() + 8 * 3600 * 1000);
+
+      return (
+        `${utc8.getUTCFullYear()}-` +
+        `${pad(utc8.getUTCMonth() + 1)}-` +
+        `${pad(utc8.getUTCDate())} ` +
+        `${pad(utc8.getUTCHours())}:` +
+        `${pad(utc8.getUTCMinutes())}:` +
+        `${pad(utc8.getUTCSeconds())}`
+      );
+    }
+
+    function extractWechatCreateTimeValue(html: string) {
+      const jsDecodeMatch = html.match(
+        /create_time\s*:\s*JsDecode\('([^']+)'\)(?=[\s,;}]|$)/,
+      );
+      if (jsDecodeMatch) return jsDecodeMatch[1];
+
+      const directValueMatch = html.match(
+        /create_time\s*[:=]\s*(?:"([^"]+)"|'([^']+)'|([0-9A-Za-z]+))(?=[\s,;}]|$)/,
+      );
+      if (!directValueMatch) return '';
+
+      return directValueMatch[1] || directValueMatch[2] || directValueMatch[3] || '';
+    }
+
+    const normalizedPublishTime = (publishTimeText || '').trim();
+    if (normalizedPublishTime) return normalizedPublishTime;
+
+    const rawCreateTime = extractWechatCreateTimeValue(htmlStr);
+    if (!/^\d{10}$|^\d{13}$/.test(rawCreateTime)) return '';
+
+    return formatWechatTimestamp(rawCreateTime);
+  }.toString()})`;
+}
+
 // ============================================================
 // CLI Registration
 // ============================================================
@@ -102,26 +209,13 @@ cli({
         const authorEl = document.querySelector('#js_name');
         result.author = authorEl ? authorEl.textContent.trim() : '';
 
-        // Publish time: extract create_time from script tags
-        const htmlStr = document.documentElement.innerHTML;
-        let timeMatch = htmlStr.match(/create_time\\s*:\\s*JsDecode\\('([^']+)'\\)/);
-        if (!timeMatch) timeMatch = htmlStr.match(/create_time\\s*:\\s*'(\\d+)'/);
-        if (!timeMatch) timeMatch = htmlStr.match(/create_time\\s*[:=]\\s*["']?(\\d+)["']?/);
-        if (timeMatch) {
-          const ts = parseInt(timeMatch[1], 10);
-          if (ts > 0) {
-            const d = new Date(ts * 1000);
-            const pad = n => String(n).padStart(2, '0');
-            const utc8 = new Date(d.getTime() + 8 * 3600 * 1000);
-            result.publishTime =
-              utc8.getUTCFullYear() + '-' +
-              pad(utc8.getUTCMonth() + 1) + '-' +
-              pad(utc8.getUTCDate()) + ' ' +
-              pad(utc8.getUTCHours()) + ':' +
-              pad(utc8.getUTCMinutes()) + ':' +
-              pad(utc8.getUTCSeconds());
-          }
-        }
+        // Publish time: prefer the rendered DOM text, then fall back to numeric create_time values.
+        const publishTimeEl = document.querySelector('#publish_time');
+        const extractWechatPublishTime = ${buildExtractWechatPublishTimeJs()};
+        result.publishTime = extractWechatPublishTime(
+          publishTimeEl ? publishTimeEl.textContent : '',
+          document.documentElement.innerHTML,
+        );
 
         // Content processing
         const contentEl = document.querySelector('#js_content');

package/src/clis/weread/book.ts

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import type { IPage } from '../../types.js';
-import { fetchWithPage } from './utils.js';
+import { fetchPrivateApi } from './utils.js';
 
 cli({
   site: 'weread',
@@ -13,7 +13,7 @@ cli({
   ],
   columns: ['title', 'author', 'publisher', 'intro', 'category', 'rating'],
   func: async (page: IPage, args) => {
-    const data = await fetchWithPage(page, '/book/info', { bookId: args.bookId });
+    const data = await fetchPrivateApi(page, '/book/info', { bookId: args['book-id'] });
     // newRating is 0-1000 scale per community docs; needs runtime verification
     const rating = data.newRating ? `${(data.newRating / 10).toFixed(1)}%` : '-';
     return [{

package/src/clis/weread/commands.test.ts

@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockFetchPrivateApi } = vi.hoisted(() => ({
+  mockFetchPrivateApi: vi.fn(),
+}));
+
+vi.mock('./utils.js', async () => {
+  const actual = await vi.importActual<typeof import('./utils.js')>('./utils.js');
+  return {
+    ...actual,
+    fetchPrivateApi: mockFetchPrivateApi,
+  };
+});
+
+import { getRegistry } from '../../registry.js';
+import './book.js';
+import './highlights.js';
+import './notes.js';
+
+describe('weread book-id positional args', () => {
+  const book = getRegistry().get('weread/book');
+  const highlights = getRegistry().get('weread/highlights');
+  const notes = getRegistry().get('weread/notes');
+
+  beforeEach(() => {
+    mockFetchPrivateApi.mockReset();
+  });
+
+  it('passes the positional book-id to book details', async () => {
+    mockFetchPrivateApi.mockResolvedValue({ title: 'Three Body', newRating: 880 });
+
+    await book!.func!({} as any, { 'book-id': '12345' });
+
+    expect(mockFetchPrivateApi).toHaveBeenCalledWith({}, '/book/info', { bookId: '12345' });
+  });
+
+  it('passes the positional book-id to highlights', async () => {
+    mockFetchPrivateApi.mockResolvedValue({ updated: [] });
+
+    await highlights!.func!({} as any, { 'book-id': 'abc', limit: 5 });
+
+    expect(mockFetchPrivateApi).toHaveBeenCalledWith({}, '/book/bookmarklist', { bookId: 'abc' });
+  });
+
+  it('passes the positional book-id to notes', async () => {
+    mockFetchPrivateApi.mockResolvedValue({ reviews: [] });
+
+    await notes!.func!({} as any, { 'book-id': 'xyz', limit: 5 });
+
+    expect(mockFetchPrivateApi).toHaveBeenCalledWith({}, '/review/list', {
+      bookId: 'xyz',
+      listType: '11',
+      mine: '1',
+      synckey: '0',
+    });
+  });
+});

package/src/clis/weread/highlights.ts

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import type { IPage } from '../../types.js';
-import { fetchWithPage, formatDate } from './utils.js';
+import { fetchPrivateApi, formatDate } from './utils.js';
 
 cli({
   site: 'weread',
@@ -14,7 +14,7 @@ cli({
   ],
   columns: ['chapter', 'text', 'createTime'],
   func: async (page: IPage, args) => {
-    const data = await fetchWithPage(page, '/book/bookmarklist', { bookId: args.bookId });
+    const data = await fetchPrivateApi(page, '/book/bookmarklist', { bookId: args['book-id'] });
     const items: any[] = data?.updated ?? [];
     return items.slice(0, Number(args.limit)).map((item: any) => ({
       chapter: item.chapterName ?? '',

package/src/clis/weread/notebooks.ts

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import type { IPage } from '../../types.js';
-import { fetchWithPage } from './utils.js';
+import { fetchPrivateApi } from './utils.js';
 
 cli({
   site: 'weread',
@@ -10,7 +10,7 @@ cli({
   strategy: Strategy.COOKIE,
   columns: ['title', 'author', 'noteCount', 'bookId'],
   func: async (page: IPage, _args) => {
-    const data = await fetchWithPage(page, '/user/notebooks');
+    const data = await fetchPrivateApi(page, '/user/notebooks');
     const books: any[] = data?.books ?? [];
     return books.map((item: any) => ({
       title: item.book?.title ?? '',

package/src/clis/weread/notes.ts

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import type { IPage } from '../../types.js';
-import { fetchWithPage, formatDate } from './utils.js';
+import { fetchPrivateApi, formatDate } from './utils.js';
 
 cli({
   site: 'weread',
@@ -14,8 +14,8 @@ cli({
   ],
   columns: ['chapter', 'text', 'review', 'createTime'],
   func: async (page: IPage, args) => {
-    const data = await fetchWithPage(page, '/review/list', {
-      bookId: args.bookId,
+    const data = await fetchPrivateApi(page, '/review/list', {
+      bookId: args['book-id'],
       listType: '11',
       mine: '1',
       synckey: '0',

package/src/clis/weread/shelf.ts

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '../../registry.js';
 import type { IPage } from '../../types.js';
-import { fetchWithPage } from './utils.js';
+import { fetchPrivateApi } from './utils.js';
 
 cli({
   site: 'weread',
@@ -13,7 +13,7 @@ cli({
   ],
   columns: ['title', 'author', 'progress', 'bookId'],
   func: async (page: IPage, args) => {
-    const data = await fetchWithPage(page, '/shelf/sync', { synckey: '0', lectureSynckey: '0' });
+    const data = await fetchPrivateApi(page, '/shelf/sync', { synckey: '0', lectureSynckey: '0' });
     const books: any[] = data?.books ?? [];
     return books.slice(0, Number(args.limit)).map((item: any) => ({
       title: item.bookInfo?.title ?? item.title ?? '',

package/src/clis/weread/utils.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { formatDate, fetchWebApi, fetchWithPage } from './utils.js';
+import { formatDate, fetchWebApi } from './utils.js';
 
 describe('formatDate', () => {
   it('formats a typical Unix timestamp in UTC+8', () => {
@@ -71,34 +71,3 @@ describe('fetchWebApi', () => {
     await expect(fetchWebApi('/search/global')).rejects.toThrow('Invalid JSON');
   });
 });
-
-describe('fetchWithPage', () => {
-  it('throws AUTH_REQUIRED on errcode -2010', async () => {
-    const mockPage = {
-      evaluate: vi.fn().mockResolvedValue({ errcode: -2010, errmsg: '用户不存在' }),
-    } as any;
-    await expect(fetchWithPage(mockPage, '/book/info')).rejects.toThrow('Not logged in');
-  });
-
-  it('throws API_ERROR on unknown errcode', async () => {
-    const mockPage = {
-      evaluate: vi.fn().mockResolvedValue({ errcode: -1, errmsg: 'unknown error' }),
-    } as any;
-    await expect(fetchWithPage(mockPage, '/book/info')).rejects.toThrow('unknown error');
-  });
-
-  it('returns data on success (errcode 0 or absent)', async () => {
-    const mockPage = {
-      evaluate: vi.fn().mockResolvedValue({ title: 'Test Book', errcode: 0 }),
-    } as any;
-    const result = await fetchWithPage(mockPage, '/book/info');
-    expect(result.title).toBe('Test Book');
-  });
-
-  it('throws FETCH_ERROR on HTTP error', async () => {
-    const mockPage = {
-      evaluate: vi.fn().mockResolvedValue({ _httpError: '403' }),
-    } as any;
-    await expect(fetchWithPage(mockPage, '/book/info')).rejects.toThrow('HTTP 403');
-  });
-});

package/src/clis/weread/utils.ts

@@ -3,16 +3,20 @@
  *
  * Two API domains:
  * - WEB_API (weread.qq.com/web/*): public, Node.js fetch
- * - API (i.weread.qq.com/*): private, browser page.evaluate with cookies
+ * - API (i.weread.qq.com/*): private, Node.js fetch with cookies from browser
  */
 
 import { CliError } from '../../errors.js';
-import type { IPage } from '../../types.js';
+import type { BrowserCookie, IPage } from '../../types.js';
 
 const WEB_API = 'https://weread.qq.com/web';
 const API = 'https://i.weread.qq.com';
 const UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36';
 
+function buildCookieHeader(cookies: BrowserCookie[]): string {
+  return cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ');
+}
+
 /**
  * Fetch a public WeRead web endpoint (Node.js direct fetch).
  * Used by search and ranking commands (browser: false).
@@ -36,29 +40,50 @@ export async function fetchWebApi(path: string, params?: Record<string, string>)
 }
 
 /**
- * Fetch a private WeRead API endpoint via browser page.evaluate.
- * Automatically carries cookies for authenticated requests.
+ * Fetch a private WeRead API endpoint with cookies extracted from the browser.
+ * The HTTP request itself runs in Node.js to avoid page-context CORS failures.
  */
-export async function fetchWithPage(page: IPage, path: string, params?: Record<string, string>): Promise<any> {
+export async function fetchPrivateApi(page: IPage, path: string, params?: Record<string, string>): Promise<any> {
   const url = new URL(`${API}${path}`);
   if (params) {
     for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
   }
   const urlStr = url.toString();
-  const data = await page.evaluate(`
-    async () => {
-      const res = await fetch(${JSON.stringify(urlStr)}, { credentials: "include" });
-      if (!res.ok) return { _httpError: String(res.status) };
-      try { return await res.json(); }
-      catch { return { _httpError: 'JSON parse error (status ' + res.status + ')' }; }
-    }
-  `);
-  if (data?._httpError) {
-    throw new CliError('FETCH_ERROR', `HTTP ${data._httpError} for ${path}`, 'WeRead API may be temporarily unavailable');
+
+  const cookies = await page.getCookies({ url: urlStr });
+  const cookieHeader = buildCookieHeader(cookies);
+
+  let resp: Response;
+  try {
+    resp = await fetch(urlStr, {
+      headers: {
+        'User-Agent': UA,
+        'Origin': 'https://weread.qq.com',
+        'Referer': 'https://weread.qq.com/',
+        ...(cookieHeader ? { 'Cookie': cookieHeader } : {}),
+      },
+    });
+  } catch (error) {
+    throw new CliError(
+      'FETCH_ERROR',
+      `Failed to fetch ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      'WeRead API may be temporarily unavailable',
+    );
+  }
+
+  let data: any;
+  try {
+    data = await resp.json();
+  } catch {
+    throw new CliError('PARSE_ERROR', `Invalid JSON response for ${path}`, 'WeRead may have returned an HTML error page');
   }
-  if (data?.errcode === -2010) {
+
+  if (resp.status === 401 || data?.errcode === -2010) {
     throw new CliError('AUTH_REQUIRED', 'Not logged in to WeRead', 'Please log in to weread.qq.com in Chrome first');
   }
+  if (!resp.ok) {
+    throw new CliError('FETCH_ERROR', `HTTP ${resp.status} for ${path}`, 'WeRead API may be temporarily unavailable');
+  }
   if (data?.errcode != null && data.errcode !== 0) {
     throw new CliError('API_ERROR', data.errmsg ?? `WeRead API error ${data.errcode}`);
   }