@jackwener/opencli 1.7.1 → 1.7.3

package/clis/mubu/utils.js

@@ -0,0 +1,304 @@
+import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
+
+export const API_BASE = 'https://api2.mubu.com/v3/api';
+const MUBU_DOMAIN = 'mubu.com';
+const AUTH_HINT = 'Mubu requires a logged-in browser session at mubu.com';
+
+function isAuthFailure(code, message) {
+  if (code === 401 || code === 403) return true;
+  if (!message) return false;
+  return /not logged in|login required|unauthorized|未登录|请先登录|需要登录|login expired/i.test(message);
+}
+
+/**
+ * 在浏览器页面上下文里用 XHR 发 POST 请求（参考 zsxq 适配器模式）。
+ * mubu app 自身也是这个机制：从 localStorage 读 Jwt-Token，通过同名 header 发到 api2.mubu.com。
+ * 不经过 Node.js 进程发网络请求，避免 CORS 问题和 extension fetch 拦截。
+ */
+export async function mubuPost(page, path, body) {
+  const url = `${API_BASE}${path}`;
+
+  const result = await page.evaluate(`
+    (async () => {
+      const token = localStorage.getItem('Jwt-Token');
+      if (!token) return { ok: false, status: 0, data: null, error: 'no token' };
+      return await new Promise((resolve) => {
+        const xhr = new XMLHttpRequest();
+        xhr.open('POST', ${JSON.stringify(url)}, true);
+        xhr.setRequestHeader('Content-Type', 'application/json');
+        xhr.setRequestHeader('Jwt-Token', token);
+        xhr.onload = () => {
+          let data = null;
+          try { data = JSON.parse(xhr.responseText); } catch {}
+          resolve({ ok: xhr.status >= 200 && xhr.status < 300, status: xhr.status, data });
+        };
+        xhr.onerror = () => resolve({ ok: false, status: 0, data: null, error: 'network error' });
+        xhr.send(${JSON.stringify(JSON.stringify(body))});
+      });
+    })()
+  `);
+
+  if (!result || result.error === 'no token') {
+    throw new AuthRequiredError(MUBU_DOMAIN, AUTH_HINT);
+  }
+  if (!result.ok || !result.data) {
+    throw new CommandExecutionError(`mubu: ${path}: HTTP ${result.status} ${result.error ?? ''}`);
+  }
+
+  const { data } = result;
+  if (data.code !== 0) {
+    if (isAuthFailure(data.code, data.message)) {
+      throw new AuthRequiredError(MUBU_DOMAIN, AUTH_HINT);
+    }
+    throw new CommandExecutionError(`mubu: ${path}: code=${data.code} ${data.message ?? ''}`);
+  }
+
+  return data.data;
+}
+
+export function formatDate(ts) {
+  if (!ts) return '';
+  const d = new Date(ts);
+  const pad = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
+}
+
+const NAMED_ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' };
+
+function decodeHtmlEntities(s) {
+  return s
+    .replace(/&#x([0-9a-f]+);/gi, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(parseInt(n, 10)))
+    .replace(/&(amp|lt|gt|quot|apos|nbsp);/g, (_, n) => NAMED_ENTITIES[n]);
+}
+
+/** 解析幕布 HTML 表格为行列二维数组（保留内部 HTML） */
+function parseTableRows(tableHtml) {
+  const rows = [];
+  const rowMatches = tableHtml.match(/<tr[^>]*>[\s\S]*?<\/tr>/gi) ?? [];
+  for (const row of rowMatches) {
+    const cells = [];
+    const cellMatches = row.match(/<(?:td|th)[^>]*>[\s\S]*?<\/(?:td|th)>/gi) ?? [];
+    for (const cell of cellMatches) {
+      // 只剥离最外层的 <td> 或 <th>，保留内部的加粗、链接和 <br>
+      let innerHtml = cell.replace(/^<(?:td|th)[^>]*>|<\/(?:td|th)>$/gi, '');
+      cells.push(innerHtml.trim());
+    }
+    rows.push(cells);
+  }
+  return rows;
+}
+
+/** 将幕布 HTML text 转为纯文本 */
+export function htmlToText(html) {
+  let text = html;
+  // 表格 → 纯文本（tab 分隔）；用 </table>\s*</div> 作结束锚，跳过 th/td 内部嵌套 div
+  text = text.replace(/<div class="table-container">[\s\S]*?<\/table>\s*<\/div>/g, (m) => {
+    return parseTableRows(m).map((r) => r.map(c => {
+      // 纯文本环境：<br> 换空格，清空所有标签
+      let plainCell = c.replace(/<br\s*\/?>/gi, ' ').replace(/<[^>]+>/g, '');
+      return decodeHtmlEntities(plainCell).trim();
+    }).join('\t')).join('\n');
+  });
+  text = text
+    .replace(/<br\s*\/?>/gi, '\n')
+    .replace(/<[^>]+>/g, '');
+  return decodeHtmlEntities(text).trim();
+}
+
+/** 将幕布 HTML 表格转为 Markdown 表格 */
+function tableToMarkdown(tableHtml) {
+  const rows = parseTableRows(tableHtml);
+  if (rows.length === 0) return '';
+  
+  const processRow = (row) => row.map(cellHtml => {
+    // 把表格内的 <br> 换成占位符，防止稍后被全局替换为 \n 导致表格断裂
+    return cellHtml.replace(/<br\s*\/?>/gi, '[[BR]]');
+  }).join(' | ');
+
+  const lines = [`| ${processRow(rows[0])} |`, `| ${rows[0].map(() => '---').join(' | ')} |`];
+  for (let i = 1; i < rows.length; i++) {
+    lines.push(`| ${processRow(rows[i])} |`);
+  }
+  return lines.join('\n');
+}
+
+/** 将幕布 HTML text 转为 Markdown inline 标记 */
+export function htmlToMarkdown(html) {
+  let md = html;
+  
+  // 1. 表格 → Markdown 表格
+  md = md.replace(/<div class="table-container">[\s\S]*?<\/table>\s*<\/div>/g, (m) => tableToMarkdown(m));
+  
+  // 2. <br> → 换行
+  md = md.replace(/<br\s*\/?>/gi, '\n');
+  
+  // 3. 统一处理样式标签，支持多 class 组合
+  md = md.replace(/<span class="([^"]+)"[^>]*>([\s\S]*?)<\/span>/gi, (match, classes, inner) => {
+    // 允许正常处理超链接内部的 bold 和 italic 样式
+    if (classes.includes('node-mention')) {
+      return match;
+    }
+    let res = inner;
+    if (/\bbold\b/.test(classes)) res = `**${res}**`;
+    if (/\bitalic\b/.test(classes)) res = `*${res}*`;
+    if (/\bstrikethrough\b/.test(classes)) res = `~~${res}~~`;
+    if (/\bunderline\b/.test(classes)) res = `\uFFFEU_OPEN\uFFFE${res}\uFFFEU_CLOSE\uFFFE`;
+    return res;
+  });
+
+  // 4. node-mention（主题链接 → Markdown 链接，支持组合 class 并继承自身样式）
+  md = md.replace(
+    /<span([^>]*\bclass="[^"]*\bnode-mention\b[^"]*"[^>]*)>([\s\S]*?)<\/span>/gi,
+    (match, attrs, inner) => {
+      const docMatch = attrs.match(/\bdata-doc="([^"]+)"/i);
+      const docId = docMatch ? docMatch[1] : '';
+      if (!docId) return match;
+      
+      const classMatch = attrs.match(/\bclass="([^"]+)"/i);
+      const classes = classMatch ? classMatch[1] : '';
+      
+      let res = inner.replace(/<[^>]+>/g, '').trim();
+      
+      // 继承标签自身的样式
+      if (/\bbold\b/.test(classes)) res = `**${res}**`;
+      if (/\bitalic\b/.test(classes)) res = `*${res}*`;
+      if (/\bstrikethrough\b/.test(classes)) res = `~~${res}~~`;
+      if (/\bunderline\b/.test(classes)) res = `\uFFFEU_OPEN\uFFFE${res}\uFFFEU_CLOSE\uFFFE`;
+      
+      return `[${res}](https://mubu.com/app/edit/${docId})`;
+    }
+  );
+  
+  // 5. links （外部链接 → Markdown 链接，继承 a 标签自身样式）
+  md = md.replace(/<a([^>]*)>([\s\S]*?)<\/a>/gi, (match, attrs, inner) => {
+    const hrefMatch = attrs.match(/\bhref="([^"]+)"/i);
+    if (!hrefMatch) return match;
+    const href = hrefMatch[1];
+    
+    const classMatch = attrs.match(/\bclass="([^"]+)"/i);
+    const classes = classMatch ? classMatch[1] : '';
+    
+    let res = inner;
+    
+    // 继承 a 标签自身的样式
+    if (/\bbold\b/.test(classes)) res = `**${res}**`;
+    if (/\bitalic\b/.test(classes)) res = `*${res}*`;
+    if (/\bstrikethrough\b/.test(classes)) res = `~~${res}~~`;
+    if (/\bunderline\b/.test(classes)) res = `\uFFFEU_OPEN\uFFFE${res}\uFFFEU_CLOSE\uFFFE`;
+    
+    return `[${res}](${href})`;
+  });
+  
+  // 6. 普通 span
+  md = md.replace(/<span[^>]*>([\s\S]*?)<\/span>/gi, '$1');
+  
+  // 7. 清理其余标签
+  md = md.replace(/<[^>]+>/g, '');
+  
+  // 8. HTML 实体解码
+  md = decodeHtmlEntities(md);
+  
+  // 9. 还原 underline 占位符
+  md = md.replace(/\uFFFEU_OPEN\uFFFE/g, '<u>').replace(/\uFFFEU_CLOSE\uFFFE/g, '</u>');
+  
+  // 10. 还原表格内的换行符
+  md = md.replace(/\[\[BR\]\]/g, '<br>');
+
+  return md.trim();
+}
+
+const IMAGE_BASE = 'https://api2.mubu.com/v3';
+
+function imageUrl(uri) {
+  return uri.startsWith('http') ? uri : `${IMAGE_BASE}/${uri}`;
+}
+
+function taskPrefix(node) {
+  if (!node.taskStatus) return '';
+  return node.taskStatus === 2 ? '[x] ' : '[ ] ';
+}
+
+function taskMeta(node) {
+  const parts = [];
+  if (node.deadline) {
+    const ts = formatDate(node.deadline * 1000);
+    parts.push(`📅 ${node.deadlineType === 'date' ? ts.slice(0, 10) : ts}`);
+  }
+  if (node.remindAt) parts.push(`⏰ ${formatDate(node.remindAt * 1000)}`);
+  return parts.length ? ' ' + parts.join(' ') : '';
+}
+
+/** 递归将节点树渲染为缩进纯文本 */
+export function nodesToText(nodes, depth = 0) {
+  const lines = [];
+  for (const node of nodes) {
+    const indent = '  '.repeat(depth);
+    const emoji = node.emoji ? node.emoji + ' ' : '';
+    const text = htmlToText(node.text);
+    const prefix = taskPrefix(node);
+    const meta = taskMeta(node);
+    if (text || emoji || prefix) {
+      if (text.includes('\n')) {
+        const [first, ...rest] = text.split('\n');
+        lines.push(indent + prefix + emoji + first);
+        for (const line of rest) lines.push(indent + '  ' + line);
+        if (meta) lines.push(indent + '  ' + meta.trim());
+      } else {
+        lines.push(indent + prefix + emoji + text + meta);
+      }
+    }
+    if (node.note) {
+      const noteText = htmlToText(node.note);
+      for (const line of noteText.split('\n')) lines.push(indent + '  ' + line);
+    }
+    if (node.images?.length) {
+      for (const img of node.images) {
+        lines.push(indent + `[图片: ${imageUrl(img.uri)}]`);
+      }
+    }
+    if (node.children?.length) {
+      lines.push(nodesToText(node.children, depth + 1));
+    }
+  }
+  return lines.filter(Boolean).join('\n');
+}
+
+/** 递归将节点树渲染为 Markdown（大纲 = 缩进列表，不映射为标题） */
+export function nodesToMarkdown(nodes, depth = 0) {
+  const lines = [];
+  for (const node of nodes) {
+    const text = htmlToMarkdown(node.text);
+    if (!text && !node.images?.length && !node.note && !node.emoji) continue;
+
+    const indent = '  '.repeat(depth);
+    const emoji = node.emoji ? node.emoji + ' ' : '';
+    const prefix = taskPrefix(node);
+    const meta = taskMeta(node);
+    if (text || emoji || prefix) {
+      if (text.includes('\n')) {
+        const [first, ...rest] = text.split('\n');
+        lines.push(indent + '- ' + prefix + emoji + first);
+        const continuation = indent + '  ';
+        for (const line of rest) lines.push(continuation + line);
+        if (meta) lines.push(continuation + meta.trim());
+      } else {
+        lines.push(indent + '- ' + prefix + emoji + text + meta);
+      }
+    }
+    if (node.note) {
+      const noteLines = htmlToMarkdown(node.note).split('\n');
+      for (const line of noteLines) lines.push(indent + '  > ' + line);
+    }
+    if (node.images?.length) {
+      for (const img of node.images) {
+        lines.push(indent + `  ![image](${imageUrl(img.uri)})`);
+      }
+    }
+
+    if (node.children?.length) {
+      lines.push(nodesToMarkdown(node.children, depth + 1));
+    }
+  }
+  return lines.filter(Boolean).join('\n');
+}

package/clis/reuters/search.js

@@ -21,7 +21,7 @@ cli({
       (async () => {
         const count = ${count};
         const apiQuery = JSON.stringify({
-          keyword: '${kwargs.query.replace(/'/g, "\\'")}',
+          keyword: ${JSON.stringify(kwargs.query)},
           offset: 0, orderby: 'display_date:desc', size: count, website: 'reuters'
         });
         const apiUrl = 'https://www.reuters.com/pf/api/v3/content/fetch/articles-by-search-v2?query=' + encodeURIComponent(apiQuery);

package/clis/twitter/lists-parser.js

@@ -0,0 +1,77 @@
+const MEMBER_PATTERNS = [
+    /([\d.,]+(?:\s?[KMB千萬万亿])?)\s*members?/i,
+    /([\d.,]+(?:\s?[KMB千萬万亿])?)\s*位成员/,
+];
+const FOLLOWER_PATTERNS = [
+    /([\d.,]+(?:\s?[KMB千萬万亿])?)\s*followers?/i,
+    /([\d.,]+(?:\s?[KMB千萬万亿])?)\s*位关注者/,
+];
+const PRIVATE_PATTERNS = [/\bprivate\b/i, /锁定列表/];
+const EMPTY_STATE_PATTERNS = [
+    /hasn't created any lists/i,
+    /has not created any lists/i,
+    /no lists yet/i,
+    /没有创建任何列表/,
+    /还没有创建任何列表/,
+];
+function normalizeText(text) {
+    return String(text || '').replace(/\s+/g, ' ').trim();
+}
+function matchMetric(text, patterns) {
+    for (const pattern of patterns) {
+        const match = text.match(pattern);
+        if (match)
+            return normalizeText(match[1]);
+    }
+    return '0';
+}
+function looksLikeMetadata(line) {
+    const text = normalizeText(line);
+    if (!text)
+        return true;
+    if (text.startsWith('@'))
+        return true;
+    if (MEMBER_PATTERNS.some((pattern) => pattern.test(text)))
+        return true;
+    if (FOLLOWER_PATTERNS.some((pattern) => pattern.test(text)))
+        return true;
+    if (PRIVATE_PATTERNS.some((pattern) => pattern.test(text)))
+        return true;
+    if (/^(public|pinned)$/i.test(text))
+        return true;
+    if (/^(lists?|你的列表)$/i.test(text))
+        return true;
+    return false;
+}
+export function parseListCards(cards) {
+    const seen = new Set();
+    const results = [];
+    for (const card of cards || []) {
+        const href = normalizeText(card?.href);
+        const rawText = String(card?.text || '');
+        if (!href || seen.has(href))
+            continue;
+        seen.add(href);
+        const text = normalizeText(rawText);
+        if (!text)
+            continue;
+        const lines = rawText
+            .split('\n')
+            .map((line) => normalizeText(line))
+            .filter(Boolean);
+        const name = lines.find((line) => !looksLikeMetadata(line));
+        if (!name)
+            continue;
+        results.push({
+            name,
+            members: matchMetric(text, MEMBER_PATTERNS),
+            followers: matchMetric(text, FOLLOWER_PATTERNS),
+            mode: PRIVATE_PATTERNS.some((pattern) => pattern.test(text)) ? 'private' : 'public',
+        });
+    }
+    return results;
+}
+export function isEmptyListsState(text) {
+    const normalized = normalizeText(text);
+    return EMPTY_STATE_PATTERNS.some((pattern) => pattern.test(normalized));
+}

package/clis/twitter/lists.d.ts

@@ -0,0 +1,5 @@
+import { Argument, Column } from '@jackwener/opencli/types';
+declare const args: Argument[];
+declare const columns: Column[];
+export { args, columns };
+export default {};

package/clis/twitter/lists.js

@@ -0,0 +1,62 @@
+import { AuthRequiredError, SelectorError } from '@jackwener/opencli/errors';
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { isEmptyListsState, parseListCards } from './lists-parser.js';
+
+cli({
+    site: 'twitter',
+    name: 'lists',
+    description: 'Get Twitter/X lists for a user',
+    domain: 'x.com',
+    strategy: Strategy.COOKIE,
+    browser: true,
+    args: [
+        { name: 'user', positional: true, type: 'string', required: false },
+        { name: 'limit', type: 'int', default: 50 },
+    ],
+    columns: ['name', 'members', 'followers', 'mode'],
+    func: async (page, kwargs) => {
+        let targetUser = kwargs.user;
+        if (!targetUser) {
+            await page.goto('https://x.com/home');
+            await page.wait({ selector: '[data-testid="primaryColumn"]' });
+            const href = await page.evaluate(`() => {
+            const link = document.querySelector('a[data-testid="AppTabBar_Profile_Link"]');
+            return link ? link.getAttribute('href') : null;
+        }`);
+            if (!href) {
+                throw new AuthRequiredError('x.com', 'Could not find logged-in user profile link. Are you logged in?');
+            }
+            targetUser = href.replace('/', '');
+        }
+        await page.goto(`https://x.com/${targetUser}/lists`);
+        await page.wait(3);
+        const pageData = await page.evaluate(`() => {
+            const cards = [];
+            const seen = new Set();
+            for (const anchor of Array.from(document.querySelectorAll('a[href*="/i/lists/"]'))) {
+                const href = anchor.getAttribute('href') || '';
+                if (!/\\/i\\/lists\\/\\d+/.test(href) || seen.has(href)) continue;
+                seen.add(href);
+                const container = anchor.closest('[data-testid="cellInnerDiv"]') || anchor;
+                const text = (container.innerText || anchor.innerText || '').trim();
+                if (!text) continue;
+                cards.push({ href, text });
+            }
+            return {
+                cards,
+                pageText: document.body.innerText || '',
+            };
+        }`);
+        if (!pageData?.pageText) {
+            throw new SelectorError('Twitter lists', 'Empty page text');
+        }
+        const results = parseListCards(pageData.cards);
+        if (results.length === 0) {
+            if (isEmptyListsState(pageData.pageText)) {
+                return [];
+            }
+            throw new SelectorError('Twitter lists', `Could not parse list data`);
+        }
+        return results.slice(0, kwargs.limit);
+    }
+});

package/clis/twitter/lists.test.js

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import { isEmptyListsState, parseListCards } from './lists-parser.js';
+
+describe('twitter lists parser', () => {
+    it('parses english list cards without relying on page locale', () => {
+        const result = parseListCards([
+            {
+                href: '/i/lists/123',
+                text: `AI Researchers
+@jack
+124 Members 3.4K Followers
+Private`,
+            },
+        ]);
+        expect(result).toEqual([
+            {
+                name: 'AI Researchers',
+                members: '124',
+                followers: '3.4K',
+                mode: 'private',
+            },
+        ]);
+    });
+
+    it('parses chinese list cards without scanning document.body.innerText', () => {
+        const result = parseListCards([
+            {
+                href: '/i/lists/456',
+                text: `AI观察
+@jack
+321 位成员 8.8K 位关注者
+锁定列表`,
+            },
+        ]);
+        expect(result).toEqual([
+            {
+                name: 'AI观察',
+                members: '321',
+                followers: '8.8K',
+                mode: 'private',
+            },
+        ]);
+    });
+
+    it('detects empty state text in english and chinese', () => {
+        expect(isEmptyListsState(`@jack hasn't created any Lists yet`)).toBe(true);
+        expect(isEmptyListsState('这个账号还没有创建任何列表')).toBe(true);
+        expect(isEmptyListsState('AI Researchers 124 Members')).toBe(false);
+    });
+});

package/clis/weibo/feed.js

@@ -1,20 +1,32 @@
 /**
- * Weibo feed — home timeline from followed users.
+ * Weibo feed — for-you or following timeline.
  */
 import { cli, Strategy } from '@jackwener/opencli/registry';
 import { getSelfUid } from './utils.js';
+const TIMELINE_ENDPOINTS = {
+    'for-you': 'unreadfriendstimeline',
+    following: 'friendstimeline',
+};
 cli({
     site: 'weibo',
     name: 'feed',
-    description: 'Weibo home timeline (posts from followed users)',
+    description: 'Fetch Weibo timeline (for-you or following)',
     domain: 'weibo.com',
     strategy: Strategy.COOKIE,
     args: [
+        {
+            name: 'type',
+            default: 'for-you',
+            choices: ['for-you', 'following'],
+            help: 'Timeline type: for-you (algorithmic) or following (chronological)',
+        },
         { name: 'limit', type: 'int', default: 15, help: 'Number of posts (max 50)' },
     ],
     columns: ['author', 'text', 'reposts', 'comments', 'likes', 'time', 'url'],
     func: async (page, kwargs) => {
         const count = Math.min(kwargs.limit || 15, 50);
+        const timelineType = kwargs.type === 'following' ? 'following' : 'for-you';
+        const endpoint = TIMELINE_ENDPOINTS[timelineType];
         await page.goto('https://weibo.com');
         await page.wait(2);
         const uid = await getSelfUid(page);
@@ -22,13 +34,14 @@ cli({
       (async () => {
         const uid = ${JSON.stringify(uid)};
         const count = ${count};
+        const endpoint = ${JSON.stringify(endpoint)};
         const listId = '10001' + uid;
         const strip = (html) => (html || '').replace(/<[^>]+>/g, '').replace(/&nbsp;/g, ' ').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').trim();
 
-        const resp = await fetch('/ajax/feed/unreadfriendstimeline?list_id=' + listId + '&refresh=4&since_id=0&count=' + count, {credentials: 'include'});
-        if (!resp.ok) return {error: 'HTTP ' + resp.status};
+        const resp = await fetch('/ajax/feed/' + endpoint + '?list_id=' + listId + '&refresh=4&since_id=0&count=' + count, { credentials: 'include' });
+        if (!resp.ok) return { error: 'HTTP ' + resp.status };
         const data = await resp.json();
-        if (!data.ok) return {error: 'API error: ' + (data.msg || 'unknown')};
+        if (!data.ok) return { error: 'API error: ' + (data.msg || 'unknown') };
 
         return (data.statuses || []).slice(0, count).map(s => {
           const u = s.user || {};

package/clis/xiaohongshu/comments.js

@@ -6,7 +6,7 @@
  * the --with-replies flag.
  */
 import { cli, Strategy } from '@jackwener/opencli/registry';
-import { AuthRequiredError, EmptyResultError } from '@jackwener/opencli/errors';
+import { AuthRequiredError, CliError, EmptyResultError } from '@jackwener/opencli/errors';
 import { parseNoteId, buildNoteUrl } from './note-helpers.js';
 function parseCommentLimit(raw, fallback = 20) {
     const n = Number(raw);
@@ -20,6 +20,7 @@ cli({
     description: '获取小红书笔记评论（支持楼中楼子回复）',
     domain: 'www.xiaohongshu.com',
     strategy: Strategy.COOKIE,
+    navigateBefore: false,
     args: [
         { name: 'note-id', required: true, positional: true, help: 'Note ID or full URL (preserves xsec_token for access)' },
         { name: 'limit', type: 'int', default: 20, help: 'Number of top-level comments (max 50)' },
@@ -32,21 +33,27 @@ cli({
         const raw = String(kwargs['note-id']);
         const noteId = parseNoteId(raw);
         await page.goto(buildNoteUrl(raw));
-        await page.wait(3);
+        await page.wait({ time: 2 + Math.random() * 3 });
         const data = await page.evaluate(`
       (async () => {
         const wait = (ms) => new Promise(r => setTimeout(r, ms))
         const withReplies = ${withReplies}
 
         // Check login state
-        const loginWall = /登录后查看|请登录/.test(document.body.innerText || '')
+        const bodyText = document.body?.innerText || ''
+        const loginWall = /登录后查看|请登录/.test(bodyText)
+        const securityBlock = /安全限制|访问链接异常/.test(bodyText)
+          || /website-login\\/error|error_code=300017|error_code=300031/.test(location.href)
 
         // Scroll the note container to trigger comment loading
         const scroller = document.querySelector('.note-scroller') || document.querySelector('.container')
         if (scroller) {
           for (let i = 0; i < 3; i++) {
+            const beforeCount = scroller.querySelectorAll('.parent-comment').length
             scroller.scrollTo(0, scroller.scrollHeight)
-            await wait(1000)
+            await wait(800 + Math.random() * 1200)
+            const afterCount = scroller.querySelectorAll('.parent-comment').length
+            if (afterCount <= beforeCount) break
           }
         }
 
@@ -72,7 +79,7 @@ cli({
               const text = clean(el)
               el.click()
               clickedTexts.add(text)
-              await wait(300)
+              await wait(200 + Math.random() * 300)
             }
           }
         }
@@ -105,12 +112,17 @@ cli({
           }
         }
 
-        return { loginWall, results }
+        return { pageUrl: location.href, securityBlock, loginWall, results }
       })()
     `);
         if (!data || typeof data !== 'object') {
             throw new EmptyResultError('xiaohongshu/comments', 'Unexpected evaluate response');
         }
+        if (data.securityBlock) {
+            throw new CliError('SECURITY_BLOCK', 'Xiaohongshu security block: the note detail page was blocked by risk control.', /^https?:\/\//.test(raw)
+                ? 'The page may be temporarily restricted. Try again later or from a different session.'
+                : 'Try using a full URL from search results (with xsec_token) instead of a bare note ID.');
+        }
         if (data.loginWall) {
             throw new AuthRequiredError('www.xiaohongshu.com', 'Note comments require login');
         }