@mkterswingman/5mghost-yonder 0.0.29 → 0.0.32

package/dist/cli/setupCookies.js

@@ -251,7 +251,18 @@ export async function readImportedBrowserCookies(candidate, chromium, deps) {
             "--headless=new",
             "--no-first-run",
             "--no-default-browser-check",
-            "https://www.youtube.com",
+            // Why: these flags prevent Chrome's background services from contacting Google
+            // servers, which would trigger Account Reconcilor / token rotation and invalidate
+            // the user's real Chrome YouTube session.
+            "--disable-sync",
+            "--disable-background-networking",
+            "--disable-features=AccountReconcilor,IdentityManager",
+            "--disable-client-side-phishing-detection",
+            "--disable-component-update",
+            "--disable-extensions",
+            "--disable-breakpad",
+            "--metrics-recording-only",
+            "about:blank",
         ], {
             detached: true,
             stdio: "ignore",

package/dist/download/downloader.js

@@ -261,14 +261,25 @@ function assertManagerInput(manager, jobId) {
         throw new Error("jobManager and jobId must be provided together.");
     }
 }
+const VIDEO_FORMAT_BY_QUALITY = {
+    "2160p60": "bv*[height<=2160][fps<=60]+ba/b[height<=2160]/b",
+    "1440p60": "bv*[height<=1440][fps<=60]+ba/b[height<=1440]/b",
+    "1080p60": "bv*[height<=1080][fps<=60]+ba/b[height<=1080]/b",
+    "1080p": "bv*[height<=1080]+ba/b[height<=1080]/b",
+    "720p60": "bv*[height<=720][fps<=60]+ba/b[height<=720]/b",
+    "480p": "bv*[height<=480]+ba/b[height<=480]/b",
+    "360p": "bv*[height<=360]+ba/b[height<=360]/b",
+    "240p": "bv*[height<=240]+ba/b[height<=240]/b",
+    max: "bv*+ba/b",
+};
 function normalizeVideoQuality(videoQuality) {
-    return videoQuality === "max" ? "max" : "1080p";
+    if (videoQuality && Object.hasOwn(VIDEO_FORMAT_BY_QUALITY, videoQuality)) {
+        return videoQuality;
+    }
+    return "1080p";
 }
 function resolveVideoFormat(videoQuality) {
-    if (videoQuality === "max") {
-        return "bv*+ba/b";
-    }
-    return "bv*[height<=1080]+ba/b[height<=1080]/b";
+    return VIDEO_FORMAT_BY_QUALITY[videoQuality] ?? VIDEO_FORMAT_BY_QUALITY["1080p"];
 }
 function needsVideo(mode) {
     return mode === "video" || mode === "both";

package/dist/tools/downloads.js

@@ -5,7 +5,17 @@ import { buildMediaOutputPaths } from "../utils/mediaPaths.js";
 import { resolveVideoInput } from "../utils/videoInput.js";
 const AUTH_REQUIRED_MSG = "❌ 未认证。请先登录：\n• OAuth: npx @mkterswingman/5mghost-yonder setup\n• PAT: 设置环境变量 YT_MCP_TOKEN 或在 https://mkterswingman.com/pat/login 生成 token";
 const DOWNLOAD_MODES = ["video", "subtitles", "both"];
-const VIDEO_QUALITIES = ["1080p", "max"];
+const VIDEO_QUALITIES = [
+    "2160p60",
+    "1440p60",
+    "1080p60",
+    "1080p",
+    "720p60",
+    "480p",
+    "360p",
+    "240p",
+    "max",
+];
 const SUBTITLE_FORMATS = ["vtt", "srt", "ttml", "srv3", "csv"];
 const MAX_DOWNLOAD_VIDEOS = 5;
 class DownloadToolError extends Error {

package/dist/utils/cookieRefresh.d.ts

@@ -1,18 +1,20 @@
 /**
- * Headless cookie auto-refresh.
+ * Cookie auto-refresh with three-tier fallback.
  *
- * Uses Playwright to open YouTube in a headless browser with the existing
- * browser-profile. If Google session is still valid, YouTube cookies are
- * extracted and saved automatically — no user interaction needed.
+ * Tier 1: Headless Playwright refresh using existing browser-profile.
+ *   If Google session is still valid, cookies are extracted automatically.
  *
- * If Google session has expired too, returns false so the caller can
- * prompt the user for interactive login.
+ * Tier 2: Re-import from system Chrome/Edge (headless, about:blank).
+ *   Copies the real browser profile to a temp dir and reads cookies via CDP
+ *   without making any network requests (avoids Google token rotation).
+ *
+ * Tier 3: Open a headed browser for manual user login.
+ *   Blocks the MCP tool call for up to ~2 minutes while the user logs in.
+ *   Creates browser-profile so Tier 1 works next time.
  */
 /**
- * Attempt to refresh YouTube cookies headlessly using existing browser profile.
+ * Attempt to refresh YouTube cookies through a three-tier fallback chain.
  *
- * @returns true if cookies were refreshed, false if Google session expired
- *          (needs interactive login).
- * @throws if Playwright is not installed or browser can't launch.
+ * @returns true if cookies were refreshed, false if all tiers failed.
  */
 export declare function tryHeadlessRefresh(): Promise<boolean>;

package/dist/utils/cookieRefresh.js

@@ -1,38 +1,55 @@
 /**
- * Headless cookie auto-refresh.
+ * Cookie auto-refresh with three-tier fallback.
  *
- * Uses Playwright to open YouTube in a headless browser with the existing
- * browser-profile. If Google session is still valid, YouTube cookies are
- * extracted and saved automatically — no user interaction needed.
+ * Tier 1: Headless Playwright refresh using existing browser-profile.
+ *   If Google session is still valid, cookies are extracted automatically.
  *
- * If Google session has expired too, returns false so the caller can
- * prompt the user for interactive login.
+ * Tier 2: Re-import from system Chrome/Edge (headless, about:blank).
+ *   Copies the real browser profile to a temp dir and reads cookies via CDP
+ *   without making any network requests (avoids Google token rotation).
+ *
+ * Tier 3: Open a headed browser for manual user login.
+ *   Blocks the MCP tool call for up to ~2 minutes while the user logs in.
+ *   Creates browser-profile so Tier 1 works next time.
  */
 import { existsSync } from "node:fs";
 import { PATHS, ensureConfigDir } from "./config.js";
 import { detectBrowserChannel, hasYouTubeSession, saveCookiesToDisk, } from "../cli/setupCookies.js";
+import { hasSIDCookies } from "./cookies.js";
 const HEADLESS_TIMEOUT_MS = 30_000;
 /**
- * Attempt to refresh YouTube cookies headlessly using existing browser profile.
+ * Attempt to refresh YouTube cookies through a three-tier fallback chain.
  *
- * @returns true if cookies were refreshed, false if Google session expired
- *          (needs interactive login).
- * @throws if Playwright is not installed or browser can't launch.
+ * @returns true if cookies were refreshed, false if all tiers failed.
  */
 export async function tryHeadlessRefresh() {
-    // No browser profile = never logged in = can't refresh
-    if (!existsSync(PATHS.browserProfile)) {
-        return false;
-    }
     ensureConfigDir();
-    // Dynamic import to keep serve startup fast
+    // Tier 1: Playwright persistent context (requires browser-profile from prior manual login)
+    if (existsSync(PATHS.browserProfile)) {
+        const tier1 = await tryPlaywrightRefresh();
+        if (tier1)
+            return true;
+    }
+    // Tier 2: Re-import from system browser (headless, no network requests)
+    const tier2 = await tryReimportFromSystemBrowser();
+    if (tier2)
+        return true;
+    // Tier 3: Open headed browser for manual login
+    const tier3 = await tryHeadedManualLogin();
+    return tier3;
+}
+/**
+ * Tier 1: Use existing browser-profile with Playwright to refresh cookies.
+ * This is the original tryHeadlessRefresh logic.
+ */
+async function tryPlaywrightRefresh() {
     let chromium;
     try {
         const pw = await import("playwright");
         chromium = pw.chromium;
     }
     catch {
-        return false; // Playwright not installed — can't refresh
+        return false;
     }
     const channel = await detectBrowserChannel(chromium);
     let context;
@@ -44,7 +61,7 @@ export async function tryHeadlessRefresh() {
         });
     }
     catch {
-        return false; // Browser launch failed
+        return false;
     }
     try {
         const page = context.pages()[0] ?? (await context.newPage());
@@ -52,11 +69,9 @@ export async function tryHeadlessRefresh() {
         await page.waitForLoadState("domcontentloaded");
         const cookies = await context.cookies("https://www.youtube.com");
         if (!hasYouTubeSession(cookies)) {
-            // Google session expired — can't auto-refresh
             await context.close().catch(() => { });
             return false;
         }
-        // Wait a moment for all cookies to settle
         await new Promise((r) => setTimeout(r, 1500));
         const finalCookies = await context.cookies("https://www.youtube.com");
         saveCookiesToDisk(finalCookies);
@@ -68,3 +83,53 @@ export async function tryHeadlessRefresh() {
         return false;
     }
 }
+/**
+ * Tier 2: Re-import cookies from the user's system Chrome/Edge.
+ * Uses headless Chrome with about:blank to avoid triggering Google token rotation.
+ */
+async function tryReimportFromSystemBrowser() {
+    try {
+        const pw = await import("playwright");
+        const { tryImportBrowserCookies, saveCookiesAndClose, readImportedBrowserCookies, } = await import("../cli/setupCookies.js");
+        const { findImportableBrowserProfileCandidates, prepareImportedBrowserWorkspace, cleanupImportedBrowserWorkspace, } = await import("./browserProfileImport.js");
+        const deps = {
+            ensureConfigDir,
+            loadChromium: async () => pw.chromium,
+            detectBrowserChannel,
+            hasYouTubeSession,
+            saveCookiesAndClose,
+            // Why: waitForLogin is unused in import path but required by SetupCookiesDeps type
+            waitForLogin: async () => null,
+            findImportableBrowserProfileCandidates,
+            prepareImportedBrowserWorkspace,
+            cleanupImportedBrowserWorkspace,
+            readImportedBrowserCookies,
+            tryImportBrowserCookies,
+            // Why: runManualCookieSetup is unused in import path but required by type
+            runManualCookieSetup: async () => { },
+            // Why: silent logging during auto-refresh — user doesn't see MCP server stdout
+            log: () => { },
+        };
+        return await tryImportBrowserCookies(pw.chromium, deps);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Tier 3: Open a headed browser for the user to manually log in.
+ * Blocks the MCP tool call for up to ~2 minutes.
+ * Creates browser-profile so Tier 1 works for future refreshes.
+ */
+async function tryHeadedManualLogin() {
+    try {
+        // Why: runSetupCookies with { headed: true } skips import and goes straight
+        // to manual Playwright login, which creates browser-profile for future Tier 1 use.
+        const { runSetupCookies } = await import("../cli/setupCookies.js");
+        await runSetupCookies({}, { headed: true });
+        return hasSIDCookies(PATHS.cookiesTxt);
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mkterswingman/5mghost-yonder",
-  "version": "0.0.29",
+  "version": "0.0.32",
   "description": "Internal MCP client with local data tools and remote API proxy",
   "type": "module",
   "bin": {

package/skills/use-yt-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: use-yt-mcp
 preamble-tier: 3
-version: 1.2.0
+version: 1.2.1
 description: |
   Use when the user wants YouTube analysis through yt-mcp: channel performance,
   video stats, subtitles, comments, trending, or batch YouTube data work.
@@ -54,6 +54,8 @@ All tools are prefixed `mcp__yt-mcp__` in actual calls.
 - If the user provides a fuzzy channel name (for example only a brand/person name), call `search_channels` first and present 3-5 candidates before doing channel analysis.
 - After `search_channels` returns candidates, explicitly ask the user which channel they mean; do not auto-select candidate #1.
 - If the user already provides a channel URL, `@handle`, or explicit `channel_id`, skip candidate search and go directly to `get_channel_stats` / `list_channel_uploads`.
+- For local media download requests where the user says to download/save a video but does not explicitly choose mode, call `start_download_job` with `mode: "both"` so subtitles are downloaded by default.
+- If the user explicitly says no subtitles / video-only (for example "不要字幕", "只下视频"), then call `start_download_job` with `mode: "video"`.
 - `get_video_stats` accepts up to 1000 items. If the response returns `mode: "file"`, then inline `preview_items` is only a preview sample from a larger dataset and must not be used as the full basis of analysis. Tell the user the complete result is in `output_file` or `download_url`.
 - For large video/comment analyses where completeness matters, prefer async jobs: `start_video_stats_job` -> `poll_video_stats_job`, or `start_comments_job` -> `poll_comments_job`.
 - When using async jobs, poll until status is `completed`, and tell the user if the result is still partial or in progress.