@mkterswingman/yt-mcp 0.1.1 → 0.2.0

package/dist/auth/oauthFlow.js

@@ -9,9 +9,10 @@ function base64url(buf) {
         .replace(/=+$/, "");
 }
 export async function runOAuthFlow(authUrl) {
-    // 1. Generate PKCE
+    // 1. Generate PKCE + state
     const codeVerifier = base64url(randomBytes(32));
     const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+    const state = base64url(randomBytes(32));
     // 2. Start temp HTTP server to get the actual port for redirect_uri
     const { server: httpServer, port } = await startCallbackServer();
     const redirectUri = `http://127.0.0.1:${port}`;
@@ -55,6 +56,7 @@ export async function runOAuthFlow(authUrl) {
                 const url = new URL(req.url ?? "/", `http://127.0.0.1`);
                 const code = url.searchParams.get("code");
                 const error = url.searchParams.get("error");
+                const returnedState = url.searchParams.get("state");
                 if (error) {
                     const safeError = error.replace(/[<>&"']/g, (c) => `&#${c.charCodeAt(0)};`);
                     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -68,6 +70,14 @@ export async function runOAuthFlow(authUrl) {
                     res.end("<h1>Waiting for authorization...</h1>");
                     return;
                 }
+                // Verify state to prevent CSRF
+                if (returnedState !== state) {
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<h1>Authorization failed</h1><p>State mismatch — possible CSRF attack.</p>");
+                    cleanup();
+                    reject(new Error("OAuth state mismatch"));
+                    return;
+                }
                 // Exchange code for tokens
                 const tokenBody = {
                     grant_type: "authorization_code",
@@ -111,7 +121,7 @@ export async function runOAuthFlow(authUrl) {
             }
         });
         // Open browser
-        const authorizeUrl = `${authUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256`;
+        const authorizeUrl = `${authUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256&state=${encodeURIComponent(state)}`;
         console.log("\n\x1b[1mOpen this URL in your browser to authorize:\x1b[0m");
         console.log(`\n  ${authorizeUrl}\n`);
         import("node:child_process").then(({ exec }) => {

package/dist/cli/setup.js

@@ -1,9 +1,12 @@
 import { execSync } from "node:child_process";
 import { createInterface } from "node:readline";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { loadConfig, saveConfig, PATHS, ensureConfigDir } from "../utils/config.js";
 import { TokenManager } from "../auth/tokenManager.js";
 import { runOAuthFlow } from "../auth/oauthFlow.js";
 import { hasSIDCookies } from "../utils/cookies.js";
+import { getYtDlpVersion } from "../utils/ytdlpPath.js";
 function detectCli(name) {
     try {
         execSync(`${name} --version`, { stdio: "pipe" });
@@ -77,13 +80,31 @@ export async function runSetup() {
     }
     // ── Step 1: Check yt-dlp ──
     console.log("Step 1/5: Checking yt-dlp...");
-    try {
-        const ver = execSync("yt-dlp --version", { stdio: "pipe" }).toString().trim();
-        console.log(`  ✅ yt-dlp ${ver}`);
+    const ytdlpInfo = getYtDlpVersion();
+    if (ytdlpInfo) {
+        console.log(`  ✅ yt-dlp ${ytdlpInfo.version} (${ytdlpInfo.source})`);
     }
-    catch {
-        console.log("  ⚠️  yt-dlp not found (subtitle features will be unavailable)");
-        console.log("  💡 Install later: https://github.com/yt-dlp/yt-dlp#installation");
+    else {
+        // Try running the postinstall download script
+        console.log("  ⏳ yt-dlp not found, attempting download...");
+        try {
+            execSync("node scripts/download-ytdlp.mjs", {
+                cwd: join(dirname(fileURLToPath(import.meta.url)), "..", ".."),
+                stdio: "inherit",
+            });
+            const retryInfo = getYtDlpVersion();
+            if (retryInfo) {
+                console.log(`  ✅ yt-dlp ${retryInfo.version} (${retryInfo.source})`);
+            }
+            else {
+                console.log("  ⚠️  yt-dlp download failed (subtitle features will be unavailable)");
+                console.log("  💡 Install manually: https://github.com/yt-dlp/yt-dlp#installation");
+            }
+        }
+        catch {
+            console.log("  ⚠️  yt-dlp not found (subtitle features will be unavailable)");
+            console.log("  💡 Install: https://github.com/yt-dlp/yt-dlp#installation");
+        }
     }
     // ── Step 2: Config ──
     console.log("Step 2/5: Initializing config...");

package/dist/tools/subtitles.js

@@ -157,7 +157,7 @@ export function registerSubtitleTools(server, config, tokenManager) {
     }
     // ── get_subtitles ──
     server.registerTool("get_subtitles", {
-        description: "Download subtitles for a YouTube video. Accepts video ID or any YouTube URL (watch, shorts, youtu.be). Each language is fetched separately. Supports CSV output (timestamp + text columns).",
+        description: "Download subtitles for a YouTube video. Accepts video ID or any YouTube URL (watch, shorts, youtu.be). Each language is fetched separately. Supports CSV output (timestamp + text columns). If languages is omitted, defaults to English + Simplified Chinese (unavailable languages are silently skipped).",
         inputSchema: {
             video: z.string().min(1).describe("YouTube video ID or URL"),
             languages: z.array(z.string().min(1)).optional(),
@@ -170,6 +170,7 @@ export function registerSubtitleTools(server, config, tokenManager) {
         const videoId = resolveVideoInput(video);
         if (!videoId)
             return toolErr("INVALID_INPUT", `无法解析视频 ID: ${video}`);
+        const usingDefaults = !languages;
         const langs = languages ?? config.default_languages;
         const fmt = format ?? "vtt";
         const results = [];
@@ -183,11 +184,14 @@ export function registerSubtitleTools(server, config, tokenManager) {
                 return toolErr("COOKIES_EXPIRED", "YouTube cookies have expired. Run: npx @mkterswingman/yt-mcp setup-cookies");
             }
             if (!dl.ok) {
-                results.push({
-                    language: lang,
-                    status: "failed",
-                    error: dl.error,
-                });
+                // When using default languages, silently skip unavailable ones
+                if (!usingDefaults) {
+                    results.push({
+                        language: lang,
+                        status: "failed",
+                        error: dl.error,
+                    });
+                }
             }
             else if (dl.text) {
                 results.push({

package/dist/utils/config.js

@@ -13,7 +13,7 @@ export const PATHS = {
 const DEFAULTS = {
     auth_url: "https://mkterswingman.com",
     api_url: "https://mkterswingman.com/mcp/yt",
-    default_languages: ["en"],
+    default_languages: ["en", "zh-Hans"],
     batch_sleep_min_ms: 3000,
     batch_sleep_max_ms: 8000,
     batch_max_size: 10,

package/dist/utils/ytdlp.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { PATHS } from "./config.js";
+import { getYtDlpPath } from "./ytdlpPath.js";
 export function runYtDlp(args, timeoutMs = 45_000) {
     return new Promise((resolve, reject) => {
         const start = Date.now();
@@ -8,7 +9,7 @@ export function runYtDlp(args, timeoutMs = 45_000) {
         if (existsSync(PATHS.cookiesTxt)) {
             finalArgs.push("--cookies", PATHS.cookiesTxt);
         }
-        const proc = spawn("yt-dlp", finalArgs, {
+        const proc = spawn(getYtDlpPath(), finalArgs, {
             stdio: ["ignore", "pipe", "pipe"],
         });
         const stdoutChunks = [];

package/dist/utils/ytdlpPath.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Resolve the yt-dlp binary path.
+ *
+ * Priority:
+ *   1. YT_DLP_PATH env var (explicit override)
+ *   2. Bundled binary at <pkg>/bin/yt-dlp (downloaded by postinstall)
+ *   3. "yt-dlp" — fall back to system PATH
+ */
+/**
+ * Returns the absolute path to the yt-dlp binary, or the bare command name
+ * "yt-dlp" if only available on system PATH.
+ */
+export declare function getYtDlpPath(): string;
+export interface YtDlpVersionInfo {
+    version: string;
+    source: "bundled" | "system" | "env";
+}
+/**
+ * Get the version string and source of the resolved yt-dlp binary.
+ * Returns null if yt-dlp is not available at all.
+ */
+export declare function getYtDlpVersion(binPath?: string): YtDlpVersionInfo | null;

package/dist/utils/ytdlpPath.js

@@ -0,0 +1,64 @@
+/**
+ * Resolve the yt-dlp binary path.
+ *
+ * Priority:
+ *   1. YT_DLP_PATH env var (explicit override)
+ *   2. Bundled binary at <pkg>/bin/yt-dlp (downloaded by postinstall)
+ *   3. "yt-dlp" — fall back to system PATH
+ */
+import { existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// From dist/utils/ → package root is ../../
+const pkgRoot = join(__dirname, "..", "..");
+function bundledPath() {
+    const name = process.platform === "win32" ? "yt-dlp.exe" : "yt-dlp";
+    return join(pkgRoot, "bin", name);
+}
+/**
+ * Returns the absolute path to the yt-dlp binary, or the bare command name
+ * "yt-dlp" if only available on system PATH.
+ */
+export function getYtDlpPath() {
+    // 1. Explicit env override
+    const envPath = process.env.YT_DLP_PATH;
+    if (envPath && existsSync(envPath))
+        return envPath;
+    // 2. Bundled binary
+    const bundled = bundledPath();
+    if (existsSync(bundled))
+        return bundled;
+    // 3. System PATH
+    return "yt-dlp";
+}
+/**
+ * Get the version string and source of the resolved yt-dlp binary.
+ * Returns null if yt-dlp is not available at all.
+ */
+export function getYtDlpVersion(binPath) {
+    const resolved = binPath ?? getYtDlpPath();
+    let source;
+    if (process.env.YT_DLP_PATH && resolved === process.env.YT_DLP_PATH) {
+        source = "env";
+    }
+    else if (resolved === bundledPath()) {
+        source = "bundled";
+    }
+    else {
+        source = "system";
+    }
+    try {
+        const ver = execFileSync(resolved, ["--version"], {
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 10_000,
+        })
+            .toString()
+            .trim();
+        return { version: ver, source };
+    }
+    catch {
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mkterswingman/yt-mcp",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "YouTube MCP client — local subtitles + remote API proxy",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "dev": "tsx src/cli/index.ts",
-    "start": "node dist/cli/index.js"
+    "start": "node dist/cli/index.js",
+    "postinstall": "node scripts/download-ytdlp.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -34,6 +35,7 @@
   },
   "files": [
     "dist/",
+    "scripts/download-ytdlp.mjs",
     "README.md"
   ],
   "devDependencies": {

package/scripts/download-ytdlp.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+/**
+ * postinstall script — downloads yt-dlp binary for the current platform.
+ *
+ * Runs automatically on `npm install`. Uses only Node.js built-ins (no deps).
+ *
+ * Env overrides:
+ *   YT_MCP_SKIP_YTDLP=1   — skip download entirely (CI / air-gapped)
+ *   YT_MCP_YTDLP_MIRROR   — custom base URL (default: GitHub releases)
+ */
+
+import { createWriteStream, chmodSync, mkdirSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { pipeline } from "node:stream/promises";
+
+// ── Constants ────────────────────────────────────────────────────────────────
+
+const YT_DLP_VERSION = "2026.03.17";
+
+const BASE_URL =
+  process.env.YT_MCP_YTDLP_MIRROR ||
+  `https://github.com/yt-dlp/yt-dlp/releases/download/${YT_DLP_VERSION}`;
+
+/** Map (platform, arch) → binary file name on GitHub Releases. */
+const PLATFORM_MAP = {
+  "darwin-arm64":  "yt-dlp_macos",
+  "darwin-x64":    "yt-dlp_macos",
+  "linux-x64":     "yt-dlp_linux",
+  "linux-arm64":   "yt-dlp_linux_aarch64",
+  "win32-x64":     "yt-dlp.exe",
+};
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = join(__dirname, "..");
+const binDir = join(pkgRoot, "bin");
+
+function localName() {
+  return process.platform === "win32" ? "yt-dlp.exe" : "yt-dlp";
+}
+
+/**
+ * Follow redirects (GitHub releases → S3) and stream to disk.
+ * Uses global fetch() (Node 18+).
+ */
+async function download(url, dest) {
+  const res = await fetch(url, { redirect: "follow" });
+  if (!res.ok) {
+    throw new Error(`HTTP ${res.status} ${res.statusText} — ${url}`);
+  }
+  const fileStream = createWriteStream(dest);
+  // res.body is a ReadableStream; convert to Node stream for pipeline
+  await pipeline(res.body, fileStream);
+}
+
+// ── Main ─────────────────────────────────────────────────────────────────────
+
+async function main() {
+  // Allow skipping for CI or air-gapped environments
+  if (process.env.YT_MCP_SKIP_YTDLP === "1") {
+    console.log("[yt-mcp] YT_MCP_SKIP_YTDLP=1 — skipping yt-dlp download");
+    return;
+  }
+
+  const key = `${process.platform}-${process.arch}`;
+  const remoteName = PLATFORM_MAP[key];
+
+  if (!remoteName) {
+    console.warn(
+      `[yt-mcp] ⚠️  No pre-built yt-dlp binary for ${key}. ` +
+      `Install yt-dlp manually: https://github.com/yt-dlp/yt-dlp#installation`
+    );
+    return;
+  }
+
+  const dest = join(binDir, localName());
+
+  // Already downloaded?
+  if (existsSync(dest)) {
+    console.log(`[yt-mcp] yt-dlp already present at ${dest}`);
+    return;
+  }
+
+  mkdirSync(binDir, { recursive: true });
+
+  const url = `${BASE_URL}/${remoteName}`;
+  console.log(`[yt-mcp] Downloading yt-dlp ${YT_DLP_VERSION} for ${key}...`);
+  console.log(`[yt-mcp]   ${url}`);
+
+  try {
+    await download(url, dest);
+
+    // chmod +x on non-Windows
+    if (process.platform !== "win32") {
+      chmodSync(dest, 0o755);
+    }
+
+    console.log(`[yt-mcp] ✅ yt-dlp installed to ${dest}`);
+  } catch (err) {
+    console.error(`[yt-mcp] ⚠️  Failed to download yt-dlp: ${err.message}`);
+    console.error(
+      `[yt-mcp]    Install manually: https://github.com/yt-dlp/yt-dlp#installation`
+    );
+    // Non-fatal — remote tools still work without yt-dlp
+  }
+}
+
+main();