@sovovs/bycli 2.1.0 → 2.1.2

package/clis/weixin/_wechat/wechat-api.js

@@ -0,0 +1,133 @@
+import { AuthRequiredError, CommandExecutionError } from '@sovovs/bycli/errors';
+import { buildSecretSet, redactText } from './redact.js';
+
+const DOMAIN = 'mp.weixin.qq.com';
+const ENDPOINT = `https://${DOMAIN}/cgi-bin/appmsgpublish`;
+
+function normalizedMessage(value) {
+  return String(value ?? '').trim().toLowerCase().replace(/\s+/g, ' ');
+}
+
+function commandError(message) {
+  return new CommandExecutionError(redactText(message, []));
+}
+
+function parseNestedJson(value, label) {
+  if (typeof value !== 'string') return value;
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw commandError(`WeChat ${label} is malformed: ${detail}`);
+  }
+}
+
+/** @param {unknown} data */
+export function parsePublishData(data) {
+  if (!data || typeof data !== 'object') {
+    throw new CommandExecutionError('WeChat article history returned an unreadable response');
+  }
+  const response = /** @type {Record<string, any>} */ (data);
+  const ret = response.base_resp?.ret;
+  const message = response.base_resp?.err_msg ?? response.base_resp?.err_msg_en ?? '';
+  if (ret === 200013 && normalizedMessage(message) === 'invalid credential') {
+    throw new AuthRequiredError(DOMAIN, 'WeChat article-history credentials have expired');
+  }
+  if (ret !== undefined && ret !== 0) {
+    throw new CommandExecutionError(`WeChat article history failed (ret=${String(ret)})`);
+  }
+  if (response.publish_page === undefined || response.publish_page === null || response.publish_page === '') {
+    return { total: 0, publishItemCount: 0, articles: [] };
+  }
+  const page = parseNestedJson(response.publish_page, 'publish_page');
+  if (!page || typeof page !== 'object' || !Array.isArray(page.publish_list)) {
+    throw new CommandExecutionError('WeChat article history returned an invalid publish page');
+  }
+  const total = page.total_count === undefined ? 0 : page.total_count;
+  if (!Number.isSafeInteger(total) || total < 0) {
+    throw new CommandExecutionError('WeChat article history returned invalid total metadata');
+  }
+  const articles = [];
+  for (const item of page.publish_list) {
+    const info = parseNestedJson(item?.publish_info ?? {}, 'publish_info');
+    if (!info || typeof info !== 'object' || !Array.isArray(info.appmsg_info)) {
+      throw new CommandExecutionError('WeChat article history returned invalid publish information');
+    }
+    const timestamp = info.sent_info?.time ?? info.publish_info?.create_time ?? 0;
+    let publishedAt = null;
+    if (timestamp !== 0) {
+      if (typeof timestamp !== 'number' || !Number.isFinite(timestamp) || timestamp <= 0) {
+        throw new CommandExecutionError('WeChat article history returned an invalid publish timestamp');
+      }
+      const date = new Date(timestamp * 1000);
+      if (!Number.isFinite(date.getTime())) {
+        throw new CommandExecutionError('WeChat article history returned an invalid publish timestamp');
+      }
+      publishedAt = date.toISOString();
+    }
+    for (const messageItem of info.appmsg_info) {
+      const article = messageItem && typeof messageItem === 'object' ? messageItem : {};
+      articles.push({
+        title: typeof article.title === 'string' ? article.title : '',
+        url: typeof article.content_url === 'string' ? article.content_url : '',
+        isDeleted: article.is_deleted === true,
+        timestamp,
+        publishedAt,
+        digest: typeof article.digest === 'string' ? article.digest : '',
+        author: typeof article.author === 'string' ? article.author : '',
+      });
+    }
+  }
+  return {
+    total,
+    publishItemCount: page.publish_list.length,
+    articles,
+  };
+}
+
+export function requestHeaders(cookie, token) {
+  return {
+    Accept: 'application/json, text/javascript, */*; q=0.01',
+    Cookie: cookie,
+    Origin: `https://${DOMAIN}`,
+    Referer: `https://${DOMAIN}/cgi-bin/appmsg?t=media/appmsg_edit_v2&action=edit&isNew=1&type=10&token=${encodeURIComponent(token)}&lang=zh_CN`,
+    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/143 Safari/537.36',
+    'X-Requested-With': 'XMLHttpRequest',
+  };
+}
+
+/**
+ * @param {{token:string,cookie:string,timeoutMs?:number,fetchImpl?:typeof fetch}} options
+ */
+export function createWechatApi({ token, cookie, timeoutMs = 30_000, fetchImpl = fetch }) {
+  const headers = requestHeaders(cookie, token);
+  const secrets = buildSecretSet({ token, cookie });
+
+  return {
+    async fetchPage({ fakeid, begin = 0, count = 10 }) {
+      const query = new URLSearchParams({
+        sub: 'list', begin: String(begin), count: String(count), fakeid, token,
+        lang: 'zh_CN', f: 'json', ajax: '1',
+      });
+      try {
+        const response = await fetchImpl(`${ENDPOINT}?${query}`, {
+          headers,
+          signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!response.ok) {
+          throw new CommandExecutionError(`WeChat article history request failed: HTTP ${response.status} ${response.statusText ?? ''}`.trim());
+        }
+        return parsePublishData(await response.json());
+      } catch (error) {
+        if (error instanceof AuthRequiredError && error.domain === DOMAIN) throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        const hint = error && typeof error === 'object' && 'hint' in error && typeof error.hint === 'string'
+          ? error.hint : undefined;
+        throw new CommandExecutionError(
+          `WeChat article history request failed: ${redactText(message, secrets)}`,
+          hint ? redactText(hint, secrets) : undefined,
+        );
+      }
+    },
+  };
+}

package/clis/weixin/accounts.js

@@ -0,0 +1,38 @@
+import { ArgumentError, EmptyResultError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { readEnvironmentCredentials, resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { captureSearchBizFingerprint } from './_wechat/fingerprint.js';
+import { executeSearchBiz } from './_wechat/search-biz.js';
+import { readAuthSource } from './_wechat/args.js';
+
+const DOMAIN = 'mp.weixin.qq.com';
+const browserRequired = args => readAuthSource(args) === 'browser';
+
+export const accountsCommand = cli({
+  site: 'weixin', name: 'accounts', access: 'read', domain: DOMAIN,
+  description: 'Search WeChat official accounts and return their fakeids',
+  strategy: Strategy.INTERCEPT, browser: browserRequired,
+  args: [
+    { name: 'query', positional: true, required: true, help: 'Official-account name to search for' },
+    { name: 'limit', type: 'int', default: 10, help: 'Maximum number of matching accounts to return' },
+    { name: 'auth-source', default: 'browser', choices: ['browser', 'env'], help: 'Credential source: browser session or environment variables' },
+  ],
+  columns: ['nickname', 'fakeid', 'alias'],
+  func: async (page, args) => {
+    const query = String(args.query ?? '').trim();
+    if (!query) throw new ArgumentError('query is required');
+    const limit = args.limit ?? 10;
+    if (!Number.isSafeInteger(limit) || limit <= 0) throw new ArgumentError('limit must be a positive safe integer');
+    const authSource = readAuthSource(args);
+    let credentials;
+    if (authSource === 'env') {
+      credentials = readEnvironmentCredentials(true);
+    } else {
+      credentials = await resolveBrowserCredentials(page);
+      credentials = { ...credentials, fingerprint: await captureSearchBizFingerprint(page, query) };
+    }
+    const rows = await executeSearchBiz({ page, source: authSource, credentials, query, limit });
+    if (rows.length === 0) throw new EmptyResultError('weixin accounts', `No official accounts matched "${query}".`);
+    return rows.map(row => ({ nickname: row.nickname, fakeid: row.fakeid, alias: row.alias || null }));
+  },
+});

package/clis/weixin/articles.js

@@ -0,0 +1,35 @@
+import { ArgumentError, EmptyResultError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { readEnvironmentCredentials, resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { collectArticles } from './_wechat/article-service.js';
+import { createWechatApi } from './_wechat/wechat-api.js';
+import { readAuthSource } from './_wechat/args.js';
+
+const DOMAIN = 'mp.weixin.qq.com';
+const browserRequired = args => readAuthSource(args) === 'browser';
+
+export const articlesCommand = cli({
+  site: 'weixin', name: 'articles', access: 'read', domain: DOMAIN,
+  description: 'List published articles from a WeChat official account',
+  strategy: Strategy.COOKIE, browser: browserRequired,
+  args: [
+    { name: 'fakeid', positional: true, required: true, help: 'Official-account fakeid returned by weixin accounts' },
+    { name: 'name', help: 'Optional official-account name for display context' }, { name: 'limit', type: 'int', help: 'Maximum number of articles to return' }, { name: 'max-pages', type: 'int', help: 'Maximum number of history pages to scan' },
+    { name: 'auth-source', default: 'browser', choices: ['browser', 'env'], help: 'Credential source: browser session or environment variables' },
+  ],
+  columns: ['title', 'author', 'digest', 'publishedAt', 'url'],
+  func: async (page, args) => {
+    const fakeid = String(args.fakeid ?? '').trim();
+    if (!fakeid) throw new ArgumentError('fakeid is required');
+    const authSource = readAuthSource(args);
+    const credentials = authSource === 'env'
+      ? readEnvironmentCredentials(false) : await resolveBrowserCredentials(page);
+    const { fetchPage } = createWechatApi(credentials);
+    const { articles } = await collectArticles({ fakeid, fetchPage, limit: args.limit, maxPages: args['max-pages'] });
+    if (articles.length === 0) throw new EmptyResultError('weixin articles', `No published articles were found for ${fakeid}.`);
+    return articles.map(article => ({
+      title: article.title, author: article.author || null, digest: article.digest || null,
+      publishedAt: article.publishedAt || null, url: article.url,
+    }));
+  },
+});

package/clis/weixin/download.js

@@ -8,6 +8,8 @@
  */
 import { cli, Strategy } from '@sovovs/bycli/registry';
 import { downloadArticle } from '@sovovs/bycli/download/article-download';
+import { buildExtractWechatArticleContentJs } from './_wechat/article-content.js';
+export { extractWechatArticleContent } from './_wechat/article-content.js';
 // ============================================================
 // URL Normalization
 // ============================================================
@@ -241,53 +243,8 @@ cli({
         );
         if (result.errorHint) return result;
 
-        // Content processing
-        const contentEl = document.querySelector('#js_content');
-        if (!contentEl) return result;
-
-        // Fix lazy-loaded images: data-src -> src
-        contentEl.querySelectorAll('img').forEach(img => {
-          const dataSrc = img.getAttribute('data-src');
-          if (dataSrc) img.setAttribute('src', dataSrc);
-        });
-
-        // Extract code blocks with placeholder replacement
-        const codeBlocks = [];
-        contentEl.querySelectorAll('.code-snippet__fix').forEach(el => {
-          el.querySelectorAll('.code-snippet__line-index').forEach(li => li.remove());
-          const pre = el.querySelector('pre[data-lang]');
-          const lang = pre ? (pre.getAttribute('data-lang') || '') : '';
-          const lines = [];
-          el.querySelectorAll('code').forEach(codeTag => {
-            const text = codeTag.textContent;
-            if (/^[ce]?ounter\\(line/.test(text)) return;
-            lines.push(text);
-          });
-          if (lines.length === 0) lines.push(el.textContent);
-          const placeholder = 'CODEBLOCK-PLACEHOLDER-' + codeBlocks.length;
-          codeBlocks.push({ lang, code: lines.join('\\n') });
-          const p = document.createElement('p');
-          p.textContent = placeholder;
-          el.replaceWith(p);
-        });
-        result.codeBlocks = codeBlocks;
-
-        // Remove noise elements
-        ['script', 'style', '.qr_code_pc', '.reward_area'].forEach(sel => {
-          contentEl.querySelectorAll(sel).forEach(tag => tag.remove());
-        });
-
-        // Collect image URLs (deduplicated)
-        const seen = new Set();
-        contentEl.querySelectorAll('img[src]').forEach(img => {
-          const src = img.getAttribute('src');
-          if (src && !seen.has(src)) {
-            seen.add(src);
-            result.imageUrls.push(src);
-          }
-        });
-
-        result.contentHtml = contentEl.innerHTML;
+        const extractWechatArticleContent = ${buildExtractWechatArticleContentJs()};
+        Object.assign(result, extractWechatArticleContent(document));
         return result;
       })()
     `);
@@ -318,6 +275,7 @@ cli({
                 const m = url.match(/wx_fmt=(\w+)/) || url.match(/\.(\w{3,4})(?:\?|$)/);
                 return m ? m[1] : 'png';
             },
+            secureMarkdown: true,
         });
     },
 });

package/clis/weixin/save-articles.js

@@ -0,0 +1,175 @@
+import { ArgumentError, CommandExecutionError } from '@sovovs/bycli/errors';
+import { MAX_WECHAT_HTML_BYTES } from '@sovovs/bycli/download/wechat-article';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { readEnvironmentCredentials, resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { collectArticles, isTrustedWechatArticleUrl } from './_wechat/article-service.js';
+import { saveArticles } from './_wechat/save-service.js';
+import { createWechatApi } from './_wechat/wechat-api.js';
+import { readAuthSource } from './_wechat/args.js';
+
+const DOMAIN = 'mp.weixin.qq.com';
+const browserRequired = args => readAuthSource(args) === 'browser';
+
+const MAX_REDIRECTS = 5;
+
+async function readBoundedHtml(response) {
+  const lengthValue = response.headers?.get?.('content-length');
+  if (lengthValue !== null && lengthValue !== undefined && lengthValue !== '') {
+    const length = Number(lengthValue);
+    if (!Number.isSafeInteger(length) || length < 0 || length > MAX_WECHAT_HTML_BYTES) {
+      throw new CommandExecutionError('Article response exceeds the allowed size');
+    }
+  }
+  if (!response.body?.getReader) {
+    if (typeof response.text !== 'function') throw new CommandExecutionError('Article response has no readable body');
+    const text = await response.text();
+    if (new TextEncoder().encode(text).byteLength > MAX_WECHAT_HTML_BYTES) {
+      throw new CommandExecutionError('Article response exceeds the allowed size');
+    }
+    return text;
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!(value instanceof Uint8Array)) throw new CommandExecutionError('Article response returned invalid body data');
+    total += value.byteLength;
+    if (total > MAX_WECHAT_HTML_BYTES) {
+      try { await reader.cancel(); } catch { /* best-effort stream cleanup */ }
+      throw new CommandExecutionError('Article response exceeds the allowed size');
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+  return new TextDecoder().decode(bytes);
+}
+
+export async function fetchArticleHtml(article, { fetchImpl = fetch, timeoutMs = 30_000 } = {}) {
+  try {
+    if (!isTrustedWechatArticleUrl(article?.url)) throw new CommandExecutionError('Article request rejected an untrusted URL');
+    let current = new URL(article.url).href;
+    const seen = new Set([current]);
+    for (let redirects = 0; ; redirects += 1) {
+      const response = await fetchImpl(current, {
+        signal: AbortSignal.timeout(timeoutMs), redirect: 'manual',
+      });
+      if (response.status >= 300 && response.status < 400) {
+        if (redirects >= MAX_REDIRECTS) throw new CommandExecutionError('Article request exceeded the redirect limit');
+        const location = response.headers?.get?.('location');
+        if (!location) throw new CommandExecutionError('Article redirect was missing a destination');
+        let next;
+        try { next = new URL(location, current).href; } catch { throw new CommandExecutionError('Article redirect was invalid'); }
+        if (!isTrustedWechatArticleUrl(next)) throw new CommandExecutionError('Article redirect was rejected');
+        if (seen.has(next)) throw new CommandExecutionError('Article redirect loop was rejected');
+        seen.add(next);
+        current = next;
+        continue;
+      }
+      if (!response.ok) throw new CommandExecutionError(`Article request failed: HTTP ${response.status}`);
+      return await readBoundedHtml(response);
+    }
+  } catch (error) {
+    if (error instanceof CommandExecutionError) throw error;
+    throw new CommandExecutionError('Article request failed');
+  }
+}
+
+export async function fetchArticleHtmlInBrowser(article, page) {
+  try {
+    if (!isTrustedWechatArticleUrl(article?.url)) {
+      throw new CommandExecutionError('Article browser request rejected an untrusted URL');
+    }
+    if (!page || typeof page.goto !== 'function' || typeof page.evaluate !== 'function') {
+      throw new CommandExecutionError('Article browser fallback is unavailable');
+    }
+    await page.goto(article.url);
+    await page.wait(5);
+    const result = await page.evaluate(({ maxBytes }) => {
+      const html = document.documentElement?.outerHTML ?? '';
+      const pageText = document.body?.innerText?.replace(/\s+/g, ' ').trim() ?? '';
+      const finalUrl = window.location.href;
+      const pathname = window.location.pathname;
+      const accessIssue = pathname.includes('/mp/wappoc_appmsgcaptcha')
+        || (/环境异常/.test(pageText) && /(完成验证后即可继续访问|去验证)/.test(pageText))
+        || /secitptpage\/verify\.html/.test(html)
+        || /id=["']js_verify["']/.test(html)
+        ? 'environment verification required' : '';
+      const byteLength = new TextEncoder().encode(html).byteLength;
+      return {
+        finalUrl,
+        accessIssue,
+        byteLength,
+        tooLarge: byteLength > maxBytes,
+        html: byteLength > maxBytes ? '' : html,
+      };
+    }, { maxBytes: MAX_WECHAT_HTML_BYTES });
+    if (result?.accessIssue) throw new CommandExecutionError('Article browser page requires environment verification');
+    if (!isTrustedWechatArticleUrl(result?.finalUrl)) {
+      throw new CommandExecutionError('Article browser navigation left the trusted article path');
+    }
+    if (result?.tooLarge || !Number.isSafeInteger(result?.byteLength)
+        || result.byteLength < 0 || result.byteLength > MAX_WECHAT_HTML_BYTES) {
+      throw new CommandExecutionError('Article response exceeds the allowed size');
+    }
+    if (typeof result?.html !== 'string' || result.html.length === 0) {
+      throw new CommandExecutionError('Article browser page returned no HTML');
+    }
+    if (new TextEncoder().encode(result.html).byteLength > MAX_WECHAT_HTML_BYTES) {
+      throw new CommandExecutionError('Article response exceeds the allowed size');
+    }
+    return result.html;
+  } catch (error) {
+    if (error instanceof CommandExecutionError) throw error;
+    throw new CommandExecutionError('Article browser request failed');
+  }
+}
+
+export function createArticleHtmlDownloader({
+  authSource,
+  page,
+  nodeFetcher = fetchArticleHtml,
+  browserFetcher = fetchArticleHtmlInBrowser,
+}) {
+  return async article => {
+    try {
+      return await nodeFetcher(article);
+    } catch (error) {
+      if (authSource !== 'browser') throw error;
+      return browserFetcher(article, page);
+    }
+  };
+}
+
+export const saveArticlesCommand = cli({
+  site: 'weixin', name: 'save-articles', access: 'write', domain: DOMAIN,
+  description: 'Download WeChat official-account articles as Markdown files',
+  strategy: Strategy.COOKIE, browser: browserRequired,
+  args: [
+    { name: 'fakeid', positional: true, required: true, help: 'Official-account fakeid returned by weixin accounts' }, { name: 'name', help: 'Official-account name used in Markdown metadata' },
+    { name: 'output', default: './weixin-articles', help: 'Directory for saved Markdown files' }, { name: 'limit', type: 'int', help: 'Maximum number of articles to save' },
+    { name: 'max-pages', type: 'int', help: 'Maximum number of history pages to scan' }, { name: 'auth-source', default: 'browser', choices: ['browser', 'env'], help: 'Credential source: browser session or environment variables' },
+  ],
+  columns: ['title', 'status', 'stage', 'path', 'error', 'url'],
+  func: async (page, args) => {
+    const fakeid = String(args.fakeid ?? '').trim();
+    if (!fakeid) throw new ArgumentError('fakeid is required');
+    const authSource = readAuthSource(args);
+    const credentials = authSource === 'env'
+      ? readEnvironmentCredentials(false) : await resolveBrowserCredentials(page);
+    const { fetchPage } = createWechatApi(credentials);
+    const { articles } = await collectArticles({ fakeid, fetchPage, limit: args.limit, maxPages: args['max-pages'] });
+    const articleHtmlDownloader = createArticleHtmlDownloader({ authSource, page });
+    const rows = await saveArticles({
+      articles, accountName: String(args.name ?? '').trim(),
+      outputDir: args.output ?? './weixin-articles', fetchArticleHtml: articleHtmlDownloader,
+    });
+    return rows.map(row => ({
+      title: row.title, status: row.status, stage: row.stage || null, path: row.saved || null,
+      error: row.error || null, url: row.url,
+    }));
+  },
+});

package/dist/src/daemon-config.d.ts

@@ -0,0 +1,2 @@
+export type DaemonHost = '127.0.0.1' | '0.0.0.0';
+export declare function resolveDaemonHost(env?: NodeJS.ProcessEnv): DaemonHost;

package/dist/src/daemon-config.js

@@ -0,0 +1,11 @@
+import { ConfigError } from './errors.js';
+export function resolveDaemonHost(env = process.env) {
+    const raw = env.BYCLI_DAEMON_HOST;
+    if (raw === undefined || raw === '') {
+        return '127.0.0.1';
+    }
+    if (raw === '127.0.0.1' || raw === '0.0.0.0') {
+        return raw;
+    }
+    throw new ConfigError(`config_invalid: BYCLI_DAEMON_HOST=${raw} is not allowed`, 'Use 127.0.0.1 for local use or 0.0.0.0 for an isolated sandbox.');
+}

package/dist/src/daemon-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/daemon.d.ts

@@ -17,6 +17,6 @@
  * Lifecycle:
  *   - Auto-spawned by bycli on first browser command
  *   - Persistent — stays alive until explicit shutdown, SIGTERM, or uninstall
- *   - Listens on localhost:19825
+ *   - Listens on 127.0.0.1:19825 by default; isolated sandboxes may opt into 0.0.0.0
  */
 export {};

package/dist/src/daemon.js

@@ -17,7 +17,7 @@
  * Lifecycle:
  *   - Auto-spawned by bycli on first browser command
  *   - Persistent — stays alive until explicit shutdown, SIGTERM, or uninstall
- *   - Listens on localhost:19825
+ *   - Listens on 127.0.0.1:19825 by default; isolated sandboxes may opt into 0.0.0.0
  */
 import { createServer } from 'node:http';
 import { WebSocketServer, WebSocket } from 'ws';
@@ -37,7 +37,9 @@ import { defaultSessionKeyRegistry } from './recorder/runner/session-keys.js';
 import { recordExtensionVersion } from './update-check.js';
 import { EXTENSION_CAPABILITY_MISSING_ERROR_CODE, EXTENSION_CAPABILITY_MISSING_HTTP_STATUS, extensionCapabilityHint, missingRequiredExtensionCapability, normalizeExtensionCapabilities, } from './browser/extension-capabilities.js';
 import { buildCommandDispatchFailure, buildExtensionDisconnectFailure, getResponseCorsHeaders, } from './daemon-utils.js';
+import { resolveDaemonHost } from './daemon-config.js';
 const PORT = parseInt(process.env.BYCLI_DAEMON_PORT ?? String(DEFAULT_DAEMON_PORT), 10);
+const HOST = resolveDaemonHost();
 // The verify runner (M6b) spawns child processes that connect back to THIS daemon for a
 // browser Page. Hand them our port (→ BYCLI_DAEMON_PORT in the child env) so the child's
 // Page reaches us, not a freshly-spawned daemon. Must run before the first /v1/verify
@@ -585,8 +587,8 @@ wss.on('connection', (ws) => {
     });
 });
 // ─── Start ───────────────────────────────────────────────────────────
-httpServer.listen(PORT, '127.0.0.1', () => {
-    log.info(`[daemon] Listening on http://127.0.0.1:${PORT}`);
+httpServer.listen(PORT, HOST, () => {
+    log.info(`[daemon] Listening on http://${HOST}:${PORT}`);
     // Temp-store reap policy (M7b · 09:27-29). Resolved once at startup; out-of-range env → throws,
     // but we keep the daemon alive by falling back to the (validated-elsewhere) defaults on error.
     let tempPolicy;

package/dist/src/download/article-download.d.ts

@@ -6,6 +6,7 @@
  * Flow: ArticleData → TurndownService → image download → frontmatter → .md file
  */
 import TurndownService from 'turndown';
+export { extractWechatArticleHtml } from './wechat-article.js';
 export interface ArticleData {
     title: string;
     author?: string;
@@ -49,6 +50,8 @@ export interface ArticleDownloadOptions {
      * as-is so the output is self-contained when piped.
      */
     stdout?: boolean;
+    /** Opt-in hardened Markdown rules used by HTML-focused adapters. */
+    secureMarkdown?: boolean;
 }
 export interface ArticleDownloadResult {
     title: string;
@@ -58,6 +61,9 @@ export interface ArticleDownloadResult {
     size: string;
     saved: string;
 }
+export declare function convertArticleHtmlToMarkdown(contentHtml: string, options?: {
+    safeFencedCodeBlocks?: boolean;
+}): string;
 /**
  * Download an article to Markdown with optional image localization.
  *