@sovovs/bycli 2.1.16 → 2.1.18

package/clis/weixin/collections.js

@@ -0,0 +1,66 @@
+import { ArgumentError, EmptyResultError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { collectCollections } from './_wechat/collections.js';
+
+const SAFE_REFERER = 'https://mp.weixin.qq.com/cgi-bin/appmsgalbum?action=list';
+const PAGE_SIZE = 20;
+
+const positiveSafeInteger = (value, name) => {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new ArgumentError(`${name} must be a positive safe integer`);
+  }
+  return value;
+};
+
+export const collectionsCommand = cli({
+  site: 'weixin',
+  name: 'collections',
+  access: 'read',
+  description: 'List WeChat official-account content collections',
+  domain: 'mp.weixin.qq.com',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'limit', type: 'int', default: 20, help: 'Maximum number of collections to return' },
+    { name: 'max-pages', type: 'int', default: 5, help: 'Maximum number of collection pages to scan' },
+  ],
+  columns: [
+    'collectionId', 'title', 'collectionType', 'itemCount', 'views', 'continuousRead',
+    'isUpdating', 'isBanned', 'isPaid', 'createdAt', 'updatedAt', 'coverUrl',
+  ],
+  func: async (page, args) => {
+    const limit = positiveSafeInteger(args.limit, 'limit');
+    const maxPages = positiveSafeInteger(args['max-pages'], 'max-pages');
+    const { token } = await resolveBrowserCredentials(page);
+    const rows = await collectCollections({
+      page,
+      token,
+      safeReferer: SAFE_REFERER,
+      limit,
+      pageSize: PAGE_SIZE,
+      maxPages,
+    });
+    if (rows.length === 0) {
+      throw new EmptyResultError(
+        'weixin collections',
+        'No collections were found. Create a collection in the WeChat Official Accounts dashboard first.',
+      );
+    }
+    return rows.map(row => ({
+      collectionId: row.collectionId,
+      title: row.title,
+      collectionType: row.collectionType,
+      itemCount: row.itemCount,
+      views: row.views,
+      continuousRead: row.continuousRead,
+      isUpdating: row.isUpdating,
+      isBanned: row.isBanned,
+      isPaid: row.isPaid,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt,
+      coverUrl: row.coverUrl,
+    }));
+  },
+});

package/clis/weixin/download-publish-data.js

@@ -0,0 +1,66 @@
+import { ArgumentError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { downloadPublishData } from './_wechat/publish-download.js';
+import {
+  buildDetailUrl,
+  collectPublishedRecords,
+  matchPublishedRecord,
+  positiveSafeInteger,
+  validatePublishDate,
+} from './_wechat/publish-records.js';
+
+const COLUMNS = ['title', 'published_at', 'url', 'status', 'path', 'size'];
+
+export const downloadPublishDataCommand = cli({
+  site: 'weixin',
+  name: 'download-publish-data',
+  access: 'write',
+  domain: 'mp.weixin.qq.com',
+  description: 'Match a Weixin published article and download its detail spreadsheet',
+  strategy: Strategy.INTERCEPT,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'query', positional: true, required: true, help: 'Exact article URL or title text' },
+    { name: 'date', help: 'Optional publication date in YYYY-MM-DD' },
+    { name: 'output', default: './weixin-publish-data', help: 'Directory for downloaded spreadsheets' },
+    { name: 'max-pages', type: 'int', default: 5, help: 'Maximum published-record pages to scan' },
+    { name: 'timeout', type: 'int', default: 60, help: 'Maximum seconds for capture and download' },
+  ],
+  columns: COLUMNS,
+  func: async (page, args) => {
+    const query = String(args.query ?? '').trim();
+    if (!query) throw new ArgumentError('query required');
+
+    const timeoutSeconds = positiveSafeInteger(args.timeout, 'timeout', 60);
+    const maxPages = positiveSafeInteger(args['max-pages'], 'max-pages', 5);
+    const validatedDate = validatePublishDate(args.date);
+    const scanLimit = maxPages * 10;
+    if (!Number.isSafeInteger(scanLimit)) throw new ArgumentError('max-pages is too large');
+    const { token } = await resolveBrowserCredentials(page);
+    const rows = await collectPublishedRecords(page, {
+      token,
+      limit: scanLimit,
+      maxPages,
+      timeout: timeoutSeconds,
+    });
+    const record = matchPublishedRecord(rows, query, validatedDate);
+    const detailUrl = buildDetailUrl(record, token);
+    const result = await downloadPublishData(page, {
+      detailUrl,
+      title: record.title,
+      outputDir: args.output ?? './weixin-publish-data',
+      timeoutSeconds,
+    });
+
+    return [{
+      title: record.title,
+      published_at: record.publishedAt,
+      url: record.url,
+      status: result.status,
+      path: result.path,
+      size: result.size,
+    }];
+  },
+});

package/clis/weixin/published.js

@@ -0,0 +1,72 @@
+import { EmptyResultError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { resolveBrowserCredentials } from './_wechat/auth-session.js';
+import { collectPublishedRecords, positiveSafeInteger } from './_wechat/publish-records.js';
+
+const COLUMNS = [
+  'title',
+  'published_at',
+  'url',
+  'notified',
+  'failed',
+  'reads',
+  'likes',
+  'shares',
+  'recommends',
+  'comments',
+  'underlines',
+  'reprints',
+];
+
+export const publishedCommand = cli({
+  site: 'weixin',
+  name: 'published',
+  access: 'read',
+  domain: 'mp.weixin.qq.com',
+  description: 'List Weixin published records and engagement metrics',
+  strategy: Strategy.INTERCEPT,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'query', positional: true, required: false, help: 'Optional article title or URL filter' },
+    { name: 'limit', type: 'int', default: 10, help: 'Maximum articles to return' },
+    { name: 'max-pages', type: 'int', default: 5, help: 'Maximum published-record pages to scan' },
+    { name: 'timeout', type: 'int', default: 30, help: 'Maximum seconds for request capture' },
+  ],
+  columns: COLUMNS,
+  func: async (page, args) => {
+    const limit = positiveSafeInteger(args.limit, 'limit', 10);
+    const { token } = await resolveBrowserCredentials(page);
+    const query = String(args.query ?? '').trim();
+    const maxPages = args['max-pages'] ?? 5;
+    const rows = await collectPublishedRecords(page, {
+      token,
+      limit: query ? maxPages * 10 : limit,
+      maxPages,
+      timeout: args.timeout,
+    });
+    const matched = rows.filter(row => (
+      !query || row.title.includes(query) || row.url.includes(query)
+    ));
+    if (matched.length === 0) {
+      throw new EmptyResultError(
+        'weixin published',
+        `No published record matched "${query}".`,
+      );
+    }
+    return matched.slice(0, limit).map(row => ({
+      title: row.title,
+      published_at: row.publishedAt,
+      url: row.url,
+      notified: row.notified,
+      failed: row.failed,
+      reads: row.reads,
+      likes: row.likes,
+      shares: row.shares,
+      recommends: row.recommends,
+      comments: row.comments,
+      underlines: row.underlines,
+      reprints: row.reprints,
+    }));
+  },
+});

package/dist/src/browser/base-page.d.ts

@@ -65,7 +65,8 @@ export declare abstract class BasePage implements IPage {
     /**
      * Safely evaluate JS with pre-serialized arguments.
      * Each key in `args` becomes a `const` declaration with JSON-serialized value,
-     * prepended to the JS code. Prevents injection by design.
+     * scoped to this invocation. Prevents injection and persistent-context lexical
+     * redeclarations by design.
      *
      * Usage:
      *   page.evaluateWithArgs(`(async () => { return sym; })()`, { sym: userInput })

package/dist/src/browser/base-page.js

@@ -59,6 +59,14 @@ function parseKeyChord(rawKey) {
     const key = parts.at(-1);
     return key ? { key, modifiers } : { key: rawKey, modifiers: [] };
 }
+const EVALUATE_ARG_RESERVED_WORDS = new Set([
+    'await', 'break', 'case', 'catch', 'class', 'const', 'continue', 'debugger',
+    'default', 'delete', 'do', 'else', 'enum', 'export', 'extends', 'false',
+    'finally', 'for', 'function', 'if', 'implements', 'import', 'in', 'instanceof',
+    'interface', 'let', 'new', 'null', 'package', 'private', 'protected', 'public',
+    'return', 'static', 'super', 'switch', 'this', 'throw', 'true', 'try', 'typeof',
+    'var', 'void', 'while', 'with', 'yield',
+]);
 export class BasePage {
     _lastUrl = null;
     /** Cached previous snapshot hashes for incremental diff marking */
@@ -68,7 +76,8 @@ export class BasePage {
     /**
      * Safely evaluate JS with pre-serialized arguments.
      * Each key in `args` becomes a `const` declaration with JSON-serialized value,
-     * prepended to the JS code. Prevents injection by design.
+     * scoped to this invocation. Prevents injection and persistent-context lexical
+     * redeclarations by design.
      *
      * Usage:
      *   page.evaluateWithArgs(`(async () => { return sym; })()`, { sym: userInput })
@@ -76,18 +85,19 @@ export class BasePage {
     async evaluateWithArgs(js, args) {
         const declarations = Object.entries(args)
             .map(([key, value]) => {
-            if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key)) {
+            if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) || EVALUATE_ARG_RESERVED_WORDS.has(key)) {
                 throw new Error(`evaluateWithArgs: invalid key "${key}"`);
             }
             return `const ${key} = ${JSON.stringify(value)};`;
         })
             .join('\n');
-        return this.evaluate(`${declarations}\n${js}`);
+        return this.evaluate(`{\n${declarations}\n${js}\n}`);
     }
     async fetchJson(url, opts = {}) {
         const request = {
             url,
             method: opts.method ?? 'GET',
+            referrer: opts.referrer,
             headers: opts.headers ?? {},
             body: opts.body,
             hasBody: opts.body !== undefined,
@@ -105,6 +115,7 @@ export class BasePage {
             headers,
             signal: ctrl.signal,
           };
+          if (request.referrer !== undefined) init.referrer = request.referrer;
           if (request.hasBody) {
             if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {
               headers['Content-Type'] = 'application/json';

package/dist/src/browser/page.d.ts

@@ -8,7 +8,7 @@
  * by the navigate action and pass it to all subsequent commands. This ensures
  * page-scoped operations target the correct page without guessing.
  */
-import type { BrowserCookie, BrowserDownloadWaitResult, BrowserEvaluateFunction, ScreenshotOptions } from '../types.js';
+import type { BrowserCookie, BrowserDownloadWaitOptions, BrowserDownloadWaitResult, BrowserEvaluateFunction, ScreenshotOptions } from '../types.js';
 import { BasePage } from './base-page.js';
 /**
  * Page — implements IPage by talking to the daemon via HTTP.
@@ -57,7 +57,7 @@ export declare class Page extends BasePage {
     screenshot(options?: ScreenshotOptions): Promise<string>;
     startNetworkCapture(pattern?: string): Promise<boolean>;
     readNetworkCapture(): Promise<unknown[]>;
-    waitForDownload(pattern?: string, timeoutMs?: number): Promise<BrowserDownloadWaitResult>;
+    waitForDownload(pattern?: string, timeoutMs?: number, options?: BrowserDownloadWaitOptions): Promise<BrowserDownloadWaitResult>;
     /**
      * Set local file paths on a file input element via CDP DOM.setFileInputFiles.
      * Chrome reads the files directly from the local filesystem, avoiding the

package/dist/src/browser/page.js

@@ -302,10 +302,12 @@ export class Page extends BasePage {
             return [];
         }
     }
-    async waitForDownload(pattern = '', timeoutMs = 30_000) {
+    async waitForDownload(pattern = '', timeoutMs = 30_000, options) {
         const result = await sendCommand('wait-download', {
             pattern,
             timeoutMs,
+            ...(options?.includeRecent === undefined ? {} : { includeRecent: options.includeRecent }),
+            ...(options?.startedAfterMs === undefined ? {} : { startedAfterMs: options.startedAfterMs }),
             ...this._cmdOpts(),
         });
         return result;

package/dist/src/download/article-download.js

@@ -5,6 +5,7 @@
  *
  * Flow: ArticleData → TurndownService → image download → frontmatter → .md file
  */
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import TurndownService from 'turndown';
@@ -238,11 +239,38 @@ function defaultDetectImageExt(url) {
     const extMatch = url.match(/\.(\w{3,4})(?:\?|$)/);
     return extMatch ? extMatch[1] : 'jpg';
 }
+/** Random 8-char lowercase hex segment used in downloaded image filenames. */
+function randomImageId() {
+    return crypto.randomBytes(4).toString('hex');
+}
+/**
+ * Build a collision-free `img_<8 hex>.<ext>` filename inside `imgDir`.
+ *
+ * `taken` guards against collisions between images downloaded concurrently in
+ * the same run, since those files do not exist on disk yet when the name is
+ * picked. The on-disk check covers files from earlier runs into the same dir.
+ */
+function buildImageFilename(imgDir, ext, taken) {
+    for (let attempt = 0; attempt < 10; attempt++) {
+        const filename = `img_${randomImageId()}.${ext}`;
+        if (taken.has(filename))
+            continue;
+        if (fs.existsSync(path.join(imgDir, filename)))
+            continue;
+        taken.add(filename);
+        return filename;
+    }
+    // Astronomically unlikely; fall back to a longer id rather than overwriting.
+    const filename = `img_${randomImageId()}${randomImageId()}.${ext}`;
+    taken.add(filename);
+    return filename;
+}
 async function downloadImages(imgUrls, imgDir, headers, detectExt) {
     const urlMap = {};
     if (imgUrls.length === 0)
         return urlMap;
     const detect = detectExt || defaultDetectImageExt;
+    const takenFilenames = new Set();
     // Deduplicate image URLs
     const seen = new Set();
     const uniqueUrls = imgUrls.filter(url => {
@@ -253,13 +281,12 @@ async function downloadImages(imgUrls, imgDir, headers, detectExt) {
     });
     for (let i = 0; i < uniqueUrls.length; i += IMAGE_CONCURRENCY) {
         const batch = uniqueUrls.slice(i, i + IMAGE_CONCURRENCY);
-        const results = await Promise.all(batch.map(async (rawUrl, j) => {
-            const index = i + j + 1;
+        const results = await Promise.all(batch.map(async (rawUrl) => {
             let imgUrl = rawUrl;
             if (imgUrl.startsWith('//'))
                 imgUrl = `https:${imgUrl}`;
             const ext = detect(imgUrl);
-            const filename = `img_${String(index).padStart(3, '0')}.${ext}`;
+            const filename = buildImageFilename(imgDir, ext, takenFilenames);
             const filepath = path.join(imgDir, filename);
             try {
                 const result = await httpDownload(imgUrl, filepath, {

package/dist/src/observation/redaction.js

@@ -11,6 +11,7 @@ const SENSITIVE_HEADER_NAMES = new Set([
 ]);
 const SENSITIVE_FIELD_PATTERN = /(password|passwd|pwd|token|secret|authorization|cookie|set-cookie|api[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?id|csrf|xsrf)/i;
 const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)=[^&]*/gi;
+const ENCODED_SENSITIVE_QUERY_ASSIGNMENT = /(%26(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)(?:%3D|=))(?:(?!%26|["'\s,;}&#]).)+|(\\u0026(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)(?:%3D|=))(?:(?!\\u0026|["'\s,;}&#]).)+/gi;
 function hasFingerprintFieldSegment(name) {
     return name
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -38,7 +39,8 @@ export function redactText(text, opts = {}) {
     let out = text
         .replace(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi, 'Bearer [REDACTED]')
         .replace(/(["'])(password|passwd|pwd|token|secret|fingerprint|api_key|apikey|access_token|session_id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
-        .replace(/(token|secret|fingerprint|password|api_key|apikey|access_token|session_id)\s*[=:]\s*['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
+        .replace(ENCODED_SENSITIVE_QUERY_ASSIGNMENT, (_match, percentPrefix, escapedPrefix) => `${percentPrefix ?? escapedPrefix}[REDACTED]`)
+        .replace(/(token|secret|fingerprint|password|api_key|apikey|access_token|session_id)\s*[=:]\s*(?!['"]?\[REDACTED\](?=\\u0026|%26|['"\s,;}&#]|$))['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
         .replace(/(cookie[=:]\s*)[^\n;]{3,}/gi, '$1[REDACTED]')
         .replace(/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[REDACTED_JWT]');
     if (out.length > max)

package/dist/src/types.d.ts

@@ -42,6 +42,10 @@ export interface BrowserDownloadWaitResult {
     error?: string;
     elapsedMs: number;
 }
+export interface BrowserDownloadWaitOptions {
+    includeRecent?: boolean;
+    startedAfterMs?: number;
+}
 export interface ScreenshotOptions {
     format?: 'png' | 'jpeg';
     quality?: number;
@@ -56,6 +60,7 @@ export interface ScreenshotOptions {
 }
 export interface FetchJsonOptions {
     method?: string;
+    referrer?: string;
     headers?: Record<string, string>;
     body?: unknown;
     timeoutMs?: number;
@@ -178,7 +183,7 @@ export interface IPage {
     }): Promise<any>;
     getFormState(): Promise<any>;
     wait(options: number | WaitOptions): Promise<void>;
-    waitForDownload?(pattern?: string, timeoutMs?: number): Promise<BrowserDownloadWaitResult>;
+    waitForDownload?(pattern?: string, timeoutMs?: number, options?: BrowserDownloadWaitOptions): Promise<BrowserDownloadWaitResult>;
     tabs(): Promise<any>;
     closeTab?(target?: number | string): Promise<void>;
     newTab?(url?: string): Promise<string | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.16",
+  "version": "2.1.18",
   "publishConfig": {
     "access": "public"
   },

package/dist/src/browser/extension-version-metadata.test.d.ts

@@ -1 +0,0 @@
-export {};