@sovovs/bycli 2.1.62 → 2.1.65

package/cli-manifest.json

@@ -30243,6 +30243,251 @@
     "sourceFile": "weixin/user-info.js",
     "navigateBefore": false
   },
+  {
+    "site": "weixin-channels",
+    "name": "overview",
+    "description": "读取视频号账号概览：所选日期内播放、推荐、喜欢、评论、分享和新增关注，默认昨日",
+    "access": "read",
+    "domain": "channels.weixin.qq.com",
+    "strategy": "cookie",
+    "browser": true,
+    "args": [
+      {
+        "name": "days",
+        "type": "int",
+        "required": false,
+        "valueRequired": true,
+        "help": "截至上海昨日的天数（默认 1）；不可与自定义日期同时使用"
+      },
+      {
+        "name": "start-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "开始日期 YYYY-MM-DD（包含），须同时提供 --end-date"
+      },
+      {
+        "name": "end-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "结束日期 YYYY-MM-DD（包含），最晚为上海昨日"
+      }
+    ],
+    "columns": [
+      "start_date",
+      "end_date",
+      "views",
+      "recommendations",
+      "likes",
+      "comments",
+      "shares",
+      "follows"
+    ],
+    "type": "js",
+    "modulePath": "weixin-channels/overview.js",
+    "sourceFile": "weixin-channels/overview.js",
+    "navigateBefore": false
+  },
+  {
+    "site": "weixin-channels",
+    "name": "post-detail",
+    "description": "读取单条视频号作品的概览、趋势、来源和留存，默认最近 7 天；建议使用 --format json",
+    "access": "read",
+    "domain": "channels.weixin.qq.com",
+    "strategy": "cookie",
+    "browser": true,
+    "args": [
+      {
+        "name": "id",
+        "type": "str",
+        "required": true,
+        "positional": true,
+        "help": "posts 返回的作品 ID（objectId），按数字字符串原样传入"
+      },
+      {
+        "name": "days",
+        "type": "int",
+        "required": false,
+        "valueRequired": true,
+        "help": "截至上海昨日的统计天数（默认 7）；不可与自定义日期同时使用"
+      },
+      {
+        "name": "start-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "统计开始日期 YYYY-MM-DD（包含），须同时提供 --end-date"
+      },
+      {
+        "name": "end-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "统计结束日期 YYYY-MM-DD（包含），最晚为上海昨日"
+      }
+    ],
+    "columns": [
+      "id",
+      "start_date",
+      "end_date",
+      "overview",
+      "trend",
+      "sources",
+      "retention"
+    ],
+    "type": "js",
+    "modulePath": "weixin-channels/post-detail.js",
+    "sourceFile": "weixin-channels/post-detail.js",
+    "navigateBefore": false
+  },
+  {
+    "site": "weixin-channels",
+    "name": "posts",
+    "description": "列出所选发布时间内的视频号作品及后台累计指标，默认最近 30 天，最多 20 条",
+    "access": "read",
+    "domain": "channels.weixin.qq.com",
+    "strategy": "cookie",
+    "browser": true,
+    "args": [
+      {
+        "name": "days",
+        "type": "int",
+        "required": false,
+        "valueRequired": true,
+        "help": "截至上海昨日的发布时间天数（默认 30）；不可与自定义日期同时使用"
+      },
+      {
+        "name": "start-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "作品发布时间起始日期 YYYY-MM-DD（包含），须同时提供 --end-date"
+      },
+      {
+        "name": "end-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "作品发布时间结束日期 YYYY-MM-DD（包含），最晚为上海昨日"
+      },
+      {
+        "name": "limit",
+        "type": "int",
+        "default": 20,
+        "required": false,
+        "valueRequired": true,
+        "help": "最多返回的作品数（1–1000 的整数，默认 20）"
+      }
+    ],
+    "columns": [
+      "id",
+      "title",
+      "published_at",
+      "views",
+      "recommendations",
+      "likes",
+      "comments",
+      "shares",
+      "follows",
+      "completion_rate",
+      "avg_play_seconds"
+    ],
+    "type": "js",
+    "modulePath": "weixin-channels/posts.js",
+    "sourceFile": "weixin-channels/posts.js",
+    "navigateBefore": false
+  },
+  {
+    "site": "weixin-channels",
+    "name": "sources",
+    "description": "按视频号后台返回的来源统计账号指标，默认最近 7 天，截至昨日",
+    "access": "read",
+    "domain": "channels.weixin.qq.com",
+    "strategy": "cookie",
+    "browser": true,
+    "args": [
+      {
+        "name": "days",
+        "type": "int",
+        "required": false,
+        "valueRequired": true,
+        "help": "截至上海昨日的天数（默认 7）；不可与自定义日期同时使用"
+      },
+      {
+        "name": "start-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "开始日期 YYYY-MM-DD（包含），须同时提供 --end-date"
+      },
+      {
+        "name": "end-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "结束日期 YYYY-MM-DD（包含），最晚为上海昨日"
+      }
+    ],
+    "columns": [
+      "source",
+      "views",
+      "recommendations",
+      "likes",
+      "comments",
+      "shares",
+      "follows"
+    ],
+    "type": "js",
+    "modulePath": "weixin-channels/sources.js",
+    "sourceFile": "weixin-channels/sources.js",
+    "navigateBefore": false
+  },
+  {
+    "site": "weixin-channels",
+    "name": "trend",
+    "description": "读取视频号账号逐日指标趋势，默认最近 7 天，截至昨日",
+    "access": "read",
+    "domain": "channels.weixin.qq.com",
+    "strategy": "cookie",
+    "browser": true,
+    "args": [
+      {
+        "name": "days",
+        "type": "int",
+        "required": false,
+        "valueRequired": true,
+        "help": "截至上海昨日的天数（默认 7）；不可与自定义日期同时使用"
+      },
+      {
+        "name": "start-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "开始日期 YYYY-MM-DD（包含），须同时提供 --end-date"
+      },
+      {
+        "name": "end-date",
+        "type": "str",
+        "required": false,
+        "valueRequired": true,
+        "help": "结束日期 YYYY-MM-DD（包含），最晚为上海昨日"
+      }
+    ],
+    "columns": [
+      "date",
+      "views",
+      "recommendations",
+      "likes",
+      "comments",
+      "shares",
+      "follows"
+    ],
+    "type": "js",
+    "modulePath": "weixin-channels/trend.js",
+    "sourceFile": "weixin-channels/trend.js",
+    "navigateBefore": false
+  },
   {
     "site": "weread",
     "name": "ai-outline",

package/clis/weixin-channels/_shared/client.js

@@ -0,0 +1,155 @@
+import { ArgumentError, AuthRequiredError, CommandExecutionError, TimeoutError } from '@sovovs/bycli/errors';
+import { randomUUID } from 'node:crypto';
+
+const DOMAIN = 'channels.weixin.qq.com';
+const PAGE_URL = `https://${DOMAIN}/platform/statistic/post`;
+const API_PREFIX = `/micro/statistic/cgi-bin/mmfinderassistant-bin/statistic/`;
+const POLL_ATTEMPTS = 40;
+const POLL_SECONDS = 0.25;
+const AUTH_FIELDS = ['timestamp', '_log_finder_uin', '_log_finder_id', 'rawKeyBuff', 'pluginSessionId', 'scene', 'reqScene'];
+
+function requireData(status, body, endpoint) {
+  if (status === 401 || status === 403 || body?.errCode === 401 || body?.errCode === 403
+    || (body?.errCode !== 0 && /登录|not.?logged|login|session.*expired/i.test(String(body?.errMsg ?? '')))) {
+    throw new AuthRequiredError(DOMAIN);
+  }
+  // The service returns HTTP 201 for successful read-only queries.
+  if (!Number.isInteger(status) || status < 200 || status >= 300 || !body || body.errCode !== 0
+    || !body.data || typeof body.data !== 'object' || Array.isArray(body.data)) {
+    throw new CommandExecutionError(`weixin-channels ${endpoint}: invalid API response (HTTP ${Number(status) || 0}, code ${Number(body?.errCode) || 0})`);
+  }
+  return body.data;
+}
+
+function parseObject(text) {
+  try {
+    const value = JSON.parse(text);
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+  } catch { return null; }
+}
+
+async function isLoginPage(page) {
+  return await page.evaluate(`(() => {
+    return /\\/login(?:\\/|$)/i.test(window.location.pathname)
+      || /扫码登录|扫描二维码登录|登录视频号助手|Log in/i.test(document.body?.innerText || '');
+  })()`);
+}
+
+/** Capture a fresh page request. Credentials are never returned by public helpers. */
+async function bootstrap(page) {
+  if (typeof page?.startNetworkCapture !== 'function' || typeof page?.readNetworkCapture !== 'function') {
+    throw new CommandExecutionError('weixin-channels requires Browser Bridge network capture', 'Update the byCLI browser extension and log in to 视频号助手.');
+  }
+  if (await page.startNetworkCapture('/statistic/') === false) {
+    throw new CommandExecutionError('weixin-channels network capture is unavailable', 'Update the byCLI browser extension.');
+  }
+  // A retained tab already at PAGE_URL hits the bridge's no-navigation fast
+  // path. A harmless query nonce guarantees a guarded, fresh page request.
+  await page.goto(`${PAGE_URL}?bycli_capture=${randomUUID()}`, { stealth: false });
+  for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
+    const captures = await page.readNetworkCapture();
+    for (const entry of captures) {
+      let url;
+      try { url = new URL(entry.url); } catch { continue; }
+      if (url.protocol !== 'https:' || url.hostname !== DOMAIN || url.pathname !== `${API_PREFIX}new_post_total_data`) continue;
+      if (entry.requestBodyTruncated || entry.responseBodyTruncated) {
+        throw new CommandExecutionError('weixin-channels bootstrap capture was truncated');
+      }
+      // Capture reads drain pending requests too. The complete request body is
+      // enough to bootstrap; our own API response will verify the session.
+      if (entry.responsePreview) requireData(entry.responseStatus, parseObject(entry.responsePreview), 'session');
+      const request = parseObject(entry.requestBodyPreview);
+      // Cookie-authenticated sessions legitimately send an empty rawKeyBuff
+      // and a null pluginSessionId. Preserve the template without inventing auth.
+      if (!request || typeof request.rawKeyBuff !== 'string') {
+        throw new CommandExecutionError('weixin-channels session request is unavailable', 'Reload 视频号助手 and retry.');
+      }
+      return Object.fromEntries(AUTH_FIELDS.filter(key => key in request).map(key => [key, request[key]]));
+    }
+    if (await isLoginPage(page)) throw new AuthRequiredError(DOMAIN);
+    await page.wait(POLL_SECONDS);
+  }
+  throw new TimeoutError('weixin-channels session capture', POLL_ATTEMPTS * POLL_SECONDS, 'Open 视频号助手 in Chrome, finish login, and retry.');
+}
+
+async function request(page, auth, endpoint, params) {
+  const url = `https://${DOMAIN}${API_PREFIX}${endpoint}`;
+  const body = JSON.stringify({ ...auth, ...params, timestamp: String(Date.now()) });
+  // The statistic app is a same-origin iframe. Use its fetch implementation and
+  // referrer, while keeping credentials and raw session fields inside the browser.
+  let response;
+  try {
+    response = await page.evaluate(`(async () => {
+      if (window.location.hostname !== ${JSON.stringify(DOMAIN)}) return { status: 401 };
+      const frame = document.querySelector('iframe');
+      const context = frame?.contentWindow || window;
+      if (context.location.hostname !== ${JSON.stringify(DOMAIN)}) return { status: 401 };
+      try {
+        const response = await context.fetch(${JSON.stringify(url)}, {
+          method: 'POST', credentials: 'include',
+          headers: { 'Content-Type': 'application/json' },
+          body: ${JSON.stringify(body)},
+        });
+        let parsed;
+        try { parsed = await response.json(); } catch { return { status: response.status }; }
+        return { status: response.status, body: parsed };
+      } catch { return { status: 0 }; }
+    })()`);
+  } catch {
+    // Transport exceptions may include the script (and session fields).
+    throw new CommandExecutionError(`weixin-channels ${endpoint}: browser request failed`, 'Reload 视频号助手 and retry.');
+  }
+  return requireData(response?.status, response?.body, endpoint);
+}
+
+function periodParams(range) {
+  return { startTs: String(range.startTs), endTs: String(range.endTs), interval: 3 };
+}
+
+export async function fetchTotalData(page, range) {
+  const auth = await bootstrap(page);
+  return request(page, auth, 'new_post_total_data', periodParams(range));
+}
+
+export async function fetchPosts(page, range, limit = 20) {
+  if (!Number.isInteger(limit) || limit < 1 || limit > 1000) {
+    throw new ArgumentError('--limit must be an integer between 1 and 1000');
+  }
+  const auth = await bootstrap(page);
+  const rows = [], seen = new Set();
+  let expected;
+  for (let currentPage = 1; currentPage <= Math.ceil(limit / 10); currentPage += 1) {
+    const data = await request(page, auth, 'post_list', {
+      pageSize: 10, currentPage, sort: 0, order: 0,
+      startTime: range.startTs, endTime: range.endTs + 86400,
+    });
+    if (!Array.isArray(data.list) || !Number.isSafeInteger(data.totalCount) || data.totalCount < 0) {
+      throw new CommandExecutionError('weixin-channels post_list: unexpected list response');
+    }
+    if (expected === undefined) expected = Math.min(data.totalCount, limit);
+    if (expected === 0 && data.list.length === 0) return [];
+    const before = rows.length;
+    for (const row of data.list) {
+      if (typeof row?.objectId !== 'string' || !/^\d+$/.test(row.objectId)) {
+        throw new CommandExecutionError('weixin-channels post_list: video id is unavailable');
+      }
+      if (!seen.has(row.objectId)) { seen.add(row.objectId); rows.push(row); }
+    }
+    if (rows.length >= expected) return rows.slice(0, expected);
+    if (rows.length === before || data.list.length < 10) {
+      throw new CommandExecutionError('weixin-channels post_list: incomplete pagination', 'Retry after the video list finishes updating.');
+    }
+  }
+  throw new CommandExecutionError('weixin-channels post_list: incomplete pagination');
+}
+
+export async function fetchPostDetail(page, id, range) {
+  if (typeof id !== 'string' || !/^\d+$/.test(id)) throw new ArgumentError('--id must be a video id string');
+  const auth = await bootstrap(page);
+  const data = await request(page, auth, 'feed_aggreagate_data_by_tab_type', { ...periodParams(range), feedId: id });
+  const retention = await request(page, auth, 'get_feed_lost_rate', { feedId: id });
+  if (retention.baseResp && retention.baseResp.errcode !== 0) {
+    throw new CommandExecutionError('weixin-channels get_feed_lost_rate: retention unavailable');
+  }
+  return { data, retention };
+}

package/clis/weixin-channels/_shared/model.js

@@ -0,0 +1,255 @@
+import { ArgumentError, CommandExecutionError } from '@sovovs/bycli/errors';
+
+const DAY_MS = 86_400_000;
+const SHANGHAI_OFFSET_MS = 8 * 60 * 60 * 1000;
+const DAILY_METRICS = {
+    views: 'browse',
+    recommendations: 'like',
+    likes: 'fav',
+    comments: 'comment',
+    shares: 'forwardAggregation',
+    follows: 'follow',
+};
+// Daily engagement is added actions minus cancellations or deletions.
+const DAILY_NET_METRICS = new Set(['like', 'fav', 'comment', 'follow']);
+const POST_COUNTERS = {
+    views: 'readCount',
+    recommendations: 'likeCount',
+    likes: 'favCount',
+    comments: 'commentCount',
+    shares: 'forwardAggregationCount',
+    follows: 'followCount',
+    chat_shares: 'forwardCount',
+    ringtone_sets: 'ringsetCount',
+    status_sets: 'statusrefCount',
+    cover_sets: 'snscoverCount',
+    wecom_link_clicks: 'wecomLinkClickCount',
+    wecom_link_visitors: 'wecomLinkClickUv',
+    wecom_contact_adds: 'wecomContactAddCount',
+    wecom_contact_visitors: 'wecomContactAddUv',
+};
+
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function calendarDateMs(value, label) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+        throw new ArgumentError(`${label} must be YYYY-MM-DD`);
+    }
+    const ms = Date.parse(`${value}T00:00:00Z`);
+    if (!Number.isFinite(ms) || new Date(ms).toISOString().slice(0, 10) !== value) {
+        throw new ArgumentError(`${label} must be a valid calendar date`);
+    }
+    return ms;
+}
+
+function positiveDays(value) {
+    const validType = typeof value === 'number' || (typeof value === 'string' && /^\d+$/.test(value));
+    const days = validType ? Number(value) : NaN;
+    if (!Number.isSafeInteger(days) || days < 1 || days > 366) {
+        throw new ArgumentError('--days must be an integer between 1 and 366');
+    }
+    return days;
+}
+
+/** Inclusive dates, expressed as Shanghai midnight Unix seconds. */
+export function resolveDateRange(args = {}, now = new Date(), defaultDays = 7) {
+    if (!isRecord(args) || !(now instanceof Date) || !Number.isFinite(now.getTime())) {
+        throw new ArgumentError('Invalid date range arguments');
+    }
+    const today = new Date(now.getTime() + SHANGHAI_OFFSET_MS).toISOString().slice(0, 10);
+    const todayMs = calendarDateMs(today, 'today');
+    const hasStart = args['start-date'] !== undefined;
+    const hasEnd = args['end-date'] !== undefined;
+    const hasDays = args.days !== undefined;
+    if (hasStart !== hasEnd) {
+        throw new ArgumentError('--start-date and --end-date must be supplied together');
+    }
+    if (hasDays && hasStart) {
+        throw new ArgumentError('--days cannot be combined with --start-date and --end-date');
+    }
+
+    let startMs;
+    let endMs;
+    let days;
+    if (hasStart) {
+        startMs = calendarDateMs(args['start-date'], '--start-date');
+        endMs = calendarDateMs(args['end-date'], '--end-date');
+        if (startMs > endMs) throw new ArgumentError('--start-date must not be after --end-date');
+        if (endMs >= todayMs) throw new ArgumentError('--end-date must be before today in Asia/Shanghai');
+        days = (endMs - startMs) / DAY_MS + 1;
+        if (days > 366) throw new ArgumentError('The date range must not exceed 366 days');
+    } else {
+        days = positiveDays(hasDays ? args.days : defaultDays);
+        endMs = todayMs - DAY_MS;
+        startMs = endMs - (days - 1) * DAY_MS;
+    }
+    return {
+        startDate: new Date(startMs).toISOString().slice(0, 10),
+        endDate: new Date(endMs).toISOString().slice(0, 10),
+        days,
+        startTs: (startMs - SHANGHAI_OFFSET_MS) / 1000,
+        endTs: (endMs - SHANGHAI_OFFSET_MS) / 1000,
+    };
+}
+
+function counter(value, label, optional = true, allowNegative = false) {
+    if (optional && (value === undefined || value === null)) return null;
+    const numberString = allowNegative ? /^-?\d+$/ : /^\d+$/;
+    const validType = typeof value === 'number' || (typeof value === 'string' && numberString.test(value));
+    const number = validType ? Number(value) : NaN;
+    if (!Number.isSafeInteger(number) || (!allowNegative && number < 0)) {
+        throw new CommandExecutionError(`Weixin Channels returned an invalid ${label} count`);
+    }
+    return number;
+}
+
+function decimalMetric(value, label, optional = true) {
+    if (optional && (value === undefined || value === null)) return null;
+    const validType = typeof value === 'number'
+        || (typeof value === 'string' && /^\d+(?:\.\d+)?$/.test(value));
+    const number = validType ? Number(value) : NaN;
+    if (!Number.isFinite(number) || number < 0 || number > Number.MAX_SAFE_INTEGER) {
+        throw new CommandExecutionError(`Weixin Channels returned an invalid ${label} metric`);
+    }
+    return number;
+}
+
+function roundTwo(value) {
+    return value === null ? null : Math.round((value + Number.EPSILON) * 100) / 100;
+}
+
+function percentage(value, label, optional = true) {
+    const ratio = decimalMetric(value, label, optional);
+    if (ratio === null) return null;
+    if (ratio > 1) throw new CommandExecutionError(`Weixin Channels returned an invalid ${label} ratio`);
+    return roundTwo(ratio * 100);
+}
+
+function dailySeries(data, range) {
+    if (!isRecord(data) || (data.totalData != null && !isRecord(data.totalData))) {
+        throw new CommandExecutionError('Weixin Channels returned malformed daily metrics');
+    }
+    const metrics = data.totalData ?? {};
+    return Object.fromEntries(Object.entries(DAILY_METRICS).map(([name, key]) => {
+        const values = metrics[key];
+        if (values === undefined || values === null) return [name, null];
+        if (!Array.isArray(values) || (values.length !== 0 && values.length !== range.days)) {
+            throw new CommandExecutionError(`Weixin Channels returned an unexpected ${key} series length`);
+        }
+        if (!values.length) return [name, null];
+        return [name, Array.from(values, (value) => counter(value, key, false, DAILY_NET_METRICS.has(key)))];
+    }));
+}
+
+/** API like = heart/recommendation; API fav = thumb/like. */
+export function normalizeTrend(data, range) {
+    const series = dailySeries(data, range);
+    const startMs = Date.parse(`${range.startDate}T00:00:00Z`);
+    return Array.from({ length: range.days }, (_, index) => ({
+        date: new Date(startMs + index * DAY_MS).toISOString().slice(0, 10),
+        ...Object.fromEntries(Object.entries(series).map(([name, values]) => [name, values === null ? null : values[index]])),
+    }));
+}
+
+export function normalizeOverview(data, range) {
+    const series = dailySeries(data, range);
+    return {
+        start_date: range.startDate,
+        end_date: range.endDate,
+        ...Object.fromEntries(Object.entries(series).map(([name, values]) => {
+            if (values === null) return [name, null];
+            // Exact addition also preserves safe results after large signed changes cancel.
+            const sum = Number(values.reduce((total, value) => total + BigInt(value), 0n));
+            if (!Number.isSafeInteger(sum)) {
+                throw new CommandExecutionError(`Weixin Channels returned an unsafe ${name} total`);
+            }
+            return [name, sum];
+        })),
+    };
+}
+
+export function normalizeSources(data, range) {
+    if (!isRecord(data) || !Array.isArray(data.dataByTabtype)) {
+        throw new CommandExecutionError('Weixin Channels returned malformed source metrics');
+    }
+    return data.dataByTabtype.map((item) => {
+        if (!isRecord(item) || item.tabType == null || typeof item.tabTypeName !== 'string' || !isRecord(item.data)) {
+            throw new CommandExecutionError('Weixin Channels returned a source without its identity or metrics');
+        }
+        if (typeof item.tabType !== 'string' && !(Number.isSafeInteger(item.tabType) && item.tabType >= 0)) {
+            throw new CommandExecutionError('Weixin Channels returned an invalid source identity');
+        }
+        return {
+            ...normalizeOverview({ totalData: item.data }, range),
+            source_id: item.tabType,
+            source: item.tabTypeName,
+        };
+    });
+}
+
+function postId(value) {
+    if (typeof value === 'string' && value.trim()) return value;
+    if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0) return String(value);
+    throw new CommandExecutionError('Weixin Channels returned a post without a stable objectId');
+}
+
+function publishedAt(value) {
+    const seconds = counter(value, 'createTime');
+    if (seconds === null) return null;
+    const ms = seconds * 1000 + SHANGHAI_OFFSET_MS;
+    if (!Number.isFinite(ms) || Math.abs(ms) > 8.64e15) {
+        throw new CommandExecutionError('Weixin Channels returned an invalid createTime timestamp');
+    }
+    return `${new Date(ms).toISOString().slice(0, 19)}+08:00`;
+}
+
+export function normalizePost(item) {
+    if (!isRecord(item)) throw new CommandExecutionError('Weixin Channels returned a malformed post');
+    const title = typeof item.desc === 'string' ? item.desc
+        : (typeof item.desc?.description === 'string' ? item.desc.description : '');
+    return {
+        id: postId(item.objectId),
+        title,
+        published_at: publishedAt(item.createTime),
+        ...Object.fromEntries(Object.entries(POST_COUNTERS).map(([name, key]) => [name, counter(item[key], key)])),
+        // The verified API unit is a 0..1 ratio; business output uses percent.
+        completion_rate: percentage(item.fullPlayRate, 'fullPlayRate'),
+        avg_play_seconds: roundTwo(decimalMetric(item.avgPlayTimeSec, 'avgPlayTimeSec')),
+    };
+}
+
+function normalizeRetention(data) {
+    if (!isRecord(data) || !Array.isArray(data.items)) {
+        throw new CommandExecutionError('Weixin Channels returned malformed retention metrics');
+    }
+    return {
+        video_seconds: counter(data.videoLen, 'videoLen', false),
+        max_loss_second: counter(data.maxLostRateSec, 'maxLostRateSec', false),
+        points: Array.from(data.items, (item) => {
+            if (!isRecord(item)) throw new CommandExecutionError('Weixin Channels returned a malformed retention point');
+            return {
+                second: counter(item.sec, 'retention second', false),
+                retained_pct: percentage(item.rate, 'retention', false),
+            };
+        }),
+    };
+}
+
+export function normalizeDetail(data, retention, id, range) {
+    if (!isRecord(data) || !Array.isArray(data.feedData) || data.feedData.length !== 1 || !isRecord(data.feedData[0])) {
+        throw new CommandExecutionError('Weixin Channels returned an unexpected single-post detail payload');
+    }
+    const feed = data.feedData[0];
+    return {
+        id: postId(id),
+        start_date: range.startDate,
+        end_date: range.endDate,
+        overview: normalizeOverview(feed, range),
+        trend: normalizeTrend(feed, range),
+        sources: normalizeSources(feed, range),
+        retention: normalizeRetention(retention),
+        fans_breakdown_available: !data.notExistFansData,
+    };
+}

package/clis/weixin-channels/overview.js

@@ -0,0 +1,25 @@
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { fetchTotalData } from './_shared/client.js';
+import { normalizeOverview, resolveDateRange } from './_shared/model.js';
+
+export const overviewCommand = cli({
+  site: 'weixin-channels',
+  name: 'overview',
+  access: 'read',
+  domain: 'channels.weixin.qq.com',
+  description: '读取视频号账号概览：所选日期内播放、推荐、喜欢、评论、分享和新增关注，默认昨日',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'days', type: 'int', valueRequired: true, help: '截至上海昨日的天数（默认 1）；不可与自定义日期同时使用' },
+    { name: 'start-date', type: 'str', valueRequired: true, help: '开始日期 YYYY-MM-DD（包含），须同时提供 --end-date' },
+    { name: 'end-date', type: 'str', valueRequired: true, help: '结束日期 YYYY-MM-DD（包含），最晚为上海昨日' },
+  ],
+  columns: ['start_date', 'end_date', 'views', 'recommendations', 'likes', 'comments', 'shares', 'follows'],
+  func: async (page, args = {}) => {
+    const range = resolveDateRange(args, new Date(), 1);
+    const data = await fetchTotalData(page, range);
+    return [normalizeOverview(data, range)];
+  },
+});

package/clis/weixin-channels/post-detail.js

@@ -0,0 +1,31 @@
+import { ArgumentError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { fetchPostDetail } from './_shared/client.js';
+import { normalizeDetail, resolveDateRange } from './_shared/model.js';
+
+export const postDetailCommand = cli({
+  site: 'weixin-channels',
+  name: 'post-detail',
+  access: 'read',
+  domain: 'channels.weixin.qq.com',
+  description: '读取单条视频号作品的概览、趋势、来源和留存，默认最近 7 天；建议使用 --format json',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'id', type: 'str', required: true, positional: true, help: 'posts 返回的作品 ID（objectId），按数字字符串原样传入' },
+    { name: 'days', type: 'int', valueRequired: true, help: '截至上海昨日的统计天数（默认 7）；不可与自定义日期同时使用' },
+    { name: 'start-date', type: 'str', valueRequired: true, help: '统计开始日期 YYYY-MM-DD（包含），须同时提供 --end-date' },
+    { name: 'end-date', type: 'str', valueRequired: true, help: '统计结束日期 YYYY-MM-DD（包含），最晚为上海昨日' },
+  ],
+  columns: ['id', 'start_date', 'end_date', 'overview', 'trend', 'sources', 'retention'],
+  func: async (page, args = {}) => {
+    const id = args.id;
+    if (typeof id !== 'string' || !/^\d+$/.test(id)) {
+      throw new ArgumentError('作品 ID 必须是非空的数字字符串', '请复制 weixin-channels posts 返回的 id，保留完整数字');
+    }
+    const range = resolveDateRange(args, new Date(), 7);
+    const { data, retention } = await fetchPostDetail(page, id, range);
+    return [normalizeDetail(data, retention, id, range)];
+  },
+});

package/clis/weixin-channels/posts.js

@@ -0,0 +1,34 @@
+import { ArgumentError } from '@sovovs/bycli/errors';
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { fetchPosts } from './_shared/client.js';
+import { normalizePost, resolveDateRange } from './_shared/model.js';
+
+export const postsCommand = cli({
+  site: 'weixin-channels',
+  name: 'posts',
+  access: 'read',
+  domain: 'channels.weixin.qq.com',
+  description: '列出所选发布时间内的视频号作品及后台累计指标，默认最近 30 天，最多 20 条',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'days', type: 'int', valueRequired: true, help: '截至上海昨日的发布时间天数（默认 30）；不可与自定义日期同时使用' },
+    { name: 'start-date', type: 'str', valueRequired: true, help: '作品发布时间起始日期 YYYY-MM-DD（包含），须同时提供 --end-date' },
+    { name: 'end-date', type: 'str', valueRequired: true, help: '作品发布时间结束日期 YYYY-MM-DD（包含），最晚为上海昨日' },
+    { name: 'limit', type: 'int', valueRequired: true, default: 20, help: '最多返回的作品数（1–1000 的整数，默认 20）' },
+  ],
+  columns: [
+    'id', 'title', 'published_at', 'views', 'recommendations', 'likes', 'comments',
+    'shares', 'follows', 'completion_rate', 'avg_play_seconds',
+  ],
+  func: async (page, args = {}) => {
+    const range = resolveDateRange(args, new Date(), 30);
+    const limit = args.limit ?? 20;
+    if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 1000) {
+      throw new ArgumentError('--limit 必须是 1–1000 的整数');
+    }
+    const items = await fetchPosts(page, range, limit);
+    return items.map(normalizePost);
+  },
+});

package/clis/weixin-channels/sources.js

@@ -0,0 +1,25 @@
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { fetchTotalData } from './_shared/client.js';
+import { normalizeSources, resolveDateRange } from './_shared/model.js';
+
+export const sourcesCommand = cli({
+  site: 'weixin-channels',
+  name: 'sources',
+  access: 'read',
+  domain: 'channels.weixin.qq.com',
+  description: '按视频号后台返回的来源统计账号指标，默认最近 7 天，截至昨日',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'days', type: 'int', valueRequired: true, help: '截至上海昨日的天数（默认 7）；不可与自定义日期同时使用' },
+    { name: 'start-date', type: 'str', valueRequired: true, help: '开始日期 YYYY-MM-DD（包含），须同时提供 --end-date' },
+    { name: 'end-date', type: 'str', valueRequired: true, help: '结束日期 YYYY-MM-DD（包含），最晚为上海昨日' },
+  ],
+  columns: ['source', 'views', 'recommendations', 'likes', 'comments', 'shares', 'follows'],
+  func: async (page, args = {}) => {
+    const range = resolveDateRange(args, new Date(), 7);
+    const data = await fetchTotalData(page, range);
+    return normalizeSources(data, range);
+  },
+});

package/clis/weixin-channels/trend.js

@@ -0,0 +1,25 @@
+import { cli, Strategy } from '@sovovs/bycli/registry';
+import { fetchTotalData } from './_shared/client.js';
+import { normalizeTrend, resolveDateRange } from './_shared/model.js';
+
+export const trendCommand = cli({
+  site: 'weixin-channels',
+  name: 'trend',
+  access: 'read',
+  domain: 'channels.weixin.qq.com',
+  description: '读取视频号账号逐日指标趋势，默认最近 7 天，截至昨日',
+  strategy: Strategy.COOKIE,
+  browser: true,
+  navigateBefore: false,
+  args: [
+    { name: 'days', type: 'int', valueRequired: true, help: '截至上海昨日的天数（默认 7）；不可与自定义日期同时使用' },
+    { name: 'start-date', type: 'str', valueRequired: true, help: '开始日期 YYYY-MM-DD（包含），须同时提供 --end-date' },
+    { name: 'end-date', type: 'str', valueRequired: true, help: '结束日期 YYYY-MM-DD（包含），最晚为上海昨日' },
+  ],
+  columns: ['date', 'views', 'recommendations', 'likes', 'comments', 'shares', 'follows'],
+  func: async (page, args = {}) => {
+    const range = resolveDateRange(args, new Date(), 7);
+    const data = await fetchTotalData(page, range);
+    return normalizeTrend(data, range);
+  },
+});

package/dist/src/browser/stealth.js

@@ -180,15 +180,9 @@ export function generateStealthJs() {
         return fn;
       };
 
-      // 8. Anti-debugger statement trap
-      //    Sites inject debugger statements to detect DevTools/CDP.
-      //    When a CDP debugger is attached, the statement pauses execution
-      //    and the site measures the time gap to confirm automation.
-      //    We neutralize this by overriding the Function constructor and
-      //    eval to strip debugger statements from dynamically created code.
-      //    Note: this does NOT affect static debugger statements in parsed
-      //    scripts — those require CDP Debugger.setBreakpointsActive(false)
-      //    which we handle at the extension level.
+      // 8. Strip debugger statements from dynamically created Function bodies.
+      //    Native eval must remain intact to preserve the caller's lexical scope.
+      //    This does not remove debugger statements from eval or static scripts.
       //    Caveat: the regex targets standalone debugger statements (preceded
       //    by a statement boundary) to minimise false positives inside string
       //    literals, but cannot perfectly distinguish all cases without a
@@ -218,13 +212,8 @@ export function generateStealthJs() {
         _disguise(_PatchedFunction, 'Function');
         try { window.Function = _PatchedFunction; } catch {}
 
-        // Patch eval to strip debugger
-        const _origEval = window.eval;
-        const _patchedEval = function(code) {
-          return _origEval.call(this, _cleanDebugger(code));
-        };
-        _disguise(_patchedEval, 'eval');
-        try { window.eval = _patchedEval; } catch {}
+        // Keep native eval: wrapping it changes direct eval to indirect eval,
+        // losing the caller's lexical scope and strict-mode behavior.
       } catch {}
 
       // 9. Console method fingerprinting defense

package/dist/src/observation/redaction.js

@@ -9,9 +9,9 @@ const SENSITIVE_HEADER_NAMES = new Set([
     'x-csrf-token',
     'x-xsrf-token',
 ]);
-const SENSITIVE_FIELD_PATTERN = /(password|passwd|pwd|token|secret|authorization|cookie|set-cookie|api[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?id|csrf|xsrf)/i;
-const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)=[^&]*/gi;
-const ENCODED_SENSITIVE_QUERY_ASSIGNMENT = /(%26(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)(?:%3D|=))(?:(?!%26|["'\s,;}&#]).)+|(\\u0026(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)(?:%3D|=))(?:(?!\\u0026|["'\s,;}&#]).)+/gi;
+const SENSITIVE_FIELD_PATTERN = /(password|passwd|pwd|token|secret|authorization|cookie|set-cookie|api[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?id|csrf|xsrf|^raw[_-]?key[_-]?buff$|^plugin[_-]?session[_-]?id$)/i;
+const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf|raw[_-]?key[_-]?buff|plugin[_-]?session[_-]?id)=[^&]*/gi;
+const ENCODED_SENSITIVE_QUERY_ASSIGNMENT = /(%26(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf|raw[_-]?key[_-]?buff|plugin[_-]?session[_-]?id)(?:%3D|=))(?:(?!%26|["'\s,;}&#]).)+|(\\u0026(?:token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf|raw[_-]?key[_-]?buff|plugin[_-]?session[_-]?id)(?:%3D|=))(?:(?!\\u0026|["'\s,;}&#]).)+/gi;
 function hasFingerprintFieldSegment(name) {
     return name
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -38,9 +38,9 @@ export function redactText(text, opts = {}) {
     const max = opts.maxStringLength ?? 50_000;
     let out = text
         .replace(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi, 'Bearer [REDACTED]')
-        .replace(/(["'])(password|passwd|pwd|token|secret|fingerprint|api_key|apikey|access_token|session_id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
+        .replace(/(["'])(password|passwd|pwd|token|secret|fingerprint|api_key|apikey|access_token|session_id|raw[_-]?key[_-]?buff|plugin[_-]?session[_-]?id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
         .replace(ENCODED_SENSITIVE_QUERY_ASSIGNMENT, (_match, percentPrefix, escapedPrefix) => `${percentPrefix ?? escapedPrefix}[REDACTED]`)
-        .replace(/(token|secret|fingerprint|password|api_key|apikey|access_token|session_id)\s*[=:]\s*(?!['"]?\[REDACTED\](?=\\u0026|%26|['"\s,;}&#]|$))['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
+        .replace(/((?<![\w-])(?:raw[_-]?key[_-]?buff|plugin[_-]?session[_-]?id)|token|secret|fingerprint|password|api_key|apikey|access_token|session_id)\s*[=:]\s*(?!['"]?\[REDACTED\](?=\\u0026|%26|['"\s,;}&#]|$))['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
         .replace(/(cookie[=:]\s*)[^\n;]{3,}/gi, '$1[REDACTED]')
         .replace(/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[REDACTED_JWT]');
     if (out.length > max)

package/extension/README.md

@@ -9,6 +9,9 @@ commands.
 - `debugger`: sends CDP commands to byCLI-controlled or bound tabs.
 - `tabs` / `tabGroups`: manages the dedicated byCLI automation container and
   reports selected tab metadata back to the CLI.
+- `system.display`: reads logical display work areas so owned windows fit the
+  usable screen space, including headless virtual displays. It does not change
+  display settings.
 - `cookies`: reads cookies for browser-backed adapters that need authenticated
   fetches.
 - `downloads`: surfaces download lifecycle to `bycli browser wait download`.
@@ -17,6 +20,22 @@ commands.
   filters by the command's filename/URL pattern and timeout, and does not modify,
   redirect, or persist browser download history.
 
+## Owned Window Placement
+
+New byCLI windows use up to 1280 × 900 logical pixels, capped by the selected
+display's work area. The last-focused normal Chrome window selects the display;
+the primary display is the fallback. Existing owned normal windows stay on the
+display with their largest intersection, keeping smaller sizes and positions
+that already fit. Bounds are corrected on reuse, lease restoration and display
+changes without changing focus. Borrowed user windows and minimized, maximized
+or fullscreen window states are preserved.
+Dragging an owned tab into a user window does not transfer window ownership
+during lease restoration. A move, resize or state change while display metadata
+is being read also takes precedence over that pending correction.
+
+If display metadata is unavailable, byCLI logs a warning. New windows use
+Chrome's natural size and placement, and existing windows retain their bounds.
+
 Suggested Chrome Web Store justification for `downloads`:
 
 > This extension uses `chrome.downloads` to surface download lifecycle

package/extension/dist/background.js

@@ -1558,6 +1558,46 @@ function checkUrlSyntax(input, opts = {}) {
   return { ok: true, url: parsed.toString(), hostname, isIpLiteral: false };
 }
 
+function hasUsableBounds(bounds) {
+  return !!bounds && Number.isFinite(bounds.left) && Number.isFinite(bounds.top) && Number.isFinite(bounds.width) && Number.isFinite(bounds.height) && bounds.width >= 1 && bounds.height >= 1;
+}
+function selectWindowWorkArea(displays, reference) {
+  const usable = displays.filter((display) => display.isEnabled && display.activeState !== "inactive" && hasUsableBounds(display.workArea));
+  if (usable.length === 0) return null;
+  let selected = usable.find((display) => display.isPrimary) ?? usable[0];
+  let largestIntersection = 0;
+  if (hasUsableBounds(reference)) {
+    for (const display of usable) {
+      const area = display.workArea;
+      const width = Math.max(0, Math.min(reference.left + reference.width, area.left + area.width) - Math.max(reference.left, area.left));
+      const height = Math.max(0, Math.min(reference.top + reference.height, area.top + area.height) - Math.max(reference.top, area.top));
+      const intersection = width * height;
+      if (intersection > largestIntersection) {
+        largestIntersection = intersection;
+        selected = display;
+      }
+    }
+  }
+  return selected.workArea;
+}
+function createOwnedWindowBounds(area) {
+  return {
+    left: area.left,
+    top: area.top,
+    width: Math.min(1280, area.width),
+    height: Math.min(900, area.height)
+  };
+}
+function constrainOwnedWindowBounds(window, area) {
+  if (!hasUsableBounds(window)) return null;
+  const width = Math.min(window.width, area.width);
+  const height = Math.min(window.height, area.height);
+  const left = Math.min(Math.max(window.left, area.left), area.left + area.width - width);
+  const top = Math.min(Math.max(window.top, area.top), area.top + area.height - height);
+  if (width === window.width && height === window.height && left === window.left && top === window.top) return null;
+  return { left, top, width, height };
+}
+
 const EXTENSION_CAPABILITIES = ["focus-window-v1", "ima-reader-v1"];
 let ws = null;
 let reconnectTimer = null;
@@ -2047,7 +2087,86 @@ async function focusOwnedWindowIfRequested(windowId, mode) {
   if (typeof updateWindow === "function") await updateWindow(windowId, { focused: true }).catch(() => {
   });
 }
+async function getOwnedWindowWorkArea(reference) {
+  try {
+    if (typeof chrome.system?.display?.getInfo !== "function") throw new Error("system.display API unavailable");
+    const displays = await chrome.system.display.getInfo();
+    const area = selectWindowWorkArea(displays, reference);
+    if (!area) throw new Error("no enabled displays with a valid work area");
+    return area;
+  } catch (err) {
+    console.warn(`[bycli] Unable to query display work area: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+async function getNewOwnedWindowBounds() {
+  let reference;
+  try {
+    if (typeof chrome.windows.getLastFocused === "function") {
+      const lastFocused = await chrome.windows.getLastFocused({ windowTypes: ["normal"] });
+      if (lastFocused.type === "normal") reference = lastFocused;
+    }
+  } catch {
+  }
+  const area = await getOwnedWindowWorkArea(reference);
+  return area ? createOwnedWindowBounds(area) : void 0;
+}
+const ownedWindowGeometryUpdates = /* @__PURE__ */ new Map();
+const excludedOwnedWindowIds = /* @__PURE__ */ new Set();
+function isKnownOwnedWindow(windowId) {
+  return Object.values(ownedContainers).some((container) => container.windowId === windowId) || [...automationSessions.values()].some((session) => session.owned && session.windowId === windowId);
+}
+function rememberOwnedTabDrift(tab, ownedWindowId) {
+  if (tab.windowId !== ownedWindowId && !isKnownOwnedWindow(tab.windowId)) {
+    excludedOwnedWindowIds.add(tab.windowId);
+  }
+}
+async function rememberOwnedGroupDrift(groupId, ownedWindowId) {
+  if (groupId === null) return;
+  try {
+    const group = await chrome.tabGroups.get(groupId);
+    if (group.windowId !== ownedWindowId && !isKnownOwnedWindow(group.windowId)) {
+      excludedOwnedWindowIds.add(group.windowId);
+    }
+  } catch {
+  }
+}
+async function constrainOwnedWindowGeometry(windowId) {
+  const previous = ownedWindowGeometryUpdates.get(windowId) ?? Promise.resolve();
+  const next = previous.catch(() => void 0).then(async () => {
+    if (!isKnownOwnedWindow(windowId)) return;
+    try {
+      const window = await chrome.windows.get(windowId);
+      if (window.type !== "normal" || window.state !== "normal") return;
+      const originalBounds = { left: window.left, top: window.top, width: window.width, height: window.height };
+      const area = await getOwnedWindowWorkArea(window);
+      if (!area || !isKnownOwnedWindow(windowId)) return;
+      const current = await chrome.windows.get(windowId);
+      if (!isKnownOwnedWindow(windowId) || current.type !== "normal" || current.state !== "normal" || current.left !== originalBounds.left || current.top !== originalBounds.top || current.width !== originalBounds.width || current.height !== originalBounds.height) return;
+      const bounds = constrainOwnedWindowBounds(current, area);
+      if (bounds) await chrome.windows.update(windowId, bounds);
+    } catch (err) {
+      console.warn(`[bycli] Failed to constrain owned window ${windowId} geometry: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  });
+  const tracked = next.finally(() => {
+    if (ownedWindowGeometryUpdates.get(windowId) === tracked) ownedWindowGeometryUpdates.delete(windowId);
+  });
+  ownedWindowGeometryUpdates.set(windowId, tracked);
+  await tracked;
+}
+chrome.system?.display?.onDisplayChanged?.addListener(async () => {
+  const ids = /* @__PURE__ */ new Set();
+  for (const container of Object.values(ownedContainers)) {
+    if (container.windowId !== null) ids.add(container.windowId);
+  }
+  for (const session of automationSessions.values()) {
+    if (session.owned) ids.add(session.windowId);
+  }
+  await Promise.all([...ids].map(constrainOwnedWindowGeometry));
+});
 async function toOwnedContainerDiscoveryCandidate(group) {
+  if (excludedOwnedWindowIds.has(group.windowId)) return null;
   try {
     const chromeWindow = await chrome.windows.get(group.windowId);
     const reusableTabId = await findReusableOwnedContainerTab(group.windowId, group.id);
@@ -2074,6 +2193,7 @@ async function discoverOwnedContainerFromTabGroup(role) {
   if (container.groupId !== null) {
     try {
       const group = await chrome.tabGroups.get(container.groupId);
+      if (excludedOwnedWindowIds.has(group.windowId)) throw new Error("Owned group moved to a user window");
       await chrome.windows.get(group.windowId);
       container.windowId = group.windowId;
       return { windowId: group.windowId, groupId: group.id };
@@ -2139,8 +2259,11 @@ async function ensureOwnedContainerWindow(role, initialUrl, mode = "background")
 async function ensureOwnedContainerWindowUnlocked(role, initialUrl, mode = "background") {
   const container = ownedContainers[role];
   if (container.windowId !== null) {
+    const knownWindowId = container.windowId;
+    const knownGroupId = container.groupId;
     try {
       await chrome.windows.get(container.windowId);
+      await constrainOwnedWindowGeometry(container.windowId);
       await focusOwnedWindowIfRequested(container.windowId, mode);
       const initialTabId2 = await findReusableOwnedContainerTab(container.windowId, await getOwnedContainerGroupId(role, container.windowId));
       await ensureOwnedContainerTabGroup(role, container.windowId, [initialTabId2]);
@@ -2149,12 +2272,16 @@ async function ensureOwnedContainerWindowUnlocked(role, initialUrl, mode = "back
         initialTabId: initialTabId2
       };
     } catch {
-      container.windowId = null;
-      container.groupId = null;
+      await rememberOwnedGroupDrift(knownGroupId, knownWindowId);
+      if (container.windowId === knownWindowId && container.groupId === knownGroupId) {
+        container.windowId = null;
+        container.groupId = null;
+      }
     }
   }
   const discovered = await discoverOwnedContainerFromTabGroup(role);
   if (discovered) {
+    await constrainOwnedWindowGeometry(discovered.windowId);
     await focusOwnedWindowIfRequested(discovered.windowId, mode);
     const initialTabId2 = await findReusableOwnedContainerTab(discovered.windowId, discovered.groupId);
     await ensureOwnedContainerTabGroup(role, discovered.windowId, [initialTabId2]);
@@ -2168,8 +2295,7 @@ async function ensureOwnedContainerWindowUnlocked(role, initialUrl, mode = "back
   const win = await chrome.windows.create({
     url: startUrl,
     focused: mode === "foreground",
-    width: 1280,
-    height: 900,
+    ...await getNewOwnedWindowBounds(),
     type: "normal"
   });
   container.windowId = win.id;
@@ -2264,9 +2390,14 @@ async function getAutomationWindow(leaseKey, initialUrl) {
       const tabId = existing.preferredTabId;
       if (tabId !== null) {
         const tab = await chrome.tabs.get(tabId);
-        if (isDebuggableUrl(tab.url)) return tab.windowId;
+        rememberOwnedTabDrift(tab, existing.windowId);
+        if (isDebuggableUrl(tab.url) && tab.windowId === existing.windowId) {
+          await constrainOwnedWindowGeometry(existing.windowId);
+          return existing.windowId;
+        }
       }
       await chrome.windows.get(existing.windowId);
+      await constrainOwnedWindowGeometry(existing.windowId);
       return existing.windowId;
     } catch {
       await removeLeaseSession(leaseKey);
@@ -2277,10 +2408,15 @@ async function getAutomationWindow(leaseKey, initialUrl) {
   return (await ensureOwnedContainerWindow(role, initialUrl, getWindowModeForOwnedPage(leaseKey, url))).windowId;
 }
 chrome.windows.onRemoved.addListener(async (windowId) => {
+  excludedOwnedWindowIds.delete(windowId);
   for (const container of Object.values(ownedContainers)) {
     if (container.windowId === windowId) {
-      container.windowId = null;
-      container.groupId = null;
+      const knownGroupId = container.groupId;
+      await rememberOwnedGroupDrift(knownGroupId, windowId);
+      if (container.windowId === windowId && container.groupId === knownGroupId) {
+        container.windowId = null;
+        container.groupId = null;
+      }
     }
   }
   for (const [leaseKey, expected] of [...automationSessions.entries()]) {
@@ -2535,8 +2671,14 @@ async function resolveTabUnlocked(tabId, leaseKey, initialUrl, blankFirst = fals
     try {
       const tab = await chrome.tabs.get(tabId);
       const session = existingSession;
+      if (session?.owned && (session.preferredTabId === tabId || session.preferredTabId === null)) {
+        rememberOwnedTabDrift(tab, session.windowId);
+      }
       const matchesSession = session ? session.preferredTabId !== null ? session.preferredTabId === tabId : tab.windowId === session.windowId : false;
-      if (isDebuggableUrl(tab.url) && matchesSession) return { tabId, tab };
+      if (isDebuggableUrl(tab.url) && matchesSession) {
+        if (session?.owned && tab.windowId === session.windowId) await constrainOwnedWindowGeometry(session.windowId);
+        return { tabId, tab };
+      }
       if (session && !session.owned) {
         throw new CommandFailure(
           matchesSession ? "bound_tab_not_debuggable" : "bound_tab_mismatch",
@@ -2550,6 +2692,7 @@ async function resolveTabUnlocked(tabId, leaseKey, initialUrl, blankFirst = fals
           await chrome.tabs.move(tabId, { windowId: session.windowId, index: -1 });
           const moved = await chrome.tabs.get(tabId);
           if (moved.windowId === session.windowId && isDebuggableUrl(moved.url)) {
+            if (session.owned) await constrainOwnedWindowGeometry(session.windowId);
             return { tabId, tab: moved };
           }
         } catch (moveErr) {
@@ -2576,7 +2719,11 @@ async function resolveTabUnlocked(tabId, leaseKey, initialUrl, blankFirst = fals
     const session = existingSession;
     try {
       const preferredTab = await chrome.tabs.get(existingPreferredTabId);
-      if (isDebuggableUrl(preferredTab.url)) return { tabId: preferredTab.id, tab: preferredTab };
+      if (session.owned) rememberOwnedTabDrift(preferredTab, session.windowId);
+      if (isDebuggableUrl(preferredTab.url)) {
+        if (session.owned && preferredTab.windowId === session.windowId) await constrainOwnedWindowGeometry(session.windowId);
+        return { tabId: preferredTab.id, tab: preferredTab };
+      }
       if (!session.owned) {
         throw new CommandFailure(
           "bound_tab_not_debuggable",
@@ -2871,6 +3018,8 @@ async function handleFocusUnlocked(cmd, leaseKey) {
   if (activatedTab.id !== tabId || activatedTab.windowId !== focusLease.windowId) {
     return { id: cmd.id, ok: false, error: "Current automation session tab changed window during focus" };
   }
+  await constrainOwnedWindowGeometry(focusLease.windowId);
+  if (!isFocusLeaseCurrent(leaseKey, focusLease)) return focusLeaseChangedResult(cmd.id);
   await updateWindow(focusLease.windowId, { focused: true });
   if (!isFocusLeaseCurrent(leaseKey, focusLease)) return focusLeaseChangedResult(cmd.id);
   return { id: cmd.id, ok: true, data: { focused: true } };
@@ -2964,12 +3113,16 @@ async function handleTabSelectUnlocked(cmd, leaseKey) {
     if (!session || tab.windowId !== session.windowId) {
       return { id: cmd.id, ok: false, error: "Page is not in the automation container" };
     }
+    if (session.owned) await constrainOwnedWindowGeometry(session.windowId);
     await chrome.tabs.update(cmdTabId, { active: true });
     return pageScopedResult(cmd.id, cmdTabId, { selected: true });
   }
   const tabs = await listAutomationWebTabsUnlocked(leaseKey);
   const target = tabs[cmd.index];
   if (!target?.id) return { id: cmd.id, ok: false, error: `Tab index ${cmd.index} not found` };
+  if (lockedSession?.owned && target.windowId === lockedSession.windowId) {
+    await constrainOwnedWindowGeometry(lockedSession.windowId);
+  }
   await chrome.tabs.update(target.id, { active: true });
   return pageScopedResult(cmd.id, target.id, { selected: true });
 }
@@ -3285,13 +3438,20 @@ async function reconcileTargetLeaseRegistry() {
   for (const role of Object.keys(ownedContainers)) {
     ownedContainers[role].windowId = registry.ownedContainers[role]?.windowId ?? null;
     ownedContainers[role].groupId = registry.ownedContainers[role]?.groupId ?? null;
+  }
+  for (const role of Object.keys(ownedContainers)) {
     const windowId = ownedContainers[role].windowId;
+    const groupId = ownedContainers[role].groupId;
     if (windowId !== null) {
       try {
         await chrome.windows.get(windowId);
+        await constrainOwnedWindowGeometry(windowId);
       } catch {
-        ownedContainers[role].windowId = null;
-        ownedContainers[role].groupId = null;
+        await rememberOwnedGroupDrift(groupId, windowId);
+        if (ownedContainers[role].windowId === windowId && ownedContainers[role].groupId === groupId) {
+          ownedContainers[role].windowId = null;
+          ownedContainers[role].groupId = null;
+        }
       }
     }
   }
@@ -3302,6 +3462,8 @@ async function reconcileTargetLeaseRegistry() {
     try {
       const tab = await chrome.tabs.get(tabId);
       if (!isDebuggableUrl(tab.url)) continue;
+      if (stored.owned && (!Number.isInteger(stored.windowId) || stored.windowId < 0)) continue;
+      if (stored.owned) rememberOwnedTabDrift(tab, stored.windowId);
       if (stored.lifecycle === "ephemeral" || stored.lifecycle === "persistent" || stored.lifecycle === "pinned") {
         sessionLifecycleOverrides.set(leaseKey, stored.lifecycle);
       }
@@ -3309,7 +3471,9 @@ async function reconcileTargetLeaseRegistry() {
         session: typeof stored.session === "string" ? stored.session : getSessionFromKey(leaseKey),
         surface: stored.surface === "adapter" ? "adapter" : getSurfaceFromKey(leaseKey),
         kind: stored.kind === "bound" || stored.owned === false ? "bound" : "owned",
-        windowId: tab.windowId,
+        // A leased tab can be dragged into a user window while the worker is
+        // stopped. Its current location does not transfer window ownership.
+        windowId: stored.owned ? stored.windowId : tab.windowId,
         owned: stored.owned,
         preferredTabId: tabId
       });
@@ -3319,9 +3483,10 @@ async function reconcileTargetLeaseRegistry() {
         idleTimer: null,
         idleDeadlineAt: stored.idleDeadlineAt
       });
-      if (session.owned) {
+      if (session.owned && tab.windowId === session.windowId) {
         const role = getOwnedWindowRole(leaseKey);
         if (ownedContainers[role].windowId === null) ownedContainers[role].windowId = tab.windowId;
+        await constrainOwnedWindowGeometry(tab.windowId);
         await ensureOwnedContainerTabGroup(role, tab.windowId, [tabId]);
       }
       const remaining = stored.idleDeadlineAt > 0 ? stored.idleDeadlineAt - Date.now() : timeout;

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "byCLI",
-  "version": "2.1.23",
+  "version": "2.1.24",
   "description": "Browser automation bridge for the byCLI CLI tool. Executes commands in Chrome tab leases via a local daemon.",
   "permissions": [
     "debugger",
@@ -11,6 +11,7 @@
     "alarms",
     "storage",
     "tabGroups",
+    "system.display",
     "downloads"
   ],
   "host_permissions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.62",
+  "version": "2.1.65",
   "publishConfig": {
     "access": "public"
   },