baiduwangpan-cli 1.0.0 → 1.0.1

package/README.md

@@ -65,13 +65,25 @@ npm link           # 全局注册 bdp 命令
 
 ### 2. 配置认证
 
+**方式一：浏览器自动登录（推荐）**
+
+```bash
+bdp login
+```
+
+自动启动 Chrome/Edge → 打开百度网盘登录页 → **手机扫码** → 在页面会话内验证登录 → 自动同步引擎。无需 F12。
+
+扫码产生的新会话可能被百度限制为只能在原浏览器上下文中使用。因此 `bdp` 会保留专用 profile，并在登录后将浏览器最小化；PCS API 继续使用 BDUSS/STOKEN，网页和群聊 API 通过该浏览器的 CDP 会话调用。浏览器被关闭后，下次网页 API 调用会使用同一 profile 自动重启。
+
+**方式二：手动凭证**
+
 ```bash
 bdp login --bduss <你的BDUSS> --stoken <你的STOKEN>
 bdp whoami  # 验证
 ```
 
 <details>
-<summary>📋 如何获取 BDUSS 和 STOKEN</summary>
+<summary>📋 如何获取 BDUSS 和 STOKEN（手动方式）</summary>
 
 1. 浏览器打开 [pan.baidu.com](https://pan.baidu.com) 并登录
 2. 按 `F12` → **Application** → **Cookies** → `https://pan.baidu.com`
@@ -79,6 +91,8 @@ bdp whoami  # 验证
 
 > ⚠️ STOKEN 必须在百度网盘页面获取（不是百度首页），值中应包含大写字母。
 
+> 💡 推荐直接运行 `bdp login`，全程自动化，无需手动操作。
+
 </details>
 
 ### 3. 开始使用
@@ -183,7 +197,7 @@ const results = await group.searchFiles('539478953581833690', '倪海厦');
 │    lib/pan.js    │         lib/group.js             │
 │   全盘文件操作    │        群聊文件浏览               │
 ├──────────────────┼──────────────────────────────────┤
-│  BaiduPCS-Go     │     lib/http.js (curl)           │
+│  BaiduPCS-Go     │  lib/http.js (curl / browser)    │
 │  (BDUSS 认证)    │     mbox API (逆向)              │
 │  locate → dlink  │     /mbox/group/listshare        │
 │  upload/download │     /mbox/msg/shareinfo          │
@@ -237,14 +251,63 @@ baiduwangpan-cli/
 ├── lib/
 │   ├── index.js              # 库导出
 │   ├── config.js             # 配置管理 (~/.bdp/config.json)
-│   ├── http.js               # HTTP 客户端 (curl 封装)
+│   ├── http.js               # 网页 API 双传输 (curl / browser)
+│   ├── browser-login.js      # 浏览器登录、持久 profile 与 CDP 请求
 │   ├── pan.js                # 网盘操作 (BaiduPCS-Go 桥接)
 │   └── group.js              # 群聊操作 (逆向 mbox API)
+├── test/                     # Node.js 回归测试
+├── skills/
+│   └── baiduwangpan/         # Agent Skill 源文件 (SKILL.md + reference + scripts)
+├── baiduwangpan-skill.zip    # Agent Skill 打包 (Releases 附件)
 ├── bdp.js                    # 早期独立版 (保留参考)
 ├── bdp-group.js              # 早期独立版 (保留参考)
 └── bdp.py                    # Python 版 (备用)
 ```
 
+## 🤖 Agent Skill 使用
+
+本仓库附带一个标准格式的 Agent Skill，让 Claude Code / Codex / OpenClaw / Cursor 等 Agent 通过自然语言操作百度网盘。
+
+### 安装 Skill
+
+从 [Releases](https://github.com/NkAntony777/baiduwangpan-cli/releases) 下载 `baiduwangpan-skill.zip`，或直接复制仓库 `skills/baiduwangpan/` 文件夹：
+
+```bash
+# 各平台 skills 目录
+~/.claude/skills/            # Claude Code
+~/.codex/skills/             # Codex CLI
+~/.config/opencode/skills/   # OpenCode
+# 或对应 Agent 的 skills 目录
+```
+
+### Skill 使用
+
+Agent 加载 skill 后，自然语言即可驱动（skill 会自动触发）：
+
+```
+用户: 看看我网盘里有什么
+用户: 在群里找倪海厦的资料
+用户: 读一下 /文档/data.csv 前几行
+用户: 搜索网盘里所有报告文件
+```
+
+skill 会自动执行 `bdp` 命令并返回结构化结果（含 `--json` 输出）。
+
+### Skill 内容
+
+```
+skills/baiduwangpan/
+├── SKILL.md                      # 技能定义（触发规则 + 命令规范 + 安全边界）
+├── reference/
+│   ├── commands.md               # 完整命令参考
+│   ├── authentication.md         # 凭证获取与配置
+│   ├── examples.md               # Agent 使用示例 + JSON 输出格式
+│   └── troubleshooting.md        # 故障排查
+└── scripts/
+    ├── setup.sh                  # macOS/Linux 自动安装
+    └── setup.ps1                 # Windows 自动安装
+```
+
 ## ⚠️ 注意事项
 
 - **BDUSS 有效期**：Cookie 会过期，失效后重新执行 `bdp login`

package/bin/bdp.js

@@ -90,14 +90,77 @@ function parseArgs(argv) {
 const cmds = {};
 
 cmds.login = async (args, json) => {
-  if (args.flags.bduss) config.set("bduss", args.flags.bduss);
-  if (args.flags.stoken) config.set("stoken", args.flags.stoken);
-  const cfg = config.get();
-  output(
-    { success: true, bduss: cfg.bduss ? "***set***" : "missing", stoken: cfg.stoken ? "***set***" : "missing" },
-    json,
-    () => console.log("Credentials saved to " + config.CONFIG_FILE)
-  );
+  // 方式 1: 手动传入凭证
+  if (args.flags.bduss || args.flags.stoken) {
+    if (!args.flags.bduss || !args.flags.stoken) {
+      throw new Error("Manual login requires both --bduss and --stoken");
+    }
+    config.setAuth({
+      bduss: args.flags.bduss,
+      stoken: args.flags.stoken,
+      webTransport: "curl",
+    });
+    const cfg = config.get();
+    output(
+      { success: true, bduss: cfg.bduss ? "***set***" : "missing", stoken: cfg.stoken ? "***set***" : "missing" },
+      json,
+      () => console.log("Credentials saved to " + config.CONFIG_FILE)
+    );
+    return;
+  }
+
+  // 方式 2: 浏览器自动登录（扫码，Agent 代劳）
+  const { browserLogin } = require("../lib/browser-login");
+  const status = (msg) => {
+    if (!json) console.log(msg);
+  };
+
+  status("🔐 bdp login: 未提供 --bduss/--stoken，启动浏览器扫码登录...");
+  try {
+    const previous = config.get();
+    const creds = await browserLogin({
+      onStatus: status,
+      profileDir: previous.browserProfile || undefined,
+      port: previous.webTransport === "browser" ? previous.browserPort : undefined,
+    });
+    config.setAuth({
+      bduss: creds.bduss,
+      stoken: creds.stoken,
+      webTransport: "browser",
+      browserProfile: creds.browserProfile,
+      browserPort: creds.browserPort,
+    });
+    status("✅ 登录成功，凭证已保存到 " + config.CONFIG_FILE);
+
+    // 同步登录 BaiduPCS-Go 引擎（全盘操作依赖）
+    try {
+      const { spawnSync } = require("child_process");
+      const cfg = config.get();
+      const loginResult = spawnSync(cfg.pcsPath, ["login", `-bduss=${creds.bduss}`, `-stoken=${creds.stoken}`], {
+        encoding: "utf-8",
+        timeout: 30000,
+      });
+      if (loginResult.stdout && loginResult.stdout.includes("登录成功")) {
+        status("✅ BaiduPCS-Go 引擎已同步登录");
+      } else {
+        status("⚠️ BaiduPCS-Go 引擎登录失败: " + (loginResult.stdout || loginResult.stderr || "未知错误").trim().substring(0, 100));
+      }
+    } catch (e) {
+      status("⚠️ BaiduPCS-Go 引擎登录异常: " + e.message);
+    }
+
+    if (json) {
+      console.log(JSON.stringify({ success: true, method: "browser-qr", bduss: "***set***", stoken: "***set***" }));
+    }
+  } catch (e) {
+    if (json) {
+      console.log(JSON.stringify({ error: e.message }));
+    } else {
+      console.error(`[ERROR] ${e.message}`);
+      console.error("        提示: 也可手动方式 bdp login --bduss <值> --stoken <值>");
+    }
+    process.exit(1);
+  }
 };
 
 cmds.whoami = async (args, json) => {
@@ -107,6 +170,7 @@ cmds.whoami = async (args, json) => {
       loggedIn: !!(cfg.bduss && cfg.stoken),
       bduss: cfg.bduss ? "***set***" : "missing",
       stoken: cfg.stoken ? "***set***" : "missing",
+      webTransport: cfg.webTransport,
       pcsPath: cfg.pcsPath,
       configFile: config.CONFIG_FILE,
     },
@@ -115,6 +179,7 @@ cmds.whoami = async (args, json) => {
       console.log(`Status:     ${d.loggedIn ? "✅ Logged in" : "❌ Not logged in"}`);
       console.log(`BDUSS:      ${d.bduss}`);
       console.log(`STOKEN:     ${d.stoken}`);
+      console.log(`Web API:    ${d.webTransport}`);
       console.log(`PCS Path:   ${d.pcsPath}`);
       console.log(`Config:     ${d.configFile}`);
     }
@@ -127,6 +192,7 @@ cmds.config = async (args, json) => {
     console.log("Configuration:");
     console.log(`  bduss:     ${d.bduss ? d.bduss.substring(0, 10) + "..." : "(not set)"}`);
     console.log(`  stoken:    ${d.stoken ? d.stoken.substring(0, 10) + "..." : "(not set)"}`);
+    console.log(`  web API:   ${d.webTransport}`);
     console.log(`  pcsPath:   ${d.pcsPath}`);
     console.log(`  ua:        ${d.ua.substring(0, 40)}...`);
     console.log(`  maxBytes:  ${d.maxBytes}`);
@@ -336,7 +402,8 @@ GROUP CHAT OPERATIONS (群聊)
   gsearch <gid> <keyword>    Search group file names
 
 CONFIGURATION
-  login --bduss X --stoken Y  Save credentials
+  login                        Browser QR login (auto-detect cookies)
+  login --bduss X --stoken Y   Save credentials manually
   whoami                       Check login status
   config                       Show configuration
 
@@ -380,7 +447,11 @@ async function main() {
     } else {
       console.error(`[ERROR] ${e.message}`);
     }
-    process.exit(1);
+    process.exitCode = 1;
+  } finally {
+    try {
+      require("../lib/browser-login").disconnectBrowserSession();
+    } catch {}
   }
 }
 

package/lib/browser-login.js

@@ -0,0 +1,426 @@
+const { spawn, execSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const http = require("http");
+
+const PAN_HOME = "https://pan.baidu.com/disk/main";
+const DEFAULT_PROFILE_DIR = path.join(os.homedir(), ".bdp", "browser-profile");
+const APP_ID = "250528";
+
+let activeSession = null;
+let disconnectTimer = null;
+
+function findBrowser() {
+  const candidates = [];
+
+  if (os.platform() === "win32") {
+    const programFiles = [
+      process.env.PROGRAMFILES || "C:\\Program Files",
+      process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)",
+      process.env.LOCALAPPDATA || "",
+    ];
+    for (const pf of programFiles) {
+      candidates.push(path.join(pf, "Google\\Chrome\\Application\\chrome.exe"));
+      candidates.push(path.join(pf, "Microsoft\\Edge\\Application\\msedge.exe"));
+    }
+  }
+
+  if (os.platform() === "darwin") {
+    candidates.push("/Applications/Google Chrome.app/Contents/MacOS/Google Chrome");
+    candidates.push("/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge");
+  }
+
+  for (const name of ["google-chrome", "chromium", "chromium-browser", "microsoft-edge", "chrome"]) {
+    try {
+      const out = execSync(`command -v ${name}`, { stdio: "pipe" }).toString().trim();
+      if (out) candidates.push(out);
+    } catch {}
+  }
+
+  for (const candidate of candidates) {
+    if (candidate && fs.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+function httpRequest(url, method = "GET") {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method }, (res) => {
+      let data = "";
+      res.on("data", (chunk) => (data += chunk));
+      res.on("end", () => resolve(data));
+    });
+    req.setTimeout(2000, () => req.destroy(new Error("DevTools request timed out")));
+    req.on("error", reject);
+    req.end();
+  });
+}
+
+async function getDevToolsVersion(port) {
+  const raw = await httpRequest(`http://127.0.0.1:${port}/json/version`);
+  const version = JSON.parse(raw);
+  if (!version.webSocketDebuggerUrl || !/Chrome|Chromium|Edg/i.test(version.Browser || "")) {
+    throw new Error("The configured DevTools port is not a Chromium browser");
+  }
+  return version;
+}
+
+async function waitForDevTools(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      return await getDevToolsVersion(port);
+    } catch {}
+    await delay(300);
+  }
+  throw new Error("DevTools 启动超时");
+}
+
+async function listTabs(port) {
+  return JSON.parse(await httpRequest(`http://127.0.0.1:${port}/json/list`));
+}
+
+async function openTab(port, url) {
+  const encoded = encodeURIComponent(url);
+  return JSON.parse(await httpRequest(`http://127.0.0.1:${port}/json/new?${encoded}`, "PUT"));
+}
+
+function getWebSocketImpl() {
+  if (typeof WebSocket !== "undefined") return WebSocket;
+  try {
+    return require("ws");
+  } catch {
+    throw new Error("Browser login requires Node.js 22+ or the optional 'ws' package");
+  }
+}
+
+class CDPClient {
+  constructor(wsUrl) {
+    const WebSocketImpl = getWebSocketImpl();
+    this.ws = new WebSocketImpl(wsUrl);
+    this.id = 0;
+    this.pending = new Map();
+  }
+
+  connect() {
+    return new Promise((resolve, reject) => {
+      this.ws.onopen = resolve;
+      this.ws.onerror = () => reject(new Error("WebSocket 连接失败"));
+      this.ws.onclose = () => {
+        for (const pending of this.pending.values()) {
+          pending.reject(new Error("DevTools connection closed"));
+        }
+        this.pending.clear();
+      };
+      this.ws.onmessage = (event) => {
+        const raw = typeof event.data === "string" ? event.data : event.data.toString();
+        const msg = JSON.parse(raw);
+        if (msg.id && this.pending.has(msg.id)) {
+          const pending = this.pending.get(msg.id);
+          this.pending.delete(msg.id);
+          if (msg.error) pending.reject(new Error(msg.error.message));
+          else pending.resolve(msg.result);
+        }
+      };
+    });
+  }
+
+  send(method, params = {}) {
+    return new Promise((resolve, reject) => {
+      const id = ++this.id;
+      this.pending.set(id, { resolve, reject });
+      this.ws.send(JSON.stringify({ id, method, params }));
+    });
+  }
+
+  close() {
+    try { this.ws.close(); } catch {}
+  }
+}
+
+function randomPort() {
+  return 9000 + Math.floor(Math.random() * 2000);
+}
+
+function launchBrowser(browser, profileDir, port, { minimized = false } = {}) {
+  fs.mkdirSync(profileDir, { recursive: true });
+  const args = [
+    `--remote-debugging-port=${port}`,
+    `--user-data-dir=${profileDir}`,
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--disable-extensions",
+    "--disable-popup-blocking",
+  ];
+  if (minimized) args.push("--start-minimized");
+  args.push("about:blank");
+
+  const proc = spawn(browser, args, {
+    stdio: "ignore",
+    detached: true,
+    windowsHide: minimized,
+  });
+  proc.unref();
+  return proc;
+}
+
+async function connectPanTab(port) {
+  const tabs = await listTabs(port);
+  let tab = tabs.find((item) => item.type === "page" && /^https:\/\/pan\.baidu\.com\//.test(item.url));
+  if (!tab) tab = await openTab(port, PAN_HOME);
+
+  const cdp = new CDPClient(tab.webSocketDebuggerUrl);
+  await cdp.connect();
+  await cdp.send("Network.enable");
+  await cdp.send("Runtime.enable");
+  return { cdp, tab };
+}
+
+async function waitForPanPage(cdp, timeoutMs = 20000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const result = await cdp.send("Runtime.evaluate", {
+        expression: "location.hostname === 'pan.baidu.com' && document.readyState !== 'loading'",
+        returnByValue: true,
+      });
+      if (result.result?.value === true) return;
+    } catch {}
+    await delay(300);
+  }
+  throw new Error("百度网盘页面加载超时");
+}
+
+async function evaluateFetch(cdp, url, options = {}) {
+  const request = {
+    method: options.method || "GET",
+    credentials: "include",
+    headers: options.headers || {},
+  };
+  if (Object.prototype.hasOwnProperty.call(options, "body")) request.body = options.body;
+
+  const expression = `fetch(${JSON.stringify(url)}, ${JSON.stringify(request)})
+    .then(async response => ({
+      ok: response.ok,
+      status: response.status,
+      url: response.url,
+      text: await response.text()
+    }))`;
+  const evaluated = await cdp.send("Runtime.evaluate", {
+    expression,
+    awaitPromise: true,
+    returnByValue: true,
+  });
+
+  if (evaluated.exceptionDetails) {
+    const message = evaluated.exceptionDetails.exception?.description ||
+      evaluated.exceptionDetails.text || "Browser fetch failed";
+    throw new Error(message);
+  }
+  const response = evaluated.result?.value;
+  if (!response || typeof response.text !== "string") {
+    throw new Error("Browser fetch returned no response");
+  }
+  return response;
+}
+
+async function openPersistentSession({ browser, profileDir, port, minimized }) {
+  let proc = null;
+  try {
+    await getDevToolsVersion(port);
+  } catch {
+    proc = launchBrowser(browser, profileDir, port, { minimized });
+    await waitForDevTools(port, 15000);
+  }
+  const { cdp, tab } = await connectPanTab(port);
+  return { browser, profileDir, port, proc, cdp, tab };
+}
+
+async function getBrowserSession(settings = {}) {
+  if (activeSession) {
+    try {
+      await activeSession.cdp.send("Runtime.evaluate", { expression: "1" });
+      return activeSession;
+    } catch {
+      activeSession.cdp.close();
+      activeSession = null;
+    }
+  }
+
+  const browser = settings.browser || findBrowser();
+  if (!browser) throw new Error("未找到 Chrome/Edge，无法使用扫码登录会话调用网页 API");
+  const profileDir = settings.profileDir || DEFAULT_PROFILE_DIR;
+  const configuredPort = Number(settings.port) || randomPort();
+
+  try {
+    activeSession = await openPersistentSession({
+      browser,
+      profileDir,
+      port: configuredPort,
+      minimized: true,
+    });
+  } catch (error) {
+    if (!settings.port) throw error;
+    activeSession = await openPersistentSession({
+      browser,
+      profileDir,
+      port: randomPort(),
+      minimized: true,
+    });
+  }
+  await waitForPanPage(activeSession.cdp);
+  if (settings.onPort) settings.onPort(activeSession.port);
+  return activeSession;
+}
+
+async function browserJson(url, options = {}, settings = {}) {
+  const session = await getBrowserSession(settings);
+  let response;
+  try {
+    response = await evaluateFetch(session.cdp, url, options);
+  } catch (error) {
+    session.cdp.close();
+    activeSession = null;
+    throw error;
+  }
+
+  try {
+    return JSON.parse(response.text.replace(/^\s+/, ""));
+  } catch {
+    return { _raw: response.text, _status: response.status, _url: response.url };
+  } finally {
+    scheduleDisconnect();
+  }
+}
+
+function getTemplateVariableUrl() {
+  const fields = encodeURIComponent('["bdstoken","token","uk","isdocuser","servertime"]');
+  return `https://pan.baidu.com/api/gettemplatevariable?clienttype=0&app_id=${APP_ID}&web=1&fields=${fields}`;
+}
+
+async function browserLogin({
+  timeoutMs = 180000,
+  onStatus,
+  profileDir = DEFAULT_PROFILE_DIR,
+  port = randomPort(),
+} = {}) {
+  const browser = findBrowser();
+  if (!browser) {
+    throw new Error("未找到 Chrome/Edge。请手动获取 BDUSS/STOKEN 后使用 bdp login --bduss --stoken");
+  }
+  port = Number(port) || randomPort();
+
+  if (onStatus) onStatus("启动浏览器...");
+  let proc = null;
+
+  let cdp;
+  try {
+    try {
+      await getDevToolsVersion(port);
+    } catch {
+      proc = launchBrowser(browser, profileDir, port);
+      await waitForDevTools(port, 15000);
+    }
+    const tab = await openTab(port, PAN_HOME);
+    if (onStatus) onStatus("浏览器已打开，请登录百度网盘（扫码或账号密码均可）...");
+
+    cdp = new CDPClient(tab.webSocketDebuggerUrl);
+    await cdp.connect();
+    await cdp.send("Network.enable");
+    await cdp.send("Runtime.enable");
+
+    const deadline = Date.now() + timeoutMs;
+    let lastStatus = "";
+    let authRetries = 0;
+
+    while (Date.now() < deadline) {
+      try {
+        const { cookies } = await cdp.send("Network.getCookies", {
+          urls: ["https://pan.baidu.com/", "https://passport.baidu.com/"],
+        });
+        const bduss = cookies.find((cookie) => cookie.name === "BDUSS")?.value || "";
+        const stoken = cookies.find((cookie) => cookie.name === "STOKEN")?.value || "";
+        const status = bduss ? (stoken ? "both" : "bduss-only") : "none";
+
+        if (status !== lastStatus) {
+          lastStatus = status;
+          if (status === "both" && onStatus) onStatus("检测到登录凭证，正在浏览器会话内验证...");
+          if (status === "bduss-only" && onStatus) onStatus("已检测到 BDUSS，等待 STOKEN...");
+        }
+
+        if (bduss && stoken) {
+          await waitForPanPage(cdp, 5000);
+          const response = await evaluateFetch(cdp, getTemplateVariableUrl());
+          const data = JSON.parse(response.text.replace(/^\s+/, ""));
+          const bdstoken = data?.result?.bdstoken;
+          if (data?.errno === 0 && bdstoken) {
+            await minimizeWindow(cdp, tab.id);
+            cdp.close();
+            return { bduss, stoken, bdstoken, browserProfile: profileDir, browserPort: port };
+          }
+
+          authRetries++;
+          if (onStatus && authRetries % 3 === 0) {
+            onStatus("登录凭证尚未通过网页 API 验证，请等待页面完成跳转...");
+          }
+        }
+      } catch {}
+      await delay(1500);
+    }
+
+    throw new Error(`等待登录超时（${Math.round(timeoutMs / 1000)}秒）`);
+  } catch (error) {
+    if (cdp) cdp.close();
+    killBrowser(proc);
+    throw error;
+  }
+}
+
+function scheduleDisconnect() {
+  if (disconnectTimer) clearTimeout(disconnectTimer);
+  disconnectTimer = setTimeout(disconnectBrowserSession, 500);
+  disconnectTimer.unref();
+}
+
+function disconnectBrowserSession() {
+  if (disconnectTimer) {
+    clearTimeout(disconnectTimer);
+    disconnectTimer = null;
+  }
+  if (activeSession) {
+    activeSession.cdp.close();
+    activeSession = null;
+  }
+}
+
+async function minimizeWindow(cdp, targetId) {
+  try {
+    const { windowId } = await cdp.send("Browser.getWindowForTarget", { targetId });
+    await cdp.send("Browser.setWindowBounds", { windowId, bounds: { windowState: "minimized" } });
+  } catch {}
+}
+
+function killBrowser(proc) {
+  if (!proc || proc.killed) return;
+  try {
+    if (os.platform() === "win32") {
+      execSync(`taskkill /pid ${proc.pid} /T /F`, { stdio: "ignore" });
+    } else {
+      try { process.kill(-proc.pid, "SIGKILL"); } catch { proc.kill("SIGKILL"); }
+    }
+  } catch {}
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+module.exports = {
+  browserLogin,
+  browserJson,
+  findBrowser,
+  DEFAULT_PROFILE_DIR,
+  disconnectBrowserSession,
+  _internals: { CDPClient, evaluateFetch, getTemplateVariableUrl },
+};

package/lib/config.js

@@ -2,7 +2,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 
-const CONFIG_DIR = path.join(os.homedir(), ".bdp");
+const CONFIG_DIR = process.env.BDP_CONFIG_DIR || path.join(os.homedir(), ".bdp");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 
 function load() {
@@ -24,6 +24,10 @@ function get() {
   return {
     bduss: fileCfg.bduss || process.env.BDP_BDUSS || "",
     stoken: fileCfg.stoken || process.env.BDP_STOKEN || "",
+    cookie: fileCfg.cookie || process.env.BDP_COOKIE || "",
+    webTransport: fileCfg.webTransport || "curl",
+    browserProfile: fileCfg.browserProfile || "",
+    browserPort: parseInt(fileCfg.browserPort || "0", 10) || 0,
     pcsPath: fileCfg.pcsPath || process.env.BAIDUPCS_CMD || findPCS(),
     ua: fileCfg.ua || process.env.NETDISK_UA ||
       "netdisk;P2SP;3.0.0.8;netdisk;11.12.3;ANG-AN00;android-android;10.0;JSbridge4.4.0;jointBridge;1.1.0;",
@@ -37,6 +41,18 @@ function set(key, value) {
   save(cfg);
 }
 
+function update(values) {
+  save({ ...load(), ...values });
+}
+
+function setAuth(values) {
+  const cfg = load();
+  for (const key of ["bduss", "stoken", "cookie", "webTransport", "browserProfile", "browserPort"]) {
+    delete cfg[key];
+  }
+  save({ ...cfg, ...values });
+}
+
 function findPCS() {
   // 1. Look in package root (postinstall target)
   const pkgRoot = path.join(__dirname, "..");
@@ -56,4 +72,4 @@ function isLoggedIn() {
   return !!(cfg.bduss && cfg.stoken);
 }
 
-module.exports = { get, set, load, save, isLoggedIn, CONFIG_DIR, CONFIG_FILE };
+module.exports = { get, set, update, setAuth, load, save, isLoggedIn, CONFIG_DIR, CONFIG_FILE };

package/lib/group.js

@@ -5,7 +5,7 @@ async function listGroups() {
   const bdstoken = await getBdstoken();
   if (!bdstoken) throw new Error("Cannot get bdstoken — check BDUSS/STOKEN config");
 
-  const data = http.curlJson(
+  const data = await http.webJson(
     `${http.PAN_BASE}/mbox/group/list?clienttype=0&app_id=${http.APP_ID}&web=1&bdstoken=${bdstoken}`
   );
 
@@ -23,7 +23,7 @@ async function listGroups() {
 
 async function listShares(gid) {
   const bdstoken = await getBdstoken();
-  const data = http.curlJson(
+  const data = await http.webJson(
     `${http.PAN_BASE}/mbox/group/listshare?clienttype=0&app_id=${http.APP_ID}&web=1&type=2&gid=${gid}&limit=50&desc=1&bdstoken=${bdstoken}`,
     { method: "POST", body: "" }
   );
@@ -68,7 +68,7 @@ async function listFiles(gid, fsId, options = {}) {
   }
 
   const bdstoken = await getBdstoken();
-  const data = http.curlJson(
+  const data = await http.webJson(
     `${http.PAN_BASE}/mbox/msg/shareinfo?type=2&from_uk=${fromUk}&msg_id=${msgId}&to_uk=0&num=${num}&page=${page}&fs_id=${fsId}&gid=${gid}&clienttype=0&app_id=${http.APP_ID}&web=1&bdstoken=${bdstoken}`,
     { method: "POST", body: "" }
   );

package/lib/http.js

@@ -1,10 +1,15 @@
 const { spawnSync } = require("child_process");
 const config = require("./config");
 
+function buildCookieHeader(cfg) {
+  if (cfg.cookie) return cfg.cookie;
+  return `BDUSS=${cfg.bduss}; STOKEN=${cfg.stoken}`;
+}
+
 function curlGet(url, extraHeaders = {}) {
   const cfg = config.get();
   const headers = {
-    Cookie: `BDUSS=${cfg.bduss}; STOKEN=${cfg.stoken}`,
+    Cookie: buildCookieHeader(cfg),
     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
     Referer: "https://pan.baidu.com/disk/main",
     ...extraHeaders,
@@ -23,7 +28,7 @@ function curlGet(url, extraHeaders = {}) {
 function curlPost(url, body = "", extraHeaders = {}) {
   const cfg = config.get();
   const headers = {
-    Cookie: `BDUSS=${cfg.bduss}; STOKEN=${cfg.stoken}`,
+    Cookie: buildCookieHeader(cfg),
     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
     Referer: "https://pan.baidu.com/disk/main",
     "Content-Type": "application/x-www-form-urlencoded",
@@ -67,18 +72,45 @@ function curlJson(url, options = {}) {
   }
 }
 
+async function webJson(url, options = {}) {
+  const cfg = config.get();
+  if (cfg.webTransport !== "browser") return curlJson(url, options);
+
+  const { browserJson } = require("./browser-login");
+  const headers = { ...(options.headers || {}) };
+  if (options.method === "POST" && !headers["Content-Type"]) {
+    headers["Content-Type"] = "application/x-www-form-urlencoded";
+  }
+  return browserJson(
+    url,
+    {
+      method: options.method || "GET",
+      ...(Object.prototype.hasOwnProperty.call(options, "body") ? { body: options.body } : {}),
+      headers,
+    },
+    {
+      profileDir: cfg.browserProfile,
+      port: cfg.browserPort,
+      onPort: (browserPort) => {
+        if (browserPort !== cfg.browserPort) config.update({ browserPort });
+      },
+    }
+  );
+}
+
 async function getBdstoken() {
   const fields = encodeURIComponent('["bdstoken","token","uk","isdocuser","servertime"]');
-  const data = curlJson(
+  const data = await webJson(
     `https://pan.baidu.com/api/gettemplatevariable?clienttype=0&app_id=250528&web=1&fields=${fields}`
   );
   const token = data?.result?.bdstoken || null;
   if (!token) {
     const cfg = require("./config").get();
     throw new Error(
-      `Cannot get bdstoken. Check BDUSS/STOKEN.\n` +
+      `Cannot get bdstoken. The web session is not authenticated.\n` +
       `  BDUSS: ${cfg.bduss ? "set" : "MISSING"}  STOKEN: ${cfg.stoken ? "set" : "MISSING"}\n` +
-      `  Run: bdp login --bduss <value> --stoken <value>`
+      `  Web API transport: ${cfg.webTransport}\n` +
+      `  Run: bdp login, or bdp login --bduss <value> --stoken <value>`
     );
   }
   return token;
@@ -87,4 +119,4 @@ async function getBdstoken() {
 const APP_ID = "250528";
 const PAN_BASE = "https://pan.baidu.com";
 
-module.exports = { curlGet, curlPost, curlRange, curlJson, getBdstoken, APP_ID, PAN_BASE };
+module.exports = { curlGet, curlPost, curlRange, curlJson, webJson, getBdstoken, APP_ID, PAN_BASE };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baiduwangpan-cli",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "百度网盘 CLI — 全盘读写 · 免下载读取文件内容 · 群聊文件浏览 (Agent 友好)",
   "main": "lib/index.js",
   "bin": {
@@ -8,11 +8,15 @@
   },
   "scripts": {
     "start": "node bin/bdp.js",
+    "test": "node --test",
     "postinstall": "node scripts/postinstall.js"
   },
   "engines": {
     "node": ">=14"
   },
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
   "license": "MIT",
   "keywords": [
     "baidu",