kiku-agent 1.2.0 → 1.3.1

package/server/agent/websearch/security/ssrf.js

@@ -0,0 +1,289 @@
+import http from 'node:http';
+import https from 'node:https';
+import { lookup as dnsLookup } from 'node:dns/promises';
+
+export function parseIPv4(host) {
+  if (typeof host !== 'string' || !host) return null;
+  if (host.includes(':')) return null;
+
+  const parts = host.split('.');
+  if (parts.length > 4 || parts.length === 0) return null;
+
+  const numbers = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i];
+    if (!part) return null;
+    let val;
+    if (/^0x[0-9a-f]+$/i.test(part)) {
+      val = parseInt(part, 16);
+    } else if (/^0[0-7]+$/.test(part)) {
+      val = parseInt(part, 8);
+    } else if (/^\d+$/.test(part)) {
+      val = parseInt(part, 10);
+    } else {
+      return null;
+    }
+    if (isNaN(val) || val < 0) return null;
+    numbers.push(val);
+  }
+
+  let a, b, c, d;
+  if (numbers.length === 1) {
+    const n = numbers[0];
+    if (n > 0xffffffff) return null;
+    a = (n >>> 24) & 255;
+    b = (n >>> 16) & 255;
+    c = (n >>> 8) & 255;
+    d = n & 255;
+  } else if (numbers.length === 2) {
+    if (numbers[0] > 255 || numbers[1] > 0xffffff) return null;
+    a = numbers[0];
+    b = (numbers[1] >>> 16) & 255;
+    c = (numbers[1] >>> 8) & 255;
+    d = numbers[1] & 255;
+  } else if (numbers.length === 3) {
+    if (numbers[0] > 255 || numbers[1] > 255 || numbers[2] > 0xffff) return null;
+    a = numbers[0];
+    b = numbers[1];
+    c = (numbers[2] >>> 8) & 255;
+    d = numbers[2] & 255;
+  } else if (numbers.length === 4) {
+    if (numbers.some(n => n > 255)) return null;
+    [a, b, c, d] = numbers;
+  } else {
+    return null;
+  }
+
+  return `${a}.${b}.${c}.${d}`;
+}
+
+export function isPrivateIPv4(ip) {
+  const parsed = parseIPv4(ip) || (typeof ip === 'string' ? ip : '');
+  const parts = parsed.split('.').map(Number);
+  if (parts.length !== 4 || parts.some(p => isNaN(p) || p < 0 || p > 255)) return false;
+
+  if (parts[0] === 127) return true;
+  if (parts[0] === 10) return true;
+  if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
+  if (parts[0] === 192 && parts[1] === 168) return true;
+  if (parts[0] === 169 && parts[1] === 254) return true;
+  if (parts[0] === 0) return true;
+  if (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127) return true;
+  if (parts[0] === 198 && (parts[1] === 18 || parts[1] === 19)) return true;
+  if (parts[0] >= 224) return true;
+
+  return false;
+}
+
+export function isPrivateIPv6(ip) {
+  const clean = ip.toLowerCase().trim();
+  
+  if (clean === '::1' || clean === '0:0:0:0:0:0:0:1' || clean === '::') return true;
+  
+  if (/^fe[89ab]/i.test(clean)) return true;
+  
+  if (/^f[cd]/i.test(clean)) return true;
+
+  const mapped = clean.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped && isPrivateIPv4(mapped[1])) return true;
+
+  return false;
+}
+
+export function isIpAddress(host) {
+  if (!host || typeof host !== 'string') return false;
+  return Boolean(parseIPv4(host)) || host.includes(':');
+}
+
+const DNS_CACHE = new Map();
+const DNS_CACHE_TTL_MS = 60_000;
+const DNS_CACHE_FAIL_TTL_MS = 10_000;
+const DNS_CACHE_MAX_ENTRIES = 1000;
+
+function setDnsCacheEntry(hostname, entry) {
+  if (!DNS_CACHE.has(hostname) && DNS_CACHE.size >= DNS_CACHE_MAX_ENTRIES) {
+    const oldestKey = DNS_CACHE.keys().next().value;
+    if (oldestKey !== undefined) DNS_CACHE.delete(oldestKey);
+  }
+  DNS_CACHE.set(hostname, entry);
+}
+
+export function clearDnsCache() {
+  DNS_CACHE.clear();
+}
+
+const httpKeepAliveAgent = new http.Agent({ keepAlive: true, maxSockets: 20 });
+const httpsKeepAliveAgent = new https.Agent({ keepAlive: true, maxSockets: 20 });
+
+export async function assertSafeUrlHostname(hostname) {
+  if (!hostname || typeof hostname !== 'string') {
+    return { safe: false, reason: 'Missing hostname' };
+  }
+  const clean = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
+
+  if (clean === 'localhost' || clean.endsWith('.localhost') || clean.includes('metadata.google') || clean.includes('169.254.169.254')) {
+    return { safe: false, reason: `Blocked hostname: ${clean}` };
+  }
+
+  const parsedIp = parseIPv4(clean);
+  if (parsedIp) {
+    if (isPrivateIPv4(parsedIp)) {
+      return { safe: false, reason: `Target is private/internal IP: ${clean}` };
+    }
+    return { safe: true, pinnedIp: parsedIp };
+  }
+
+  if (isIpAddress(clean)) {
+    if (isPrivateIPv6(clean)) {
+      return { safe: false, reason: `Target is private/internal IP: ${clean}` };
+    }
+    return { safe: true, pinnedIp: clean };
+  }
+
+  const cached = DNS_CACHE.get(clean);
+  if (cached && cached.expiresAt > Date.now()) {
+    return { safe: cached.safe, pinnedIp: cached.pinnedIp, reason: cached.reason };
+  }
+
+  try {
+    const addresses = await dnsLookup(clean, { all: true });
+    if (!addresses || addresses.length === 0) {
+      const res = { safe: false, reason: `Unable to resolve DNS for hostname "${clean}"` };
+      setDnsCacheEntry(clean, { ...res, expiresAt: Date.now() + DNS_CACHE_FAIL_TTL_MS });
+      return res;
+    }
+
+    for (const { address } of addresses) {
+      if (isPrivateIPv4(address) || isPrivateIPv6(address)) {
+        const res = { safe: false, reason: `Hostname "${clean}" resolved to private IP: ${address}` };
+        setDnsCacheEntry(clean, { ...res, expiresAt: Date.now() + DNS_CACHE_FAIL_TTL_MS });
+        return res;
+      }
+    }
+
+    const res = { safe: true, pinnedIp: addresses[0].address };
+    setDnsCacheEntry(clean, { ...res, expiresAt: Date.now() + DNS_CACHE_TTL_MS });
+    return res;
+  } catch (err) {
+    const res = { safe: false, reason: `DNS lookup failed for "${clean}": ${err.message}` };
+    setDnsCacheEntry(clean, { ...res, expiresAt: Date.now() + DNS_CACHE_FAIL_TTL_MS });
+    return res;
+  }
+}
+
+
+export async function safeFetchWithPinning(inputUrl, options = {}, maxRedirects = 3) {
+  let currentUrl = String(inputUrl || '');
+  let currentOptions = { ...options };
+
+  for (let redirects = 0; redirects <= maxRedirects; redirects++) {
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(currentUrl);
+    } catch {
+      throw new Error(`Invalid URL format: "${currentUrl}"`);
+    }
+
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      throw new Error(`Unsupported protocol: ${parsedUrl.protocol}`);
+    }
+
+    const hostname = parsedUrl.hostname.toLowerCase();
+    const ssrfCheck = await assertSafeUrlHostname(hostname);
+    if (!ssrfCheck.safe) {
+      throw new Error(`SSRF Guard rejected: ${ssrfCheck.reason}`);
+    }
+
+    const targetIp = ssrfCheck.pinnedIp;
+    const isHttps = parsedUrl.protocol === 'https:';
+    const client = isHttps ? https : http;
+    const port = parsedUrl.port ? Number(parsedUrl.port) : (isHttps ? 443 : 80);
+    const method = String(currentOptions.method || 'GET').toUpperCase();
+
+    const headers = { ...(currentOptions.headers || {}) };
+    if (!headers.host && !headers.Host) {
+      headers.Host = parsedUrl.host;
+    }
+
+    const agent = currentOptions.agent || (isHttps ? httpsKeepAliveAgent : httpKeepAliveAgent);
+
+    const response = await new Promise((resolve, reject) => {
+      let req = null;
+      try {
+        req = client.request({
+          host: targetIp, 
+          port,
+          path: parsedUrl.pathname + parsedUrl.search,
+          method,
+          headers,
+          agent,
+          servername: isHttps ? hostname : undefined, 
+          signal: currentOptions.signal,
+          timeout: currentOptions.timeoutMs || 15000
+        }, res => {
+          const chunks = [];
+          let bytesReceived = 0;
+          const maxBytes = currentOptions.maxBytes || 5_000_000;
+
+          res.on('data', chunk => {
+            bytesReceived += chunk.length;
+            if (bytesReceived <= maxBytes) {
+              chunks.push(chunk);
+            } else {
+              res.destroy();
+              req.destroy();
+            }
+          });
+
+          res.on('end', () => {
+            const bodyBuffer = Buffer.concat(chunks);
+            const responseHeaders = new Headers();
+            for (const [k, v] of Object.entries(res.headers)) {
+              if (Array.isArray(v)) {
+                v.forEach(val => responseHeaders.append(k, val));
+              } else if (v !== undefined) {
+                responseHeaders.set(k, v);
+              }
+            }
+
+            resolve({
+              status: res.statusCode || 200,
+              statusText: res.statusMessage || '',
+              ok: res.statusCode >= 200 && res.statusCode < 300,
+              headers: responseHeaders,
+              url: parsedUrl.href,
+              text: async () => bodyBuffer.toString('utf8'),
+              json: async () => JSON.parse(bodyBuffer.toString('utf8')),
+              buffer: async () => bodyBuffer
+            });
+          });
+        });
+
+        req.on('error', reject);
+        req.on('timeout', () => {
+          req.destroy(new Error(`Request to ${hostname} (${targetIp}) timed out`));
+        });
+
+        if (currentOptions.body) {
+          req.write(currentOptions.body);
+        }
+        req.end();
+      } catch (err) {
+        reject(err);
+      }
+    });
+
+    const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return response;
+    }
+
+    const location = response.headers.get('location');
+    if (!location) return response;
+    if (redirects === maxRedirects) throw new Error('Too many redirects');
+
+    currentUrl = new URL(location, parsedUrl).href;
+  }
+
+  throw new Error('Too many redirects');
+}

package/server/agent/websearch/telemetry.js

@@ -0,0 +1,71 @@
+export class SearchTelemetry {
+  constructor() {
+    this.reset();
+  }
+
+  reset() {
+    this.totalSearches = 0;
+    this.fallbackTriggers = 0;
+    this.zeroResults = 0;
+    this.latencies = [];
+    this.circuitBreakerTrips = {
+      duckduckgo: 0,
+      searxng: 0,
+      jina: 0
+    };
+    this.searchesByEngine = {
+      duckduckgo: 0,
+      searxng: 0,
+      jina: 0
+    };
+  }
+
+  recordSearch({ latencyMs = 0, fallbackOccurred = false, zeroResult = false, engine = null } = {}) {
+    this.totalSearches++;
+    if (fallbackOccurred) this.fallbackTriggers++;
+    if (zeroResult) this.zeroResults++;
+    if (Number.isFinite(latencyMs) && latencyMs >= 0) {
+      this.latencies.push(latencyMs);
+      if (this.latencies.length > 2000) {
+        this.latencies = this.latencies.slice(-1000);
+      }
+    }
+    if (engine && this.searchesByEngine[engine] !== undefined) {
+      this.searchesByEngine[engine]++;
+    }
+  }
+
+  recordCircuitTrip(engine) {
+    const key = String(engine || '').toLowerCase();
+    if (this.circuitBreakerTrips[key] !== undefined) {
+      this.circuitBreakerTrips[key]++;
+    } else {
+      this.circuitBreakerTrips[key] = 1;
+    }
+  }
+
+  calculateP95Latency() {
+    if (this.latencies.length === 0) return 0;
+    const sorted = [...this.latencies].sort((a, b) => a - b);
+    const index = Math.ceil(sorted.length * 0.95) - 1;
+    return sorted[Math.max(0, index)];
+  }
+
+  getMetrics() {
+    const total = this.totalSearches || 1;
+    const fallbackRate = (this.fallbackTriggers / total);
+    const zeroRate = (this.zeroResults / total);
+    const p95 = this.calculateP95Latency();
+
+    return {
+      totalSearches: this.totalSearches,
+      fallbackTriggerRate: Number(fallbackRate.toFixed(4)),
+      zeroResultRate: Number(zeroRate.toFixed(4)),
+      searchLatencyP95Ms: p95,
+      circuitBreakerTrips: { ...this.circuitBreakerTrips },
+      searchesByEngine: { ...this.searchesByEngine }
+    };
+  }
+}
+
+export const defaultTelemetry = new SearchTelemetry();

package/server/agent/youtubeAuth.js

@@ -1,24 +1,32 @@
 import fs from 'fs';
 import path from 'path';
-import { spawn, execSync } from 'child_process';
+import { spawn, execFile } from 'child_process';
+import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import { KIKU_DATA_DIR } from './appPaths.js';
+import { PACKAGE_ENV_PATH, USER_ENV_PATH, upsertEnvKey } from './envManager.js';
+import { bootstrapEnv } from './envBootstrap.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ENV_PATH = path.resolve(__dirname, '..', '..', '.env');
+
+bootstrapEnv();
+
+const execFileAsync = promisify(execFile);
+const getPrimaryEnvPath = () => (fs.existsSync(PACKAGE_ENV_PATH) ? PACKAGE_ENV_PATH : USER_ENV_PATH);
 const AUTH_CONFIG_PATH = path.join(KIKU_DATA_DIR, 'yt_auth.json');
-const SECURE_COOKIE_PATH = path.join(KIKU_DATA_DIR, 'cookies.txt');
-loadEnv();
-const YTDLP_CMD = process.env.KIKU_YTDLP || 'yt-dlp';
+const COOKIE_FILE_PATH = path.join(KIKU_DATA_DIR, 'cookies.txt');
+
+const YTDLP_CMD = () => process.env.KIKU_YTDLP || 'yt-dlp';
 
 
 const BROWSERS = ['firefox', 'chrome', 'edge', 'brave'];
+let browserDetectionCache = null;
 
-function findBrowserExe(browser) {
+async function findBrowserExeAsync(browser, { execImpl = execFileAsync } = {}) {
   const isWin = process.platform === 'win32';
   const probes = {
     firefox: {
-      cmd: isWin ? 'firefox' : 'firefox',
+      cmd: 'firefox',
       paths: [
         'C:\\Program Files\\Mozilla Firefox\\firefox.exe',
         'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe',
@@ -53,7 +61,7 @@ function findBrowserExe(browser) {
   const p = probes[browser];
   if (!p) return null;
   try {
-    execSync(isWin ? `where ${p.cmd}` : `which ${p.cmd}`, { stdio: 'ignore', windowsHide: true });
+    await execImpl(isWin ? 'where' : 'which', [p.cmd], { windowsHide: true, timeout: 1500 });
     return p.cmd;
   } catch {}
 
@@ -65,12 +73,18 @@ function findBrowserExe(browser) {
   return null;
 }
 
-function detectBrowsers() {
-  return BROWSERS.filter(b => findBrowserExe(b) !== null);
+async function detectBrowsersCached({ execImpl } = {}) {
+  if (browserDetectionCache) return browserDetectionCache;
+  const found = [];
+  for (const b of BROWSERS) {
+    if (await findBrowserExeAsync(b, { execImpl })) found.push(b);
+  }
+  browserDetectionCache = found;
+  return found;
 }
 
-function openBrowser(url, browser) {
-  const exe = browser ? findBrowserExe(browser) : null;
+async function openBrowser(url, browser) {
+  const exe = browser ? await findBrowserExeAsync(browser) : null;
   const isWin = process.platform === 'win32';
   try {
     if (exe) {
@@ -105,8 +119,7 @@ function writeAuthConfig(updates) {
   } catch {}
 }
 
-function loadEnv() {
-
+function refreshYtAuthEnv() {
   const userConfig = readAuthConfig();
   if (userConfig.KIKU_YT_BROWSER && process.env.KIKU_YT_BROWSER === undefined) {
     process.env.KIKU_YT_BROWSER = userConfig.KIKU_YT_BROWSER;
@@ -114,62 +127,40 @@ function loadEnv() {
   if (userConfig.KIKU_YT_COOKIES && process.env.KIKU_YT_COOKIES === undefined) {
     process.env.KIKU_YT_COOKIES = userConfig.KIKU_YT_COOKIES;
   }
-
-
-  try {
-    if (!fs.existsSync(ENV_PATH)) return;
-    const text = fs.readFileSync(ENV_PATH, 'utf8');
-    for (const line of text.split('\n')) {
-      const m = line.match(/^\s*([\w.-]+)\s*=\s*(.*)\s*$/);
-      if (!m) continue;
-      const key = m[1].trim();
-      const val = m[2].trim().replace(/^["']|["']$/g, '');
-      if (process.env[key] === undefined) process.env[key] = val;
-    }
-  } catch {}
-}
-
-function readEnvMap() {
-  const map = {};
-  try {
-    if (!fs.existsSync(ENV_PATH)) return map;
-    const text = fs.readFileSync(ENV_PATH, 'utf8');
-    for (const line of text.split('\n')) {
-      const m = line.match(/^\s*([\w.-]+)\s*=\s*(.*)\s*$/);
-      if (m) map[m[1]] = m[2].replace(/^["']|["']$/g, '');
-    }
-  } catch {}
-  return map;
 }
 
 function writeEnv(updates) {
-
-  for (const [k, v] of Object.entries(updates)) {
-    process.env[k] = v;
+  const cleanUpdates = {};
+  for (const [k, v] of Object.entries(updates || {})) {
+    const cleanKey = String(k || '').replace(/[\r\n]+/g, '').trim();
+    const cleanVal = String(v ?? '').replace(/[\r\n]+/g, '').trim();
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(cleanKey)) {
+      cleanUpdates[cleanKey] = cleanVal;
+      process.env[cleanKey] = cleanVal;
+    }
   }
-  writeAuthConfig(updates);
+  writeAuthConfig(cleanUpdates);
 
- 
   try {
-    const map = readEnvMap();
-    Object.assign(map, updates);
-    const out = Object.entries(map).map(([k, v]) => `${k}=${v}`).join('\n') + '\n';
-    fs.writeFileSync(ENV_PATH, out, 'utf8');
+    const envFile = getPrimaryEnvPath();
+    for (const [key, value] of Object.entries(cleanUpdates)) {
+      upsertEnvKey(envFile, key, value);
+    }
   } catch {}
 }
 
-function hasSession(browser) {
+function hasSession(browser, { timeoutMs = 6000 } = {}) {
   return new Promise((resolve) => {
-    const timeoutMs = 8000;
+    const probeUrl = process.env.KIKU_YT_PROBE_URL || 'https://www.youtube.com/watch?v=dQw4w9WgXcQ';
     const args = [
       '--cookies-from-browser', browser,
       '--print', '%(title)s',
       '--no-warnings',
       '--no-playlist',
       '--no-check-certificates',
-      'https://www.youtube.com/watch?v=dQw4w9WgXcQ'
+      probeUrl
     ];
-    const p = spawn(YTDLP_CMD, args, {
+    const p = spawn(YTDLP_CMD(), args, {
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe']
     });
@@ -182,17 +173,18 @@ function hasSession(browser) {
       if (!resolved) {
         resolved = true;
         try { p.kill('SIGKILL'); } catch {}
-        resolve(false);
+        resolve({ ok: false, reason: 'timeout' });
       }
     }, timeoutMs);
 
     p.stdout?.on('data', d => { out += d.toString(); });
     p.stderr?.on('data', d => { err += d.toString(); });
-    p.on('error', () => {
+    p.on('error', (spawnErr) => {
       if (!resolved) {
         resolved = true;
         clearTimeout(timer);
-        resolve(false);
+        const missing = spawnErr?.code === 'ENOENT';
+        resolve({ ok: false, reason: missing ? 'yt-dlp-missing' : 'spawn-error', detail: spawnErr?.message });
       }
     });
     p.on('close', (code) => {
@@ -201,7 +193,11 @@ function hasSession(browser) {
       clearTimeout(timer);
       const title = out.trim();
       const blocked = /403|Forbidden|Sign in|confirm you'?re not a bot|Login Required|Private Video|database is locked/i.test(err);
-      resolve(code === 0 && title.length > 0 && !blocked);
+      if (code === 0 && title.length > 0 && !blocked) {
+        resolve({ ok: true, reason: 'session-found' });
+      } else {
+        resolve({ ok: false, reason: blocked ? 'blocked' : 'no-session', detail: err.slice(0, 200) });
+      }
     });
   });
 }
@@ -248,18 +244,17 @@ export function isCookieFileValid(filePath) {
 }
 
 async function _ensureYouTubeCookiesImpl(opts = {}) {
-  loadEnv();
+  refreshYtAuthEnv();
 
   const cookiesCandidate = (process.env.KIKU_YT_COOKIES && isCookieFileValid(process.env.KIKU_YT_COOKIES))
     ? process.env.KIKU_YT_COOKIES
-    : (isCookieFileValid(SECURE_COOKIE_PATH) ? SECURE_COOKIE_PATH : null);
+    : (isCookieFileValid(COOKIE_FILE_PATH) ? COOKIE_FILE_PATH : null);
   if (cookiesCandidate && isCookieFileValid(cookiesCandidate)) {
     _ensured = { ok: true, source: 'file', cookiesPath: cookiesCandidate };
     return _ensured;
   }
 
- 
-  const available = detectBrowsers();
+  const available = await detectBrowsersCached();
   if (!available.length) {
     _ensured = { ok: false, reason: 'no-browser', detail: 'No supported browser found (Firefox, Chrome, Edge, Brave)' };
     _lastFailTime = Date.now();
@@ -271,12 +266,21 @@ async function _ensureYouTubeCookiesImpl(opts = {}) {
     ? [preferred, ...available.filter(b => b !== preferred)]
     : available;
 
+  let sawYtdlpMissing = false;
   for (const b of candidates) {
-    if (await hasSession(b)) {
+    const probe = await hasSession(b, { timeoutMs: opts.probeTimeoutMs });
+    if (probe.ok) {
       writeEnv({ KIKU_YT_BROWSER: b });
       _ensured = { ok: true, source: 'existing-session', browser: b };
       return _ensured;
     }
+    if (probe.reason === 'yt-dlp-missing') sawYtdlpMissing = true;
+  }
+
+  if (sawYtdlpMissing) {
+    _ensured = { ok: false, reason: 'yt-dlp-missing', detail: `yt-dlp was not found (set KIKU_YTDLP in .env, e.g. ${YTDLP_CMD()})` };
+    _lastFailTime = Date.now();
+    return _ensured;
   }
 
  
@@ -310,7 +314,8 @@ async function _ensureYouTubeCookiesImpl(opts = {}) {
     }
 
     for (const b of available) {
-      if (await hasSession(b)) {
+      const probe = await hasSession(b, { timeoutMs: opts.probeTimeoutMs });
+      if (probe.ok) {
         writeEnv({ KIKU_YT_BROWSER: b });
         if (process.stdout.isTTY) {
           process.stdout.write('\r' + ' '.repeat(65) + '\r');
@@ -335,9 +340,9 @@ async function _ensureYouTubeCookiesImpl(opts = {}) {
 }
 
 export async function exportCookiesToFile() {
-  loadEnv();
+  refreshYtAuthEnv();
 
-  const available = detectBrowsers();
+  const available = await detectBrowsersCached();
   const preferred = process.env.KIKU_YT_BROWSER;
   const candidates = preferred && available.includes(preferred)
     ? [preferred, ...available.filter(b => b !== preferred)]
@@ -348,18 +353,18 @@ export async function exportCookiesToFile() {
       fs.mkdirSync(KIKU_DATA_DIR, { recursive: true });
       const args = [
         '--cookies-from-browser', b,
-        '--cookies', SECURE_COOKIE_PATH,
+        '--cookies', COOKIE_FILE_PATH,
         '--no-warnings',
         '--skip-download',
-        'https://www.youtube.com/watch?v=dQw4w9WgXcQ'
+        process.env.KIKU_YT_PROBE_URL || 'https://www.youtube.com/watch?v=dQw4w9WgXcQ'
       ];
       await new Promise((resolve, reject) => {
-        const p = spawn(YTDLP_CMD, args, { windowsHide: true, stdio: ['ignore', 'ignore', 'pipe'] });
+        const p = spawn(YTDLP_CMD(), args, { windowsHide: true, stdio: ['ignore', 'ignore', 'pipe'] });
         let err = '';
         p.stderr?.on('data', d => { err += d.toString(); });
         p.on('error', reject);
         p.on('close', code => {
-          if (code === 0 && fs.existsSync(SECURE_COOKIE_PATH)) {
+          if (code === 0 && fs.existsSync(COOKIE_FILE_PATH)) {
             resolve();
           } else {
             reject(new Error(err || `yt-dlp exited ${code}`));
@@ -367,8 +372,11 @@ export async function exportCookiesToFile() {
         });
       });
 
-      writeEnv({ KIKU_YT_COOKIES: SECURE_COOKIE_PATH });
-      return { ok: true, browser: b, cookiesPath: SECURE_COOKIE_PATH };
+      if (process.platform !== 'win32') {
+        try { fs.chmodSync(COOKIE_FILE_PATH, 0o600); } catch {}
+      }
+      writeEnv({ KIKU_YT_COOKIES: COOKIE_FILE_PATH });
+      return { ok: true, browser: b, cookiesPath: COOKIE_FILE_PATH };
     } catch {}
   }
 
@@ -384,12 +392,13 @@ export function resetCookieCheck() {
 export function getCookieStatus() {
   const envCookies = (process.env.KIKU_YT_COOKIES && isCookieFileValid(process.env.KIKU_YT_COOKIES))
     ? process.env.KIKU_YT_COOKIES
-    : (isCookieFileValid(SECURE_COOKIE_PATH) ? SECURE_COOKIE_PATH : null);
+    : (isCookieFileValid(COOKIE_FILE_PATH) ? COOKIE_FILE_PATH : null);
   return {
     ensured: _ensured,
     envBrowser: process.env.KIKU_YT_BROWSER || null,
     envCookies,
-    envPath: ENV_PATH,
+    envPath: getPrimaryEnvPath(),
+    userEnvPath: USER_ENV_PATH,
     authConfigPath: AUTH_CONFIG_PATH
   };
 }