plx-converter 0.1.4 → 0.1.5

package/dist/browser.js

@@ -243,3 +243,18 @@ export function fetchBrowserCredentials() {
     }
     return credentials;
 }
+// Why auto-fetch came back empty, said in the terms of the platform the user is actually on. macOS
+// is the only place a denied Keychain prompt can be the answer; everywhere else Firefox is the only
+// backend, so the useful thing to report is which half of that is missing. This says *why* only —
+// the caller owns pointing at the manual paste, so that instruction lives in one place. Both inputs
+// are injected so the branches are testable without a browser or a second OS.
+export function autoFetchHint(os = platform(), firefoxFound = firefoxProfiles().length > 0) {
+    if (os === 'darwin')
+        return 'No browser was logged in, or the macOS Keychain prompt was denied.';
+    if (firefoxFound)
+        return 'A Firefox profile was found but held none of the cookies — log in at the provider in Firefox and retry.';
+    const why = os === 'win32'
+        ? 'Chrome/Edge cookies are sealed by App-Bound Encryption that only a SYSTEM process can unwrap'
+        : 'the Chromium keyring backends are not implemented here';
+    return `Auto-fetch supports Firefox only on this OS and no Firefox profile was found — ${why}.`;
+}

package/dist/cli.js

@@ -1,36 +1,67 @@
 #!/usr/bin/env node
 import { confirm, intro, isCancel, outro, password, select, text } from '@clack/prompts';
+import { autoFetchHint } from './browser.js';
 import { credential, loadConfig, saveCredential, saveRecentUrl, tryAutoFillCredentials } from './config.js';
 import { Conversion } from './conversion.js';
 import { PROVIDERS, inferSource, providerFor, targetKeys } from './registry.js';
 import { HELP_TEXT, parseArgs } from './args.js';
 function args() { return process.argv.slice(2); }
 // --- Credentials -----------------------------------------------------------
-// Fill one provider's credential: browser auto-fill first, then a manual paste. Persists what it
-// gets. Returns the credential, or null when the user cancels.
+// Why the browser read came back with nothing for this provider, and what to do instead. Every
+// auto-fetch failure says this, so the user never sees a bare "could not be fetched".
+function explainAutoFetchFailure(spec) {
+    const what = spec ? `${spec.label} cookies` : 'No credentials';
+    console.log(`✗ ${what} could not be read from your browser. ${autoFetchHint()}`);
+}
+// One manual paste, with where to find the value and what a correct one looks like.
+async function promptCredential(cfg, spec) {
+    console.log(`ℹ️ Where to find it: ${spec.credentialHint}`);
+    console.log(`   Looks like:      ${spec.credentialExample}`);
+    const entered = await password({ message: `Paste ${spec.credentialLabel}` });
+    if (isCancel(entered) || !entered)
+        return false;
+    await saveCredential(cfg, spec.key, String(entered).trim()); // pasted values carry stray whitespace
+    return true;
+}
+// Fill one provider's credential mid-conversion: browser auto-fill first, then a manual paste.
+// Persists what it gets. Returns the credential, or null when the user cancels.
 async function ensureCredential(cfg, spec) {
     if (credential(cfg, spec.key))
         return credential(cfg, spec.key);
     const filled = await tryAutoFillCredentials(cfg);
     if (filled.includes(spec.key))
         return credential(cfg, spec.key);
-    const entered = await password({ message: `${spec.credentialLabel} (${spec.credentialHint})` });
-    if (isCancel(entered) || !entered)
+    explainAutoFetchFailure(spec);
+    if (!(await promptCredential(cfg, spec)))
         return null;
-    await saveCredential(cfg, spec.key, String(entered));
     return credential(cfg, spec.key);
 }
-// Settings entry for one provider's credential: unlike ensureCredential this always asks, so a
-// saved-but-expired credential can be replaced. Proves it against the live service before saying so.
+// Settings entry for one provider's credential. The two ways in are offered as a choice rather than
+// auto-first-then-manual, so someone who knows the browser read will fail (or who wants to replace a
+// saved-but-expired value with a cookie of their own) can go straight to the paste. Auto-fetch here
+// overwrites, scoped to this provider, so an expired credential is actually replaced.
+// Proves whatever lands against the live service before saying it worked.
 async function reenterCredential(cfg, spec) {
-    warnLogin(spec.loginSite);
-    const filled = await tryAutoFillCredentials(cfg);
-    if (!filled.includes(spec.key)) {
-        const entered = await password({ message: `${spec.credentialLabel} (${spec.credentialHint})` });
-        if (isCancel(entered) || !entered)
+    const how = await select({
+        message: `${spec.credentialLabel}`,
+        options: [
+            { value: 'auto', label: 'Auto-fetch from browser' },
+            { value: 'manual', label: 'Paste cookies manually' },
+        ],
+    });
+    if (isCancel(how))
+        return;
+    if (how === 'auto') {
+        warnLogin(spec.loginSite);
+        if ((await tryAutoFillCredentials(cfg, true, spec.key)).includes(spec.key)) {
+            await report(cfg, spec);
             return;
-        await saveCredential(cfg, spec.key, String(entered));
+        }
+        explainAutoFetchFailure(spec);
+        console.log('   Paste it manually instead:');
     }
+    if (!(await promptCredential(cfg, spec)))
+        return;
     await report(cfg, spec);
 }
 // Check one provider's stored credential against the live service and say what happened.
@@ -241,16 +272,22 @@ async function runInteractive(options) {
         if (choice === 'autofetch') {
             warnLogin(PROVIDERS.map((p) => p.label).join(' & '));
             const filled = await tryAutoFillCredentials(cfg, true);
-            if (!filled.length) {
-                console.log('✗ No credentials could be fetched (browser not logged in / keychain denied).');
-                continue;
+            if (filled.length) {
+                console.log(`Fetched from browser: ${filled.join(', ')}. Checking…`);
+                for (const key of filled) {
+                    const spec = providerFor(key);
+                    if (spec)
+                        await report(cfg, spec);
+                }
             }
-            console.log(`Fetched from browser: ${filled.join(', ')}. Checking…`);
-            for (const key of filled) {
-                const spec = providerFor(key);
-                if (spec)
-                    await report(cfg, spec);
+            else {
+                explainAutoFetchFailure();
             }
+            // Whatever auto-fetch managed, the manual path is what closes the gap — name it and the menu
+            // entry that leads to it, rather than leaving the user at a dead end.
+            const missing = PROVIDERS.filter((p) => !credential(cfg, p.key));
+            if (missing.length)
+                console.log(`→ Still missing: ${missing.map((p) => p.label).join(', ')}. Add them from "Credentials: ${saved}/${PROVIDERS.length} saved" → pick the provider → "Paste cookies manually".`);
             continue;
         }
         if (choice === 'output') {

package/dist/config.js

@@ -63,14 +63,16 @@ async function write(patch) {
 // Semi-auto: fill credentials from a logged-in browser (pops the macOS Keychain "Allow" dialog on
 // first use), persist what's found, and return the provider names filled. By default only fills
 // providers with no credential yet (env vars and stored credentials win); pass overwrite=true to
-// refetch and replace. Never throws — a denied keychain / TCC block just fills nothing, and the
-// caller falls back to the manual paste prompt.
-export async function tryAutoFillCredentials(cfg, overwrite = false) {
-    if (!overwrite && Object.keys(ENV_VAR).every((provider) => cfg.credentials[provider]))
+// refetch and replace, and `only` to confine that to one provider — the Credentials menu refetches
+// the provider being edited without quietly replacing the other two. Never throws — a denied
+// keychain / TCC block just fills nothing, and the caller falls back to the manual paste prompt.
+export async function tryAutoFillCredentials(cfg, overwrite = false, only) {
+    const wanted = only ? [only] : Object.keys(ENV_VAR);
+    if (!overwrite && wanted.every((provider) => cfg.credentials[provider]))
         return [];
     const filled = [];
     for (const [provider, value] of Object.entries(fetchBrowserCredentials())) {
-        if (!value || (!overwrite && cfg.credentials[provider]))
+        if (!value || !wanted.includes(provider) || (!overwrite && cfg.credentials[provider]))
             continue;
         cfg.credentials[provider] = value;
         filled.push(provider);

package/dist/registry.js

@@ -8,6 +8,7 @@ const spotify = {
     matches: ['open.spotify.com', 'spotify:playlist:'],
     credentialLabel: 'Spotify sp_dc',
     credentialHint: 'login open.spotify.com → F12 → Application → Cookies → sp_dc → copy value',
+    credentialExample: 'AQBv7pC3...9Kk  (the value only, ~150 chars, no "sp_dc=" prefix)',
     loginSite: 'Spotify (open.spotify.com)',
     anonymousRead: true,
     parseRef: async (ref) => parsePlaylistId(ref),
@@ -23,6 +24,7 @@ const deezer = {
     matches: ['deezer.com', 'link.deezer.com'],
     credentialLabel: 'Deezer ARL',
     credentialHint: 'login deezer.com → F12 → Application → Cookies → arl → copy value',
+    credentialExample: '3f9a1c...e7b2  (the value only, 192 hex chars, no "arl=" prefix)',
     loginSite: 'Deezer (deezer.com)',
     // Deezer's search is public, but reading a *playlist* goes through the authenticated GraphQL API.
     anonymousRead: false,
@@ -45,6 +47,7 @@ const ytmusic = {
     matches: ['music.youtube.com', 'youtube.com'],
     credentialLabel: 'YouTube Music cookies',
     credentialHint: 'login music.youtube.com → F12 → Network → any request → Request Headers → copy the whole "cookie:" value',
+    credentialExample: 'SAPISID=xxx; __Secure-3PAPISID=xxx; SID=xxx; __Secure-3PSID=xxx; __Secure-3PSIDTS=xxx; HSID=xxx; SSID=xxx; APISID=xxx  (one line, every cookie, SAPISID is required)',
     loginSite: 'YouTube Music (music.youtube.com)',
     anonymousRead: false,
     parseRef: async (ref) => parsePlaylistRef(ref),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plx-converter",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Convert playlists between Spotify, Deezer, and YouTube Music using your own browser session",
   "license": "MIT",
   "repository": {