notebooklm-mcp-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/.gitignore

@@ -83,6 +83,9 @@ notebooklm-mcp-*.mcpb
 # GitHub CLI temp files
 .gh_comment_body.md
 
+# Local ad-hoc test scripts
+scratch/
+
 # PR diff/patch scratch files
 *.diff
 *.patch

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.2] - 2026-06-08
+
+### Added
+
+- **ChatGPT File Parameter Upload Bridge (PR #220)** — Enables direct upload of files provided by ChatGPT App/Action clients by resolving and downloading from the client's temporary HTTPS URL before uploading to Google NotebookLM. Thanks to **@insane66613**!
+- **ChatGPT Artifact Download Bridge (PR #220)** — Allows copying generated artifacts to the local server's public directory and returning public download links when the server runs behind secure tunnels. Exposes a new `/artifacts/{filename}` route in the MCP HTTP server. Thanks to **@insane66613**!
+- **Transient Source Content Polling** (`poll_source_content` service function) — Automatically handles Google NotebookLM indexing states (processing, indexing, try again) via robust polling with exponential backoff when fetching raw source contents immediately after creation.
+
+### Fixed
+
+- **Sanitize `no_proxy` environment variable (PR #221)** — Fixed package import crashes on Windows systems by cleaning up the `no_proxy` environment variable on initialization before `httpx` parses it. Thanks to **@insane66613**!
+- **Modern Chrome Cookie DB path detection (PR #222)** — Improved the SQLite cookie database location search logic for Google Chrome to work correctly with modern Chrome setups. Thanks to **@insane66613**!
+- **Profile-aware headless refresh (PR #223)** — Fixed headless login refresh to use the default/active profile configured in the CLI configuration file instead of falling back. Thanks to **@insane66613**!
+- **`AuthHealthChecker` API fallback passed wrong cookie format, causing false `stale` on semi-stale sessions (PR #225)** — The API fallback flattened `profile.cookies` to a dict, dropping domain-specific duplicates and omitting `session_id` / `build_label`. The API probe now passes `profile.cookies` unchanged with all session fields, matching `nlm login --check`. Thanks to **@insane66613**!
+- **`server_info`, `refresh_auth`, and `studio_create` disagreed on semi-stale auth (PR #225, Fixes #224)** — These three MCP paths each ran independent auth checks, so `server_info` could report `stale` and `studio_create` refuse to run while `notebook_list` and CLI tools worked fine. All MCP auth gates now share `credentials_are_usable()` (`AuthHealthChecker` + live API confirmation), eliminating split-brain results. Thanks to **@insane66613**!
+
+## [0.7.1] - 2026-06-06
+
+### Fixed
+
+- **`server_info` reported `"stale"` for valid semi-stale cookies (PR #219)** — Google enforces different session lifecycles for the NotebookLM homepage (a navigation endpoint) and the RPC API endpoints. Cookies that are "semi-stale" — rejected by the homepage with a redirect to `accounts.google.com`, but still 100% accepted by the RPC API — were causing the MCP `server_info` tool (and `nlm login --check`) to falsely report `"stale"` even though every actual API tool would work fine. The new `AuthHealthChecker` runs a homepage probe first and, on `expired` / `http_401` / `http_403`, falls back to a live `NotebookLMClient.list_notebooks()` call before deciding. The homepage headers were also upgraded to use the full browser-like `_PAGE_FETCH_HEADERS` (including `Sec-Fetch-Dest` / `Sec-Fetch-Mode` / `Sec-Fetch-Site` / `Sec-Fetch-User`) — without them Google was bot-detecting the homepage check and redirecting even fresh cookies, producing false `"stale"` reports on first probe. Results are cached for 30 seconds with mtime-based bypass, so an external `nlm login` is reflected without waiting for the TTL. The CLI and MCP now share the cache via the `get_auth_health_checker()` singleton in `services/auth.py`. Thanks to **@SERDAR-AKIN** for the original multi-probe design and PR #219!
+
+### Changed
+
+- **`AuthHealthChecker` lives in `services/auth.py`, not `core/auth.py`** — the multi-probe orchestration, 30-second cache, and verdict aggregation are business logic and belong in the services layer per the layering rule in `CLAUDE.md` / `AGENTS.md` / `GEMINI.md`. `core/auth.py` stays focused on the low-level auth primitives (`AuthManager`, `AuthTokens`, `check_auth`, `save_tokens_to_cache`, `load_cached_tokens`, `_fetch_notebooklm_homepage`).
+- **`server_info` docstring no longer calls `auth_status` a "live check"** — it is cached for 30 seconds with mtime-based bypass. `docs/AUTHENTICATION.md` documents the same contract for `nlm login --check` (always live) vs `server_info` (cached).
+- **`AuthHealthReport.valid` is now `verdict == "configured"` (was `!=`)** — the field was inverted: it returned `True` for `stale` / `unverified` / `not_configured` reports. Pinned by `TestReportValid` in `tests/services/test_auth_health.py`.
+- **API-probe exceptions are classified as transport errors when they are** — `_probe_api` now catches `httpx.TimeoutException` and `httpx.RequestError` explicitly and emits the `"network_error:"` prefix so `_determine_verdict` can route them to `"unverified"`. Previously all exceptions emitted `f"{type(e).__name__}: {e}"`, which meant a real transport error on the API path was misclassified as an auth failure (`"stale"`). Pinned by `TestProbeApiErrorClassification` in `tests/services/test_auth_health.py`.
+
 ## [0.7.0] - 2026-06-03
 
 ### Added

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/CLAUDE.md

@@ -11,6 +11,9 @@ Tested with personal/free tier accounts. May work with Google Workspace accounts
 ## Development Commands
 
 ```bash
+# Fetch latest from remote (run before git operations)
+git fetch
+
 # Install dependencies
 uv tool install .
 
@@ -142,7 +145,8 @@ src/notebooklm_tools/
 | `notebook_get` | Get notebook details |
 | `notebook_describe` | Get AI-generated summary of notebook content with keywords |
 | `source_describe` | Get AI-generated summary and keyword chips for a source |
-| `source_get_content` | Get raw text content from a source (no AI processing) |
+| `source_get_content` | Get raw text content from a source (no AI processing). Supports `wait`, `wait_timeout`, `poll_interval` params and returns `download_url` when MCP HTTP transport is active. |
+| `source_add_chatgpt_file` | Add a ChatGPT-uploaded file to a notebook (supports `openai/fileParams`). Supports `wait`, `wait_timeout`, `cleanup` params. |
 | `notebook_rename` | Rename a notebook |
 | `chat_configure` | Configure chat goal/style and response length |
 | `notebook_delete` | Delete a notebook (REQUIRES confirmation) |
@@ -156,7 +160,7 @@ src/notebooklm_tools/
 | `research_status` | Check research progress and get results |
 | `research_import` | Import discovered sources into notebook |
 | `studio_create` | Generate unified content (audio, video, infographic, slides, etc.) |
-| `download_artifact` | Download any artifact (audio, video, pdf, markdown, json) |
+| `download_artifact` | Download any artifact (audio, video, pdf, markdown, json). Supports `wait`, `wait_timeout`, `poll_interval` params and returns `download_url` when MCP HTTP transport is active. |
 | `export_artifact` | Export Data Tables to Google Sheets or Reports to Google Docs |
 | `studio_status` | Check studio artifact generation status |
 | `studio_delete` | Delete studio artifacts (REQUIRES confirmation) |

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: notebooklm-mcp-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: Unified CLI and MCP server for Google NotebookLM
 Project-URL: Homepage, https://github.com/jacob-bd/notebooklm-mcp-cli
 Project-URL: Repository, https://github.com/jacob-bd/notebooklm-mcp-cli
@@ -37,8 +37,7 @@ Description-Content-Type: text/markdown
 [![Total downloads](https://static.pepy.tech/badge/notebooklm-mcp-cli)](https://pepy.tech/projects/notebooklm-mcp-cli)
 [![Python](https://img.shields.io/pypi/pyversions/notebooklm-mcp-cli)](https://pypi.org/project/notebooklm-mcp-cli/)
 [![License](https://img.shields.io/pypi/l/notebooklm-mcp-cli)](https://github.com/jacob-bd/notebooklm-mcp-cli/blob/main/LICENSE)
-
-> 🎉 **January 2026 — Major Update!** This project has been completely refactored to unify **NotebookLM-MCP** and **NotebookLM-CLI** into a single, powerful package. One install gives you both the CLI (`nlm`) and MCP server (`notebooklm-mcp`). See the [CLI Guide](docs/CLI_GUIDE.md) and [MCP Guide](docs/MCP_GUIDE.md) for full documentation.
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-FFDD00?style=flat-square&logo=buy-me-a-coffee&logoColor=black)](https://buymeacoffee.com/jacobbd)
 
 **Programmatic access to Google NotebookLM** — via command-line interface (CLI) or Model Context Protocol (MCP) server.
 
@@ -603,6 +602,15 @@ Special thanks to:
 - **codepiano** ([@codepiano](https://github.com/codepiano)) for the configurable DevTools timeout for the auth CLI.
 - **Tony Hansmann** ([@997unix](https://github.com/997unix)) for contributing the `nlm setup` and `nlm doctor` commands and CLI Guide documentation.
 - **Fabiana Furtado** ([@fabianafurtadoff](https://github.com/fabianafurtadoff)) for batch operations, cross-notebook query, pipelines, and smart select/tagging (PR #90).
+- **Amy-Ra-lph** ([@Amy-Ra-lph](https://github.com/Amy-Ra-lph)) for security hardening: TOCTOU-safe credential storage, sensitive cookie redaction from debug logs, and pinning all CI actions to full commit SHAs (PRs #205–207).
+- **Kyle Brodeur** ([@kylebrodeur](https://github.com/kylebrodeur)) for WSL2 authentication support with Windows Chrome integration (PR #138).
+- **Robiton** ([@Robiton](https://github.com/Robiton)) for enterprise NotebookLM support via configurable base URL (PR #114).
+- **pjeby** ([@pjeby](https://github.com/pjeby)) for connection pooling and fast startup improvements (PR #54).
+- **beausea** ([@beausea](https://github.com/beausea)) for making the interface language configurable via the `NOTEBOOKLM_HL` environment variable (PR #59).
+- **JumpLao** ([@JumpLao](https://github.com/JumpLao)) for extended audio, video, and image format support (PR #82).
+- **cbruyndoncx** ([@cbruyndoncx](https://github.com/cbruyndoncx)) for including `cited_text` passages in query output (PR #81).
+- **zxyasfas** ([@zxyasfas](https://github.com/zxyasfas)) for cited-only research import (PR #188).
+- **Serdar Akın** ([@SERDAR-AKIN](https://github.com/SERDAR-AKIN)) for the multi-probe `AuthHealthChecker` that fixes false `"stale"` reports for semi-stale cookies (PR #219).
 
 
 ## Star History

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/README.md

@@ -7,8 +7,7 @@
 [![Total downloads](https://static.pepy.tech/badge/notebooklm-mcp-cli)](https://pepy.tech/projects/notebooklm-mcp-cli)
 [![Python](https://img.shields.io/pypi/pyversions/notebooklm-mcp-cli)](https://pypi.org/project/notebooklm-mcp-cli/)
 [![License](https://img.shields.io/pypi/l/notebooklm-mcp-cli)](https://github.com/jacob-bd/notebooklm-mcp-cli/blob/main/LICENSE)
-
-> 🎉 **January 2026 — Major Update!** This project has been completely refactored to unify **NotebookLM-MCP** and **NotebookLM-CLI** into a single, powerful package. One install gives you both the CLI (`nlm`) and MCP server (`notebooklm-mcp`). See the [CLI Guide](docs/CLI_GUIDE.md) and [MCP Guide](docs/MCP_GUIDE.md) for full documentation.
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-FFDD00?style=flat-square&logo=buy-me-a-coffee&logoColor=black)](https://buymeacoffee.com/jacobbd)
 
 **Programmatic access to Google NotebookLM** — via command-line interface (CLI) or Model Context Protocol (MCP) server.
 
@@ -573,6 +572,15 @@ Special thanks to:
 - **codepiano** ([@codepiano](https://github.com/codepiano)) for the configurable DevTools timeout for the auth CLI.
 - **Tony Hansmann** ([@997unix](https://github.com/997unix)) for contributing the `nlm setup` and `nlm doctor` commands and CLI Guide documentation.
 - **Fabiana Furtado** ([@fabianafurtadoff](https://github.com/fabianafurtadoff)) for batch operations, cross-notebook query, pipelines, and smart select/tagging (PR #90).
+- **Amy-Ra-lph** ([@Amy-Ra-lph](https://github.com/Amy-Ra-lph)) for security hardening: TOCTOU-safe credential storage, sensitive cookie redaction from debug logs, and pinning all CI actions to full commit SHAs (PRs #205–207).
+- **Kyle Brodeur** ([@kylebrodeur](https://github.com/kylebrodeur)) for WSL2 authentication support with Windows Chrome integration (PR #138).
+- **Robiton** ([@Robiton](https://github.com/Robiton)) for enterprise NotebookLM support via configurable base URL (PR #114).
+- **pjeby** ([@pjeby](https://github.com/pjeby)) for connection pooling and fast startup improvements (PR #54).
+- **beausea** ([@beausea](https://github.com/beausea)) for making the interface language configurable via the `NOTEBOOKLM_HL` environment variable (PR #59).
+- **JumpLao** ([@JumpLao](https://github.com/JumpLao)) for extended audio, video, and image format support (PR #82).
+- **cbruyndoncx** ([@cbruyndoncx](https://github.com/cbruyndoncx)) for including `cited_text` passages in query output (PR #81).
+- **zxyasfas** ([@zxyasfas](https://github.com/zxyasfas)) for cited-only research import (PR #188).
+- **Serdar Akın** ([@SERDAR-AKIN](https://github.com/SERDAR-AKIN)) for the multi-probe `AuthHealthChecker` that fixes false `"stale"` reports for semi-stale cookies (PR #219).
 
 
 ## Star History

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/desktop-extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "notebooklm-mcp",
   "display_name": "NotebookLM MCP Server",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Connect Claude to Google NotebookLM. Create podcasts, research topics, generate quizzes, flashcards, mind maps, and more from your notebooks.",
   "long_description": "This extension connects Claude Desktop to Google NotebookLM via the Model Context Protocol. It provides 29 tools for managing notebooks, sources, and generating AI content.\n\n**Prerequisites:**\n1. Install the package: `pip install notebooklm-mcp-cli` or `uv tool install notebooklm-mcp-cli`\n2. Authenticate: Run `nlm login` to set up your Google account\n\n**Features:**\n- Create and manage notebooks\n- Add sources (URLs, YouTube, Google Drive, text, files)\n- Generate podcasts (Audio Overview)\n- Create quizzes, flashcards, mind maps, reports\n- Research topics with web or Drive search",
   "author": {

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/docs/AUTHENTICATION.md

@@ -270,10 +270,15 @@ When you start seeing authentication errors, simply run `nlm login` again to ref
 ## Understanding `auth_status`
 
 The MCP `server_info` tool and `nlm login --check` report one of five
-`auth_status` values after a best-effort *live* check against NotebookLM.
-Knowing the difference matters: a `stale` status means you must re-auth, but
+`auth_status` values from the multi-probe AuthHealthChecker. Knowing the
+difference matters: a `stale` status means you must re-auth, but
 an `unverified` status is a network problem, not a credential problem.
 
+> **Caching note:** the `server_info` result is cached for 30 seconds
+> (the checker's `CACHE_TTL`) and bypassed on the next call if any auth
+> file on disk is rewritten, so an external `nlm login` is reflected
+> without waiting for the TTL. `nlm login --check` is always live.
+
 | Status | Meaning | What to do |
 |--------|---------|------------|
 | `configured` | Live check passed. Credentials are good. | Nothing. |

notebooklm_mcp_cli-0.7.2/docs/CHATGPT_CONNECTOR_SETUP.md

@@ -0,0 +1,162 @@
+# ChatGPT connector setup
+
+This guide covers using `notebooklm-mcp-cli` from ChatGPT with normal ChatGPT file uploads and downloadable NotebookLM outputs.
+
+## Capabilities
+
+- Add a normal ChatGPT-uploaded file to NotebookLM with `source_add_chatgpt_file`.
+- Retrieve source text with `source_get_content` and get a downloadable `/artifacts/...` URL.
+- Download already-generated NotebookLM artifacts with `download_artifact`, including audio, video, slide decks, reports, mind maps, infographics, quizzes, flashcards, and data tables.
+- Serve downloaded files from the MCP HTTP server at `/artifacts/{filename}`.
+
+## Recommended flow for existing artifacts
+
+1. Call `studio_status` with a `notebook_id`.
+2. Pick an artifact whose `status` is `completed` and note its `artifact_id` and `type`.
+3. Call `download_artifact` with:
+   - `notebook_id`
+   - `artifact_type`
+   - `artifact_id`
+   - `output_path`
+4. Use the returned `download_url` from ChatGPT.
+
+Example result:
+
+```json
+{
+  "status": "success",
+  "artifact_type": "audio",
+  "path": "C:\\Users\\you\\Downloads\\overview.m4a",
+  "download_url": "https://your-public-host.example/artifacts/overview.m4a"
+}
+```
+
+## Local authentication
+
+Before exposing the MCP server to ChatGPT, verify NotebookLM auth locally:
+
+```powershell
+uv run nlm login --profile default --check
+```
+
+If expired, run:
+
+```powershell
+uv run nlm login --profile default --clear
+```
+
+## Option A: OpenAI/ChatGPT secure tunnel
+
+Use this when ChatGPT is configured in tunnel mode.
+
+Start the local MCP server:
+
+```powershell
+cd X:\Code\notebooklm-mcp-cli
+pwsh -File .\tools\run-chatgpt-tunnel.ps1 -Profile default -NoOpenAITunnel
+```
+
+Then create/connect the ChatGPT secure MCP tunnel using target URL:
+
+```text
+http://127.0.0.1:8811/mcp
+```
+
+The same server exposes files at:
+
+```text
+http://127.0.0.1:8811/artifacts/<filename>
+```
+
+When ChatGPT connects through a secure tunnel, the server captures forwarded host headers and returns public artifact links using the tunnel host.
+
+## Option B: Cloudflare tunnel
+
+Use this when you want a stable public hostname.
+
+Start the MCP server:
+
+```powershell
+cd X:\Code\notebooklm-mcp-cli
+uv run notebooklm-mcp --transport http --host 127.0.0.1 --port 8811 --query-timeout 600
+```
+
+Create a Cloudflare tunnel ingress rule pointing your hostname to the local origin:
+
+```yaml
+hostname: notebooklm-mcp.example.com
+service: http://127.0.0.1:8811
+```
+
+Then configure ChatGPT to use:
+
+```text
+https://notebooklm-mcp.example.com/mcp
+```
+
+Downloads will be returned as:
+
+```text
+https://notebooklm-mcp.example.com/artifacts/<filename>
+```
+
+For a quick local reverse-proxy test:
+
+```powershell
+pwsh -File .\tools\run-cloudflare-chatgpt.ps1 -PublicHostname notebooklm-mcp.example.com -Profile default
+```
+
+## Tool usage examples
+
+### Download an existing audio artifact
+
+```json
+{
+  "notebook_id": "<notebook-id>",
+  "artifact_type": "audio",
+  "artifact_id": "<completed-audio-artifact-id>",
+  "output_path": "C:\\Users\\you\\Downloads\\notebooklm-audio.m4a",
+  "wait": true,
+  "wait_timeout": 180,
+  "poll_interval": 5
+}
+```
+
+### Download an existing slide deck
+
+```json
+{
+  "notebook_id": "<notebook-id>",
+  "artifact_type": "slide_deck",
+  "artifact_id": "<completed-slide-deck-artifact-id>",
+  "output_path": "C:\\Users\\you\\Downloads\\notebooklm-slides.pdf",
+  "slide_deck_format": "pdf"
+}
+```
+
+### Retrieve source text as a downloadable file
+
+```json
+{
+  "source_id": "<source-id>",
+  "wait": true,
+  "wait_timeout": 120,
+  "poll_interval": 3
+}
+```
+
+## Delay handling
+
+NotebookLM may need time to index new sources or propagate generated media URLs. The download tools now poll transient states by default:
+
+- `source_get_content`: waits for source text indexing.
+- `download_artifact`: waits for existing generated artifacts whose media URL is still propagating.
+
+For already-generated artifacts, this usually returns immediately.
+
+## Security notes
+
+- `/artifacts/{filename}` serves files from the configured `public_artifacts` directory only.
+- Path traversal is neutralized by reducing requests to the basename.
+- Do not expose the MCP server publicly without the same access controls you use for other private NotebookLM tooling.
+- Cloudflare Access or ChatGPT's secure tunnel is preferred over an unauthenticated public hostname.

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "notebooklm-mcp-cli"
-version = "0.7.0"
+version = "0.7.2"
 description = "Unified CLI and MCP server for Google NotebookLM"
 readme = "README.md"
 license = "MIT"

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/__init__.py

@@ -4,7 +4,9 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "0.7.0"
+import notebooklm_tools.utils.env_sanitize as _env_sanitize  # noqa: F401
+
+__version__ = "0.7.2"
 
 __all__ = ["NotebookLMClient", "__version__"]
 

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/core/auth.py

@@ -95,9 +95,10 @@ def load_cached_tokens() -> AuthTokens | None:
                 cookies=profile.cookies,
                 csrf_token=profile.csrf_token or "",
                 session_id=profile.session_id or "",
-                extracted_at=profile.last_validated.timestamp()
-                if profile.last_validated
-                else time.time(),
+                build_label=profile.build_label or "",
+                extracted_at=(
+                    profile.last_validated.timestamp() if profile.last_validated else time.time()
+                ),
             )
     except Exception as e:
         logger.debug(f"Failed to load default profile: {e}")
@@ -311,7 +312,7 @@ class Profile:
             "session_id": self.session_id,
             "email": self.email,
             "build_label": self.build_label,
-            "last_validated": self.last_validated.isoformat() if self.last_validated else None,
+            "last_validated": (self.last_validated.isoformat() if self.last_validated else None),
         }
 
     @classmethod
@@ -326,9 +327,11 @@ class Profile:
 
         return cls(
             name=data.get("name", "default"),
-            cookies=data.get("cookies", [])
-            if isinstance(data.get("cookies"), list)
-            else data.get("cookies", {}),
+            cookies=(
+                data.get("cookies", [])
+                if isinstance(data.get("cookies"), list)
+                else data.get("cookies", {})
+            ),
             csrf_token=data.get("csrf_token"),
             session_id=data.get("session_id"),
             email=data.get("email"),
@@ -368,7 +371,10 @@ class AuthManager:
         """Load the current profile from disk."""
         from datetime import datetime
 
-        from notebooklm_tools.core.exceptions import AuthenticationError, ProfileNotFoundError
+        from notebooklm_tools.core.exceptions import (
+            AuthenticationError,
+            ProfileNotFoundError,
+        )
 
         if self._profile is not None and not force_reload:
             return self._profile
@@ -388,9 +394,11 @@ class AuthManager:
                 csrf_token=metadata.get("csrf_token"),
                 session_id=metadata.get("session_id"),
                 email=metadata.get("email"),
-                last_validated=datetime.fromisoformat(metadata["last_validated"])
-                if metadata.get("last_validated")
-                else None,
+                last_validated=(
+                    datetime.fromisoformat(metadata["last_validated"])
+                    if metadata.get("last_validated")
+                    else None
+                ),
                 build_label=metadata.get("build_label"),
             )
             return self._profile
@@ -588,6 +596,21 @@ class AuthCheckResult:
     details: dict[str, Any] | None = None  # e.g. extracted csrf on success
 
 
+# Browser-like headers required for the NotebookLM homepage fetch.
+# These match _PAGE_FETCH_HEADERS in BaseClient (core/base.py).
+# The Sec-Fetch-* headers are critical: without them Google may redirect
+# even valid cookies to the login page, causing false "expired" results.
+_PAGE_FETCH_HEADERS = {
+    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8",
+    "Accept-Language": "en-US,en;q=0.9",
+    "Sec-Fetch-Dest": "document",
+    "Sec-Fetch-Mode": "navigate",
+    "Sec-Fetch-Site": "none",
+    "Sec-Fetch-User": "?1",
+}
+
+
 def _fetch_notebooklm_homepage(
     cookies: dict[str, str] | list[dict],
     *,
@@ -598,6 +621,9 @@ def _fetch_notebooklm_homepage(
 
     Returns the final response after redirects. Callers decide what the
     final URL / status means.
+
+    Note: uses proper browser-like _PAGE_FETCH_HEADERS (including Sec-Fetch-*)
+    to avoid false redirects to Google login that occur with minimal headers.
     """
     import httpx
 
@@ -608,11 +634,7 @@ def _fetch_notebooklm_homepage(
     else:
         cookie_dict = cookies
 
-    headers = {
-        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",
-        "Accept": "text/html,application/xhtml+xml",
-        "Accept-Language": "en-US,en;q=0.9",
-    }
+    headers = _PAGE_FETCH_HEADERS.copy()
 
     cookie_header = cookies_to_header(cookie_dict)
     if cookie_header:
@@ -686,7 +708,10 @@ def check_auth(
             age = (time.time() - p.last_validated.timestamp()) / 3600
             if age <= 168:
                 return AuthCheckResult(
-                    valid=True, live=False, profile=profile, checked_at=p.last_validated.timestamp()
+                    valid=True,
+                    live=False,
+                    profile=profile,
+                    checked_at=p.last_validated.timestamp(),
                 )
         return AuthCheckResult(valid=False, reason="stale_heuristic", live=False, profile=profile)
 
@@ -743,3 +768,10 @@ def check_auth(
             profile=profile,
             details={"exception": str(exc)},
         )
+
+
+# Note: AuthHealthChecker, AuthProbeResult, AuthHealthReport live in
+# notebooklm_tools.services.auth — they are business logic (multi-probe
+# orchestration, caching, verdict aggregation) and belong in the services
+# layer, not here. The thin re-export shim in services.auth makes them
+# available to cli/ and mcp/ without breaking the layering rule.

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/core/base.py

@@ -932,11 +932,13 @@ class BaseClient:
                 self._session_id = ""  # Force re-extraction of session ID
             return True
 
-        # Try headless auth if Chrome profile exists
+        # Try headless auth if the configured default Chrome profile exists.
         try:
-            from notebooklm_tools.utils.cdp import run_headless_auth
+            from notebooklm_tools.utils.auth_browser import run_headless_auth
+            from notebooklm_tools.utils.config import get_config
 
-            tokens = run_headless_auth()
+            profile_name = get_config().auth.default_profile
+            tokens = run_headless_auth(profile_name=profile_name)
             if tokens:
                 with self._state_lock:
                     self.cookies = tokens.cookies

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/data/AGENTS_SECTION.md

@@ -1,5 +1,5 @@
 <!-- nlm-skill-start -->
-<!-- nlm-version: 0.7.0 -->
+<!-- nlm-version: 0.7.2 -->
 ## NLM - NotebookLM CLI Expert
 
 **Triggers:** "nlm", "notebooklm", "notebook lm", "podcast", "audio overview", "research"

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/data/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nlm-skill
-version: "0.7.0"
+version: "0.7.2"
 description: "Expert guide for the NotebookLM CLI (`nlm`) and MCP server - interfaces for Google NotebookLM. Use this skill when users want to interact with NotebookLM programmatically, including: creating/managing notebooks, adding sources (URLs, YouTube, text, Google Drive), generating content (podcasts, reports, quizzes, flashcards, mind maps, slides, infographics, videos, data tables), conducting research, chatting with sources, or automating NotebookLM workflows. Triggers on mentions of \"nlm\", \"notebooklm\", \"notebook lm\", \"podcast generation\", \"audio overview\", or any NotebookLM-related automation task."
 ---
 

{notebooklm_mcp_cli-0.7.0 → notebooklm_mcp_cli-0.7.2}/src/notebooklm_tools/mcp/server.py

@@ -20,18 +20,23 @@ Tool Modules:
 import argparse
 import logging
 import os
+from pathlib import Path
 
 from fastmcp import FastMCP
+from starlette.middleware import Middleware
+from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
-from starlette.responses import JSONResponse
+from starlette.responses import FileResponse, JSONResponse, Response
 
 from notebooklm_tools import __version__
 
+from .tools._utils import PUBLIC_DIR, reset_mcp_base_url, set_mcp_base_url
+
 _FALSY = frozenset({"false", "0", "no", "off"})
 
 
 def _env_bool(name: str, default: bool = False) -> bool:
-    """Read a boolean from an environment variable. Unset/empty → *default*; otherwise ``false|0|no|off`` (case-insensitive) → False, anything else → True."""
+    """Read a boolean from an environment variable. Unset/empty → *default*; otherwise ``false|0|no|off`` (case-insensitive) → False, anything else → True."""
     raw = os.environ.get(name, "")
     if not raw:
         return default
@@ -73,6 +78,46 @@ async def health_check(request: Request) -> JSONResponse:
     )
 
 
+class BaseUrlMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        host = request.headers.get(
+            "x-forwarded-host", request.headers.get("host", "127.0.0.1:8000")
+        )
+        proto = request.headers.get("x-forwarded-proto", "http")
+        base_url = f"{proto}://{host}"
+
+        token = set_mcp_base_url(base_url)
+        try:
+            return await call_next(request)
+        finally:
+            reset_mcp_base_url(token)
+
+
+# Ensure FastMCP applies the HTTP middleware to the actual served Starlette app.
+_original_http_app = mcp.http_app
+
+
+def _http_app_with_base_url(*args, middleware=None, **kwargs):
+    merged_middleware = [Middleware(BaseUrlMiddleware), *(middleware or [])]
+    return _original_http_app(*args, middleware=merged_middleware, **kwargs)
+
+
+mcp.http_app = _http_app_with_base_url
+
+
+# Custom route to serve public artifacts
+@mcp.custom_route("/artifacts/{filename}", methods=["GET"])
+async def get_public_artifact(request: Request) -> Response:
+    """Serve downloaded artifacts and source files via the public URL."""
+    filename = request.path_params["filename"]
+    # Clean the path to prevent directory traversal
+    safe_name = Path(filename).name
+    filepath = PUBLIC_DIR / safe_name
+    if not filepath.exists() or not filepath.is_file():
+        return Response("File not found", status_code=404)
+    return FileResponse(str(filepath))
+
+
 def _register_tools() -> None:
     """Import and register all tools from the modular tools package."""
     # Import all tool modules to populate the registry
@@ -169,7 +214,7 @@ Examples:
         default=_env_bool("NOTEBOOKLM_MCP_STATELESS", default=True),
         help=(
             "Stateless HTTP sessions (default: true). Avoids MCP SDK double-response crash "
-            "(python-sdk#2416). NOTE: this affects the MCP HTTP transport layer only — "
+            "(python-sdk#2416). NOTE: this affects the MCP HTTP transport layer only — "
             "it does NOT control the in-process conversation history cache. To bound the "
             "conversation cache (e.g. for long-lived servers), set "
             "NOTEBOOKLM_CONVERSATION_MAX_TURNS / NOTEBOOKLM_CONVERSATION_MAX_CONVS."
@@ -241,7 +286,7 @@ Examples:
             if not _env_bool("NOTEBOOKLM_ALLOW_EXTERNAL_BIND"):
                 print(
                     f"SECURITY ERROR: Refusing to bind to non-loopback address '{args.host}'.\n"
-                    "There is no built-in authentication — binding externally exposes\n"
+                    "There is no built-in authentication — binding externally exposes\n"
                     "your Google cookies to anyone on the network.\n\n"
                     "To override, set: NOTEBOOKLM_ALLOW_EXTERNAL_BIND=1",
                     file=sys.stderr,