OnePick v2.4.78

Fix Douyin share video downloads failing when the default playback line resolves to an unavailable or rate-limited CDN.

• Keep a bounded alternate official playback line and preserve supplied video URL candidates, allowing the existing download flow to retry before sending media.
• Generate alternate lines only for recognized unsigned first-party share playback wrappers. Preserve signed CDN URLs and retain public-address checks on every redirect.
• Add regression coverage for alternate lines, opaque signed URLs, invalid wrappers, deduplication, and candidate limits.

Validation: full npm test suite passed; production dependency audit reported zero vulnerabilities. A real Douyin video completed through the Shortcut endpoint and passed full audio/video decoding. An isolated test with an injected primary-line 502 verified successful download through the alternate line. Production health reports 2.4.78.

OnePick v2.4.77

修复

• 修复未登录时登录页 Logo 与 favicon 被鉴权重定向，导致图片无法显示的问题。
• 仅精确公开 /logo.png、/favicon.png，其他静态资源和 API 继续保持原鉴权边界。
• 更新登录页图片缓存版本，统一 package 与运行时版本为 2.4.77。

验证

• 新增隔离真实服务回归：PNG 内容、GET/HEAD、查询参数及受保护路径。
• 全量 npm test 通过；生产依赖审计 0 vulnerabilities。
• 生产桌面与手机视口浏览器验证 Logo 完整显示；匿名受保护 API 为 401，认证请求为 200。

OnePick v2.4.76

Harden Douyin official share playback fallback validation.

OnePick v2.4.74

X/Twitter authentication and cancellation fixes

• Fix the root cause of authorized sensitive-post failures: explicitly use native Twitter GraphQL when account cookies are configured, rather than allowing the syndication extractor option to override authenticated results. Anonymous metadata adapters remain the first, cookie-free path.
• Use a separate, temporary 0600 cookie jar for each native X parse/download attempt, containing only x.com/twitter.com domains. Never send account cookies to anonymous metadata services; preserve the master cookie file and clean up temporary copies on success and failure.
• Bound subprocess cancellation: terminate yt-dlp and descendant processes on disconnect, timeout, or output limits, and wait for process close before deleting temporary files. Pass cancellation through probing, remuxing, transcoding, and response streaming.
• Give X downloads a shared 300-second yt-dlp budget across proxy attempts, retain 120 seconds for other platforms, and limit concurrent X download processing to two. The streaming lifecycle has a separate 600-second deadline; these are not a single end-to-end guarantee.
• Add cookie isolation/concurrency and real subprocess lifecycle regression tests.

Verification and limitations

Full local test suites passed in both private and clean public trees, including container runs. Production dependency audit passed the high-severity gate; four existing moderate advisories remain.

Pre-release HTTP verification of the matching fix source downloaded an authorized sensitive X video (219,021,875 bytes, approximately 112 seconds) and an ordinary video (approximately 3.9 MB, 15 seconds). Client-disconnect cancellation completed in approximately 5.7 seconds with no temporary cookie jars left behind.

Long synchronous requests remain subject to iOS Shortcuts/mobile-client and intermediary timeout limits. HTTP verification does not establish success on every mobile device. This release does not introduce background download jobs or remove those client limits.

OnePick v2.4.73

CI-only patch release of v2.4.72. Installs ffmpeg and util-linux before media integration tests. Application behavior is unchanged. The existing v2.4.72 tag is preserved. Multi-architecture GHCR publication is handled by the tag-triggered Actions run.

OnePick v2.4.72

Douyin photo posts with audio

• iOS Shortcut downloads now combine ordered photos and the full audio track into an H.264/AAC MP4 suitable for saving to Photos.
• Single-photo posts retain a still image; multiple photos receive equal durations in source order. Original timing synchronization is not reconstructed.
• Existing Shortcut downloads use the same endpoint; no Shortcut update is required for this server-side change.
• Web original-image/audio downloads and explicit item selection remain unchanged.
• Adds bounded downloads, input format and image-size validation, process memory limits, cancellation and temporary-file cleanup.
• Supported slideshow audio inputs: MP3, AAC and WAV. Unsupported formats return an error.

Validation: full test suite, container build, real ffmpeg fixtures and authenticated real-post MP4 download passed. Actual iPhone Photos import remains device-side verification.

OnePick v2.4.71

X/Twitter 下载恢复

• 保留匿名 syndication 与 VxTwitter 元数据快路径；当二者不可用、返回非 JSON 或未返回媒体时，自动使用 yt-dlp 的 Twitter extractor 作为一次性末级解析回退。
• 回退媒体统一进入 OnePick 的 /api/ytdlp-download 同源下载路由，不再把 Twitter CDN 直链交给网页、快捷指令或用户脚本，从而继续复用既有的 yt-dlp、代理、格式选择和流式下载链路。
• 匿名 metadata 请求不发送 X Cookie；解析阶段的 yt-dlp fallback 也不会传入 X Cookie。若下载链已配置 Cookie，仍由同源、已认证下载端点按现有策略处理。

回归保障

• 新增覆盖：匿名 adapter 无媒体或 HTML 响应时的 yt-dlp fallback、每个 adapter 的单次调用、原始 status URL/偏好保留、禁止回退到 CDN 直链，以及 parser fallback 的无 Cookie 参数边界。
• 版本号升级至 2.4.71。

验证

• npm test 通过。
• Docker 构建通过。
• GitHub Actions 已在 main 提交 56afced40fb73c1324aad39878705dfac141059f 完成测试与多架构镜像发布；tag 工作流仍在同步执行中。