What causes "bbs.hupu.com" in jackwener/OpenCLI?

Log in to Hupu in the automated browser (or re-run the CLI's login command) to refresh cookies, then retry.

jackwener/OpenCLI · error · AuthRequiredError

bbs.hupu.com

Error message

bbs.hupu.com

What it means

postHupuJson maps the in-page fetch's HTTP status to errors: a 401 or 403 response from a bbs.hupu.com API (like/unlike/reply) raises AuthRequiredError with domain 'bbs.hupu.com' and message '<action> failed: please log in to Hupu first'. The observed message 'bbs.hupu.com' is the AuthRequiredError's domain field, indicating the Hupu session is unauthenticated — the site rejected the authenticated POST.

Source

Thrown at clis/hupu/utils.js:309

          error: error instanceof Error ? error.message : String(error)
        };
      }
    })()
  `;
}
/**
 * Execute authenticated Hupu JSON requests inside the browser page so
 * cookies and the thread referer come from the live logged-in session.
 */
export async function postHupuJson(page, tid, apiUrl, body, actionLabel, mode = 'default') {
    const referer = getHupuThreadUrl(tid);
    await page.goto(referer);
    const result = await page.evaluate(buildBrowserJsonPostScript(apiUrl, body, mode));
    if (!result || typeof result !== 'object') {
        throw new CommandExecutionError(`${actionLabel} failed: invalid browser response`);
    }
    if (result.status === 401 || result.status === 403) {
        throw new AuthRequiredError('bbs.hupu.com', `${actionLabel} failed: please log in to Hupu first`);
    }
    if (result.error) {
        throw new CommandExecutionError(`${actionLabel} failed: ${result.error}`);
    }
    if (!result.ok) {
        const detail = result.data?.msg || result.data?.message || `HTTP ${result.status ?? 'unknown'}`;
        throw new CommandExecutionError(`${actionLabel} failed: ${detail}`);
    }
    return result.data ?? {};
}

View on GitHub (pinned to 49907e53dc)

Solutions

Log in to Hupu in the automated browser (or re-run the CLI's login command) to refresh cookies, then retry.
Verify cookies are actually loaded (Strategy.COOKIE) and not expired — check the session/cookie store the CLI uses.
Open bbs.hupu.com in the session and confirm you appear logged in before running write commands.
If you get 403 while logged in, risk-control tokens may be missing — browse the thread normally so .thumbcache_/smidV2 cookies are set, then retry.
Retry later if Hupu's WAF is rate-limiting your IP.

Example fix

// before
await cliRun(['hupu', 'unlike', tid, pid, '--fid', fid]); // AuthRequiredError: bbs.hupu.com
// after — ensure login state before write ops
if (!(await isLoggedIn(page, 'bbs.hupu.com'))) {
  await runLogin('hupu');
}
await cliRun(['hupu', 'unlike', tid, pid, '--fid', fid]);

Defensive patterns

Strategy: try-catch

Validate before calling

// check login state before any authenticated write
const loggedIn = await page.evaluate(() =>
  document.cookie.split('; ').some(c => c.startsWith('ua=')) ||
  Boolean(document.querySelector('.login-after, [class*="user"]')));
if (!loggedIn) throw new AuthRequiredError('bbs.hupu.com', 'log in before running write commands');

Type guard

function isAuthError(err) {
  return err instanceof AuthRequiredError ||
    (err && err.domain === 'bbs.hupu.com') ||
    /please log in to Hupu first/.test(err?.message || '');
}

Try / catch

try {
  await hupuUnlike(tid, pid, fid);
} catch (err) {
  if (isAuthError(err)) {
    await runHupuLogin();      // refresh cookies / interactive login
    return hupuUnlike(tid, pid, fid); // retry once with fresh session
  }
  throw err;
}

Prevention

Run the login command and confirm a valid session before any write (like/unlike/reply).
Check cookie expiry periodically; Hupu sessions expire and silently break writes.
Browse a thread normally first so risk-control cookies (.thumbcache_, smidV2, ua) are populated.
Treat 403-while-logged-in as anti-bot risk control: slow down, avoid rapid batch writes.
Catch AuthRequiredError explicitly so it is not swallowed by generic error wrappers.

When it happens

Trigger: Running a write command (hupu like/unlike/reply) whose in-browser POST returns HTTP 401 or 403, typically because cookies are missing, expired, or the account is not logged in in the automated browser session.

Common situations: Expired Hupu session cookies (the CLI uses Strategy.COOKIE auth), running the command without logging in first, cookies cleared or rotated by the browser, or Hupu's anti-bot/WAF returning 403 to requests lacking valid session/risk tokens (shumei_id/thumbcache).

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/d67cca4f72d89160. Report an issue: GitHub.