fix(sites): keep signed API downloads outside browser sessions

packages/adapters/src/sites/spiders/common.ts

@@ -332,7 +332,9 @@ export async function downloadTorrentFile(
   const res = await siteFetch(ctx.http, url, {
     method: "GET",
     headers,
-    ...(opts.cookie ? { redirect: "manual" as const } : {}),
+    ...(opts.cookie
+      ? { redirect: "manual" as const }
+      : { credentials: "omit" as const, referrerPolicy: "no-referrer" as const }),
     ...(ctx.signal ? { signal: ctx.signal } : {}),
   });
   const verifiedAt = ctx.http.now().toISOString();

packages/adapters/src/sites/spiders/milkie.test.ts

@@ -54,11 +54,21 @@ describe("Milkie API", () => {
   it("下载时编码当前API Key；缺凭据、无效凭据与响应结构各自报错", async () => {
     const mock = createMockFetch({ "/api/v1/torrents": { body: {} } });
     const torrent = withTorrent(mock.fetch, (url) => url.pathname.endsWith("/torrent"));
-    const adapter = adapterWith(def, milkieSpider, torrent.fetch, { apiKey: "a+b/&secret" });
+    const requests: RequestInit[] = [];
+    const adapter = adapterWith(
+      def,
+      milkieSpider,
+      (input, init) => {
+        requests.push(init ?? {});
+        return torrent.fetch(input, init);
+      },
+      { apiKey: "a+b/&secret" },
+    );
     await adapter.downloadTarget(id);
     expect(torrent.hits[0]!.url.searchParams.get("key")).toBe("a+b/&secret");
     expect(torrent.hits[0]!.url.pathname).toBe(`/api/v1/torrents/${id}/torrent`);
     expect(torrent.hits[0]!.headers.get("x-milkie-auth")).toBeNull();
+    expect(requests[0]).toMatchObject({ credentials: "omit", referrerPolicy: "no-referrer" });
     await expectSiteError(adapter.list(1), "parse_error");
     await expectSiteError(adapterWith(def, milkieSpider, mock.fetch, {}).list(1), "auth_missing");
     const denied = createMockFetch({ "/api/v1/torrents": { status: 401 } });