Forcing the ".google.com" domain on all cookies is a problematic side effect of using a flat dictionary (self.auth.cookies) to populate the cookie jar. While this ensures cookies are sent to accounts.google.com during redirects, it also means that cookies originally intended for other domains—such as .googleusercontent.com (which is used for media downloads and is explicitly allowed in auth.py)—will now be sent to .google.com and not to their intended destination. This will likely break authenticated downloads from Google's content servers. Additionally, ensure that when making requests to external URLs using these cookies, the domain is validated against an allowlist of trusted domains to prevent credential leakage.

Re-assigning the cookie jar here will overwrite any cookies that the server might have updated or set during the session (e.g., via Set-Cookie headers in previous requests). Since self.auth.cookies is a static dictionary initialized at startup and never updated, this call effectively reverts the client's session state to its initial values. Given that csrf_token and session_id are handled separately and are not stored in this cookie jar, this reset may be unnecessary and potentially harmful to session persistence.

This logic for building a cookie jar is duplicated in ClientCore._build_cookies_jar. It should be centralized (e.g., as a method on AuthTokens) to ensure consistent behavior. Additionally, as noted in the core client review, forcing the .google.com domain for all cookies may break functionality for other domains like googleusercontent.com which are used for media downloads.

fetch_tokens() builds a cookie jar from the filtered cookies dict, but extract_cookies_from_storage() currently excludes cookies whose domain is accounts.google.com (because _is_allowed_auth_domain() only allows ALLOWED_COOKIE_DOMAINS and regional .google.*). If the cross-host refresh flow depends on accounts-scoped cookies (as described in #273), they will never make it into this jar, so redirects to accounts.google.com can still fail. Consider expanding the auth-domain allowlist to include accounts.google.com (and possibly .accounts.google.com) or switching token fetching to use a domain-preserving httpx.Cookies source (similar to load_httpx_cookies()).

update_auth_headers() replaces the entire AsyncClient.cookies jar with a new jar rebuilt from self.auth.cookies. Since self.auth.cookies is not updated by refresh_auth() (it only updates CSRF/session_id), this can discard any cookies that were refreshed via Set-Cookie during redirect flows (e.g., the short-lived __Secure-*PSIDRTS cookies), undermining the goal of using a persistent cookie jar. Prefer keeping the existing jar and only mutating it when the cookie values actually change (or explicitly syncing refreshed cookies back into self.auth.cookies before rebuilding).

The new redirect-handling behavior in fetch_tokens() is not directly asserted in tests. There are existing pytest_httpx patterns in this repo to inspect outgoing requests; adding an assertion that the redirected request to accounts.google.com still includes a Cookie header (and/or that the request chain completes when cookies are valid) would prevent regressions of #273.

⚠️ Potential issue | 🟠 Major

#!/bin/bash
# Search for usages of fetch_tokens_with_domains
rg -n 'fetch_tokens_with_domains' --type=py

Remove or integrate fetch_tokens_with_domains() — the function is unused.

The new function defined at lines 851–896 is not called anywhere in the codebase. Either remove it or integrate it into the actual authentication flow (e.g., in download.py or AuthTokens.from_storage()). If it's planned for a follow-up, document that intention or defer the implementation to a separate PR.

Verify each finding against the current code and only fix it if needed.

In `@src/notebooklm/auth.py` around lines 851 - 896, The function
fetch_tokens_with_domains is unused; either delete it or wire it into the auth
flow—specifically replace or augment the current token-loading path (e.g.,
AuthTokens.from_storage or the code in download.py that loads tokens) to call
fetch_tokens_with_domains(path) when you need cookies preserved with original
domains, or if you plan to defer, remove the function and add a brief TODO in
the PR description; ensure any callers expect the returned tuple (csrf,
session_id) and handle its exceptions (FileNotFoundError, httpx.HTTPError,
ValueError).

⚠️ Potential issue | 🟡 Minor

Response accessed after client context exit.

The response object is used (lines 882–893) after exiting the async with httpx.AsyncClient(...) block at line 880. While response.text is typically available because the body was fully read during response.raise_for_status(), this pattern is fragile and inconsistent with fetch_tokens() which extracts tokens inside the context.

     async with httpx.AsyncClient(cookies=cookie_jar) as client:
         response = await client.get(
             "https://notebooklm.google.com/",
             follow_redirects=True,
             timeout=30.0,
         )
         response.raise_for_status()

-    final_url = str(response.url)
+        final_url = str(response.url)

-    # Check if we were redirected to login
-    if is_google_auth_redirect(final_url):
-        raise ValueError(
-            "Authentication expired or invalid. "
-            "Redirected to: " + final_url + "\n"
-            "Run 'notebooklm login' to re-authenticate."
-        )
+        # Check if we were redirected to login
+        if is_google_auth_redirect(final_url):
+            raise ValueError(
+                "Authentication expired or invalid. "
+                "Redirected to: " + final_url + "\n"
+                "Run 'notebooklm login' to re-authenticate."
+            )

-    csrf = extract_csrf_from_html(response.text, final_url)
-    session_id = extract_session_id_from_html(response.text, final_url)
+        csrf = extract_csrf_from_html(response.text, final_url)
+        session_id = extract_session_id_from_html(response.text, final_url)

-    logger.debug("Authentication tokens obtained successfully")
-    return csrf, session_id
+        logger.debug("Authentication tokens obtained successfully")
+        return csrf, session_id

Verify each finding against the current code and only fix it if needed.

In `@src/notebooklm/auth.py` around lines 874 - 896, The code reads and uses the
httpx Response (final_url, response.text) after closing the AsyncClient; move
all uses of response — computing final_url, calling
is_google_auth_redirect(final_url), and calling
extract_csrf_from_html(response.text, final_url) and
extract_session_id_from_html(response.text, final_url) — inside the async with
httpx.AsyncClient(...) block so the response body is still valid; ensure
response.raise_for_status() remains, perform the redirect check and token
extractions before exiting the context, then log and return csrf, session_id.