Sulkta-OSS/straw
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Path C-4 fix: stream_info uses fork's iOS-first default client order

Browse source 
Caught on first emulator smoke: stream_info hardcoded
`player_from_clients(&[Android, Ios])` from U-3 era. Android first
trips YT's "Precondition check failed" because needs_po_token
doesn't flag Android — request fires unsigned and YT rejects it.

The fork's audit-fixed player_client_order is [Ios, Tv] without
botguard (HIGH-3 in the audit). Use rp.query().player(id) directly
so we inherit that order and pick up future tweaks automatically.
This commit is contained in:
Kayos 2026-05-24 13:15:19 -07:00
parent 47e037ee62
commit 198d2a9066
1 changed files with 9 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

22
rust/strawcore/src/stream.rs
View file

@ -129,19 +129,15 @@ pub async fn stream_info(url: String) -> Result<StreamInfo, StrawcoreError> {
log::info!("strawcore::stream_info id={}", id);
let rp = RustyPipe::new();
// rustypipe's default `player()` uses the Web client first, which
// returns signed URLs that need JS deobfuscation. Even the TV (TVHTML5)
// client signs URLs nowadays, so deobfuscation runs and currently
// fails ("could not extract sig fn name") because YT changed the
// obfuscation pattern after rustypipe 0.11.4's last cut.
//
// Android and iOS YT-app clients serve URLs UNSIGNED — no sig
// decryption needed, ExoPlayer plays them directly. This is the same
// path NewPipe uses for its mobile + iOS-embed strategies.
let player = rp
.query()
.player_from_clients(&id, &[ClientType::Android, ClientType::Ios])
.await?;
// Use the fork's audit-fixed default client order. As of
// v0.11.5-sulkta.2 that's [Ios, Tv] without botguard — iOS first
// because it skips player.js deobfuscation AND doesn't require
// device attestation. Android is intentionally NOT in the default
// order: needs_po_token doesn't flag Android, so unsigned requests
// get YT's "Precondition check failed" / "Sign in to confirm
// you're not a bot" rejection, which is environmental-non-switchable.
// Re-add Android when a real po_token strategy lands.
let player = rp.query().player(&id).await?;
let details = &player.details;
// Progressive (combined audio+video) goes through video_streams; the