Cobb
a21a6e14ab
Some checks failed
gitleaks / scan (push) Failing after 2s
Post-outage-review batch (Fable adversarially audited: SHIP-WITH-FIXES; the one
MED is folded below).
S3 — cheaper stream_metadata feed-enrich. On the anonymous reel path, ask
reel_item_watch for only playabilityStatus+videoDetails via a narrowed nested
$fields selector (~3-6 KB vs the full ~150-500 KB reel body). BEST-EFFORT with a
HARD fallback to the unchanged full fetch_android, so feed enrichment can never
regress: the narrowed response is trusted only when videoDetails.videoId equals
the requested id — a bare is_some() would accept a gutted videoDetails:{} or wave
through a videoId-stripped decoy, so the id binding also subsumes the decoy check
for this path (audit MED). Full extraction path untouched; po_token path skips
the narrowing.
S7 — reclaim the raw ~1.5 MB player.js once the hot-path snippets (signature
timestamp + nsig) are built, keeping player_url as the installed-generation
sentinel. memo_verdict is rekeyed off player_url (was player_code): under the
old lockstep invariant the two were equivalent, and decoupling is REQUIRED so a
byte-released generation is still "installed" for memo purposes. Release is
single-site, build-success-only, under the state lock; a build FAILURE keeps the
bytes so sibling artifacts still extract; the dead-in-android sig path re-fetches
on demand via ensure_player_code.
Also fixes three leftovers from the 2026-07-29 outage flip (
|
||
|---|---|---|
| .. | ||
| downloader | ||
| stream | ||
| youtube | ||
| exceptions.rs | ||
| image.rs | ||
| lib.rs | ||
| localization.rs | ||
| newpipe.rs | ||