docs(agent): refresh TikTok playback investigation (2026-09-14) #3

Merged

brennoflavio merged 1 commit from docs/refresh-tiktok-playback-20260914 into master

2026-09-14 16:26:50 +00:00

pi commented

2026-09-14 12:09:51 +00:00

Collaborator

Summary

Executed src/agent/PROMPT.md in full after discovering Tokai through Forgejo and cloning it with git.

Documentation drift found and corrected in src/agent/DOCS.md:

Refresh desktop/common assets and security SDK versions and source offsets from newly fetched frontend JavaScript.
Record the browser's later HTTP 206 range request, in addition to initial full-media requests, and conditional presence of msToken in related-item API requests.
Replace stale validation results with two current, independent nine-URL runs. Every full URL used 2 GETs and every short URL used 3; no live shell retry occurred.
Add reproducible application setup/run commands and current test evidence; distinguish offline shell-recovery checks from live observations.

The existing example.py still works unchanged. The minimal route remains fresh page hydration → unchanged server-signed media URL + same-session cookie jar + TikTok Referer. No browser cookies, signing service, or additional extraction requests are needed. Obfuscated signing algorithms and precise token bindings remain explicitly unclaimed.

Validation

Installed uv 0.12.6, Python 3.14.7, and all frozen runtime/development dependencies with uv sync --frozen --all-groups.
uv run --no-sync pytest -q: 58 passed (2 upstream deprecation warnings).
Temporary standalone-example offline harness: 16 passed, plus compilation and 4 CLI checks.
example.py --test: 9/9 passed twice, with fresh sessions and full downloads; all 18 MP4s matched fresh rendition FileHash and size metadata.
ffprobe and full ffmpeg -xerror audio/video decoding: 9/9 Run 1 files passed.
Reconfirmed all four short-link 302 redirects and seven cookie/Referer/signature control variants.
Isolated logged-out Chromium investigation confirmed actual playback, hydration, rendition selection, current assets, and security traffic.
Actual app smoke test: homepage, video page, and media endpoint returned HTTP 200; served MP4 matched the example byte-for-byte.
git diff --check passed.

Only src/agent/DOCS.md changes. Research captures, temporary tests, and downloaded videos remain outside the repository in /tmp/tokai-audit-research; no cookies or signed URLs are committed. The isolated browser and temporary smoke-test server were stopped.

## Summary Executed `src/agent/PROMPT.md` in full after discovering Tokai through Forgejo and cloning it with git. Documentation drift found and corrected in `src/agent/DOCS.md`: - Refresh desktop/common assets and security SDK versions and source offsets from newly fetched frontend JavaScript. - Record the browser's later HTTP 206 range request, in addition to initial full-media requests, and conditional presence of `msToken` in related-item API requests. - Replace stale validation results with two current, independent nine-URL runs. Every full URL used 2 GETs and every short URL used 3; no live shell retry occurred. - Add reproducible application setup/run commands and current test evidence; distinguish offline shell-recovery checks from live observations. The existing `example.py` still works unchanged. The minimal route remains fresh page hydration → unchanged server-signed media URL + same-session cookie jar + TikTok Referer. No browser cookies, signing service, or additional extraction requests are needed. Obfuscated signing algorithms and precise token bindings remain explicitly unclaimed. ## Validation - Installed uv 0.12.6, Python 3.14.7, and all frozen runtime/development dependencies with `uv sync --frozen --all-groups`. - `uv run --no-sync pytest -q`: **58 passed** (2 upstream deprecation warnings). - Temporary standalone-example offline harness: **16 passed**, plus compilation and 4 CLI checks. - `example.py --test`: **9/9 passed twice**, with fresh sessions and full downloads; all 18 MP4s matched fresh rendition FileHash and size metadata. - `ffprobe` and full `ffmpeg -xerror` audio/video decoding: **9/9 Run 1 files passed**. - Reconfirmed all four short-link 302 redirects and seven cookie/Referer/signature control variants. - Isolated logged-out Chromium investigation confirmed actual playback, hydration, rendition selection, current assets, and security traffic. - Actual app smoke test: homepage, video page, and media endpoint returned HTTP 200; served MP4 matched the example byte-for-byte. - `git diff --check` passed. Only `src/agent/DOCS.md` changes. Research captures, temporary tests, and downloaded videos remain outside the repository in `/tmp/tokai-audit-research`; no cookies or signed URLs are committed. The isolated browser and temporary smoke-test server were stopped.

pi added 1 commit

2026-09-14 12:09:51 +00:00