docs: refresh TikTok playback audit for current frontend builds #5

Merged

brennoflavio merged 2 commits from docs/tiktok-audit-2026-09-21 into master

2026-09-21 13:52:48 +00:00

pi commented

2026-09-21 12:11:57 +00:00

Collaborator

Summary

Re-executed src/agent/PROMPT.md on 2026-09-21 after discovering the project through Forgejo and making a fresh git clone.

Refresh src/agent/DOCS.md with current browser observations and freshly inspected assets: both react-v18 and player-split builds were served; extended security SDK is now 1.0.0.2873.
Confirm the existing browser-free extraction algorithm still works: hydration supplies signed media URLs; the same-session chain cookie and TikTok Referer remain sufficient for the tested media request. No extra runtime requests or signing dependencies were added.
Correct application guidance for TOKAI_APP_URL and rendered job-based /media/<media_id> / /download/<media_id> links.
Keep DOCS.md and example.py in their original src/agent directory; update the documentation links, run instructions, import guidance, and CLI help to use that location. The extraction algorithm itself is unchanged.

Validation

Python 3.14.7 / uv 0.12.6; uv sync --frozen --all-groups installed the locked application and development dependencies.
85 repository pytest tests passed (two upstream deprecation warnings).
30 temporary offline example tests passed, covering URL/identity/schema checks, bounded shell retries, request preservation, integrity failures, no overwrite, and CLI test isolation/error continuation.
All 9 exact prompt URLs passed twice, each in a fresh session with a complete MP4 download and a matching fresh server FileHash: 2 GETs per full URL, 3 per short URL.
All 9 first-run files passed ffprobe and complete ffmpeg audio/video decoding (H.264/AAC, 576×1024).
Seven controlled range probes reconfirmed cookie, Referer, signature, and expiry behavior; short-link 302 chains were checked independently.
Actual Tokai server smoke test passed for homepage, short-link video page, rendered media URL, and attachment download; media matched the example byte-for-byte. Test server and browser were stopped.
py_compile, CLI help, and git diff --check passed.

Temporary research/test artifacts remain outside the repository at /tmp/tokai-audit-20260921; no videos, cookies, or signed media URLs are committed. Findings are scoped to this network/date/public content, not a claim to have recovered TikTok's signing secrets or full anti-bot SDK.

## Summary Re-executed `src/agent/PROMPT.md` on 2026-09-21 after discovering the project through Forgejo and making a fresh git clone. - Refresh `src/agent/DOCS.md` with current browser observations and freshly inspected assets: both `react-v18` and `player-split` builds were served; extended security SDK is now `1.0.0.2873`. - Confirm the existing browser-free extraction algorithm still works: hydration supplies signed media URLs; the same-session chain cookie and TikTok Referer remain sufficient for the tested media request. No extra runtime requests or signing dependencies were added. - Correct application guidance for `TOKAI_APP_URL` and rendered job-based `/media/<media_id>` / `/download/<media_id>` links. - Keep `DOCS.md` and `example.py` in their original `src/agent` directory; update the documentation links, run instructions, import guidance, and CLI help to use that location. The extraction algorithm itself is unchanged. ## Validation - Python 3.14.7 / uv 0.12.6; `uv sync --frozen --all-groups` installed the locked application and development dependencies. - **85 repository pytest tests passed** (two upstream deprecation warnings). - **30 temporary offline example tests passed**, covering URL/identity/schema checks, bounded shell retries, request preservation, integrity failures, no overwrite, and CLI test isolation/error continuation. - **All 9 exact prompt URLs passed twice**, each in a fresh session with a complete MP4 download and a matching fresh server FileHash: 2 GETs per full URL, 3 per short URL. - All 9 first-run files passed ffprobe and complete ffmpeg audio/video decoding (H.264/AAC, 576×1024). - Seven controlled range probes reconfirmed cookie, Referer, signature, and expiry behavior; short-link 302 chains were checked independently. - Actual Tokai server smoke test passed for homepage, short-link video page, rendered media URL, and attachment download; media matched the example byte-for-byte. Test server and browser were stopped. - `py_compile`, CLI help, and `git diff --check` passed. Temporary research/test artifacts remain outside the repository at `/tmp/tokai-audit-20260921`; no videos, cookies, or signed media URLs are committed. Findings are scoped to this network/date/public content, not a claim to have recovered TikTok's signing secrets or full anti-bot SDK.

pi added 1 commit

2026-09-21 12:11:57 +00:00