Add discriminating reachability probe battery (MTU vs hostname-filter vs reset)

app.py

@@ -105,38 +105,49 @@ def check_access():
         lines.append(f"- **Egress IP** {'(via proxy)' if proxy else '(Space direct)'}: `{ip}`")
     except Exception as exc:
         lines.append(f"- **Egress IP**: ❌ {type(exc).__name__}")
-    yt = "https://www.youtube.com/robots.txt"
-    last = None
-    for attempt in range(3):  # tolerate a transient TLS reset from the exit IP
-        try:
-            r = requests.get(yt, proxies=proxies, timeout=20)
-            lines.append(f"- **YouTube reachable**: ✅ HTTP {r.status_code}"
-                         + (f" (after {attempt + 1} tries)" if attempt else ""))
-            verdict = "### 🟢 YouTube is reachable — transcript + screenshots should work."
-            return verdict + "\n\n" + "\n".join(lines)
-        except Exception as exc:
-            last = exc
-            time.sleep(1.5)
-    # All retries failed — classify: CA-trust failure vs connection/handshake reset.
-    detail = f"`{type(last).__name__}: {str(last)[:160]}`"
-    if isinstance(last, requests.exceptions.SSLError):
-        try:
-            import urllib3
-            urllib3.disable_warnings()
-            r = requests.get(yt, proxies=proxies, timeout=20, verify=False)
-            lines.append(f"- **YouTube reachable**: ⚠️ only with TLS verify OFF (HTTP "
-                         f"{r.status_code}) → stale CA bundle. {detail}")
-            verdict = ("### 🟠 YouTube reachable, but the Space can't verify its certificate.\n"
-                       "Bump **`certifi`** in requirements.txt and rebuild the Space.")
-            return verdict + "\n\n" + "\n".join(lines)
-        except Exception as exc2:
-            detail = (f"verify-on: `{type(last).__name__}: {str(last)[:110]}` · "
-                      f"verify-off: `{type(exc2).__name__}: {str(exc2)[:110]}`")
-    lines.append(f"- **YouTube reachable**: ❌ {detail}")
-    verdict = ("### 🔴 YouTube is NOT reachable from the Space.\n"
-               "The proxy connects but YouTube's TLS is failing/reset (often the exit IP being "
-               "rate-limited — try again in a minute). If it persists, set/refresh a residential "
-               "**`YT_PROXY`** via the home-tunnel panel in [`tools/`](tools/README.md).")
+    def probe(url):
+        last = None
+        for _ in range(2):  # tolerate a single transient reset
+            try:
+                r = requests.get(url, proxies=proxies, timeout=20)
+                return True, f"HTTP {r.status_code}"
+            except Exception as exc:
+                last = exc
+                time.sleep(1.0)
+        return False, f"{type(last).__name__}: {str(last)[:90]}"
+
+    # Discriminating battery: neutral-small vs Google-family (same big cert as
+    # YouTube, different hostname) vs YouTube itself. The pass/fail pattern says
+    # whether it's a size/MTU blackhole, hostname-based egress filtering, or reset.
+    probes = [
+        ("example.com (neutral)", "https://example.com"),
+        ("google.com/204 (Google cert, non-YT name)", "https://www.google.com/generate_204"),
+        ("youtube.com/robots.txt", "https://www.youtube.com/robots.txt"),
+        ("youtube.com/ (large body)", "https://www.youtube.com/"),
+    ]
+    results = {}
+    for label, url in probes:
+        ok, msg = probe(url)
+        results[label] = ok
+        lines.append(f"- {'✅' if ok else '❌'} {label}: {msg}")
+
+    yt_ok = results.get("youtube.com/robots.txt")
+    if yt_ok:
+        verdict = "### 🟢 YouTube is reachable — transcript + screenshots should work."
+    elif results.get("google.com/204 (Google cert, non-YT name)"):
+        verdict = ("### 🔴 YouTube is filtered by hostname.\n"
+                   "Google works but YouTube is reset → the network between the Space and the "
+                   "tunnel is dropping the plaintext `CONNECT www.youtube.com`. Fix: run the "
+                   "home proxy as an **HTTPS proxy** (TLS-wrapped) so the target host is hidden.")
+    elif results.get("example.com (neutral)") and not results.get("google.com/204 (Google cert, non-YT name)"):
+        verdict = ("### 🔴 Large TLS handshakes are being dropped (MTU blackhole).\n"
+                   "Small sites work; Google/YouTube (large cert chains) reset. Fix: clamp MSS on "
+                   "the tunnel path or switch tunnel provider (e.g. ngrok).")
+    else:
+        verdict = ("### 🔴 YouTube is NOT reachable from the Space.\n"
+                   "The proxy connects (egress IP works) but TLS to YouTube is failing. "
+                   "Try again in a minute or refresh **`YT_PROXY`** via the panel in "
+                   "[`tools/`](tools/README.md).")
     return verdict + "\n\n" + "\n".join(lines)