Trust YT_PROXY_CA for HTTPS proxy; expand reachability probe battery

app.py

@@ -19,6 +19,31 @@ import shutil
 import tempfile
 import time
 
+
+def _install_proxy_ca() -> None:
+    """Trust a self-signed proxy CA (secret ``YT_PROXY_CA``) alongside the system
+    roots, so an HTTPS (TLS-wrapped) ``YT_PROXY`` validates. TLS-wrapping hides the
+    target host (``CONNECT www.youtube.com``) from the Space's egress DPI, which
+    otherwise resets YouTube-bound connections. Covers requests / youtube-transcript-api
+    (``REQUESTS_CA_BUNDLE``) and stdlib ssl / yt-dlp (``SSL_CERT_FILE``)."""
+    ca = os.environ.get("YT_PROXY_CA", "").strip()
+    if not ca:
+        return
+    try:
+        import certifi
+        bundle = os.path.join(tempfile.gettempdir(), "yt_proxy_ca_bundle.pem")
+        with open(certifi.where(), encoding="utf-8") as fh:
+            roots = fh.read()
+        with open(bundle, "w", encoding="utf-8") as fh:
+            fh.write(roots.rstrip() + "\n" + ca + "\n")
+        os.environ["REQUESTS_CA_BUNDLE"] = bundle
+        os.environ["SSL_CERT_FILE"] = bundle
+    except Exception:
+        pass
+
+
+_install_proxy_ca()
+
 import gradio as gr
 
 from pipeline import (
@@ -122,6 +147,8 @@ def check_access():
     probes = [
         ("example.com (neutral)", "https://example.com"),
         ("google.com/204 (Google cert, non-YT name)", "https://www.google.com/generate_204"),
+        ("i.ytimg.com (YT image CDN)", "https://i.ytimg.com/generate_204"),
+        ("youtubei.googleapis.com (YT API)", "https://youtubei.googleapis.com/generate_204"),
         ("youtube.com/robots.txt", "https://www.youtube.com/robots.txt"),
         ("youtube.com/ (large body)", "https://www.youtube.com/"),
     ]