Make YouTube reachability check self-diagnosing: retry 3x, surface real SSL error, classify cert-trust vs reset

app.py

@@ -17,6 +17,7 @@ import os
 import re
 import shutil
 import tempfile
+import time
 
 import gradio as gr
 
@@ -104,16 +105,38 @@ def check_access():
         lines.append(f"- **Egress IP** {'(via proxy)' if proxy else '(Space direct)'}: `{ip}`")
     except Exception as exc:
         lines.append(f"- **Egress IP**: ❌ {type(exc).__name__}")
-    try:
-        r = requests.get("https://www.youtube.com/robots.txt", proxies=proxies, timeout=20)
-        lines.append(f"- **YouTube reachable**: ✅ HTTP {r.status_code}")
-        verdict = "### 🟢 YouTube is reachable — transcript + screenshots should work."
-    except Exception as exc:
-        lines.append(f"- **YouTube reachable**: ❌ {type(exc).__name__} (datacenter IP likely blocked)")
-        verdict = ("### 🔴 YouTube is NOT reachable from the Space.\n"
-                   "Set a residential **`YT_PROXY`** (e.g. the home-tunnel panel in "
-                   "[`tools/`](tools/README.md)). Comments still work via the Data API; "
-                   "transcript + screenshots need the proxy.")
+    yt = "https://www.youtube.com/robots.txt"
+    last = None
+    for attempt in range(3):  # tolerate a transient TLS reset from the exit IP
+        try:
+            r = requests.get(yt, proxies=proxies, timeout=20)
+            lines.append(f"- **YouTube reachable**: ✅ HTTP {r.status_code}"
+                         + (f" (after {attempt + 1} tries)" if attempt else ""))
+            verdict = "### 🟢 YouTube is reachable — transcript + screenshots should work."
+            return verdict + "\n\n" + "\n".join(lines)
+        except Exception as exc:
+            last = exc
+            time.sleep(1.5)
+    # All retries failed — classify: CA-trust failure vs connection/handshake reset.
+    detail = f"`{type(last).__name__}: {str(last)[:160]}`"
+    if isinstance(last, requests.exceptions.SSLError):
+        try:
+            import urllib3
+            urllib3.disable_warnings()
+            r = requests.get(yt, proxies=proxies, timeout=20, verify=False)
+            lines.append(f"- **YouTube reachable**: ⚠️ only with TLS verify OFF (HTTP "
+                         f"{r.status_code}) → stale CA bundle. {detail}")
+            verdict = ("### 🟠 YouTube reachable, but the Space can't verify its certificate.\n"
+                       "Bump **`certifi`** in requirements.txt and rebuild the Space.")
+            return verdict + "\n\n" + "\n".join(lines)
+        except Exception as exc2:
+            detail = (f"verify-on: `{type(last).__name__}: {str(last)[:110]}` · "
+                      f"verify-off: `{type(exc2).__name__}: {str(exc2)[:110]}`")
+    lines.append(f"- **YouTube reachable**: ❌ {detail}")
+    verdict = ("### 🔴 YouTube is NOT reachable from the Space.\n"
+               "The proxy connects but YouTube's TLS is failing/reset (often the exit IP being "
+               "rate-limited — try again in a minute). If it persists, set/refresh a residential "
+               "**`YT_PROXY`** via the home-tunnel panel in [`tools/`](tools/README.md).")
     return verdict + "\n\n" + "\n".join(lines)