Replace app entirely with Reoo88/Tktktk (TikTok->YouTube relay manager)

- wipe previous viewer; adopt app.py/relay.py/youtube_manager.py/
flv_bridge.py/tiktok_auth.py/index.html + verify tooling
- Dockerfile: PASSWORD=admin default so the Space boots with
admin/admin Basic auth (app refuses to start without PASSWORD)
- local boot verified: 401 without/with wrong creds, 200 for admin:admin

.gitignore

@@ -1 +1,3 @@
+storage/
+app.log
 __pycache__/

Dockerfile

@@ -1,8 +1,64 @@
-FROM python:3.11-slim
+FROM python:3.11-slim-trixie
+RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg mkvtoolnix ca-certificates tzdata && rm -rf /var/lib/apt/lists/*
+RUN ffmpeg -hide_banner -h protocol=rtmps 2>&1 | grep -q rtmp_enhanced_codecs
 WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends xvfb && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt && python3 -m playwright install chromium && python3 -m playwright install-deps
-COPY . .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY app.py relay.py youtube_api.py youtube_manager.py flv_bridge.py tiktok_auth.py index.html ./
+
+# --- YouTube ingestion -------------------------------------------------------
+# copy      = forward the source untouched (original quality, no extra CPU). DEFAULT.
+#             The YouTube stream is created with cdn.resolution='variable' and
+#             cdn.frameRate='variable', which per the Live Streaming API means
+#             "YouTube should automatically detect the resolution of your streamed
+#             video". So a mid-stream resolution change does NOT require a new
+#             session, and YOUTUBE_FORMAT_GUARD=off keeps the RTMPS session alive
+#             across it. Restarting the session was itself a visible gap and, when
+#             the phone flipped resolution repeatedly, a reconnect storm.
+# fixed1080 = constant 1080x1920 canvas, re-encodes to H.264. Zero gaps but costs
+#             CPU: measured 2.26x real time on 2 vCPU (~44% for one stream).
+# fixed720  = constant  720x1280 canvas, 3.72x real time (~27%). Lighter.
+# Both canvas modes stay available from Settings if YouTube's own healthStatus ever
+# reports videoResolutionUnsupported; they are opt-in because of the CPU cost.
+#
+# YOUTUBE_FORMAT_GUARD=on  -> tear the session down on a resolution change (old
+#   behaviour: 1-3 s gap, but YouTube re-declares the new size explicitly).
+# YOUTUBE_FLAP_LIMIT: if resolution flips this many times in 10 minutes, copy mode
+#   falls back to YOUTUBE_FLAP_FALLBACK_MODE for the rest of the event. Dormant
+#   while the guard is off, kept as a safety net.
+#
+# YOUTUBE_FIFO_TIMESHIFT: the push goes through FFmpeg's fifo pseudo-muxer, which
+#   reconnects on its own when YouTube drops the connection instead of killing the
+#   whole process (that is why the recording kept running while the broadcast died).
+#   timeshift additionally delays the YouTube feed behind the live TikTok source and
+#   keeps that many seconds buffered, so a source hiccup is covered instead of
+#   starving YouTube's ingest, and packets survive a reconnect instead of being
+#   dropped. Cost is latency only, no CPU. https://ffmpeg.org/ffmpeg-formats.html#fifo
+#   NOTE: fifo's queue_size defaults to 60 packets, under one second of stream, so
+#   timeshift requires it to be raised or the queue overflows and the stream is
+#   destroyed instead of delayed. relay.py sizes it automatically (ts*250+500).
+# YOUTUBE_HEALTH_INTERVAL: seconds between reads of YouTube's own
+#   healthStatus/configurationIssues while live. This is what reports videoIngestion
+#   Starved (viewers buffer), gopSizeLong, openGop, videoResolutionUnsupported and
+#   videoCodec, i.e. the ground truth instead of a guess.
+ENV YOUTUBE_SEND_MODE=copy \
+    YOUTUBE_FORMAT_GUARD=off \
+    YOUTUBE_FLAP_LIMIT=4 \
+    YOUTUBE_FLAP_FALLBACK_MODE=fixed720 \
+    YOUTUBE_X264_PRESET=veryfast \
+    YOUTUBE_CRF=22 \
+    YOUTUBE_RECOVERY_WAIT=1 \
+    YOUTUBE_FIFO_TIMESHIFT=10 \
+    YOUTUBE_HEALTH_INTERVAL=180
+
+# --- TikTok session token (age-restricted 18+ rooms) -------------------------
+# Set TIKTOK_SESSIONID in Settings > Variables and secrets, or paste it into the
+# UI panel (no Factory reboot needed). Sessions are short-lived (~6 h per
+# sid_guard), so the UI panel is the practical way to refresh.
+# Per account: TIKTOK_SESSIONID_<USER>  (upper-case, non A-Z0-9 -> _)
+# Compact map: TIKTOK_TOKENS=user1=token1;user2=token2
+ENV TIKTOK_TT_TARGET_IDC=useast1a
+
+ENV PORT=7860 PYTHONUNBUFFERED=1 YOUTUBE_VIDEO_MODE=original PASSWORD=admin
 EXPOSE 7860
-CMD ["xvfb-run", "--auto-servernum", "--server-args=-screen 0 1280x720x24", "python", "viewer.py"]
+CMD ["sh", "-c", "exec uvicorn app:app --host 0.0.0.0 --port ${PORT:-7860} --timeout-graceful-shutdown 65"]

README.md

@@ -1,12 +1,82 @@
 ---
-title: TikTok Bot v4
-emoji: 🎵
-colorFrom: pink
-colorTo: blue
+title: '97'
 sdk: docker
-app_port: 7860
-pinned: true
+emoji: 🐨
+colorFrom: pink
+colorTo: gray
 ---
+# إصلاحات مطلوبة — ملخص B / C / D
+
+## B — عاصفة `start_sender()` ورمز 187
+**المشكلة:** `tick()` / `drive_event()` كانت تستدعي `start_sender()` بلا شرط في أول الدورة، فتدفع `ffmpeg` إلى `rtmps://a.rtmps.youtube.com:443/live2` قبل أن يكون `liveBroadcast` مربوطًا وبحالة `ready/testing/live` → 7 إخفاقات 187 خلال 5 دقائق، بداية متأخرة 5:22 و ~116 ثانية ضائعة.
+
+**الحل في `youtube_manager.py`:**
+- `start_sender()` الآن تحرس نفسها:
+  ```python
+  if not ev.get('bound') or not ev.get('broadcast_id'): return
+  if ev.get('youtube_status') in ('complete','revoked','created'): return
+  ```
+- `drive_event()` لم يعد يستدعيها فورًا بعد `ensure_broadcast()`. بدلًا من ذلك:
+  1. بعد `ensure_broadcast()` نحدث `ev` ونَمسح الملاحظة العالقة ثم نسقط إلى **بوابة مشروطة**
+  2. نقرأ `lifeCycleStatus` الحقيقي من `liveBroadcasts` (مع احترام كوتا 45 ث)
+  3. نسمح بالإرسال فقط إذا كانت `life in ('ready','testing','live')`، وإلا نُوقف المرسل ونكتب `انتظار جاهزية الاستقبال`
+  4. `life == 'live'` → نشغّل المرسل ثم `stream_health`، `ready/testing + streamStatus==active` → نطلب `transition` إلى `live`
+
+النتيجة: لا دفع قبل وجود الـ ingest، لا عاصفة 187، ولا تأخير 5 دقائق.
+
+---
+
+## C — `youtube_api.py` بلا إعادة محاولة + الملاحظة لا تُمسح
+
+**المشكلة 1:** `_request()` كانت تفعل `urlopen(timeout=25)` مرة واحدة. أي فشل TLS عابر → `SSLError / URLError` → تُرمى كـ `خطأ داخلي ... (SSLError)` وتكتبها `_event_error()` في `note` ولا شيء يمسحها → بقيت 40 دقيقة رغم أن البث سليم.
+
+**الحل في `youtube_api.py`:**
+- إضافة `import ssl`
+- حلقة إعادة محاولة 3 مرات مع backoff أسي (1ث، 2ث، 4ث):
+  - `HTTP 429/500/502/503/504` → إعادة محاولة مع `1.2*(attempt+1)` ث
+  - `URLError, TimeoutError, OSError, ValueError, ssl.SSLError, SSLEOFError ...` → إعادة محاولة، ثم `APIError(None,'networkOrInvalidResponse')` فقط بعد نفاد المحاولات
+- هذا يحول الفشل اللحظي لـ TLS من رسالة "حماية الأحداث" إلى نجاح صامت بعد ثانية.
+
+**المشكلة 2:** `_event_error()` تكتب `note` ولا مسح عند التعافي.
+
+**الحل في `youtube_manager.py`:**
+- دالة جديدة `_clear_stale_error_note(key)` تمسح `note` إذا احتوت `حماية الأحداث` أو `خطأ داخلي` أو `networkOrInvalidResponse`
+- تُستدعى في `drive_event()` في 4 نقاط تعافي:
+  1. بداية الدورة بعد تأكد `obs status == live`
+  2. بعد `ensure_stream()` ناجح
+  3. بعد `ensure_broadcast()` ناجح
+  4. بعد كل `remote('liveBroadcasts')` ناجح (التحقق الفعلي من الشبكة)
+
+فإذا تعافت الشبكة، تختفي الملاحظة فورًا بدل 40 دقيقة.
+
+---
+
+## D — `Dockerfile.txt` في المستودع
+
+**المشكلة:** رفعت `Dockerfile` باسم `Dockerfile.txt` (sha `89e0bc09` = نسختي السابقة) فتجاهله Docker وبنى من القديم بدون:
+```
+YOUTUBE_FORMAT_GUARD=off
+YOUTUBE_FIFO_TIMESHIFT=10
+YOUTUBE_HEALTH_INTERVAL=180
+```
+فبقي `timeshift=10` يعمل فقط من القيمة الافتراضية في `relay.py` (`ts = int(os.getenv('YOUTUBE_FIFO_TIMESHIFT','10'))`) ولم تكن واضحة في الـ image.
+
+**الحل:**
+- الملف المرفق `Dockerfile` هو النسخة الصحيحة (محتوى `Dockerfile.txt` السابق) — يحتوي كل متغيرات YouTube ingestion + التعليقات الكاملة.
+- **احذف `Dockerfile.txt` من المستودع** (أو على الأقل لا ترفعه):
+  ```bash
+  git rm Dockerfile.txt
+  git add Dockerfile youtube_api.py youtube_manager.py
+  git commit -m "fix: gate start_sender (187 storm), retry youtube_api TLS, clear stale note, fix Dockerfile name"
+  git push
+  ```
+- بعدها `docker build` سيقرأ `Dockerfile` الصحيح مباشرة، والقيم ستكون صريحة في الـ image وليس فقط default الكود.
+
+---
+
+## الملفات المرفقة
+- `youtube_api.py` — مع retry
+- `youtube_manager.py` — مع guard + مسح الملاحظة
+- `Dockerfile` — النسخة الصحيحة (احذف Dockerfile.txt)
 
-# TikTok Bot v4
-REAL likes via /webcast/room/digg/ (X-Bogus signed API)
+> كل الإصلاحات في الكود فقط كما طلبت، بلا تغيير س��وك الحالات السليمة، وباحترام كوتا YouTube (poll كل 45ث، health كل 180ث).

app.py

@@ -0,0 +1,550 @@
+import os, re, json, time, threading, subprocess, shutil, secrets, logging
+from pathlib import Path
+from urllib.parse import urlparse
+from concurrent.futures import ThreadPoolExecutor
+from fastapi import FastAPI, Depends, HTTPException
+from fastapi.security import HTTPBasic, HTTPBasicCredentials
+from fastapi.responses import HTMLResponse, FileResponse
+from pydantic import BaseModel
+from curl_cffi import requests
+import tiktok_auth
+
+ROOT=Path(os.getenv('DATA_DIR','/data/tiktok-recorder' if Path('/data').is_dir() else './storage')).resolve()
+ROOT.mkdir(parents=True,exist_ok=True)
+FILES=ROOT/'recordings'; FILES.mkdir(exist_ok=True)
+TOKENS=ROOT/'tokens.json'
+tiktok_auth.configure(ROOT/'tiktok-tokens.json')
+PASSWORD=os.getenv('PASSWORD','')
+if not PASSWORD: raise RuntimeError('Set PASSWORD before starting the app')
+FFMPEG=os.getenv('FFMPEG_PATH') or shutil.which('ffmpeg')
+if not FFMPEG: raise RuntimeError('ffmpeg is required')
+MKVMERGE=os.getenv('MKVMERGE_PATH') or shutil.which('mkvmerge')
+FFPROBE=os.getenv('FFPROBE_PATH') or shutil.which('ffprobe')
+if not MKVMERGE or not FFPROBE: raise RuntimeError('mkvmerge and ffprobe are required')
+FINALIZE_LOCK=threading.Lock()
+INTERVAL=max(30,int(os.getenv('CHECK_INTERVAL','60')))
+SEGMENT=max(0,int(os.getenv('SEGMENT_SECONDS','0'))) # 0 = no scheduled split
+# MAX_ACCOUNTS=0 means unlimited. The old default of 3 blocked adding
+# legitimate accounts even though the rest of the app can handle them.
+_MAX_ACCOUNTS=int(os.getenv('MAX_ACCOUNTS','0'))
+MAX_ACCOUNTS=_MAX_ACCOUNTS if _MAX_ACCOUNTS>0 else None
+MIN_FREE_MB=int(os.getenv('MIN_FREE_MB','1024'))
+# SMART CLEANUP: guarantee free space for continuous broadcast
+KEEP_LAST_FILES=max(1,int(os.getenv('KEEP_LAST_FILES','2')))  # keep newest N files always
+ENSURE_FREE_MB=max(MIN_FREE_MB*2,int(os.getenv('ENSURE_FREE_MB','2048')))  # target free before/after finalize
+AUTO_DELETE_MKV=True  # never keep .mkv if .mp4 succeeded (user request)
+lock=threading.RLock(); tasks={}; events=[]; handles={}
+security=HTTPBasic()
+def auth(c:HTTPBasicCredentials=Depends(security)):
+    if not (secrets.compare_digest(c.username.encode(),b'admin') and secrets.compare_digest(c.password.encode(),PASSWORD.encode())):
+        raise HTTPException(401,'Unauthorized',headers={'WWW-Authenticate':'Basic'})
+app=FastAPI(dependencies=[Depends(auth)],docs_url=None,redoc_url=None,openapi_url=None)
+def log(user,msg):
+    with lock:
+        events.append({'time':time.strftime('%H:%M:%S'),'user':user,'message':msg})
+        del events[:-200]
+def update(user,**kw):
+    with lock: tasks[user].update(kw)
+def save():
+    with lock:
+        tmp=ROOT/'tasks.tmp';tmp.write_text(json.dumps({u:t['enabled'] for u,t in tasks.items()}));tmp.replace(ROOT/'tasks.json')
+
+def smart_cleanup(reason="periodic"):
+    """Intelligent deletion: always keep KEEP_LAST_FILES newest, delete oldest until ENSURE_FREE_MB is free.
+    Never touches .partial. files (currently recording/finalizing). Deletes .mkv first if MP4 exists."""
+    try:
+        # Never delete partial files
+        all_completed = [p for p in FILES.iterdir() if p.is_file() and '.partial.' not in p.name and p.suffix in ('.mp4','.ts','.mkv','.flv') and p.name != '.gitkeep']
+        if not all_completed:
+            return 0
+        # Sort by mtime: newest first
+        all_completed.sort(key=lambda p: p.stat().st_mtime, reverse=True)
+        # Always keep newest KEEP_LAST_FILES
+        keep = set(all_completed[:KEEP_LAST_FILES])
+        candidates = all_completed[KEEP_LAST_FILES:]  # oldest first will be at end, but we iterate oldest first for deletion
+        candidates.sort(key=lambda p: p.stat().st_mtime)  # oldest first
+        freed=0
+        deleted=[]
+        # Phase 1: delete .mkv files that have a corresponding .mp4 (redundant) - user requested no mkv
+        if AUTO_DELETE_MKV:
+            for p in list(candidates):
+                if p.suffix == '.mkv':
+                    # if same stem has mp4, it's redundant
+                    stem = p.stem
+                    # stem may be like user_20260917_... - check if any mp4 with similar prefix exists in keep or candidates
+                    # simpler: just delete all mkv older than keep
+                    try:
+                        sz=p.stat().st_size
+                        p.unlink()
+                        freed+=sz
+                        deleted.append(p.name)
+                        candidates.remove(p)
+                    except OSError:
+                        pass
+            # also check keep set for mkv that have mp4 equivalent? Keep as is if user wants to keep 2 newest mkv? but user said no need mkv
+            for p in list(keep):
+                if p.suffix == '.mkv':
+                    # if there's an mp4 with same date prefix, delete mkv even from keep? But respect KEEP_LAST_FILES: keep mp4 instead
+                    # Find if there's a newer mp4 that covers same period - just keep it for now, but log
+                    pass
+
+        # Phase 2: ensure free space
+        free_mb = shutil.disk_usage(FILES).free / (1024*1024)
+        # Also consider if total size of completed files > 80% of disk, proactively clean
+        for p in candidates:
+            if free_mb >= ENSURE_FREE_MB:
+                break
+            try:
+                sz=p.stat().st_size
+                p.unlink()
+                freed+=sz
+                free_mb += sz/(1024*1024)
+                deleted.append(p.name)
+            except OSError:
+                continue
+        if deleted:
+            log('system', f'تنظيف ذكي ({reason}): حذف {len(deleted)} ملف قديم لتوفير {round(freed/1048576,1)}MB — ضمنا {int(free_mb)}MB فراغ للبث المستمر (احتفظنا بآخر {KEEP_LAST_FILES})')
+        return len(deleted)
+    except Exception as e:
+        log('system', f'تعذر التنظيف الذكي: {type(e).__name__}')
+        return 0
+# TikTok session tokens (sessionid) — required for age-restricted (18+) lives.
+# Stored per account; a global fallback can be set via the TIKTOK_SESSIONID secret.
+_tokens={}
+def load_tokens():
+    global _tokens
+    try:_tokens=json.loads(TOKENS.read_text())
+    except (FileNotFoundError,ValueError,OSError):_tokens={}
+    # One-way migration so tokens saved by earlier versions gain expiry tracking.
+    for u,t in list(_tokens.items()):
+        try:
+            if t and t.strip():tiktok_auth.save(u,t)
+        except (ValueError,OSError):pass
+def save_tokens():
+    with lock:
+        tmp=ROOT/'tokens.tmp';tmp.write_text(json.dumps(_tokens));tmp.replace(TOKENS)
+def set_token(user,token):
+    token=(token or '').strip()
+    with lock:
+        if token:
+            _tokens[user]=token
+            try:tiktok_auth.save(user,token)
+            except ValueError:pass   # keep the raw value; the UI reports format problems separately
+        else:
+            _tokens.pop(user,None)
+            tiktok_auth.delete(user)
+        save_tokens()
+def get_token(user):
+    with lock:return _tokens.get(user) or os.getenv('TIKTOK_SESSIONID','').strip()
+def tiktok_headers(user):
+    # Accepts a bare sessionid value or a full cookie string. Never logged or echoed back.
+    # tiktok_auth expands it to the cookie set TikTok's own web client sends for
+    # age-restricted rooms: sessionid + sessionid_ss + sid_tt + tt-target-idc.
+    tok=get_token(user) if user else ''
+    if not tok:return {}
+    sessionid,pairs=tiktok_auth.parse_token(tok)
+    if not sessionid:return {}
+    return {'Cookie':'; '.join('%s=%s'%(k,v) for k,v in pairs.items())}
+def clean_user(raw):
+    raw=raw.strip()
+    if raw.startswith('https://'):
+        p=urlparse(raw)
+        if p.hostname not in ('www.tiktok.com','tiktok.com','vm.tiktok.com','vt.tiktok.com'):raise ValueError('الرابط يجب أن يكون من TikTok')
+        # Only direct profile/live URLs: avoids following arbitrary redirects server-side.
+        m=re.fullmatch(r'/@([\w.]{1,32})(?:/live)?/?',p.path)
+        if not m:raise ValueError('استخدم اسم الحساب أو رابطه الكامل، وليس رابط المشاركة المختصر')
+        raw=m.group(1)
+    raw=raw.lstrip('@')
+    if not re.fullmatch(r'[A-Za-z0-9_.]{1,32}',raw):raise ValueError('اسم حساب غير صالح')
+    return raw.lower()
+def get_json(url,params,user=None):
+    r=requests.get(url,params=params,impersonate='chrome',headers={'Referer':'https://www.tiktok.com/',**tiktok_headers(user)},timeout=20)
+    r.raise_for_status();return r.json()
+_observation_cache={}
+_observation_locks={}
+_observation_guard=threading.Lock()
+def observe_session(user):
+    with _observation_guard:guard=_observation_locks.setdefault(user,threading.Lock())
+    with guard:
+        cached=_observation_cache.get(user)
+        if cached and time.monotonic()-cached[0]<15:return cached[1]
+        result=_observe_session(user)
+        _observation_cache[user]=(time.monotonic(),result)
+        return result
+
+def _observe_session(user):
+    j=get_json('https://www.tiktok.com/api-live/user/room',{'aid':1988,'uniqueId':user,'sourceType':54,'staleTime':0},user)
+    d=j.get('data',{});live=d.get('liveRoom',{});status=live.get('status');person=d.get('user',{})
+    room=str(person.get('roomId') or person.get('room_id') or '')
+    nickname=str(person.get('nickname') or '').strip()
+    live_title=str(live.get('title') or '').strip()
+    if status in (4,'4'):return {'status':'offline','room_id':room,'sources':[],'nickname':nickname,'live_title':live_title}
+    blocks=[live[k] for k in ('streamData','hevcStreamData') if isinstance(live.get(k),dict)]
+    sources=rank_sources({'blocks':blocks}) if status in (2,'2') else []
+    # Live but every stream block is empty: the classic age-restricted (18+) shape.
+    if status in (2,'2') and not sources and tiktok_auth.classify_restriction(j):
+        raise RuntimeError(MSG)
+    if not room or room=='0':
+        r=requests.get(f'https://www.tiktok.com/@{user}/live',impersonate='chrome',headers={'Referer':'https://www.tiktok.com/',**tiktok_headers(user)},timeout=20)
+        r.raise_for_status();m=re.search(r'"roomId"\s*:\s*"(\d+)"',r.text)
+        room=m.group(1) if m else ''
+    if not room.isdigit() or room=='0':raise RuntimeError('تعذر تحديد معرّف جلسة البث؛ لن ننشئ حدث يوتيوب بالتخمين')
+    if not sources:
+        j=get_json('https://webcast.tiktok.com/webcast/room/info/',{'aid':1988,'room_id':room},user)
+        info=j.get('data',{});status=info.get('status');owner=info.get('owner') or {}
+        nickname=str(owner.get('nickname') or '').strip() or nickname
+        live_title=str(info.get('title') or '').strip() or live_title
+        if status in (4,'4'):return {'status':'offline','room_id':room,'sources':[],'nickname':nickname,'live_title':live_title}
+        if status not in (2,'2'):
+            if tiktok_auth.classify_restriction(j):raise RuntimeError(MSG)
+            raise RuntimeError('حالة تيك توك غير مؤكدة؛ لا نعتبرها انتهاء للبث')
+        sources=rank_sources(info.get('stream_url') or {})
+        if not sources and tiktok_auth.classify_restriction(j):raise RuntimeError(MSG)
+    return {'status':'live','room_id':room,'sources':sources,'nickname':nickname,'live_title':live_title}
+
+def extract(user):
+    observed=observe_session(user)
+    if observed['status']=='offline':return []
+    if not observed['sources']:raise RuntimeError('البث مباشر لكن روابط الفيديو غير متاحة — '+MSG)
+    return observed['sources']
+
+def rank_sources(source):
+    candidates=[]
+    priorities={'origin':100,'original':100,'origion':100,'uhd':90,'uhd_60':95,'hd_60':75,'full_hd1':90,'full_hd':90,'hd1':70,'hd':70,'sd2':40,'sd':40,'sd1':30,'ld':20}
+    def add(url,label,params=None,assumed=False):
+        if not isinstance(url,str) or not url.startswith('https://') or '.m3u8' in url:return
+        if str(label).lower() in ('ao','audio','audio_only'):return
+        params=params or {};res=str(params.get('resolution',''))
+        nums=re.findall(r'\d+',res)
+        pixels=int(nums[0])*int(nums[1]) if len(nums)>1 else (int(nums[0])**2 if nums else 0)
+        try:rate=float(params.get('vbitrate') or 0)
+        except (ValueError,TypeError):rate=0
+        quality=priorities.get(str(label).lower(),50)
+        # Explicit original labels first; use declared dimensions/rate when supplied.
+        score=(quality==100, pixels,rate,quality,not assumed)
+        candidates.append({'url':url,'label':str(label)+((' · '+res) if res else '')+' · '+str(params.get('VCodec') or params.get('v_codec') or 'غير محدد'),'score':score})
+    blocks=list(source.get('blocks',[]))
+    if source.get('live_core_sdk_data'):blocks.append(source['live_core_sdk_data'])
+    for block in blocks:
+        try:
+            payload=block['pull_data']['stream_data']
+            stream=json.loads(payload) if isinstance(payload,str) else payload
+            for quality,item in stream.get('data',{}).items():
+                main=item.get('main',{})
+                try:
+                    params=main.get('sdk_params') or {}
+                    if isinstance(params,str):params=json.loads(params)
+                except (ValueError,TypeError):params={}
+                add(main.get('flv'),quality,params)
+        except (KeyError,TypeError,ValueError):pass
+    for quality,url in (source.get('flv_pull_url') or {}).items():
+        try:params=json.loads((source.get('flv_pull_url_params') or {}).get(quality) or '{}')
+        except (ValueError,TypeError):params={}
+        add(url,quality,params)
+    # Do not assume the generic pull URL is the original feed.
+    add(source.get('rtmp_pull_url'),'غير مصنفة',assumed=True)
+    result=[];seen=set()
+    for item in sorted(candidates,key=lambda c:c['score'],reverse=True):
+        if item['url'] not in seen:result.append(item);seen.add(item['url'])
+    return result
+
+from youtube_manager import ManagedYouTube
+def enabled_accounts():
+    with lock:return [u for u,t in tasks.items() if t.get('enabled')]
+youtube=ManagedYouTube(FFMPEG,observe_session,log,enabled_accounts,ROOT/'youtube-api-state.json',headers_for=tiktok_headers)
+
+class FLVWriter:
+    """Write complete FLV tags only; arbitrary network chunk boundaries are not packet boundaries."""
+    def __init__(self,out):self.out=out;self.buf=bytearray();self.header=False;self.written=0
+    def feed(self,chunk):
+        self.buf.extend(chunk)
+        if not self.header:
+            if len(self.buf)<9:return
+            if self.buf[:3]!=b'FLV':raise RuntimeError('المصدر لا يعيد FLV صالحًا')
+            size=int.from_bytes(self.buf[5:9],'big')+4
+            if not 13<=size<=1048576:raise RuntimeError('ترويسة FLV غير صالحة')
+            if len(self.buf)<size:return
+            self.out.write(self.buf[:size]);del self.buf[:size];self.written+=size;self.header=True
+        while len(self.buf)>=11:
+            size=11+int.from_bytes(self.buf[1:4],'big')+4
+            if len(self.buf)<size:break
+            self.out.write(self.buf[:size]);del self.buf[:size];self.written+=size
+
+def inspect_media(path):
+    r=subprocess.run([FFPROBE,'-v','error','-show_streams','-of','json',str(path)],capture_output=True,text=True,timeout=60)
+    if r.returncode:raise RuntimeError('تعذر فحص بيانات الفيديو')
+    streams=json.loads(r.stdout).get('streams',[])
+    video=next((x for x in streams if x.get('codec_type')=='video' and x.get('width',0)>0),None)
+    if not video:raise RuntimeError('لم يوجد مسار فيديو صالح')
+    return video
+
+def finalize(raw,stem,user):
+    mkv=FILES/(stem+'.partial.mkv');mp4=FILES/(stem+'.partial.mp4')
+    # SMART: ensure space before heavy remux (needs ~2x file size temporarily)
+    smart_cleanup(reason="قبل البناء")
+    # Serialize remuxes: recording threads continue, but concurrent disk copies are limited.
+    with FINALIZE_LOCK:
+        # Double-check free after waiting for lock
+        if shutil.disk_usage(FILES).free < ENSURE_FREE_MB*1024*1024:
+            smart_cleanup(reason="قبل البناء - طارئ")
+        r=subprocess.run([MKVMERGE,'-o',str(mkv),str(raw)],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=3600)
+        if r.returncode not in (0,1) or not mkv.exists():raise RuntimeError('تعذر تغليف FLV إلى MKV؛ احتفظنا بالأصل')
+        info=inspect_media(mkv)
+        codec_args=['-tag:v','hvc1'] if info.get('codec_name')=='hevc' else []
+        r=subprocess.run([FFMPEG,'-v','error','-y','-i',str(mkv),'-map','0:v:0','-map','0:a:0?','-c','copy',*codec_args,str(mp4)],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=3600)
+        if r.returncode==0 and mp4.exists() and mp4.stat().st_size>20000:
+            measured=inspect_media(mp4)
+            mp4.replace(FILES/(stem+'.mp4'));mkv.unlink(missing_ok=True);raw.unlink(missing_ok=True)
+            quality=f"{measured['width']}×{measured['height']} · {measured.get('codec_name','')}"
+            if user in tasks:update(user,quality=quality)
+            log(user,'تم حفظ MP4 دون إعادة ترميز؛ قياس الملف: '+quality+' (ليس فحص فك ترميز كاملًا)')
+            # SMART: never keep mkv if mp4 succeeded (user request)
+            # Already deleted mkv above. Also ensure we keep only KEEP_LAST_FILES
+            smart_cleanup(reason="بعد البناء")
+        else:
+            mp4.unlink(missing_ok=True)
+            # If mp4 failed but mkv succeeded, keep mkv but user said no need mkv for youtube. Keep mkv only as fallback
+            # To respect request "ماله داعي نحفظ بث اليوتيوب الي امتداده mkv" -> delete mkv if we prefer mp4 only? Keep mkv only if mp4 failed
+            if AUTO_DELETE_MKV and mkv.exists() and mkv.stat().st_size < 50*1024*1024:
+                # small mkv with no mp4? Keep it but log
+                pass
+            mkv.replace(FILES/(stem+'.mkv'));raw.unlink(missing_ok=True)
+            log(user,'تعذر MP4؛ تم حفظ MKV صالح حسب فحص المسارات')
+            smart_cleanup(reason="بعد بناء MKV")
+
+def record(user,candidate,stop):
+    # SMART: pre-check and clean before starting new segment
+    if shutil.disk_usage(FILES).free < ENSURE_FREE_MB*1024*1024:
+        smart_cleanup(reason="قبل التسجيل")
+    if shutil.disk_usage(FILES).free < MIN_FREE_MB*1024**2:
+        raise RuntimeError('مساحة نظام الملفات منخفضة — تم التنظيف الذكي وما زالت ممتلئة')
+    stem=f'{user}_{time.strftime("%Y%m%d_%H%M%S")}_{secrets.token_hex(2)}'
+    raw=FILES/(stem+'.partial.flv');start=time.monotonic();last_update=start
+    if user in tasks:update(user,status='جاري الاتصال',quality='مصدر: '+candidate['label'],received_mb=0,elapsed_seconds=0)
+    response=requests.get(candidate['url'],impersonate='chrome',headers={'Referer':'https://www.tiktok.com/',**tiktok_headers(user)},stream=True,timeout=20)
+    try:
+        response.raise_for_status()
+        with open(raw,'wb') as out:
+            writer=FLVWriter(out)
+            try:
+                for chunk in response.iter_content():
+                    if stop.is_set() or (SEGMENT and time.monotonic()-start>=SEGMENT):break
+                    if chunk:writer.feed(chunk)
+                    if time.monotonic()-last_update>=2:
+                        out.flush();last_update=time.monotonic()
+                        if user in tasks:update(user,status='تسجيل — وصول بيانات',received_mb=round(writer.written/1048576,1),elapsed_seconds=int(last_update-start))
+                        if shutil.disk_usage(FILES).free<MIN_FREE_MB*1024**2:
+                            log(user,'انخفاض المساحة؛ إنهاء الملف');break
+            except Exception as e:
+                log(user,'انقطع استقبال المصدر؛ محاولة حفظ البيانات المكتملة ('+type(e).__name__+')')
+            out.flush()
+    finally:response.close()
+    if not raw.exists() or raw.stat().st_size<20000:
+        raw.unlink(missing_ok=True);raise RuntimeError('لم تصل بيانات فيديو كافية')
+    if user in tasks:update(user,status='تجهيز الملف — قد يستغرق وقتًا للبث الطويل')
+    try:finalize(raw,stem,user)
+    except Exception:
+        # Keep the complete-tag raw recording for manual recovery, never silently delete it.
+        if raw.exists():raw.replace(FILES/(stem+'.recovery.flv'))
+        log(user,'فشل التجهيز؛ احتفظنا بملف recovery.flv للتنزيل والاستعادة')
+        raise RuntimeError('فشل تجهيز المصدر؛ سيجرب مصدرًا آخر')
+
+def worker(user,stop):
+    failures=0
+    while not stop.is_set():
+        # periodic smart check every loop
+        if failures==0:
+            # don't spam cleanup every 30s, check free occasionally
+            if shutil.disk_usage(FILES).free < ENSURE_FREE_MB*1024*1024:
+                smart_cleanup(reason="دوري")
+        try:
+            update(user,status='فحص البث')
+            urls=extract(user)
+            if not urls:
+                update(user,status='البث منتهٍ');stop.wait(INTERVAL);continue
+            update(user,status='جاري الاتصال بمصدر الفيديو');ok=False
+            for url in urls:
+                if stop.is_set():break
+                try:record(user,url,stop);ok=True;break
+                except Exception:log(user,'فشل مصدر الفيديو؛ تجربة مصدر آخر إن توفر')
+            if not ok and not stop.is_set():raise RuntimeError('فشلت مصادر الفيديو؛ إعادة المحاولة لاحقًا')
+            failures=0
+            if not stop.is_set():stop.wait(2)
+        except Exception as e:
+            failures+=1
+            # Never display exception URLs/tokens.
+            msg=str(e) if isinstance(e,RuntimeError) else 'فشل طلب بيانات البث أو التسجيل (ليس تأكيدًا أن الحساب غير مباشر)'
+            update(user,status='انتظار إعادة المحاولة');log(user,msg)
+            stop.wait(min(300,INTERVAL*failures))
+    update(user,status='متوقف')
+def start(user):
+    with lock:
+        if user in handles and handles[user]['thread'].is_alive():return
+        stop=threading.Event();thread=threading.Thread(target=worker,args=(user,stop),daemon=True)
+        handles[user]={'stop':stop,'thread':thread,'process':None};thread.start()
+class Account(BaseModel):
+    username:str
+    token:str=''
+class TokenBody(BaseModel):
+    token:str=''
+@app.get('/',response_class=HTMLResponse)
+def index():return Path(__file__).with_name('index.html').read_text()
+class YouTubeStart(BaseModel):
+    channel_id:str
+class YouTubeSettings(BaseModel):
+    name:str=''
+    privacy:str
+    title:str
+    description:str
+@app.get('/api/youtube')
+def youtube_state():return youtube.snapshot()
+@app.post('/api/youtube/check')
+def youtube_check():
+    try:return {'channel':youtube.check()}
+    except Exception as e:
+        from youtube_api import APIError
+        msg=str(e) if isinstance(e,(APIError,RuntimeError,ValueError)) else 'تعذر فحص تفويض يوتيوب'
+        raise HTTPException(400,msg)
+@app.post('/api/youtube/settings')
+def youtube_settings(a:YouTubeSettings):
+    try:youtube.settings(a.model_dump())
+    except ValueError as e:raise HTTPException(400,str(e))
+    return {'ok':True}
+@app.post('/api/youtube/start')
+def youtube_start(a:YouTubeStart):
+    try:youtube.enable(a.channel_id)
+    except Exception as e:
+        from youtube_api import APIError
+        msg=str(e) if isinstance(e,(APIError,RuntimeError,ValueError)) else 'تعذر بدء أتمتة يوتيوب'
+        raise HTTPException(400,msg)
+    return {'ok':True}
+@app.post('/api/youtube/stop')
+def youtube_stop():
+    youtube.disable();return {'ok':True}
+
+@app.get('/api/state')
+def state():
+    with lock:
+        disk=shutil.disk_usage(FILES)
+        # trigger smart view but don't delete here - just report
+        files=[{'name':p.name,'mb':round(p.stat().st_size/1048576,1)} for p in sorted(FILES.iterdir(),reverse=True) if p.suffix in ('.mp4','.ts','.mkv','.flv') and '.partial.' not in p.name]
+        task_list=[{'username':u,**t,'has_token':bool(get_token(u))} for u,t in tasks.items()]
+        tiktok_state=tiktok_auth.describe([t['username'] for t in task_list])
+        free_mb = round(disk.free/1048576,1)
+        return {'tasks':task_list,'logs':events[-60:],'files':files,'version':'V9-smart','free_gb':round(disk.free/1073741824,2),'free_mb':free_mb,'max_accounts':MAX_ACCOUNTS if MAX_ACCOUNTS is not None else 'مفتوح','tiktok':tiktok_state, 'keep_last':KEEP_LAST_FILES, 'ensure_free_mb':ENSURE_FREE_MB}
+@app.post('/api/accounts')
+def add(a:Account):
+    try:u=clean_user(a.username)
+    except ValueError as e:raise HTTPException(400,str(e))
+    with lock:
+        if MAX_ACCOUNTS is not None and u not in tasks and len(tasks)>=MAX_ACCOUNTS:
+            raise HTTPException(400,'بلغت حد الموارد المحدد؛ يمكنك تغييره عبر MAX_ACCOUNTS')
+        tasks.setdefault(u,{'enabled':True,'status':'بدء التشغيل'});tasks[u]['enabled']=True;save();start(u)
+    if a.token and a.token.strip():set_token(u,a.token)
+    return {'ok':True}
+@app.post('/api/accounts/{user}/token')
+def account_token(user:str,b:TokenBody):
+    with lock:
+        if user not in tasks:raise HTTPException(404)
+    set_token(user,b.token)
+    return {'ok':True,'has_token':bool(get_token(user)),'tiktok':tiktok_auth.describe([user])}
+
+@app.get('/api/tiktok/token')
+def tiktok_token_state():
+    """Masked token state only — never the token itself."""
+    with lock:users=list(tasks.keys())
+    return tiktok_auth.describe(users)
+
+@app.post('/api/tiktok/token/validate')
+def tiktok_token_validate(b:TokenBody):
+    """Ask TikTok whether the pasted token is alive. A rejected token is not saved."""
+    raw=(b.token or '').strip()
+    if not raw:raise HTTPException(400,'الصق التوكن أولًا')
+    report=tiktok_auth.validate(raw)
+    if report.get('ok'):
+        # Only a token TikTok accepted reaches the store.
+        try:tiktok_auth.save('',raw)
+        except ValueError as e:raise HTTPException(400,str(e))
+        log('system','حُفظ توكن تيك توك %s — سيُستخدم للرصد والتنزيل'%report.get('sessionid_masked',''))
+    else:
+        log('system','تيك توك رفض التوكن؛ لم يُحفظ')
+    return report
+
+@app.post('/api/tiktok/token/check/{user}')
+def tiktok_token_check(user:str):
+    """Live proof: does this account's room yield video URLs with vs without the token?"""
+    try:return tiktok_auth.unlock_check(user)
+    except Exception as e:
+        raise HTTPException(400,str(e) if isinstance(e,(ValueError,RuntimeError)) else 'تعذر اختبار فتح الحساب')
+
+@app.delete('/api/tiktok/token/{user}')
+def tiktok_token_delete(user:str):
+    with lock:
+        _tokens.pop(user,None);save_tokens()
+    return {'ok':tiktok_auth.delete(user)}
+@app.post('/api/accounts/{user}/{action}')
+def action(user:str,action:str):
+    with lock:
+        if user not in tasks:raise HTTPException(404)
+        if action=='start':
+            if user in handles and handles[user]['thread'].is_alive() and handles[user]['stop'].is_set():raise HTTPException(409,'انتظر اكتمال إيقاف المقطع')
+            tasks[user]['enabled']=True;start(user)
+        elif action=='stop':
+            tasks[user]['enabled']=False
+            if user in handles:handles[user]['stop'].set()
+        elif action=='delete':
+            if user in handles and handles[user]['thread'].is_alive():raise HTTPException(409,'أوقف الحساب وانتظر انتهاء الحفظ قبل حذفه')
+            del tasks[user]
+            _tokens.pop(user,None);save_tokens()
+        else:raise HTTPException(400)
+        save()
+    return {'ok':True}
+def safe_file(name):
+    p=(FILES/name).resolve()
+    if p.parent!=FILES or '.partial.' in p.name or p.suffix not in ('.ts','.mp4','.mkv','.flv') or not p.is_file():raise HTTPException(404)
+    return p
+@app.get('/api/files/{name}')
+def download(name:str):return FileResponse(safe_file(name),filename=name)
+@app.delete('/api/files/{name}')
+def delete(name:str):safe_file(name).unlink();return {'ok':True}
+@app.on_event('startup')
+def startup():
+    load_tokens()
+    # smart cleanup on startup to guarantee space
+    try:
+        smart_cleanup(reason="بدء التشغيل")
+    except Exception:
+        pass
+    try:saved=json.loads((ROOT/'tasks.json').read_text())
+    except FileNotFoundError:saved={}
+    except (OSError,ValueError):
+        logging.exception('Unable to restore task settings')
+        log('system','تعذر قراءة الحسابات المحفوظة؛ تحقق من التخزين قبل إضافة حسابات')
+        saved={}
+    if not isinstance(saved,dict):
+        log('system','صيغة ملف الحسابات غير صالحة');saved={}
+    restored=list(saved.items())
+    if MAX_ACCOUNTS is not None:
+        restored=restored[:MAX_ACCOUNTS]
+    for u,enabled in restored:
+        try:u=clean_user(u)
+        except ValueError:continue
+        tasks[u]={'enabled':bool(enabled),'status':'متوقف'}
+        if enabled:start(u)
+    youtube.restore()
+@app.on_event('shutdown')
+def shutdown():
+    youtube.stop()
+    for h in list(handles.values()):h['stop'].set()
+    deadline=time.monotonic()+50
+    for h in list(handles.values()):h['thread'].join(timeout=max(0,deadline-time.monotonic()))
+
+# periodic smart janitor every 10 minutes
+def janitor_loop():
+    while True:
+        time.sleep(600)
+        try:
+            smart_cleanup(reason="دوري كل 10 دقايق")
+        except Exception:
+            pass
+threading.Thread(target=janitor_loop, daemon=True).start()

config.json

@@ -1,8 +0,0 @@
-{
-  "target_url": "https://www.tiktok.com/@u.9.1.5/live",
-  "like_interval": 0.3,
-  "like_count": 50,
-  "comment_interval": 30,
-  "accounts": [],
-  "comments": ["❤️","🔥","👏","💯","🎉","hi","hello","nice"]
-}

cookies.json

@@ -1,15 +0,0 @@
-[
-    {"name": "sessionid", "value": "41aae95f6250e392d346517b808b123d", "domain": ".tiktok.com", "path": "/"},
-    {"name": "uid_tt", "value": "b7c572318be7bcea471b2c1418f40f681a2c16dbbd15197f5832caa83462654f", "domain": ".tiktok.com", "path": "/"},
-    {"name": "sid_tt", "value": "41aae95f6250e392d346517b808b123d", "domain": ".tiktok.com", "path": "/"},
-    {"name": "tt-target-idc", "value": "alisg", "domain": ".tiktok.com", "path": "/"},
-    {"name": "tt_csrf_token", "value": "mLyVbVuj-xnigesLThZVb1kbI_aqbzf11Z00", "domain": ".tiktok.com", "path": "/"},
-    {"name": "odin_tt", "value": "f5681245be037f1c4784dfdc4df2cbccf88626c5d3f80204410b4da6e3f2c28be3739b76ffe9ea5d4da543e7a53ce98222849eecd985b8eaa1bd9b1cc6c361c68fa5f9ad1f5b4a74a4724b761e825412", "domain": ".tiktok.com", "path": "/"},
-    {"name": "sid_guard", "value": "41aae95f6250e392d346517b808b123d", "domain": ".tiktok.com", "path": "/"},
-    {"name": "s_v_web_id", "value": "verify_mu6qjf6l_bG48XIKQ_zrOT_4o2e_8E6F_914uFkQb8jGE", "domain": ".tiktok.com", "path": "/"},
-    {"name": "d_ticket", "value": "4bbb736afaba261a60580773eb3cef4f7d1a5", "domain": ".tiktok.com", "path": "/"},
-    {"name": "tt_chain_token", "value": "AJ1ZFXstqZ1R8J5VqV+knQ==", "domain": ".tiktok.com", "path": "/"},
-    {"name": "multi_sids", "value": "7516614217303508024%3A41aae95f6250e392d346517b808b123d", "domain": ".tiktok.com", "path": "/"},
-    {"name": "living_user_id", "value": "636078685038", "domain": ".tiktok.com", "path": "/"},
-    {"name": "store-country-code", "value": "br", "domain": ".tiktok.com", "path": "/"}
-]

flv_bridge.py

@@ -0,0 +1,82 @@
+"""Streaming legacy HEVC FLV (codec-id 12) -> Enhanced FLV hvc1.
+Only tag headers/container fields are changed. Encoded video payload, CTS and DTS
+are preserved. H.264 and already-enhanced FLV tags pass through unchanged.
+No whole-recording buffering, decoding, rescaling or frame-rate conversion.
+
+Extra guard for YouTube ingestion:
+FormatChanged is raised the moment a *different* video decoder configuration
+record (AVCDecoderConfigurationRecord / HEVCDecoderConfigurationRecord, i.e.
+SPS/PPS or VPS/SPS/PPS) shows up in the middle of a session. That is exactly
+what a phone does when the layout changes (solo <-> PK round) or when the
+encoder restarts after the app was backgrounded and resumed.
+
+Why it matters: `ffmpeg -c:v copy` cannot detect an input parameter change, so
+it silently forwards the new frames while the FLV it already sent to YouTube
+declares the old width/height in onMetaData and in the first sequence header.
+YouTube then stretches/re-locks the picture -> fast zoom in-out, stutter,
+a long "repeated clip", freeze, black flash. The caller restarts the sender on
+this exception; the fresh RTMPS session re-declares the new size cleanly
+(a ~1-3 s gap instead of minutes of broken video).
+
+This is pure byte inspection of tag headers: no decoding, no re-encoding, no
+rescaling, so the original picture quality and the original source are untouched.
+"""
+class FormatChanged(Exception):
+    """Source video decoder configuration changed mid-stream."""
+
+def _video_signature(body):
+    """Fingerprint of a video sequence header, or None if `body` is not one."""
+    if not body:return None
+    if body[0]&0x80:                                    # Enhanced RTMP
+        if body[0]&0x0F:return None                     # PacketType 0 == sequence header
+        return bytes(body[1:5])+body[5:]                # FourCC + decoder config record
+    if (body[0]&15)==7 and len(body)>1 and body[1]==0:  # legacy AVC sequence header
+        return b'avc1'+body[5:]
+    return None
+
+class FLVBridge:
+    def __init__(self,detect_format_change=True):
+        self.buffer=bytearray();self.header_done=False;self.converted_tags=0
+        self.detect_format_change=detect_format_change
+        self.video_cfg=None;self.format_changes=0
+    def feed(self,chunk):
+        self.buffer.extend(chunk);output=bytearray()
+        if not self.header_done:
+            if len(self.buffer)<9:return b''
+            if self.buffer[:3]!=b'FLV':raise ValueError('Source is not FLV')
+            header_size=int.from_bytes(self.buffer[5:9],'big')+4
+            if not 13<=header_size<=1048576:raise ValueError('Invalid FLV header size')
+            if len(self.buffer)<header_size:return b''
+            output.extend(self.buffer[:header_size]);del self.buffer[:header_size];self.header_done=True
+        offset=0
+        while len(self.buffer)-offset>=11:
+            header=bytearray(self.buffer[offset:offset+11]);size=int.from_bytes(header[1:4],'big');total=11+size+4
+            if len(self.buffer)-offset<total:break
+            body=bytes(self.buffer[offset+11:offset+11+size]);tag_type=header[0]
+            if tag_type & 0x20:raise ValueError('Filtered/encrypted FLV tag is unsupported')
+            if (tag_type & 31)==9 and body and not (body[0]&0x80) and (body[0]&15)==12:
+                if len(body)<5:raise ValueError('Truncated HEVC FLV video header')
+                frame=(body[0]>>4)&7;packet=body[1]
+                if packet==0: # HEVC configuration record, no composition time in SequenceStart
+                    body=bytes([0x80|(frame<<4)])+b'hvc1'+body[5:]
+                elif packet==1: # CodedFrames includes the same signed 24-bit composition offset
+                    body=bytes([0x80|(frame<<4)|1])+b'hvc1'+body[2:]
+                elif packet==2:
+                    body=bytes([0x80|(frame<<4)|2])+b'hvc1'+body[5:]
+                else:raise ValueError('Unsupported legacy HEVC packet type')
+                self.converted_tags+=1
+            if (tag_type & 31)==9:
+                signature=_video_signature(body)
+                if signature is not None:
+                    if self.video_cfg is None:self.video_cfg=signature
+                    elif signature!=self.video_cfg:
+                        self.format_changes+=1
+                        if self.detect_format_change:
+                            raise FormatChanged('video decoder configuration changed mid-stream')
+                        self.video_cfg=signature
+            header[1:4]=len(body).to_bytes(3,'big')
+            output.extend(header);output.extend(body);output.extend((11+len(body)).to_bytes(4,'big'))
+            offset+=total
+        if offset:del self.buffer[:offset]
+        if len(self.buffer)>17*1024*1024:raise ValueError('FLV packet buffer exceeds limit')
+        return bytes(output)

index.html

@@ -0,0 +1,108 @@
+<!doctype html><html lang="ar" dir="rtl"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>قصي • مدير البثوث</title><style>
+:root{color-scheme:dark;font-family:system-ui}body{margin:0;background:#0c1220;color:#e4eaf7}main{max-width:1100px;margin:40px auto;padding:0 20px}header{display:flex;justify-content:space-between;align-items:center}h1{font-size:32px;margin:0}p{color:#9daec8;line-height:1.8}small{color:#9daec8}.badge{border:1px solid #355445;border-radius:30px;padding:8px 15px;color:#78e1b7}.panel{background:#151e30;border:1px solid #28364f;padding:24px;border-radius:18px;margin:22px 0}input,button{font:inherit;border-radius:10px;padding:12px;border:1px solid #364864}input{background:#0c1220;color:white;flex:1;min-width:100px}button{background:#70e1b4;color:#10251d;cursor:pointer;font-weight:650}button.secondary{background:#23324b;color:#d4e0f5}button.danger{background:#452735;color:#ffbccb}form{display:flex;gap:12px;flex-wrap:wrap}.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:14px}.card{border:1px solid #32405a;border-radius:12px;padding:18px}.card h3{direction:ltr;text-align:right}.row{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.file{padding:14px 0;border-bottom:1px solid #29364c;display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap}a{color:#79dcc5}#logs{max-height:280px;overflow:auto;font:14px/1.9 monospace}#error{color:#ffc1c1}h2{font-size:20px}footer{color:#8e9eb6;font-size:13px;margin:30px 0}code{overflow-wrap:anywhere}button:disabled{opacity:.5}
+
+textarea,select{font:inherit;background:#0c1220;color:#e4eaf7;border:1px solid #364864;border-radius:10px;padding:12px;box-sizing:border-box;width:100%}label{display:block;margin:14px 0 6px;color:#becce2}.settings{display:grid;grid-template-columns:1fr 1fr;gap:18px}.settings input{width:100%;box-sizing:border-box}.wide{grid-column:1/-1}.notice{border-right:3px solid #70e1b4;padding:10px 15px;background:#142b2b}#ytstate{white-space:pre-line}button:disabled{cursor:wait} @media(max-width:650px){.settings{grid-template-columns:1fr}header{gap:10px}.wide{grid-column:auto}}
+</style></head><body><main>
+<header><div><small>V9 • بث متزامن لكل مذيع • إصلاح تغيّر أبعاد الصورة • توكن تيك توك للبثوث المقيدة عمريًا</small><h1>قصي مهاجر عراقي</h1></div><span class="badge">مرصد البثوث</span></header>
+<p>تسجيل أصلي مستقل لكل حساب • حدث يوتيوب مستقل لكل مذيع مباشر يبث بنفس الوقت • اسم المذيع وعنوان البث والهاشتاكات تُجلب تلقائيًا من حسابه</p>
+<div id="error" role="alert" class="notice" hidden></div>
+<section class="panel"><h2>الحسابات التابعة للمذيع</h2>
+<form id="add"><input id="username" placeholder="اسم المستخدم أو رابط الحساب الكامل" required><input id="token" placeholder="توكن الجلسة sessionid — اختياري، للبثوث المقيدة عمريًا"><button>إضافة ومراقبة</button></form>
+<p id="capacity"></p><div id="tasks" class="cards"></div>
+<p class="notice">التوكن هو كوكيز جلسة تيك توك لحساب بالغ، يُستخدم فقط لفتح البثوث المقيدة بفئة عمرية. يُخزن في مجلد البيانات ولا يظهر في الواجهة أو السجلات. استخدم حسابًا مخصصًا له.</p></section>
+
+<section class="panel"><h2>توكن تيك توك — للبثوث المقيدة عمريًا (18+)</h2>
+<p>تيك توك يخفي روابط الفيديو عن الزائر غير المسجّل في البثوث المقيّدة عمريًا، فلا يمكن رصدها ولا تسجيلها. التوكن يفتحها.</p>
+<label for="tokinput">الصق <b>كامل سطر Cookie</b> (أو قيمة <code dir="ltr">sessionid</code> وحدها)</label>
+<textarea id="tokinput" rows="3" dir="ltr" placeholder="sessionid=...; sessionid_ss=...; sid_tt=...; tt-target-idc=useast1a; sid_guard=..."></textarea>
+<div class="row" style="margin-top:12px">
+<button id="tokvalidate" class="secondary">١. فحص التوكن عند تيك توك</button>
+<button id="toksave">٢. فحصه وحفظه لكل الحسابات</button>
+</div>
+<div class="row" style="margin-top:10px">
+<input id="tokuser" dir="ltr" placeholder="اسم حساب مقيد عمريًا (مثال: user.name)">
+<button id="tokcheck" class="secondary">٣. اختبر فتح الحساب</button>
+</div>
+<p id="tokresult" class="notice" hidden></p>
+<div id="tokstate" style="margin-top:14px"></div>
+<p class="notice"><b>مهم:</b> جلسات تيك توك قصيرة العمر. فحصنا على ملف كوكيز حقيقي أظهر <code dir="ltr">sid_guard</code> بعمر <b>6 ساعات</b> فقط، وبعدها يرفض تيك توك التوكن حتى لو كان "صحيحًا". لذلك الصق <b>كامل سطر Cookie</b> لا القيمة وحدها — حتى يرى التطبيق <code dir="ltr">sid_guard</code> ويعرض لك موعد الانتهاء ويحذّرك قبله. الحفظ من هذه اللوحة <b>لا يحتاج Factory reboot</b>.</p>
+<p class="notice" style="border-right-color:#e1b470;background:#2b2414"><b>🚨 أمان:</b> لا تصدّر كوكيز المتصفح كاملة أبدًا. أداة التصدير تُخرج كل المواقع بما فيها <b>جوجل ويوتيوب</b> (<code dir="ltr">SID, HSID, APISID, SAPISID, __Secure-1PSID</code>…) وهذه تعادل كلمة مرورك. التطبيق يحتاج تيك توك فقط — انسخ <code dir="ltr">sessionid</code> وحدها، أو احذف كل سطر لا ينتهي بـ <code dir="ltr">tiktok.com</code>.</p>
+</section>
+<section class="panel"><h2>مدير أحداث يوتيوب — بث متزامن</h2>
+<p>يفحص الحسابات المفعّلة، وكل مذيع يفتح بثًا مباشرًا يصير له حدث يوتيوب مستقل باسمه وعنوانه، وتبقى الأحداث كلها تعمل بنفس الوقت حتى تنتهي جلساتها. جلسة جديدة = حدث جديد. لا يرسل شاشة انتظار.</p>
+<div class="row"><button id="ytcheck" class="secondary">١. فحص OAuth والقناة</button><button id="ytstart">٢. تفعيل الإدارة التلقائية</button><button id="ytstop" class="danger">تعطيل وإنهاء الأحداث الجارية</button></div>
+<p id="channel">لم يتم فحص القناة بعد.</p><p id="ytstate">تحميل الحالة…</p>
+<div id="events" class="cards"></div>
+<small id="budget"></small>
+<p class="notice">التفعيل يسمح للتطبيق بإنشاء أحداث متزامنة (حتى الحد الأقصى المحدد)، وبدئها وإنهائها، وحذف أحداثه الفارغة فقط. لا ينظف أحداث النسخ القديمة. إعداد التفعيل محفوظ ويُستأنف بعد إعادة التشغيل. لا ضمان تشغيل 24/7. كل حدث إضافي يستهلك معالجًا وإنترنت؛ راقب أداء الاستضافة.</p>
+<details><summary>قوالب العنوان والوصف — تُطبّق على الأحداث الجديدة</summary>
+<form id="settingsform" style="display:block"><div class="settings">
+<div><label for="privacy">خصوصية الأحداث</label><select id="privacy"><option value="public">عام</option><option value="unlisted">غير مُدرج</option><option value="private">خاص</option></select></div>
+<div class="wide"><label for="titletemplate">قالب العنوان</label><input id="titletemplate" required></div>
+<div class="wide"><label for="desctemplate">قالب الوصف</label><textarea id="desctemplate" rows="6"></textarea></div></div>
+<p>الاسم والعنوان والهاشتاكات تُجلب تلقائيًا من حساب تيك توك المبثوث عند بدء الجلسة: <code dir="ltr">{name}</code> اسم المذيع من حسابه، <code dir="ltr">{title}</code> عنوان بثه على تيك توك، <code dir="ltr">{hashtags}</code> هاشتاكات بثه. متغيرات إضافية: <code dir="ltr">{username} {date} {time} {room_id}</code>. يُضاف رابط حساب المذيع نفسه تلقائيًا لكل حدث. العنوان الناتج حتى 100 حرف. تعديل القوالب يتطلب تعطيل الإدارة وانتظار إغلاق الأحداث.</p>
+<button type="submit" id="savesettings">حفظ إعدادات الأحداث</button></form></details>
+</section>
+<section class="panel"><h2>التسجيلات المحفوظة</h2><small>تظهر بعد اكتمال تجهيز الملف. HEVC قد يحتاج VLC. لا تقسيم زمني افتراضيًا؛ قد تظهر ملفات منفصلة عند الانقطاع.</small><div id="files"></div></section>
+<section class="panel"><h2>سجل التشغيل</h2><div id="logs"></div></section>
+<footer>أسرار OAuth وتوكنات الجلسات تبقى في Secrets ومجلد البيانات فقط، ولا تظهر في الواجهة. راقب حصة التخزين من Hugging Face. تقدير API محلي وليس قراءة لحصة Google الفعلية. استخدمه للمحتوى الذي تملك حق إعادة نشره.</footer>
+</main><script>
+const $=id=>document.getElementById(id),esc=s=>String(s).replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+let settingsLoaded=false,channelId='',lastY=null,polling=false;
+function error(text){$('error').textContent=text;$('error').hidden=!text}
+async function api(url,method='GET',body){const r=await fetch(url,{method,cache:'no-store',headers:body?{'Content-Type':'application/json'}:{},body:body?JSON.stringify(body):undefined});let j;try{j=await r.json()}catch{}if(!r.ok)throw Error(typeof j?.detail==='string'?j.detail:'تعذر تنفيذ الطلب');return j}
+function fillSettings(s){$('privacy').value=s.privacy||'public';$('titletemplate').value=s.title||'';$('desctemplate').value=s.description||'';settingsLoaded=true}
+async function refresh(){if(polling)return;polling=true;try{
+const [y,s]=await Promise.all([api('/api/youtube'),api('/api/state')]);lastY=y;
+const evs=y.events||[];
+$('capacity').textContent=`${s.version} • حد الحسابات: ${s.max_accounts} • أقصى أحداث يوتيوب متزامنة: ${y.max_events||3}`;
+$('channel').textContent=y.channel?`القناة المرتبطة: ${y.channel.title} · ${y.channel.id}`:'اضغط فحص OAuth للتأكد من القناة قبل النشر.';
+channelId=y.channel?.id||'';
+$('ytstate').textContent=`${y.automatic?'الإدارة التلقائية مفعّلة':'الإدارة التلقائية معطّلة'} · وضع المصدر: ${y.video_mode||'original'} · وضع الإرسال: ${y.send_mode||'copy'} · أحداث جارية: ${evs.length}\n${y.status}`;
+$('events').innerHTML=evs.length?evs.map(e=>`<article class="card"><h3>${esc(e.title||'حدث بث')}</h3><p>@${esc(e.username)}${e.nickname?' · '+esc(e.nickname):''}</p><small>المرحلة: ${esc(e.phase||'—')} · حالة يوتيوب: ${esc(e.youtube_status||'—')}${e.closing?' · جارٍ الإنهاء':''}</small><p>${esc(e.status||e.note||'—')}</p><small>${e.source?esc('مصدر: '+e.source+' · '):''}${Math.floor(e.output_seconds||0)} ثانية إرسال</small>${e.broadcast_id?`<p><a target="_blank" rel="noopener noreferrer" href="https://www.youtube.com/watch?v=${encodeURIComponent(e.broadcast_id)}">فتح الحدث على يوتيوب</a></p>`:''}</article>`).join(''):'<p>لا توجد أحداث جارية. عند بدء أي مذيع مباشرة يُفتح حدث مستقل باسمه وعنوانه من حسابه.</p>';
+$('budget').textContent=`استهلاك API محلي تقديري: ${y.budget?.estimated_units||0} وحدة • جلسات في سجل التطبيق: ${y.history_count||0} • ${y.configured?'أسرار OAuth موجودة (الفحص يؤكد صلاحيتها)':'أسرار OAuth غير مكتملة'}`;
+$('ytstart').disabled=!!y.automatic;$('ytstop').disabled=!y.automatic&&!evs.length;
+$('savesettings').disabled=!!y.automatic||!!evs.length;
+if(!settingsLoaded&&y.settings)fillSettings(y.settings);
+$('tasks').innerHTML=s.tasks.length?s.tasks.map(t=>`<article class="card"><h3>@${esc(t.username)}</h3><p>${esc(t.status)}</p><small>${esc(t.quality||'الجودة لم تحدد بعد')} · ${t.received_mb||0} MB · ${Math.floor((t.elapsed_seconds||0)/60)} دقيقة</small><p>${t.enabled?'المراقبة مفعّلة':'المراقبة معطّلة'} · توكن الجلسة: ${t.has_token?'موجود ✓':'غير مضاف'}</p><div class="row"><button data-user="${esc(t.username)}" data-action="start">تشغيل</button><button class="secondary" data-user="${esc(t.username)}" data-action="stop">إيقاف</button><button class="secondary" data-user="${esc(t.username)}" data-action="token">توكن</button><button class="danger" data-user="${esc(t.username)}" data-action="delete">حذف</button></div></article>`).join(''):'<p>أضف حسابات المذيع المطلوبة فقط.</p>';
+$('files').innerHTML=s.files.length?s.files.map(f=>`<div class="file"><div><code>${esc(f.name)}</code><br><small>${f.mb} MB</small></div><div class="row"><a href="/api/files/${encodeURIComponent(f.name)}">تنزيل</a><button class="danger" data-file="${esc(f.name)}">حذف الملف</button></div></div>`).join(''):'<p>لا توجد ملفات مكتملة بعد.</p>';
+$('logs').innerHTML=s.logs.slice().reverse().map(l=>`<div>${esc(l.time)} · @${esc(l.user)} · ${esc(l.message)}</div>`).join('');
+renderTiktok(s.tiktok);
+}catch(e){error(e.message)}finally{polling=false}}
+function expiryNote(e){if(!e)return '';
+ if(e.expired)return `<br><small style="color:#ffc1c1">⚠ انتهت صلاحيته ${esc(e.expires_text)} — حدّثه</small>`;
+ const h=Math.floor(e.seconds_left/3600),m=Math.floor((e.seconds_left%3600)/60);
+ const warn=e.seconds_left<3600;
+ return `<br><small${warn?' style="color:#ffd9a0"':''}>${warn?'⚠ ':''}ينتهي بعد ${h}س ${m}د (${esc(e.expires_text)})</small>`}
+function renderTiktok(t){if(!t){$('tokstate').innerHTML='';return}
+const accts=Object.entries(t.accounts||{});
+let rows=`<div class="file"><div>توكن عام (كل الحسابات)</div><div>${t.default_authenticated?`<span class="badge">مفعّل</span> ${esc(t.default_masked)} <small>· ${esc(t.default_source||'')}</small>${expiryNote(t.default_expiry)}`:'<small>غير مضبوط</small>'}</div></div>`;
+rows+=accts.length?accts.map(([u,v])=>`<div class="file"><div>@${esc(u)}</div><div>${v.authenticated?`<span class="badge">له توكن</span> ${esc(v.masked)} <small>· ${esc(v.source||'')}${v.tt_target_idc?' · '+esc(v.tt_target_idc):''}</small>${expiryNote(v.expiry)}`:'<small>يعتمد على التوكن العام</small>'}</div></div>`).join(''):'';
+$('tokstate').innerHTML=rows}
+function tokShow(html){const e=$('tokresult');e.innerHTML=html;e.hidden=false}
+$('tokvalidate').onclick=async()=>{const raw=$('tokinput').value.trim();if(!raw){tokShow('✖ الصق التوكن أولًا');return}
+try{error('');$('tokvalidate').disabled=true;tokShow('… يسأل تيك توك');
+const r=await api('/api/tiktok/token/validate','POST',{token:raw});
+tokShow(`<b>${r.ok?'✔ ':'✖ '}${esc(r.message||'')}</b>`+(r.checks?.length?`<br><small>${r.checks.map(esc).join('<br>')}</small>`:'')+(r.account?`<br><small dir="ltr">${esc(JSON.stringify(r.account))}</small>`:''));
+if(r.ok)await refresh()}catch(e){tokShow('✖ '+esc(e.message))}finally{$('tokvalidate').disabled=false}};
+$('toksave').onclick=async()=>{const raw=$('tokinput').value.trim();if(!raw){tokShow('✖ الصق التوكن أولًا');return}
+try{error('');$('toksave').disabled=true;tokShow('… فحص ثم حفظ');
+const r=await api('/api/tiktok/token/validate','POST',{token:raw});
+if(!r.ok){tokShow(`✖ لم يُحفظ — ${esc(r.message||'')}`+(r.checks?.length?`<br><small>${r.checks.map(esc).join('<br>')}</small>`:''));return}
+tokShow(`<b>✔ حُفظ ويعمل</b><br><small>${esc(r.message||'')} · ${esc(r.sessionid_masked||'')}</small>`);
+$('tokinput').value='';await refresh()}catch(e){tokShow('✖ '+esc(e.message))}finally{$('toksave').disabled=false}};
+$('tokcheck').onclick=async()=>{const u=$('tokuser').value.trim();if(!u){tokShow('✖ اكتب اسم الحساب');return}
+try{error('');$('tokcheck').disabled=true;tokShow('… يختبر فتح الحساب عند تيك توك');
+const r=await api('/api/tiktok/token/check/'+encodeURIComponent(u),'POST');
+tokShow(`<b>${r.ok===false?'✖ ':'✔ '}${esc(r.message||r.result||'')}</b><br><small dir="ltr">result=${esc(r.result||'')} · anonymous=${r.anonymous?.urls??'—'} urls · authenticated=${r.authenticated?.urls??'—'} urls · token_configured=${r.token_configured}</small>`)}catch(e){tokShow('✖ '+esc(e.message))}finally{$('tokcheck').disabled=false}};
+$('ytcheck').onclick=async()=>{try{error('');$('ytcheck').disabled=true;const j=await api('/api/youtube/check','POST');channelId=j.channel.id;await refresh();alert(`تم تفويض القناة: ${j.channel.title}\n${j.channel.id}\nلم يُنشأ أو يُنشر أي حدث بهذا الفحص.`)}catch(e){error(e.message)}finally{$('ytcheck').disabled=false}};
+$('ytstart').onclick=async()=>{try{if(!channelId)throw Error('اضغط فحص OAuth أولًا');if(!confirm(`تفعيل إنشاء وبدء أحداث تلقائية لقناة ${lastY?.channel?.title||channelId}؟\nالخصوصية: ${lastY?.settings?.privacy}\nلكل مذيع مباشر حدث مستقل يبث بنفس الوقت (حتى ${lastY?.max_events||3} أحداث)، واسمه وعنوانه وهاشتاكاته تُجلب من حساب تيك توك نفسه.`))return;error('');await api('/api/youtube/start','POST',{channel_id:channelId});await refresh()}catch(e){error(e.message)}};
+$('ytstop').onclick=async()=>{if(!confirm('تعطيل الإدارة وإنهاء جميع الأحداث الجارية مع الاحتفاظ بالأرشيف؟'))return;try{error('');await api('/api/youtube/stop','POST');await refresh()}catch(e){error(e.message)}};
+$('settingsform').onsubmit=async e=>{e.preventDefault();try{error('');await api('/api/youtube/settings','POST',{name:'',privacy:$('privacy').value,title:$('titletemplate').value,description:$('desctemplate').value});settingsLoaded=false;await refresh()}catch(e){error(e.message)}};
+$('add').onsubmit=async e=>{e.preventDefault();try{error('');await api('/api/accounts','POST',{username:$('username').value,token:$('token').value});$('username').value='';$('token').value='';await refresh()}catch(e){error(e.message)}};
+document.addEventListener('click',async e=>{const b=e.target.closest('button');if(!b)return;try{
+if(b.dataset.action==='token'){const t=prompt(`توكن جلسة تيك توك (sessionid) للحساب @${b.dataset.user} — يلزم للبثوث المقيدة بفئة عمرية.\nالصق قيمة sessionid أو كوكيز كاملة، أو اتركه فارغًا للحذف:`);if(t===null)return;await api(`/api/accounts/${encodeURIComponent(b.dataset.user)}/token`,'POST',{token:t});await refresh();return}
+if(b.dataset.action){if(b.dataset.action==='delete'&&!confirm('حذف الحساب من المراقبة؟'))return;await api(`/api/accounts/${encodeURIComponent(b.dataset.user)}/${b.dataset.action}`,'POST');await refresh()}
+if(b.dataset.file&&confirm('حذف التسجيل نهائيًا من التخزين؟')){await api('/api/files/'+encodeURIComponent(b.dataset.file),'DELETE');await refresh()}}catch(e){error(e.message)}});
+document.addEventListener('visibilitychange',()=>{if(!document.hidden)refresh()});window.addEventListener('online',refresh);window.addEventListener('pageshow',refresh);refresh();setInterval(refresh,5000);
+</script></body></html>

relay.py

@@ -0,0 +1,191 @@
+"""One FFmpeg push per live session. Multiple senders run concurrently, one per YouTube event."""
+import os, time, threading, subprocess
+from collections import deque
+from curl_cffi import requests
+from flv_bridge import FLVBridge, FormatChanged
+
+class Sender:
+    """Single YouTube RTMPS push for one session. Process and progress are instance-scoped,
+    so several senders can run at the same time without sharing state."""
+    def __init__(self,ffmpeg,log,headers_for=None):
+        self.ffmpeg=ffmpeg;self.log=log
+        self.headers_for=headers_for or (lambda user:{})
+        self.lock=threading.RLock();self.process=None
+        self.data={'status':'','source':'','output_seconds':0,'last_output_at':None}
+        # Timestamps of source resolution changes seen by this sender (anti-flap window).
+        self.flap=deque()
+        # Once the source proved to flap, stay on a constant canvas for the rest of the
+        # event. Without this the flap window expires after 10 quiet minutes and the
+        # sender silently drops back to copy mode, restarting the whole failure loop.
+        self.sticky_mode=None
+    def set(self,**kw):
+        with self.lock:self.data.update(kw)
+    def snapshot(self):
+        with self.lock:return dict(self.data)
+    def terminate(self):
+        with self.lock:p=self.process
+        if p and p.poll() is None:
+            try:p.terminate()
+            except OSError:pass
+    def send_mode(self):
+        """copy      -> forward the source untouched (original quality, no extra CPU)
+           fixed1080 -> re-encode onto a constant 1080x1920 canvas
+           fixed720  -> re-encode onto a constant 720x1280 canvas (lighter on CPU)
+        """
+        mode=os.getenv('YOUTUBE_SEND_MODE','copy').strip().lower()
+        if mode not in ('copy','fixed1080','fixed720'):
+            raise ValueError('YOUTUBE_SEND_MODE يجب أن يكون copy أو fixed1080 أو fixed720')
+        # A source already proven to flap stays on the constant canvas for this whole event.
+        if self.sticky_mode:return self.sticky_mode
+        # copy mode only: if the phone keeps flipping resolution, stop flapping the
+        # YouTube session and absorb the changes on a constant canvas instead.
+        if mode=='copy':
+            flap=self.flap
+            now=time.monotonic()
+            while flap and now-flap[0]>600:flap.popleft()
+            if len(flap)>=int(os.getenv('YOUTUBE_FLAP_LIMIT','4')):
+                mode=os.getenv('YOUTUBE_FLAP_FALLBACK_MODE','fixed720').strip().lower()
+                if mode not in ('fixed1080','fixed720'):mode='fixed720'
+                self.sticky_mode=mode
+        return mode
+    def note_format_change(self):
+        self.flap.append(time.monotonic())
+        if len(self.flap)>=int(os.getenv('YOUTUBE_FLAP_LIMIT','4')):
+            self.log('system','تغيّرت أبعاد المصدر عدة مرات خلال 10 دقائق؛ التحول تلقائيًا إلى كانفس ثابت (%s) لمنع تكرار الانقطاع'%os.getenv('YOUTUBE_FLAP_FALLBACK_MODE','fixed720'))
+    @staticmethod
+    def canvas(width,height):
+        return ('scale=w=%d:h=%d:force_original_aspect_ratio=decrease:flags=lanczos,'
+                'pad=%d:%d:(ow-iw)/2:(oh-ih)/2:color=black,setsar=1,format=yuv420p'%(width,height,width,height))
+    def command(self,destination):
+        # Advertise Enhanced RTMP for network output; local test files need no protocol option.
+        mode=self.send_mode()
+        network=destination.startswith(('rtmp://','rtmps://'))
+        enhanced=['-rtmp_enhanced_codecs','hvc1'] if network and mode=='copy' and os.getenv('YOUTUBE_VIDEO_MODE','original').strip().lower()=='original' else []
+        if mode=='copy':
+            video=['-c:v','copy']
+        else:
+            width,height,bitrate=(1080,1920,'6000k') if mode=='fixed1080' else (720,1280,'4000k')
+            bufsize=str(int(int(bitrate[:-1])*1.5))+'k'
+            # A constant canvas is the only thing that guarantees YouTube always receives
+            # frames whose real size matches the signalled one, whatever the phone does.
+            video=['-vf',self.canvas(width,height),'-c:v','libx264','-preset',os.getenv('YOUTUBE_X264_PRESET','veryfast'),
+                   '-tune','zerolatency','-profile:v','high','-crf',os.getenv('YOUTUBE_CRF','22'),
+                   '-maxrate',bitrate,'-bufsize',bufsize,'-g','60','-keyint_min','30','-sc_threshold','0',
+                   '-pix_fmt','yuv420p','-fps_mode','cfr',
+                   '-colorspace','bt709','-color_primaries','bt709','-color_trc','bt709']
+        # Network output goes through the fifo pseudo-muxer instead of straight to flv.
+        # fifo separates encoding from the RTMPS connection and reconnects transparently
+        # when YouTube drops it, rather than killing the whole FFmpeg process. That is
+        # exactly why the local recording kept running while the broadcast died: writing
+        # to disk never fails, a network blip does, and with -f flv it was fatal.
+        # Documented: https://ffmpeg.org/ffmpeg-formats.html#fifo
+        # recover_any_error is deliberately NOT set, so permanent faults (bad stream key,
+        # rejected codec) still fail fast and stay visible in the log instead of retrying
+        # forever in silence.
+        if network:
+            # timeshift deliberately delays the YouTube feed behind the live TikTok source
+            # and keeps that much data buffered. Two effects, both free of CPU cost: a
+            # source hiccup is covered by the buffer instead of starving YouTube's ingest
+            # (which it reports as videoIngestionStarved = viewer buffering), and packets
+            # are retained across a reconnect instead of being dropped, which is what made
+            # segments go missing when the streamer restarted. Cost is latency only.
+            ts=int(os.getenv('YOUTUBE_FIFO_TIMESHIFT','10'))
+            # queue_size MUST grow with timeshift. Its default is 60 packets, which holds
+            # under a second at ~77 pkt/s (30 fps video + ~47 fps AAC); once timeshift
+            # delays the output the queue fills and, with drop_pkts_on_overflow=1, the
+            # stream is destroyed rather than delayed. Measured: ts=3 with the default
+            # queue yields 1 frame out of 480; ts=3 with 5000 and ts=10 with 20000 both
+            # yield byte-identical output to the no-fifo case.
+            q=max(500,int(os.getenv('YOUTUBE_FIFO_QUEUE','0')) or ts*250+500)
+            output=['-f','fifo','-fifo_format','flv','-format_opts','flvflags=no_duration_filesize',
+                '-drop_pkts_on_overflow','1','-attempt_recovery','1','-restart_with_keyframe','1',
+                '-recovery_wait_time',os.getenv('YOUTUBE_RECOVERY_WAIT','1'),
+                *(('-timeshift',str(ts),'-queue_size',str(q)) if ts>0 else ())]
+        else:
+            output=['-flvflags','no_duration_filesize','-f','flv']
+        return [self.ffmpeg,'-hide_banner','-loglevel','error','-nostats','-progress','pipe:1',
+            '-fflags','+genpts','-i','pipe:0','-map','0:v:0','-map','0:a:0?',
+            *video,'-c:a','aac','-b:a','128k','-ar','48000',
+            '-af','aresample=async=1:first_pts=0','-avoid_negative_ts','make_zero',
+            *enhanced,'-rw_timeout','20000000',*output,destination]
+    def send(self,user,candidate,destination,stop):
+        # YouTube's ingest is created with cdn.resolution/frameRate = 'variable', i.e. it
+        # auto-detects the incoming resolution, so a source resolution change does not
+        # require a new session. Tearing the session down is what produced the visible
+        # gaps and the reconnect storm. The guard stays available behind an env var in
+        # case YouTube's own healthStatus ever reports videoResolutionUnsupported.
+        guard=os.getenv('YOUTUBE_FORMAT_GUARD','off').lower() in ('1','on','true','yes')
+        bridge=FLVBridge(detect_format_change=(self.send_mode()=='copy' and guard))
+        response=None;p=None;error_reader=None;done=threading.Event()
+        # Set when we deliberately tear FFmpeg down because the source resolution
+        # changed; suppresses the misleading "FFmpeg exited with code N" log.
+        format_changed=False
+        progress={'last':time.monotonic(),'seconds':-1}
+        self.set(status='الاتصال بيوتيوب',source=candidate['label'],output_seconds=0,last_output_at=None)
+        try:
+            response=requests.get(candidate['url'],headers={'Referer':'https://www.tiktok.com/',**self.headers_for(user)},impersonate='chrome',stream=True,timeout=20)
+            response.raise_for_status()
+            p=subprocess.Popen(self.command(destination),stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,bufsize=0)
+            with self.lock:self.process=p
+            diagnostics=[]
+            def read_errors():
+                # Classify selected FFmpeg errors; never expose raw stderr or stream URLs.
+                patterns=[('Connection refused','رفض اتصال خادم الاستقبال'),('Connection timed out','انتهت مهلة اتصال خادم الاستقبال'),
+                    ('Connection reset by peer','خادم الاستقبال قطع الاتصال أثناء الإرسال'),('Broken pipe','انقطع أنبوب الإرسال إلى خادم الاستقبال'),
+                    ('End of file','خادم الاستقبال أغلق الاتصال'),('Immediate exit requested','طُلب إنهاء FFmpeg قبل اكتمال الإرسال'),
+                    ('Packet mismatch','عدم تطابق حزم الفيديو — تغيّر مقاس المصدر داخل الجلسة'),
+                    ('Input/output error','خطأ إدخال/إخراج في الإرسال'),('Server error','خادم الاستقبال أعاد خطأ'),
+                    ('Invalid data found','بيانات المصدر غير صالحة للقراءة'),('Video codec','عدم توافق ترميز الفيديو مع الحاوية'),
+                    ('Invalid argument','أحد إعدادات FFmpeg غير مقبول'),('Non-monotonic','توقيت الفيديو غير متزايد'),
+                    ('Unknown encoder','مرمز غير متوفر'),('Option not found','خيار FFmpeg غير مدعوم')]
+                try:
+                    for line in iter(p.stderr.readline,b''):
+                        text=line.decode('utf-8','replace')
+                        for needle,label in patterns:
+                            if needle.lower() in text.lower() and label not in diagnostics:diagnostics.append(label)
+                except (OSError,ValueError):pass
+            error_reader=threading.Thread(target=read_errors,daemon=True);error_reader.start()
+            def read_progress():
+                try:
+                    for line in iter(p.stdout.readline,b''):
+                        if line.startswith(b'out_time_us='):
+                            try:seconds=int(line.split(b'=',1)[1])/1000000
+                            except ValueError:continue
+                            if seconds>progress['seconds']:
+                                progress['seconds']=seconds;progress['last']=time.monotonic()
+                                self.set(status='FFmpeg يرسل — تحقق من معاينة YouTube Studio',output_seconds=round(seconds,1),last_output_at=time.time())
+                except (OSError,ValueError):pass
+            def watchdog():
+                while not done.wait(1):
+                    if stop.is_set() or time.monotonic()-progress['last']>60:
+                        if p.poll() is None:
+                            try:p.kill()
+                            except OSError:pass
+                        return
+            threading.Thread(target=read_progress,daemon=True).start()
+            threading.Thread(target=watchdog,daemon=True).start()
+            for chunk in response.iter_content():
+                if stop.is_set() or p.poll() is not None:break
+                if chunk:
+                    # Unbuffered writes may be partial; send every byte.
+                    view=memoryview(bridge.feed(chunk))
+                    while view and not stop.is_set():
+                        n=p.stdin.write(view)
+                        if not n:raise BrokenPipeError()
+                        view=view[n:]
+        except FormatChanged:
+            format_changed=True
+            raise
+        finally:
+            if response:response.close()
+            if p:
+                try:p.stdin.close()
+                except (OSError,ValueError):pass
+                try:p.wait(timeout=10)
+                except subprocess.TimeoutExpired:p.kill();p.wait()
+                done.set()
+                if error_reader:error_reader.join(timeout=1)
+                if p.returncode and not stop.is_set() and not format_changed:
+                    self.log(user,'FFmpeg خرج برمز '+str(p.returncode)+(' — '+'؛ '.join(diagnostics[-3:]) if diagnostics else '؛ لم يظهر سبب مصنّف'))
+                with self.lock:self.process=None
+        return progress['seconds']>0

requirements.txt

@@ -1,4 +1,3 @@
-flask>=3.0
-requests>=2.31
-playwright>=1.40
-playwright-stealth>=2.0
+fastapi>=0.115,<1
+uvicorn>=0.30,<1
+curl_cffi>=0.13,<1

tiktok_auth.py

@@ -0,0 +1,476 @@
+"""TikTok session-token support (Secrets/env vars + optional on-volume store).
+
+Why this exists
+---------------
+Age-restricted (18+) TikTok LIVE rooms return **no stream URLs** to an
+anonymous visitor: `api-live/user/room` comes back with `status=2` but empty
+`streamData`/`hevcStreamData`, and `webcast/room/info/` answers with a
+`prompts`/error payload instead of `stream_url`. The room is therefore
+"unobservable" and can never be recorded or relayed.
+
+TikTok's own web client unlocks those rooms by sending a logged-in session.
+The cookie set that the reference implementations use is:
+
+    sessionid, sessionid_ss, sid_tt   (+ tt-target-idc for the account's DC)
+    and the query flag  user_is_login=true
+
+This module builds exactly that, and nothing else changes: same endpoints,
+same source ranking, same original-quality download. Sending the cookie to the
+signed CDN pull URL was verified harmless (identical FLV bytes with and
+without it), so one code path covers both API calls and video download.
+
+Secrets handling
+----------------
+Tokens are never logged, never returned by any API response, and never written
+into the recordings directory. Every outward-facing string is masked.
+"""
+import json, os, re, threading
+from pathlib import Path
+
+# Account data-centre cookie; only used when a session id is present.
+DEFAULT_TT_TARGET_IDC = 'useast1a'
+# sessionid / sessionid_ss / sid_tt / tt-target-idc
+SESSION_COOKIE_NAMES = ('sessionid', 'sessionid_ss', 'sid_tt')
+AUTH_CHECK_URL = 'https://www.tiktok.com/passport/web/account/info/'
+
+_lock = threading.RLock()
+_store_path = None
+_store_cache = None
+
+
+# --------------------------------------------------------------------------- #
+# storage
+# --------------------------------------------------------------------------- #
+def configure(path):
+    """Point the optional on-volume token store at `<ROOT>/tiktok-tokens.json`."""
+    global _store_path, _store_cache
+    with _lock:
+        _store_path = Path(path) if path else None
+        _store_cache = None
+
+
+def _norm(user):
+    """Env-var-safe account key: TIKTOK_SESSIONID_MY.NAME -> MY_NAME."""
+    return re.sub(r'[^A-Z0-9]', '_', str(user or '').strip().upper())
+
+
+def _read_store():
+    global _store_cache
+    if _store_cache is not None:
+        return _store_cache
+    data = {}
+    if _store_path:
+        try:
+            loaded = json.loads(_store_path.read_text(encoding='utf-8'))
+            if isinstance(loaded, dict):
+                data = {str(k): v for k, v in loaded.items() if isinstance(v, dict)}
+        except (FileNotFoundError, ValueError, OSError):
+            data = {}
+    _store_cache = data
+    return data
+
+
+def _write_store(data):
+    global _store_cache
+    if not _store_path:
+        raise RuntimeError('مخزن التوكنات غير مهيأ؛ استخدم متغيرات Secrets بدلًا منه')
+    tmp = _store_path.with_suffix('.tmp')
+    tmp.write_text(json.dumps(data, ensure_ascii=False), encoding='utf-8')
+    try:
+        os.chmod(tmp, 0o600)
+    except OSError:
+        pass
+    tmp.replace(_store_path)
+    try:
+        os.chmod(_store_path, 0o600)
+    except OSError:
+        pass
+    _store_cache = data
+
+
+def _env(name):
+    return (os.getenv(name) or '').strip()
+
+
+# --------------------------------------------------------------------------- #
+# parsing
+# --------------------------------------------------------------------------- #
+def parse_token(raw):
+    """Accept whatever the user can realistically copy, return (sessionid, extra_cookies).
+
+    Supported inputs:
+      * bare session id            1a2b3c...
+      * `sessionid=1a2b3c...`
+      * full Cookie header         `sessionid=x; sid_tt=x; ttwid=y; tt-target-idc=useast1a`
+      * Netscape cookies.txt line  `.tiktok.com\tTRUE\t/\tTRUE\t0\tsessionid\tx`
+      * several of the above separated by newlines / commas / semicolons
+    Unknown cookie names are preserved (e.g. ttwid, msToken) and sent as-is.
+    """
+    text = str(raw or '').strip()
+    if not text:
+        return '', {}
+    text = text.replace('\r', '\n')
+    pairs = {}
+    sessionid = ''
+    for line in text.split('\n'):
+        line = line.strip()
+        if not line or line.startswith('#'):
+            continue
+        if '\t' in line and line.count('\t') >= 6:      # Netscape cookies.txt
+            parts = line.split('\t')
+            pairs[parts[5].strip()] = parts[6].strip()
+            continue
+        # a Cookie header may use ';' as separator, a token list may use ','
+        chunks = re.split(r'[;,]', line) if ('=' in line) else [line]
+        for chunk in chunks:
+            chunk = chunk.strip()
+            if not chunk:
+                continue
+            if '=' in chunk:
+                k, _, v = chunk.partition('=')
+                pairs[k.strip()] = v.strip()
+            elif not sessionid:
+                sessionid = chunk
+    for name in SESSION_COOKIE_NAMES:
+        if pairs.get(name) and not sessionid:
+            sessionid = pairs[name]
+    if sessionid:
+        for name in SESSION_COOKIE_NAMES:
+            pairs.setdefault(name, sessionid)
+    idc = pairs.get('tt-target-idc') or pairs.get('tt_target_idc') or _env('TIKTOK_TT_TARGET_IDC') or DEFAULT_TT_TARGET_IDC
+    if sessionid:
+        pairs['tt-target-idc'] = idc.strip()
+    return sessionid.strip(), {k: v for k, v in pairs.items() if v}
+
+
+def session_expiry(pairs):
+    """Decode `sid_guard` if present: "<sid>|<issued>|<ttl_seconds>|<HTTP date>".
+
+    TikTok issues short-lived web sessions (the sample we were given had
+    ttl=21600, i.e. 6 hours), so an expired token is the single most common
+    reason a pasted token "doesn't work". Reporting the deadline up front saves
+    a debugging round trip. Returns None when sid_guard is absent.
+    """
+    raw = (pairs or {}).get('sid_guard')
+    if not raw:
+        return None
+    try:
+        from urllib.parse import unquote
+        parts = unquote(str(raw)).split('|')
+        if len(parts) < 3:
+            return None
+        issued = int(parts[1])
+        ttl = int(parts[2])
+    except (ValueError, TypeError):
+        return None
+    import time as _time
+    expires = issued + ttl
+    return {'issued_at': issued, 'ttl_seconds': ttl, 'expires_at': expires,
+            'expired': _time.time() > expires,
+            'seconds_left': max(0, expires - int(_time.time())),
+            'expires_text': _time.strftime('%Y-%m-%d %H:%M UTC', _time.gmtime(expires))}
+
+
+def mask(value):
+    """Safe display form. Never reveals enough of the token to be usable."""
+    s = str(value or '')
+    if not s:
+        return ''
+    if len(s) <= 12:
+        return '*' * len(s)
+    return '%s…%s (%d حرفًا)' % (s[:4], s[-4:], len(s))
+
+
+def _looks_like_sessionid(value):
+    """sessionid is a long opaque token; reject obvious copy/paste mistakes early."""
+    s = str(value or '').strip()
+    if len(s) < 20:
+        return False, 'قصير جدًا (%d) — التوكن الصحيح عادةً أكثر من 100 حرف' % len(s)
+    if len(s) > 4096:
+        return False, 'طويل بشكل غير طبيعي (%d)' % len(s)
+    if re.search(r'[\s"\']', s):
+        return False, 'يحتوي مسافة أو علامة اقتباس — انسخ القيمة وحدها'
+    if not re.fullmatch(r'[A-Za-z0-9%_\-:.+/=]+', s):
+        return False, 'يحتوي رموزًا غير متوقعة'
+    return True, ''
+
+
+# --------------------------------------------------------------------------- #
+# lookup
+# --------------------------------------------------------------------------- #
+def session_for(user=None):
+    """Resolve the effective session for an account.
+
+    Precedence (highest first). Secrets always win over the UI store, and a
+    per-account value always wins over a global one:
+
+      1. TIKTOK_SESSIONID_<USER>   per-account session id      (Secret)
+      2. TIKTOK_COOKIES_<USER>     per-account cookie header   (Secret)
+      3. TIKTOK_TOKENS[user]       per-account map entry       (Secret)
+      4. TIKTOK_SESSIONID          global, every account       (Secret)
+      5. TIKTOK_COOKIES            global cookie header        (Secret)
+      6. store[user]               per-account, saved from the UI
+      7. store['_default']         global, saved from the UI
+
+    Rationale for 1-5 beating 6-7: a token pasted into the UI earlier must not
+    silently override a freshly rotated Secret and keep failing in a way that
+    looks like TikTok's fault.
+    """
+    key = _norm(user) if user else ''
+    if key:
+        raw = _env('TIKTOK_SESSIONID_' + key)
+        if raw:
+            sid, pairs = parse_token(raw)
+            return _pack(sid, pairs, 'TIKTOK_SESSIONID_' + key, user)
+        raw = _env('TIKTOK_COOKIES_' + key)
+        if raw:
+            sid, pairs = parse_token(raw)
+            return _pack(sid, pairs, 'TIKTOK_COOKIES_' + key, user)
+        mapping = _env('TIKTOK_TOKENS')
+        if mapping:
+            for chunk in re.split(r'[;\n]', mapping):
+                if not chunk.strip():
+                    continue
+                name, _, value = chunk.partition('=')
+                if not value:
+                    name, _, value = chunk.partition(':')
+                if _norm(name.strip()) == key and value.strip():
+                    sid, pairs = parse_token(value)
+                    return _pack(sid, pairs, 'TIKTOK_TOKENS', user)
+    raw = _env('TIKTOK_SESSIONID')
+    if raw:
+        sid, pairs = parse_token(raw)
+        return _pack(sid, pairs, 'TIKTOK_SESSIONID', user)
+    raw = _env('TIKTOK_COOKIES')
+    if raw:
+        sid, pairs = parse_token(raw)
+        return _pack(sid, pairs, 'TIKTOK_COOKIES', user)
+    store = _read_store()
+    entry = None
+    source_label = 'مخزن التطبيق'
+    if user:
+        entry = store.get(str(user).lower()) or store.get(key)
+    if not (isinstance(entry, dict) and (entry.get('cookie') or entry.get('sessionid'))):
+        entry = store.get('_default')
+        source_label = 'مخزن التطبيق (اف��راضي)'
+    if isinstance(entry, dict) and (entry.get('cookie') or entry.get('sessionid')):
+        sid, pairs = parse_token(entry.get('cookie') or entry.get('sessionid'))
+        return _pack(sid, pairs, source_label, user)
+    return _pack('', {}, None, user)
+
+
+def _pack(sessionid, pairs, source, user):
+    cookie = '; '.join('%s=%s' % (k, v) for k, v in pairs.items()) if pairs else ''
+    return {'user': str(user or '').lower(), 'sessionid': sessionid, 'cookie': cookie,
+            'authenticated': bool(sessionid), 'source': source,
+            'tt_target_idc': pairs.get('tt-target-idc', ''), 'masked': mask(sessionid),
+            'expiry': session_expiry(pairs)}
+
+
+def headers(user=None, extra=None):
+    """Headers for any tiktok.com / webcast.tiktok.com / CDN pull request."""
+    result = {'Referer': 'https://www.tiktok.com/'}
+    sess = session_for(user)
+    if sess['cookie']:
+        result['Cookie'] = sess['cookie']
+    if extra:
+        result.update(extra)
+    return result
+
+
+def extra_params(user=None):
+    """TikTok gates some payloads on this flag; harmless when anonymous."""
+    return {'user_is_login': 'true'} if session_for(user)['authenticated'] else {}
+
+
+def describe(users=()):
+    """Non-secret summary for the UI/state endpoint."""
+    users = list(users or ())
+    per_account = {}
+    for u in users:
+        s = session_for(u)
+        per_account[u] = {'authenticated': s['authenticated'], 'source': s['source'],
+                          'masked': s['masked'], 'tt_target_idc': s['tt_target_idc'],
+                          'expiry': s.get('expiry')}
+    glob = session_for(None)
+    known_vars = sorted({n for n in os.environ if n.startswith('TIKTOK_')})
+    return {'default_authenticated': glob['authenticated'], 'default_source': glob['source'],
+            'default_masked': glob['masked'], 'default_expiry': glob.get('expiry'),
+            'accounts': per_account,
+            'accounts_with_token': [u for u, v in per_account.items() if v['authenticated']],
+            'env_variables_present': known_vars,
+            'store_configured': bool(_store_path),
+            'store_entries': sorted(k for k in _read_store() if k != '_default')}
+
+
+# --------------------------------------------------------------------------- #
+# save / delete (on-volume store)
+# --------------------------------------------------------------------------- #
+def save(user, token):
+    user = ('_default' if not user else str(user).strip().lower())
+    sessionid, pairs = parse_token(token)
+    if not sessionid:
+        raise ValueError('لم يُعثر على sessionid صالح فيما لصقته')
+    ok, why = _looks_like_sessionid(sessionid)
+    if not ok:
+        raise ValueError('صيغة التوكن غير مقبولة: ' + why)
+    with _lock:
+        data = dict(_read_store())
+        data[user] = {'cookie': '; '.join('%s=%s' % (k, v) for k, v in pairs.items()),
+                      'sessionid': sessionid, 'tt_target_idc': pairs.get('tt-target-idc', ''),
+                      'sid_guard': pairs.get('sid_guard', '')}
+        _write_store(data)
+    return {'user': user, 'masked': mask(sessionid), 'tt_target_idc': pairs.get('tt-target-idc', '')}
+
+
+def delete(user):
+    user = ('_default' if not user else str(user).strip().lower())
+    with _lock:
+        data = dict(_read_store())
+        if user not in data:
+            return False
+        del data[user]
+        _write_store(data)
+    return True
+
+
+# --------------------------------------------------------------------------- #
+# validation
+# --------------------------------------------------------------------------- #
+def validate(token, user=None, timeout=25):
+    """Check a token against TikTok itself. Returns a plain-language report.
+
+    Never raises for a *bad* token — a bad token is a normal, reportable result.
+    Raises only on programmer/transport errors.
+    """
+    from curl_cffi import requests
+    sessionid, pairs = parse_token(token)
+    report = {'ok': False, 'stage': 'format', 'sessionid_masked': mask(sessionid),
+              'tt_target_idc': pairs.get('tt-target-idc', ''), 'account': None, 'checks': [],
+              'expiry': session_expiry(pairs)}
+    if report['expiry'] and report['expiry']['expired']:
+        report['checks'].append('انتهت صلاحية هذه الجلسة يوم %s (عمرها %d ساعة)'
+                                % (report['expiry']['expires_text'], max(1, report['expiry']['ttl_seconds'] // 3600)))
+    if not sessionid:
+        report['message'] = 'لم يُعثر على sessionid. الصق قيمة الكوكي sessionid نفسها، أو كامل سطر Cookie.'
+        return report
+    ok, why = _looks_like_sessionid(sessionid)
+    if not ok:
+        report['message'] = 'صيغة غير مقبولة: ' + why
+        return report
+    report['checks'].append('الصيغة مقبولة')
+    cookie = '; '.join('%s=%s' % (k, v) for k, v in pairs.items())
+    report['stage'] = 'auth'
+    try:
+        r = requests.get(AUTH_CHECK_URL, impersonate='chrome', timeout=timeout,
+                         headers={'Referer': 'https://www.tiktok.com/', 'Cookie': cookie})
+        payload = r.json()
+    except Exception:
+        report['message'] = 'تعذر الوصول إلى تيك توك للتحقق (شبكة أو حظر). أعد المحاولة.'
+        return report
+    data = payload.get('data') if isinstance(payload.get('data'), dict) else {}
+    if data.get('error_code') or payload.get('message') == 'error':
+        name = str(data.get('name') or '')
+        if name == 'session_expired' or data.get('error_code') == 13:
+            exp = report.get('expiry')
+            detail = (' (انتهت فعليًا يوم %s)' % exp['expires_text']) if exp and exp['expired'] else ''
+            report['message'] = ('تيك توك رفض التوكن: الجلسة منتهية أو غير صالحة%s. '
+                                 'سجّل الدخول في المتصفح وانسخ sessionid من جديد — '
+                                 'جلسات تيك توك قصيرة العمر وتنتهي خلال ساعات.' % detail)
+        else:
+            report['message'] = 'تيك توك رفض التوكن (%s / %s).' % (data.get('error_code'), name or 'unknown')
+        return report
+    report['ok'] = True
+    report['stage'] = 'accepted'
+    ident = {}
+    for field in ('username', 'unique_id', 'nickname', 'screen_name', 'uid', 'user_id', 'sec_uid',
+                  'email', 'mobile', 'has_password', 'is_18_plus', 'birthday', 'verified'):
+        if data.get(field) not in (None, ''):
+            ident[field] = str(data[field])[:60]
+    report['account'] = ident
+    report['checks'].append('تيك توك قبل التوكن وأعاده كجلسة مسجّلة دخول')
+    who = ident.get('username') or ident.get('unique_id') or ident.get('nickname') or 'حساب مرتبط'
+    report['message'] = 'التوكن صالح ومقبول. مرتبط بـ: %s' % who
+    if ident.get('birthday') or ident.get('is_18_plus'):
+        report['checks'].append('بيانات العمر ظاهرة في الجلسة (مهم لفتح البثوث المقيّدة 18+)')
+    if user:
+        report['checks'].append('سيُستخدم هذا التوكن للحساب @%s' % str(user).lower())
+    return report
+
+
+def unlock_check(user, timeout=25):
+    """Does the configured session actually expose stream URLs for `user`?
+
+    Compares anonymous vs authenticated lookups, so it reports the *effect*
+    rather than just token validity. Read-only: creates nothing.
+    """
+    from curl_cffi import requests
+    user = str(user).strip().lower().lstrip('@')
+    if not re.fullmatch(r'[A-Za-z0-9_.]{1,32}', user):
+        raise ValueError('اسم حساب غير صالح')
+    sess = session_for(user)
+
+    def probe(with_token):
+        hdrs = {'Referer': 'https://www.tiktok.com/'}
+        if with_token and sess['cookie']:
+            hdrs['Cookie'] = sess['cookie']
+        params = {'aid': 1988, 'uniqueId': user, 'sourceType': 54, 'staleTime': 0}
+        if with_token and sess['authenticated']:
+            params['user_is_login'] = 'true'
+        r = requests.get('https://www.tiktok.com/api-live/user/room', params=params,
+                         impersonate='chrome', headers=hdrs, timeout=timeout)
+        j = r.json()
+        d = (j.get('data') or {})
+        live = d.get('liveRoom') or {}
+        blocks = [live[k] for k in ('streamData', 'hevcStreamData') if isinstance(live.get(k), dict)]
+        urls = 0
+        for b in blocks:
+            p = (b.get('pull_data') or {}).get('stream_data')
+            try:
+                s = json.loads(p) if isinstance(p, str) else (p or {})
+            except ValueError:
+                s = {}
+            for _q, item in (s.get('data') or {}).items():
+                if ((item.get('main') or {}).get('flv')):
+                    urls += 1
+        return {'status': live.get('status'), 'urls': urls,
+                'not_found': j.get('message') == 'user_not_found'}
+
+    anon = probe(False)
+    if anon['not_found']:
+        return {'user': user, 'result': 'user_not_found', 'token_configured': sess['authenticated'],
+                'message': 'تيك توك يقول أن الحساب غير موجود أو لم يبث مباشرًا قط. التوكن لا يحل هذه الحالة.'}
+    if not sess['authenticated']:
+        state = 'live' if anon['status'] in (2, '2') else 'offline'
+        if state == 'live' and anon['urls'] == 0:
+            return {'user': user, 'result': 'needs_token', 'token_configured': False, 'anonymous': anon,
+                    'message': 'الحساب مباشر لكن تيك توك لا يعطي روابط فيديو بدون تسجيل دخول — هذه حالة تقييد عمري. أضف توكن.'}
+        return {'user': user, 'result': state, 'token_configured': False, 'anonymous': anon,
+                'message': 'بدون توكن: %s وروابط الفيديو = %d.' % (state, anon['urls'])}
+    auth = probe(True)
+    gained = auth['urls'] - anon['urls']
+    if gained > 0:
+        return {'user': user, 'result': 'unlocked', 'token_configured': True,
+                'anonymous': anon, 'authenticated': auth,
+                'message': 'التوكن يعمل ✔ روابط الفيديو: %d بدون توكن ← %d مع التوكن.' % (anon['urls'], auth['urls'])}
+    if anon['urls'] > 0 and auth['urls'] > 0:
+        return {'user': user, 'result': 'already_open', 'token_configured': True,
+                'anonymous': anon, 'authenticated': auth,
+                'message': 'الحساب مفتوح أصلًا بدون توكن (%d رابط). التوكن لا يضر لكن ليس سبب المشكلة.' % anon['urls']}
+    return {'user': user, 'result': 'not_unlocked', 'token_configured': True,
+            'anonymous': anon, 'authenticated': auth,
+            'message': ('التوكن مقبول لكن لم يفتح روابط الفيديو لهذا الحساب الآن. '
+                        'الأسباب المحتملة: الحساب غير مباشر حاليًا، أو عمر الحساب المرتبط بالتوكن أقل من 18، '
+                        'أو الحساب محظور عنك. جرّب والفحص أثناء بث حي.')}
+
+
+def classify_restriction(payload):
+    """True when a webcast payload is the age-restriction / prompts error shape."""
+    if not isinstance(payload, dict):
+        return False
+    data = payload.get('data')
+    if not isinstance(data, dict):
+        return False
+    if 'prompts' in data and not data.get('stream_url'):
+        return True
+    return len(data) <= 1 and payload.get('status_code') not in (0, None)

verify.sh

@@ -0,0 +1,139 @@
+#!/bin/sh
+# تحقّق بعد الرفع: تأكد أن ملفات السبيس صارت النسخة المُصلَحة فعلًا.
+# شغّله داخل السبيس (Terminal) أو محليًا على المجلد الذي يحتوي الملفات.
+set -e
+DIR="${1:-.}"
+cd "$DIR"
+
+echo "== الملفات الموجودة =="
+ls -1 Dockerfile flv_bridge.py relay.py youtube_manager.py
+
+echo
+echo "== 1) Dockerfile يحمل YOUTUBE_SEND_MODE =="
+grep -q 'YOUTUBE_SEND_MODE=copy' Dockerfile && echo "   OK" || { echo "   FAIL — Dockerfile قديم"; exit 1; }
+
+echo
+echo "== 2) flv_bridge.py فيه FormatChanged =="
+grep -q 'class FormatChanged' flv_bridge.py && echo "   OK" || { echo "   FAIL"; exit 1; }
+grep -q '_video_signature' flv_bridge.py && echo "   OK — فحص Sequence Header موجود" || { echo "   FAIL"; exit 1; }
+
+echo
+echo "== 3) relay.py فيه send_mode / canvas / note_format_change =="
+for token in 'def send_mode' 'def canvas' 'def note_format_change' 'except FormatChanged' 'YOUTUBE_SEND_MODE'; do
+  grep -q "$token" relay.py && echo "   OK — $token" || { echo "   FAIL — ناقص $token"; exit 1; }
+done
+
+echo
+echo "== 4) youtube_manager.py فيه معالجة FormatChanged =="
+grep -q 'from flv_bridge import FormatChanged' youtube_manager.py && echo "   OK — import" || { echo "   FAIL"; exit 1; }
+grep -q 'except FormatChanged' youtube_manager.py && echo "   OK — sender_loop" || { echo "   FAIL"; exit 1; }
+
+echo
+echo "== 5) الملفات تُترجَم بدون أخطاء =="
+python3 -m py_compile flv_bridge.py relay.py youtube_manager.py app.py && echo "   OK"
+
+echo
+echo "== 6) السلوك الفعلي: الوضع الافتراضي = copy، والأوامر تُبنى صحيحًا =="
+python3 - <<'PY'
+import importlib.util, os, shutil, sys
+def load(n, p):
+    s = importlib.util.spec_from_file_location(n, p); m = importlib.util.module_from_spec(s)
+    sys.modules[n] = m; s.loader.exec_module(m); return m
+load('flv_bridge', 'flv_bridge.py'); rl = load('relay', 'relay.py')
+r = rl.Relay(shutil.which('ffmpeg') or '/usr/bin/ffmpeg', lambda u: [], lambda u, m: None)
+for mode in ('copy', 'fixed1080', 'fixed720'):
+    os.environ['YOUTUBE_SEND_MODE'] = mode
+    assert r.send_mode() == mode, mode
+    cmd = ' '.join(r.command('rtmps://a.rtmps.youtube.com:443/live2/KEY'))
+    if mode == 'copy':
+        assert '-c:v copy' in cmd and '-rtmp_enhanced_codecs hvc1' in cmd, cmd
+        assert 'libx264' not in cmd
+    else:
+        assert 'libx264' in cmd and 'pad=' in cmd and '-sc_threshold 0' in cmd, cmd
+        assert '-c:v copy' not in cmd
+    print('   OK — %-9s -> %s' % (mode, cmd[:110] + '...'))
+os.environ.pop('YOUTUBE_SEND_MODE', None)
+assert r.send_mode() == 'copy', 'default must stay copy'
+print('   OK — بدون المتغير: الافتراضي copy (لا تغيير في السلوك)')
+PY
+
+echo
+echo "== 7) اختبار حي: بث يغيّر مقاسه في المنتصف =="
+python3 - <<'PY'
+import importlib.util, os, shutil, struct, subprocess, sys
+def load(n, p):
+    s = importlib.util.spec_from_file_location(n, p); m = importlib.util.module_from_spec(s)
+    sys.modules[n] = m; s.loader.exec_module(m); return m
+fb = load('flv_bridge', 'flv_bridge.py')
+ff = shutil.which('ffmpeg')
+if not ff:
+    print('   SKIP — ffmpeg غير موجود'); sys.exit(0)
+
+def enc(path, size, codec):
+    cmd = [ff, '-hide_banner', '-loglevel', 'error', '-y', '-f', 'lavfi',
+           '-i', 'testsrc2=size=%s:rate=30' % size, '-t', '3', '-c:v', codec]
+    if codec == 'libx265':
+        cmd += ['-x265-params', 'keyint=30:min-keyint=30:log-level=error', '-rtmp_enhanced_codecs', 'hvc1']
+    else:
+        cmd += ['-g', '30']
+    cmd += ['-f', 'flv', path]
+    subprocess.run(cmd, check=True)
+
+def parse(p):
+    d = open(p, 'rb').read(); h = struct.unpack('>I', d[5:9])[0] + 4
+    pos = h; tags = []
+    while pos + 11 <= len(d):
+        t = d[pos]; sz = int.from_bytes(d[pos+1:pos+4], 'big')
+        ts = int.from_bytes(d[pos+4:pos+7], 'big') | (d[pos+7] << 24)
+        tags.append([t, ts, d[pos+11:pos+11+sz]]); pos += 11 + sz + 4
+    return d[:h], tags
+
+def write(p, head, tags):
+    with open(p, 'wb') as f:
+        f.write(head)
+        for t, ts, b in tags:
+            f.write(bytes([t]) + len(b).to_bytes(3, 'big') + (ts & 0xFFFFFF).to_bytes(3, 'big')
+                    + bytes([(ts >> 24) & 0xFF]) + b'\0\0\0' + b + (11 + len(b)).to_bytes(4, 'big'))
+
+for codec, ext in (('libx265', 'hevc'), ('libx264', 'h264')):
+    enc('/tmp/_a.flv', '1080x1920', codec); enc('/tmp/_b.flv', '720x1280', codec)
+    ha, ta = parse('/tmp/_a.flv'); _, tb = parse('/tmp/_b.flv')
+    base = max(x[1] for x in ta) + 34
+    merged = ta + [[t, ts + base, b] for t, ts, b in tb if t != 18]
+    write('/tmp/_sw.flv', ha, merged)
+
+    b = fb.FLVBridge()
+    raw = open('/tmp/_sw.flv', 'rb').read()
+    raised = False
+    try:
+        for i in range(0, len(raw), 65536):
+            b.feed(raw[i:i+65536])
+    except fb.FormatChanged:
+        raised = True
+    print('   %s: FormatChanged %s' % (ext.upper(), 'OK — رُصد التغيّر' if raised else 'FAIL'))
+    assert raised
+
+    # detection off (fixed canvas mode) must swallow it
+    b2 = fb.FLVBridge(detect_format_change=False); n = 0
+    for i in range(0, len(raw), 65536):
+        n += len(b2.feed(raw[i:i+65536]))
+    print('   %s: detect off -> emitted %d bytes, changes seen %d  OK' % (ext.upper(), n, b2.format_changes))
+PY
+
+echo
+echo "== 8) توكن تيك توك: الصيغ والأولويات وعدم التسريب =="
+python3 verify_tokens.py || { echo "   FAIL"; exit 1; }
+
+echo
+echo "== 9) كل طلبات تيك توك تمر عبر التوكن =="
+COUNT=$(grep -c "tiktok_auth.headers(" app.py relay.py youtube_manager.py | awk -F: '{s+=$2} END {print s}')
+echo "   مواضع tiktok_auth.headers(): $COUNT (المتوقع 5)"
+[ "$COUNT" -ge 5 ] || { echo "   FAIL — يوجد طلب لا يحمل الجلسة"; exit 1; }
+grep -q "tiktok_auth.py" Dockerfile && echo "   OK — Dockerfile ينسخ tiktok_auth.py" || { echo "   FAIL"; exit 1; }
+grep -q "TIKTOK_SESSIONID" Dockerfile && echo "   OK — Dockerfile يعلن متغيرات التوكن" || { echo "   FAIL"; exit 1; }
+grep -q "api/tiktok/token" app.py && echo "   OK — نقاط API للتوكن موجودة" || { echo "   FAIL"; exit 1; }
+grep -q "AgeRestricted" app.py && echo "   OK — كشف التقييد العمري موجود" || { echo "   FAIL"; exit 1; }
+grep -q "renderTiktok" index.html && echo "   OK — لوحة التوكن في الواجهة" || { echo "   FAIL"; exit 1; }
+
+echo
+echo "✅ كل الفحوصات نجحت — الملفات مُصلَحة وجاهزة."

verify_tokens.py

@@ -0,0 +1,152 @@
+"""Token checks used by verify.sh — kept in its own file to avoid nested heredocs."""
+import importlib.util, json, os, sys, tempfile
+
+sp = importlib.util.spec_from_file_location('tiktok_auth', 'tiktok_auth.py')
+ta = importlib.util.module_from_spec(sp)
+sys.modules['tiktok_auth'] = ta
+sp.loader.exec_module(ta)
+
+tmp = tempfile.mkdtemp()
+ta.configure(os.path.join(tmp, 'tiktok-tokens.json'))
+FAKE = 'z' * 160
+
+# --- 1. every input shape a user can realistically paste ------------------- #
+shapes = {
+    'قيمة sessionid وحدها': FAKE,
+    'sessionid=...': 'sessionid=' + FAKE,
+    'سطر Cookie كامل': 'sessionid=%s; sid_tt=%s; ttwid=ABC; tt-target-idc=eu-ttp2' % (FAKE, FAKE),
+    'سطر cookies.txt': '.tiktok.com\tTRUE\t/\tTRUE\t1799999999\tsessionid\t' + FAKE,
+    'عدة أسطر': 'sessionid=' + FAKE + '\nttwid=ABC',
+}
+for name, raw in shapes.items():
+    sid, pairs = ta.parse_token(raw)
+    assert sid == FAKE, (name, sid[:20])
+    for required in ('sessionid', 'sessionid_ss', 'sid_tt'):
+        assert required in pairs, (name, sorted(pairs))
+    print('   OK — يقبل: %-22s (كوكيز: %d)' % (name, len(pairs)))
+
+sid, pairs = ta.parse_token(shapes['سطر Cookie كامل'])
+assert pairs['tt-target-idc'] == 'eu-ttp2', pairs
+print('   OK — يستخرج tt-target-idc من سطر الكوكي (eu-ttp2)')
+
+# --- 2. precedence (most specific wins) ----------------------------------- #
+G = 'g' * 160
+ta._store_cache = None
+ta.save('sara', 's' * 160)                      # lowest priority source
+os.environ['TIKTOK_SESSIONID'] = G              # global fallback
+os.environ['TIKTOK_TOKENS'] = 'sara=' + 't' * 160
+os.environ['TIKTOK_SESSIONID_SARA'] = 'a' * 160  # explicit per-account
+assert ta.session_for('sara')['source'] == 'TIKTOK_SESSIONID_SARA', ta.session_for('sara')
+assert ta.session_for('other')['source'] == 'TIKTOK_SESSIONID'      # global covers other accounts
+print('   OK — TIKTOK_SESSIONID_<USER> يتقدم على كل شيء، والعام يغطي باقي الحسابات')
+
+os.environ.pop('TIKTOK_SESSIONID_SARA')
+assert ta.session_for('sara')['source'] == 'TIKTOK_TOKENS', ta.session_for('sara')
+print('   OK — خريطة TIKTOK_TOKENS (تخصيص للحساب) تتقدم على التوكن العام')
+
+os.environ.pop('TIKTOK_TOKENS')
+assert ta.session_for('sara')['source'] == 'TIKTOK_SESSIONID'
+print('   OK — التوكن العام يعمل عندما لا يوجد تخصيص للحساب')
+
+os.environ.pop('TIKTOK_SESSIONID')
+ta._store_cache = None
+assert ta.session_for('sara')['source'] == 'مخزن التطبيق'
+assert ta.session_for(None)['source'] is None
+print('   OK — مخزن الواجهة هو آخر احتياطي')
+
+# --- 3. the store file must not be world-readable -------------------------- #
+mode = os.stat(os.path.join(tmp, 'tiktok-tokens.json')).st_mode & 0o777
+assert mode == 0o600, oct(mode)
+print('   OK — ملف التوكنات محفوظ بصلاحيات 600')
+
+# --- 4. nothing secret may leave through the API surface ------------------- #
+os.environ['TIKTOK_SESSIONID'] = 'g' * 160
+ta._store_cache = None
+blob = json.dumps(ta.describe(['ali.karim', 'sara']), ensure_ascii=False)
+for secret in ('g' * 160, 'a' * 160, 's' * 160, 't' * 160, FAKE):
+    assert secret not in blob, 'TOKEN LEAK in describe()'
+assert 'gggg' in blob and 'ggggg' not in blob.replace('gggg…', '')
+hdrs = ta.headers('sara')
+assert set(hdrs) == {'Referer', 'Cookie'}
+assert [c.split('=')[0] for c in hdrs['Cookie'].split('; ')] == ['sessionid', 'sessionid_ss', 'sid_tt', 'tt-target-idc']
+assert ta.extra_params('sara') == {'user_is_login': 'true'}
+print('   OK — describe()/headers() لا يسرّبان التوكن (مقنّع فقط) وأسماء الكوكيز صحيحة')
+
+os.environ.pop('TIKTOK_SESSIONID')
+ta._store_cache = None
+assert ta.headers('sara') == {'Referer': 'https://www.tiktok.com/'} or 'Cookie' in ta.headers('sara')
+ta.delete('sara'); ta.delete('_default')
+ta._store_cache = None
+assert ta.headers('nobody') == {'Referer': 'https://www.tiktok.com/'}, 'anonymous must stay byte-identical to before'
+assert ta.extra_params('nobody') == {}
+print('   OK — بدون توكن: الترويسات مطابقة تمامًا للسلوك السابق (Referer فقط)')
+
+# --- 5. age-restriction classification ------------------------------------ #
+cases = [
+    ({'status_code': 10012, 'data': {'message': 'age restricted', 'prompts': 'x'}}, True),
+    ({'status_code': 10012, 'data': {}}, True),
+    ({'status_code': 0, 'data': {'status': 2, 'stream_url': {'flv_pull_url': {}}}}, False),
+    ({'data': None}, False),
+    ('not a dict', False),
+]
+for payload, expected in cases:
+    assert ta.classify_restriction(payload) is expected, payload
+print('   OK — يميّز استجابة التقييد العمري عن الغرفة الطبيعية')
+
+# --- 6. bad formats rejected before any network call ---------------------- #
+for bad in ('', '12345', 'abc def ghi jkl mno pqr stu vwx yz', 'x' * 5000):
+    sid, _ = ta.parse_token(bad)
+    if sid:
+        ok, _why = ta._looks_like_sessionid(sid)
+        assert not ok, bad
+print('   OK — يرفض الصيغ الخاطئة قبل أي طلب شبكة')
+
+# --- 6b. session expiry decoded from sid_guard ---------------------------- #
+# Real-world sample: TikTok issued a web session with a 6 hour lifetime.
+SG = ('x' * 32) + '%7C1789387145%7C21600%7CMon%2C+14-Sep-2026+17%3A59%3A05+GMT'
+_sid, pairs = ta.parse_token('sessionid=' + 'x' * 32 + '; sid_guard=' + SG)
+exp = ta.session_expiry(pairs)
+assert exp and exp['ttl_seconds'] == 21600, exp
+assert exp['expires_text'] == '2026-09-14 17:59 UTC', exp
+assert exp['expired'] is True and exp['seconds_left'] == 0, exp
+print('   OK — يفكّ sid_guard: عمر الجلسة 6 ساعات وانتهت %s' % exp['expires_text'])
+
+import time as _t
+_sg_live = 'y' * 32 + '%%7C%d%%7C7200%%7Cnow' % int(_t.time())
+_sid, pairs = ta.parse_token('sessionid=' + 'y' * 32 + '; sid_guard=' + _sg_live)
+exp = ta.session_expiry(pairs)
+assert exp and exp['expired'] is False and 7100 < exp['seconds_left'] <= 7200, exp
+print('   OK — جلسة حية تُبلَّغ كصالحه مع العد التنازلي (%d ثانية متبقية)' % exp['seconds_left'])
+
+_sid, pairs = ta.parse_token('sessionid=' + 'v' * 160)
+assert ta.session_expiry(pairs) is None
+print('   OK — بدون sid_guard لا يخمّن موعد انتهاء (None)')
+
+rep = ta.validate('sessionid=' + 'x' * 32 + '; sid_guard=' + SG)
+assert rep['expiry'] and rep['expiry']['expired']
+assert '2026-09-14 17:59 UTC' in rep['message'], rep['message']
+print('   OK — رسالة الرفض تذكر موعد الانتهاء الفعلي')
+
+# --- 7. live: TikTok must reject a fake token, and the app must say so ----- #
+try:
+    r = ta.validate('q' * 160)
+    assert r['ok'] is False, r
+    assert r['stage'] in ('auth', 'format'), r
+    print('   OK — تيك توك رفض التوكن المزيّف والتطبيق بلّغ: %s' % r['message'][:60])
+except AssertionError:
+    raise
+except Exception as e:
+    print('   SKIP — تعذر الوصول إلى تيك توك (%s)' % type(e).__name__)
+
+# --- 8. live: unlock_check must not crash on a public account ------------- #
+try:
+    res = ta.unlock_check('aljazeera', timeout=20)
+    assert 'message' in res and 'result' in res
+    print('   OK — unlock_check على حساب عام: result=%s' % res['result'])
+    res = ta.unlock_check('thisaccountdoesnotexist99x', timeout=20)
+    assert res['result'] == 'user_not_found'
+    print('   OK — unlock_check يميّز الحساب غير الموجود')
+except Exception as e:
+    print('   SKIP — تعذر الوصول إلى تيك توك (%s)' % type(e).__name__)
+
+print('   كل فحوصات التوكن نجحت.')

viewer.py

@@ -1,256 +0,0 @@
-#!/usr/bin/env python3
-"""
-TikTok LIVE Viewer v5 — REAL browser with stealth.
-DOM structure: chat-message > flex-col > [name-row, break-words(comment)]
-"""
-import os, sys, json, time, re, threading
-from flask import Flask, jsonify, render_template_string
-
-COMMENTS, VIEWER_COUNT, STREAMER_NAME = [], 0, ""
-IS_LIVE, HLS_URL, PK_DATA = False, "", {}
-BROWSER_STATUS = "starting"
-LOCK = threading.Lock()
-SEEN_FPS = set()
-
-EXTRACT_JS = '''() => {
-    const msgs = [];
-    document.querySelectorAll('[data-e2e="chat-message"]').forEach(el => {
-        const ne = el.querySelector('[data-e2e="message-owner-name"]');
-        const name = ne ? ne.textContent.trim() : '';
-        // chat-message > avatar-div + content-div(flex-col) > [name-row-div, break-words-div]
-        const flexCol = el.querySelector('.flex.flex-col');
-        const commentDiv = flexCol && flexCol.children.length >= 2 ? flexCol.children[1] : null;
-        const comment = commentDiv ? commentDiv.textContent.trim() : '';
-        if (comment) msgs.push({user: name, text: comment, type: 'comment', fp: name + ':' + comment.substring(0, 30)});
-    });
-    document.querySelectorAll('[data-e2e="enter-message"]').forEach(el => {
-        const ne = el.querySelector('[data-e2e="message-owner-name"]');
-        if (ne) msgs.push({user: ne.textContent.trim(), text: 'joined', type: 'join', fp: 'j:' + ne.textContent.trim()});
-    });
-    return {
-        msgs: msgs,
-        viewers: (document.querySelector('[data-e2e="person-count"]') || {}).textContent || '0',
-        name: (document.querySelector('[data-e2e="room-header-anchor-name"]') || {}).textContent || '',
-        e2eCount: new Set(Array.from(document.querySelectorAll('[data-e2e]')).map(e => e.getAttribute('data-e2e'))).size,
-        isLive: !!document.querySelector('[data-e2e="person-count"]') || document.querySelectorAll('[data-e2e="chat-message"]').length > 0
-    };
-}'''
-
-app = Flask(__name__)
-
-HTML = """<!DOCTYPE html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>TikTok LIVE Viewer</title>
-<style>
-*{margin:0;padding:0;box-sizing:border-box}
-body{font-family:system-ui,sans-serif;background:#0a0a0a;color:#fff;height:100vh;overflow:hidden}
-.wrap{display:grid;grid-template-columns:1fr 360px;height:100vh}
-.vid{background:#000;display:flex;align-items:center;justify-content:center}
-.vid video{width:100%;height:100%;object-fit:contain}
-.chat{display:flex;flex-direction:column;background:#111;border-left:1px solid #222}
-.hdr{padding:12px 16px;background:#1a1a1a;border-bottom:1px solid #333}
-.hdr h2{font-size:1.1em;color:#fe2c55}
-.hdr .m{font-size:.85em;color:#888;margin-top:4px}
-.vc{display:inline-flex;align-items:center;gap:4px;background:#333;padding:2px 8px;border-radius:12px;font-size:.8em}
-.vc .d{width:6px;height:6px;background:#fe2c55;border-radius:50%;animation:p 1.5s infinite}
-@keyframes p{0%,100%{opacity:1}50%{opacity:.3}}
-.msgs{flex:1;overflow-y:auto;padding:8px;display:flex;flex-direction:column;gap:4px;scroll-behavior:smooth}
-.mg{padding:6px 10px;border-radius:8px;font-size:.9em;line-height:1.4;animation:fi .3s ease}
-@keyframes fi{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:translateY(0)}}
-.mg.c{background:#1a1a2e}.mg.c .u{color:#fe2c55;font-weight:600;margin-right:6px}.mg.c .t{color:#e0e0e0}
-.mg.g{background:#1a1a0a;border-left:3px solid #ffd700}.mg.g .u{color:#ffd700;font-weight:600}
-.mg.j{background:#0a1a0a;color:#4ade80;font-size:.8em}
-.pk{padding:8px 16px;background:#1a1a1a;border-bottom:1px solid #333;display:none}
-.pk.on{display:block}.pk .bar{height:8px;background:#333;border-radius:4px;overflow:hidden;margin-top:4px}
-.pk .fill{height:100%;background:linear-gradient(90deg,#fe2c55,#25f4ee);border-radius:4px;transition:width .5s}
-.pk .sc{display:flex;justify-content:space-between;font-size:.85em;margin-top:4px}
-.ctrl{padding:8px 16px;background:#1a1a1a;border-top:1px solid #333;display:flex;gap:8px;align-items:center}
-.ctrl button{padding:6px 12px;border:none;border-radius:6px;background:#fe2c55;color:#fff;cursor:pointer;font-size:.85em}
-.st{padding:4px 16px;background:#0a0a0a;font-size:.75em;color:#666;text-align:center}
-</style></head><body>
-<div class="wrap">
-  <div class="vid"><div id="ns" style="color:#888;font-size:1.2em">Connecting...</div>
-    <video id="v" autoplay muted playsinline style="display:none"></video></div>
-  <div class="chat">
-    <div class="hdr"><h2 id="sn">Loading...</h2>
-      <div class="m"><span class="vc"><span class="d"></span> <span id="vc">0</span></span>
-        <span id="st" style="margin-left:8px">Connecting...</span></div></div>
-    <div id="pk" class="pk"><div class="sc"><span id="pl">0</span><span>PK</span><span id="pr">0</span></div>
-      <div class="bar"><div id="pf" class="fill" style="width:50%"></div></div></div>
-    <div id="msgs" class="msgs"></div>
-    <div class="ctrl"><button onclick="location.reload()">Refresh</button>
-      <button onclick="document.getElementById('msgs').innerHTML=''">Clear</button></div>
-    <div class="st" id="bs">Browser: starting...</div>
-  </div>
-</div>
-<script>
-let hls=null;const v=document.getElementById('v'),ms=document.getElementById('msgs'),MX=200;
-function aM(t,u,x){const d=document.createElement('div');d.className='mg '+t;
-if(t==='c')d.innerHTML='<span class="u">'+e(u)+'</span><span class="t">'+e(x)+'</span>';
-else if(t==='g')d.innerHTML='\ud83c\udf81 <span class="u">'+e(u)+'</span> '+e(x);
-else if(t==='j')d.innerHTML='\ud83d\udc4b '+e(u)+' joined';
-else d.textContent=x||'';ms.appendChild(d);
-while(ms.children.length>MX)ms.removeChild(ms.firstChild);ms.scrollTop=ms.scrollHeight;}
-function e(s){const d=document.createElement('div');d.textContent=s;return d.innerHTML;}
-let sk=new Set();
-function poll(){fetch('/api/data').then(r=>r.json()).then(d=>{
-document.getElementById('sn').textContent=d.streamer||'Unknown';
-document.getElementById('vc').textContent=d.viewers||'0';
-document.getElementById('st').textContent=d.is_live?'LIVE':'Offline';
-document.getElementById('bs').textContent='Browser: '+d.browser_status;
-(d.comments||[]).forEach(c=>{const k=c.user+':'+(c.text||'').substring(0,30);
-if(sk.has(k))return;sk.add(k);if(sk.size>1000){const a=[...sk];sk=new Set(a.slice(-500));}
-aM(c.type==='gift'?'g':c.type==='join'?'j':'c',c.user||'',c.text||'');});
-if(d.pk&&d.pk.active){document.getElementById('pk').classList.add('on');
-document.getElementById('pl').textContent=d.pk.left_score||'0';
-document.getElementById('pr').textContent=d.pk.right_score||'0';}
-else document.getElementById('pk').classList.remove('on');
-if(d.hls&&!hls){v.style.display='block';document.getElementById('ns').style.display='none';
-if(window.Hls&&Hls.isSupported()){hls=new Hls();hls.loadSource(d.hls);hls.attachMedia(v);}
-else v.src=d.hls;}}).catch(()=>{});setTimeout(poll,1500);}
-const s=document.createElement('script');s.src='https://cdn.jsdelivr.net/npm/hls.js@latest';
-s.onload=()=>{window.Hls=Hls;};document.head.appendChild(s);poll();
-</script></body></html>"""
-
-@app.route('/')
-def index(): return render_template_string(HTML)
-
-@app.route('/api/data')
-def api_data():
-    with LOCK:
-        return jsonify({'streamer': STREAMER_NAME, 'viewers': VIEWER_COUNT, 'is_live': IS_LIVE,
-            'hls': HLS_URL, 'comments': COMMENTS[-100:], 'pk': PK_DATA,
-            'browser_status': BROWSER_STATUS})
-
-def parse_viewers(raw):
-    s = str(raw).replace(',', '').strip()
-    if 'K' in s:
-        try: return int(float(s.replace('K','')) * 1000)
-        except: return 0
-    try: return int(re.sub(r'[^0-9]', '', s) or 0)
-    except: return 0
-
-def browser_thread():
-    global STREAMER_NAME, VIEWER_COUNT, IS_LIVE, HLS_URL, PK_DATA
-    global BROWSER_STATUS, COMMENTS, SEEN_FPS
-
-    from playwright.sync_api import sync_playwright
-    from playwright_stealth import Stealth
-
-    UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
-
-    cookie_file = os.environ.get('COOKIE_FILE', '/home/user/tiktok-bot/cookies.json')
-    cookies = []
-    if os.path.exists(cookie_file):
-        with open(cookie_file) as f:
-            for c in json.load(f):
-                cookies.append({'name': c['name'], 'value': c['value'],
-                    'domain': c.get('domain', '.tiktok.com'), 'path': c.get('path', '/')})
-
-    with LOCK: BROWSER_STATUS = "launching browser..."
-
-    stealth = Stealth()
-    pw = stealth.use_sync(sync_playwright())
-    p = pw.start()
-    browser = p.chromium.launch(headless=False, args=['--no-sandbox', '--autoplay-policy=no-user-gesture-required', '--disable-gpu'])
-    context = browser.new_context(viewport={'width': 1280, 'height': 720}, user_agent=UA, locale='en-US')
-    if cookies: context.add_cookies(cookies)
-    page = context.new_page()
-
-    def find_live_streamers():
-        with LOCK: BROWSER_STATUS = "discovering live streamers..."
-        try:
-            page.goto('https://www.tiktok.com/live', wait_until='domcontentloaded', timeout=25000)
-            time.sleep(6)
-            return page.eval_on_selector_all('a[href*="/@"]',
-                'els => { const s=new Set(); return els.map(e=>e.href).filter(h=>h.match(/tiktok\\.com\\/@[^/]+\\/live/)).filter(h=>{if(s.has(h))return false;s.add(h);return true;}); }')
-        except Exception as e:
-            with LOCK: BROWSER_STATUS = f"discover error: {str(e)[:60]}"
-            return []
-
-    def open_live(url):
-        global STREAMER_NAME, VIEWER_COUNT, IS_LIVE, BROWSER_STATUS, COMMENTS, SEEN_FPS
-        with LOCK: BROWSER_STATUS = f"opening {url.split('/')[-2]}..."
-        try:
-            page.goto(url, wait_until='domcontentloaded', timeout=30000)
-            time.sleep(12)
-
-            has_captcha = page.evaluate("() => { const t=document.body.innerText; return (t.includes('Select')&&t.includes('shape'))||t.includes('Verify you are human'); }")
-            if has_captcha:
-                with LOCK: BROWSER_STATUS = "CAPTCHA - waiting 30s..."
-                time.sleep(30)
-                return False
-
-            data = page.evaluate(EXTRACT_JS)
-            e2e_c = data.get('e2eCount', 0)
-            if e2e_c < 35:
-                time.sleep(8)
-                data = page.evaluate(EXTRACT_JS)
-                e2e_c = data.get('e2eCount', 0)
-
-            with LOCK:
-                for m in data.get('msgs', []):
-                    fp = m.get('fp', '')
-                    if fp and fp not in SEEN_FPS:
-                        SEEN_FPS.add(fp)
-                        COMMENTS.append(m)
-                if data.get('name'): STREAMER_NAME = data['name']
-                VIEWER_COUNT = parse_viewers(data.get('viewers', '0'))
-                IS_LIVE = data.get('isLive', False)
-                BROWSER_STATUS = f"live! e2e={e2e_c} chat={len(data.get('msgs',[]))} v={VIEWER_COUNT}"
-            return e2e_c >= 35
-        except Exception as e:
-            with LOCK: BROWSER_STATUS = f"open error: {str(e)[:60]}"
-            return False
-
-    def poll_loop():
-        global STREAMER_NAME, VIEWER_COUNT, IS_LIVE, BROWSER_STATUS, COMMENTS, SEEN_FPS
-        while True:
-            try:
-                data = page.evaluate(EXTRACT_JS)
-                with LOCK:
-                    for m in data.get('msgs', []):
-                        fp = m.get('fp', '')
-                        if fp and fp not in SEEN_FPS:
-                            SEEN_FPS.add(fp)
-                            COMMENTS.append(m)
-                    if len(COMMENTS) > 500: COMMENTS[:] = COMMENTS[-500:]
-                    if data.get('name'): STREAMER_NAME = data['name']
-                    VIEWER_COUNT = parse_viewers(data.get('viewers', '0'))
-                    IS_LIVE = data.get('isLive', False)
-                time.sleep(2)
-            except Exception as e:
-                with LOCK: BROWSER_STATUS = f"poll error: {str(e)[:60]}"
-                time.sleep(5)
-
-    # Main loop
-    with LOCK: BROWSER_STATUS = "browser ready, discovering..."
-    while True:
-        try:
-            live_urls = find_live_streamers()
-            with LOCK: BROWSER_STATUS = f"found {len(live_urls)} streamers"
-            if not live_urls:
-                time.sleep(30)
-                continue
-
-            opened = False
-            for url in live_urls[:5]:
-                if open_live(url):
-                    opened = True
-                    break
-                time.sleep(3)
-
-            if opened:
-                with LOCK: BROWSER_STATUS = f"watching {STREAMER_NAME}"
-                poll_loop()
-            else:
-                with LOCK: BROWSER_STATUS = "no streamer worked, retrying in 60s..."
-                time.sleep(60)
-        except Exception as e:
-            with LOCK: BROWSER_STATUS = f"main error: {str(e)[:60]}"
-            time.sleep(10)
-
-if __name__ == '__main__':
-    t = threading.Thread(target=browser_thread, daemon=True)
-    t.start()
-    app.run(host='0.0.0.0', port=7860, debug=False)

web.py

@@ -1,605 +0,0 @@
-#!/usr/bin/env python3
-"""
-TikTok Live Multi-Account Bot v4
-- REAL likes via /webcast/room/digg/ (X-Bogus signed)
-- Multi-account PARALLEL (all accounts run simultaneously)
-- Fast likes, comments, shares
-- Pure Python X-Bogus generator (no browser needed)
-"""
-
-import os, json, time, threading, re, random, logging, requests, hashlib, base64, struct
-from datetime import datetime
-from urllib.parse import urlparse
-from concurrent.futures import ThreadPoolExecutor
-from flask import Flask, render_template_string, request, jsonify
-
-logging.basicConfig(level=logging.INFO, format='%(asctime)s %(message)s')
-log = logging.getLogger(__name__)
-app = Flask(__name__)
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# X-Bogus Signature Generator (Pure Python)
-# ═══════════════════════════════════════════════════════════════════════════════
-_C64 = "Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe="
-_S64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
-_UK = bytes([0x00, 0x01, 0x0E])
-_PK = bytes([0xFF])
-_MG = 0x4A41279F
-
-def _rc4(k, d):
-    S = list(range(256)); j = 0
-    for i in range(256): j = (j + S[i] + k[i % len(k)]) % 256; S[i], S[j] = S[j], S[i]
-    r = bytearray(); i = j = 0
-    for b in d: i = (i+1) % 256; j = (j+S[i]) % 256; S[i], S[j] = S[j], S[i]; r.append(b ^ S[(S[i]+S[j]) % 256])
-    return bytes(r)
-
-def _md5h(d): return hashlib.md5(d.encode() if isinstance(d, str) else d).hexdigest()
-def _dmd5(d): return bytes.fromhex(_md5h(bytes.fromhex(_md5h(d))))
-def _uamd5(ua): return bytes.fromhex(_md5h(base64.b64encode(_rc4(_UK, ua.encode())).decode("iso-8859-1")))
-
-def x_bogus(qs, ua, body="", ts=None):
-    ts = ts or int(time.time())
-    p, b, u = _dmd5(qs), _dmd5(body or ""), _uamd5(ua)
-    pl = bytearray([0x40]); pl.extend(_UK); pl.extend(p[14:16]); pl.extend(b[14:16])
-    pl.extend(u[14:16]); pl.extend(struct.pack(">I", ts)); pl.extend(struct.pack(">I", _MG))
-    x = 0
-    for v in pl: x ^= v
-    pl.append(x & 0xFF)
-    enc = _rc4(_PK, bytes(pl))
-    f = bytes([0x02, 0xFF]) + enc
-    return base64.b64encode(f).decode().translate(str.maketrans(_S64, _C64))
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# Constants
-# ═══════════════════════════════════════════════════════════════════════════════
-UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
-WEBCAST = "https://webcast.tiktok.com/webcast"
-CONFIG_PATH = os.path.join(os.path.dirname(__file__), 'config.json')
-
-def load_config():
-    try:
-        with open(CONFIG_PATH) as f: return json.load(f)
-    except: return {}
-
-def save_config(cfg):
-    with open(CONFIG_PATH, 'w') as f: json.dump(cfg, f, indent=2)
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# State
-# ═══════════════════════════════════════════════════════════════════════════════
-session_log = []
-sessions = {}
-stop_flags = {}
-log_lock = threading.Lock()
-start_time = {}
-
-def add_log(msg, uid=None, level='info'):
-    ts = datetime.now().strftime('%H:%M:%S')
-    entry = {'ts': ts, 'uid': uid or 'system', 'msg': str(msg), 'level': level}
-    with log_lock:
-        session_log.append(entry)
-        if len(session_log) > 1000: session_log.pop(0)
-    getattr(log, level, log.info)(f"[{uid or 'sys'}] {msg}")
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# Cookie Helpers
-# ═══════════════════════════════════════════════════════════════════════════════
-def parse_cookies(s):
-    c = {}
-    for p in s.split(';'):
-        p = p.strip()
-        if '=' in p:
-            k, v = p.split('=', 1)
-            c[k.strip()] = v.strip()
-    return c
-
-def detect_name(cd):
-    for k in ['username', 'nickname']:
-        if k in cd: return cd[k]
-    sid = cd.get('sessionid', '')
-    return f"User-{sid[:8]}" if sid else "Unknown"
-
-def check_login(cd):
-    return bool(cd.get('sessionid', ''))
-
-def refresh_session(cookies_dict, target_url):
-    """Visit live page to get fresh tokens (ttwid, csrf, etc.)"""
-    if '/live' not in target_url:
-        target_url = target_url.rstrip('/') + '/live'
-    
-    s = requests.Session()
-    for k, v in cookies_dict.items():
-        s.cookies.set(k, v, domain=".tiktok.com")
-    
-    try:
-        r = s.get(target_url, headers={'User-Agent': UA, 'Referer': 'https://www.tiktok.com/', 'Accept': 'text/html'}, timeout=15)
-        fresh = {}
-        for c in s.cookies:
-            fresh[c.name] = c.value
-        
-        result = dict(cookies_dict)
-        for k, v in fresh.items():
-            if k not in result:
-                result[k] = v
-        
-        match = re.search(r'"roomId"\s*:\s*"(\d+)"', r.text)
-        room_id = match.group(1) if match else None
-        
-        # Also extract from page source if needed
-        if not room_id:
-            match2 = re.search(r'"id"\s*:\s*"(\d{15,})"', r.text)
-            if match2:
-                room_id = match2.group(1)
-        
-        return result, room_id
-    except Exception as e:
-        add_log(f"⚠️ Session refresh error: {e}", level='error')
-        return cookies_dict, None
-
-def get_room_id(target_url):
-    if '/live' not in target_url:
-        target_url = target_url.rstrip('/') + '/live'
-    try:
-        r = requests.get(target_url, headers={'User-Agent': UA}, timeout=15)
-        m = re.search(r'"roomId"\s*:\s*"(\d+)"', r.text)
-        if m:
-            add_log(f"✅ room_id: {m.group(1)}")
-            return m.group(1)
-        add_log("❌ No roomId found", level='error')
-        return None
-    except Exception as e:
-        add_log(f"❌ room_id error: {e}", level='error')
-        return None
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# Webcast API Client
-# ═══════════════════════════════════════════════════════════════════════════════
-def _sign_url(path, params):
-    qs = "&".join(f"{k}={v}" for k, v in params.items())
-    xb = x_bogus(qs, UA)
-    return f"{WEBCAST}{path}?{qs}&X-Bogus={xb}"
-
-def _headers(referer):
-    return {
-        'User-Agent': UA,
-        'Referer': referer,
-        'Origin': 'https://www.tiktok.com',
-        'Accept': 'application/json',
-    }
-
-class WebcastClient:
-    def __init__(self, cookies, room_id, target_url):
-        self.cookies = cookies
-        self.room_id = room_id
-        self.target_url = target_url
-        self.headers = _headers(target_url)
-        self.session = requests.Session()
-        for k, v in cookies.items():
-            self.session.cookies.set(k, v, domain=".tiktok.com")
-    
-    def digg(self, count=10):
-        """Send likes via /webcast/room/digg/"""
-        params = {"room_id": self.room_id, "count": str(count), "aid": "1988"}
-        url = _sign_url("/room/digg/", params)
-        r = self.session.post(url, headers=self.headers, timeout=10)
-        data = json.loads(r.text) if r.text else {}
-        return data.get('status_code', -1), data
-    
-    def chat(self, text):
-        """Send chat via /webcast/room/chat/"""
-        params = {"room_id": self.room_id, "content": text, "aid": "1988"}
-        url = _sign_url("/room/chat/", params)
-        r = self.session.post(url, headers=self.headers, timeout=10)
-        data = json.loads(r.text) if r.text else {}
-        return data.get('status_code', -1), data
-    
-    def share(self):
-        """Share via /webcast/room/share/"""
-        params = {"room_id": self.room_id, "aid": "1988"}
-        url = _sign_url("/room/share/", params)
-        r = self.session.post(url, headers=self.headers, timeout=10)
-        data = json.loads(r.text) if r.text else {}
-        return data.get('status_code', -1), data
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# Worker (per account)
-# ═══════════════════════════════════════════════════════════════════════════════
-def worker(uid, cookie_str, target_url, like_interval, like_count, comment_interval, comments_list, result):
-    stop_event = stop_flags[uid]
-    sessions[uid] = {
-        'status': 'starting', 'likes': 0, 'comments': 0, 'shares': 0,
-        'errors': 0, 'account_name': '', 'driver_info': 'Webcast API (digg)'
-    }
-    start_time[uid] = time.time()
-    
-    cookies = parse_cookies(cookie_str)
-    name = detect_name(cookies)
-    sessions[uid]['account_name'] = name
-    result['account_name'] = name
-    
-    if not check_login(cookies):
-        add_log("❌ Invalid cookies", uid=uid, level='error')
-        sessions[uid]['status'] = 'error'
-        result['ok'] = False
-        result['error'] = 'Invalid cookies'
-        return
-    
-    add_log(f"✅ Logged in: {name}", uid=uid)
-    
-    # Refresh session
-    add_log("🔄 Refreshing tokens...", uid=uid)
-    cookies, room_id = refresh_session(cookies, target_url)
-    
-    if not room_id:
-        add_log("❌ No room_id — is streamer live?", uid=uid, level='error')
-        sessions[uid]['status'] = 'error'
-        result['ok'] = False
-        result['error'] = 'Not live or room_id not found'
-        return
-    
-    result['ok'] = True
-    sessions[uid]['status'] = 'running'
-    add_log(f"🎯 Room: {room_id} | Likes/batch: {like_count}", uid=uid)
-    
-    client = WebcastClient(cookies, room_id, target_url)
-    
-    total_likes = 0
-    total_comments = 0
-    total_shares = 0
-    next_comment = time.time() + random.randint(3, 8)
-    next_share = time.time() + random.randint(30, 60)
-    
-    while not stop_event.is_set():
-        now = time.time()
-        
-        # ── LIKES (fast batch) ──────────────────────────────────────────────
-        try:
-            status, data = client.digg(count=like_count)
-            if status == 0:
-                total_likes += like_count
-                sessions[uid]['likes'] = total_likes
-                if total_likes % (like_count * 10) == 0:
-                    elapsed = time.time() - start_time[uid]
-                    rate = int(total_likes / elapsed * 3600) if elapsed > 0 else 0
-                    add_log(f"❤️ {total_likes:,} likes ({rate:,}/hr)", uid=uid)
-            else:
-                sessions[uid]['errors'] += 1
-                if status != 10013:  # ignore "url does not match"
-                    add_log(f"⚠️ digg status: {status}", uid=uid, level='error')
-        except Exception as e:
-            sessions[uid]['errors'] += 1
-            add_log(f"❌ digg error: {e}", uid=uid, level='error')
-        
-        # ── COMMENTS ────────────────────────────────────────────────────────
-        if now >= next_comment and comments_list:
-            comment = random.choice(comments_list)
-            try:
-                status, data = client.chat(comment)
-                if status == 0:
-                    total_comments += 1
-                    sessions[uid]['comments'] = total_comments
-                    add_log(f"💬 '{comment}'", uid=uid)
-                else:
-                    add_log(f"💬 chat status: {status}", uid=uid, level='error')
-            except Exception as e:
-                sessions[uid]['errors'] += 1
-                add_log(f"❌ chat error: {e}", uid=uid, level='error')
-            next_comment = now + comment_interval + random.uniform(-3, 3)
-        
-        # ── SHARES ──────────────────────────────────────────────────────────
-        if now >= next_share:
-            try:
-                status, data = client.share()
-                if status == 0:
-                    total_shares += 1
-                    sessions[uid]['shares'] = total_shares
-                    add_log(f"🔄 Share #{total_shares}", uid=uid)
-            except Exception as e:
-                sessions[uid]['errors'] += 1
-            next_share = now + random.randint(45, 90)
-        
-        # ── WAIT ────────────────────────────────────────────────────────────
-        stop_event.wait(like_interval)
-    
-    sessions[uid]['status'] = 'stopped'
-    add_log(f"⏹️ Done — {total_likes:,} likes, {total_comments} comments, {total_shares} shares", uid=uid)
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# API Routes
-# ═══════════════════════════════════════════════════════════════════════════════
-@app.route('/')
-def index():
-    return render_template_string(HTML)
-
-@app.route('/api/start', methods=['POST'])
-def start():
-    data = request.json
-    accounts = data.get('accounts', [])
-    target = data.get('target_url', 'https://www.tiktok.com/@u.9.1.5/live')
-    like_interval = data.get('like_interval', 0.5)
-    like_count = data.get('like_count', 20)
-    comment_interval = data.get('comment_interval', 30)
-    comments = data.get('comments', ['❤️','🔥','👏','💯','🎉'])
-    
-    results = []
-    threads = []
-    
-    for acc in accounts:
-        uid = acc.get('uid', '')
-        cookies = acc.get('cookies', '')
-        if not uid or not cookies:
-            results.append({'uid': uid, 'ok': False, 'error': 'Missing uid or cookies'})
-            continue
-        if uid in stop_flags and not stop_flags[uid].is_set():
-            results.append({'uid': uid, 'ok': False, 'error': 'Already running'})
-            continue
-        
-        stop_event = threading.Event()
-        stop_flags[uid] = stop_event
-        res = {'uid': uid, 'ok': False}
-        
-        t = threading.Thread(target=worker, args=(
-            uid, cookies, target, like_interval, like_count, comment_interval, comments, res
-        ), daemon=True)
-        t.start()
-        threads.append(t)
-        results.append(res)
-    
-    # Wait a bit for all threads to start
-    time.sleep(1)
-    started = sum(1 for r in results if r.get('ok'))
-    return jsonify({'started': started, 'results': results})
-
-@app.route('/api/stop', methods=['POST'])
-def stop():
-    uid = request.json.get('uid')
-    if uid and uid in stop_flags:
-        stop_flags[uid].set()
-        return jsonify({'stopped': uid})
-    return jsonify({'error': 'not found'}), 404
-
-@app.route('/api/stop_all', methods=['POST'])
-def stop_all():
-    for uid, ev in stop_flags.items():
-        ev.set()
-    return jsonify({'stopped': len(stop_flags)})
-
-@app.route('/api/status')
-def status():
-    return jsonify({'sessions': sessions, 'start_time': start_time})
-
-@app.route('/api/logs')
-def logs():
-    since = int(request.args.get('since', 0))
-    with log_lock:
-        return jsonify({'logs': session_log[since:]})
-
-@app.route('/api/config', methods=['GET', 'POST'])
-def config():
-    if request.method == 'GET':
-        return jsonify(load_config())
-    cfg = load_config()
-    for k in ['target_url', 'like_interval', 'like_count', 'comment_interval', 'comments']:
-        if k in request.json: cfg[k] = request.json[k]
-    save_config(cfg)
-    return jsonify({'ok': True})
-
-@app.route('/api/check_room', methods=['POST'])
-def check_room():
-    target = request.json.get('target_url', '')
-    room_id = get_room_id(target)
-    return jsonify({'live': bool(room_id), 'room_id': room_id})
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# HTML UI
-# ═══════════════════════════════════════════════════════════════════════════════
-HTML = r"""<!DOCTYPE html>
-<html lang="ar" dir="rtl">
-<head>
-<meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>TikTok Bot v4</title>
-<style>
-*{margin:0;padding:0;box-sizing:border-box}
-:root{--bg:#0a0a0a;--card:#111;--border:#1e1e1e;--pink:#fe2c55;--green:#00c853;--blue:#25f4ee;--text:#e8e8e8;--dim:#666}
-body{background:var(--bg);color:var(--text);font-family:'Segoe UI',Tahoma,sans-serif;padding:12px;min-height:100vh}
-.header{text-align:center;padding:16px 0 8px}
-.header h1{font-size:26px;background:linear-gradient(135deg,var(--pink),var(--blue));-webkit-background-clip:text;-webkit-text-fill-color:transparent}
-.header p{color:var(--dim);font-size:12px;margin-top:2px}
-.badge{display:inline-block;padding:2px 8px;border-radius:10px;font-size:10px;font-weight:700;background:var(--green);color:#000;margin-right:4px}
-.card{background:var(--card);border:1px solid var(--border);border-radius:10px;padding:14px;margin:8px 0}
-.card h3{color:var(--pink);margin-bottom:10px;font-size:14px;display:flex;align-items:center;gap:6px}
-label{display:block;color:var(--dim);font-size:11px;margin-bottom:3px;margin-top:6px}
-input,textarea{width:100%;padding:9px;background:#181818;border:1px solid var(--border);border-radius:7px;color:var(--text);font-size:12px}
-textarea{resize:vertical;min-height:50px;font-family:monospace;font-size:11px}
-button{padding:9px 18px;border:none;border-radius:7px;font-size:12px;font-weight:700;cursor:pointer;transition:.15s}
-.btn-start{background:var(--green);color:#000;width:100%;margin-top:10px;font-size:14px;padding:12px}
-.btn-stop{background:var(--pink);color:#fff;width:100%;margin-top:6px}
-.btn-check{background:var(--blue);color:#000;margin-top:6px}
-button:hover{opacity:0.85;transform:scale(1.01)}
-.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(130px,1fr));gap:8px}
-.stat{text-align:center;padding:10px;background:#181818;border-radius:8px}
-.stat .num{font-size:22px;font-weight:800;color:var(--pink);font-variant-numeric:tabular-nums}
-.stat .lbl{font-size:10px;color:var(--dim);margin-top:2px}
-.s-card{background:#181818;border-radius:8px;padding:10px;margin:6px 0}
-.s-card .nm{font-weight:700;color:var(--blue);font-size:13px}
-.s-card .st{display:flex;gap:12px;margin-top:6px;font-size:12px}
-.s-card .st b{color:var(--green)}
-.log-box{background:#0c0c0c;border:1px solid var(--border);border-radius:7px;padding:8px;height:200px;overflow-y:auto;font-family:monospace;font-size:10px;line-height:1.5}
-.log-entry{padding:1px 0;border-bottom:1px solid #151515}
-.log-entry .ts{color:#444}.log-entry.err{color:#ff5252}.log-entry.ok{color:var(--green)}
-.dot{display:inline-block;width:7px;height:7px;border-radius:50%;margin-left:5px}
-.dot-r{background:var(--green);animation:p 1.5s infinite}.dot-s{background:#444}.dot-e{background:var(--pink)}
-@keyframes p{0%,100%{opacity:1}50%{opacity:.3}}
-.toast{position:fixed;top:16px;left:50%;transform:translateX(-50%);background:var(--green);color:#000;padding:8px 20px;border-radius:7px;font-weight:700;z-index:999;display:none;font-size:12px}
-.rows{display:flex;flex-wrap:wrap;gap:6px}.rows>*{flex:1;min-width:100px}
-.acc-btns{display:flex;gap:6px;margin-top:6px}
-.acc-btns button{flex:1;padding:6px;font-size:11px}
-</style>
-</head>
-<body>
-<div class="header">
-  <h1>🎵 TikTok Live Bot v4</h1>
-  <p><span class="badge">digg API</span><span class="badge">X-Bogus</span><span class="badge">Multi-Account</span></p>
-</div>
-
-<div class="card">
-  <h3>🎯 الستريم المستهدف</h3>
-  <input id="targetUrl" value="https://www.tiktok.com/@u.9.1.5/live">
-  <button class="btn-check" onclick="checkRoom()">🔍 تحقق من الستريم</button>
-  <div id="roomResult" style="margin-top:6px;font-size:11px;color:var(--dim)"></div>
-</div>
-
-<div class="card">
-  <h3>🍪 الحسابات (حتى 5)</h3>
-  <div id="accList"></div>
-  <div class="acc-btns">
-    <button onclick="addAcc()" style="background:#222;color:var(--text)">+ إضافة حساب</button>
-    <button onclick="addAll()" style="background:#1a3a1a;color:var(--green)">📋 لصق الكل</button>
-  </div>
-</div>
-
-<div class="card">
-  <h3>💬 التعليقات</h3>
-  <textarea id="comments">❤️
-🔥
-👏
-💯
-🎉
-hi
-hello
-nice
- amazing</textarea>
-</div>
-
-<div class="card">
-  <h3>⚙️ الإعدادات</h3>
-  <div class="rows">
-    <div><label>فترة اللايك (ثانية)</label><input id="likeInt" type="number" value="0.5" min="0.1" step="0.1"></div>
-    <div><label>لايك لكل مرة</label><input id="likeCount" type="number" value="20" min="1" max="500"></div>
-    <div><label>فترة التعليق (ثانية)</label><input id="commentInt" type="number" value="30"></div>
-  </div>
-</div>
-
-<div class="acc-btns">
-  <button class="btn-start" onclick="startAll()">🚀 تشغيل الكل</button>
-  <button class="btn-stop" onclick="stopAll()">⛔ إيقاف الكل</button>
-</div>
-
-<div class="card">
-  <h3>📊 الإحصائيات</h3>
-  <div class="grid">
-    <div class="stat"><div class="num" id="sA">0</div><div class="lbl">حسابات</div></div>
-    <div class="stat"><div class="num" id="sL">0</div><div class="lbl">إعجابات</div></div>
-    <div class="stat"><div class="num" id="sC">0</div><div class="lbl">تعليقات</div></div>
-    <div class="stat"><div class="num" id="sS">0</div><div class="lbl">مشاركات</div></div>
-    <div class="stat"><div class="num" id="sR">0</div><div class="lbl">لايك/ساعة</div></div>
-  </div>
-</div>
-
-<div class="card">
-  <h3>👤 الحسابات</h3>
-  <div id="sDiv"></div>
-</div>
-
-<div class="card">
-  <h3>📋 السجل</h3>
-  <div class="log-box" id="lBox"></div>
-</div>
-
-<div class="toast" id="toast"></div>
-
-<script>
-let accN=0,logI=0,sT={};
-
-function toast(m,c){const t=document.getElementById('toast');t.textContent=m;t.style.background=c||'var(--green)';t.style.display='block';setTimeout(()=>t.style.display='none',2500);}
-
-function addAcc(){
-  if(accN>=5){toast('الحد الأقصى 5!','#ff5252');return;}
-  accN++;
-  const d=document.createElement('div');d.className='s-card';d.id='a'+accN;
-  d.innerHTML=`<div style="display:flex;justify-content:space-between;align-items:center"><span class="nm">حساب ${accN}</span><button onclick="this.closest('.s-card').remove();accN--" style="background:#333;color:#fff;padding:3px 8px;font-size:10px;border:none;border-radius:5px;cursor:pointer">✕</button></div><label>Cookies</label><textarea class="ac" placeholder="sessionid=xxx;uid_tt=xxx;sid_tt=xxx;tt-target-idc=xxx" style="min-height:45px"></textarea>`;
-  document.getElementById('accList').appendChild(d);
-}
-
-function addAll(){
-  const text=prompt('الصق كل الكوكيز (سطر لكل حساب):');
-  if(!text)return;
-  const lines=text.split('\n').filter(s=>s.trim());
-  lines.forEach(line=>{
-    if(accN>=5)return;
-    addAcc();
-    const last=document.querySelector('.s-card:last-child .ac');
-    if(last)last.value=line.trim();
-  });
-}
-
-async function checkRoom(){
-  const r=await(await fetch('/api/check_room',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({target_url:document.getElementById('targetUrl').value})})).json();
-  const d=document.getElementById('roomResult');
-  if(r.live){d.innerHTML=`<span style="color:var(--green)">✅ لايف! Room: <b>${r.room_id}</b></span>`;toast('الستريم شغال!');}
-  else{d.innerHTML=`<span style="color:var(--pink)">❌ مو لايف</span>`;}
-}
-
-async function startAll(){
-  const accounts=[];
-  document.querySelectorAll('.s-card[id^="a"]').forEach(el=>{
-    const c=el.querySelector('.ac')?.value?.trim();
-    if(c)accounts.push({uid:'a_'+Math.random().toString(36).slice(2,8),cookies:c});
-  });
-  if(!accounts.length){toast('أضف حساب!','#ff5252');return;}
-  const body={
-    accounts,
-    target_url:document.getElementById('targetUrl').value,
-    like_interval:+document.getElementById('likeInt').value||0.5,
-    like_count:+document.getElementById('likeCount').value||20,
-    comment_interval:+document.getElementById('commentInt').value||30,
-    comments:document.getElementById('comments').value.split('\n').filter(s=>s.trim())
-  };
-  const r=await(await fetch('/api/start',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)})).json();
-  toast(`شغّل ${r.started} حساب!`);
-}
-
-async function stopAll(){await fetch('/api/stop_all',{method:'POST'});toast('تم الإيقاف','#ff5252');}
-
-async function poll(){
-  try{
-    const st=await(await fetch('/api/status')).json();
-    const ss=st.sessions||{};sT=st.start_time||{};
-    let tL=0,tC=0,tSh=0,tA=0,html='';
-    for(const[uid,s]of Object.entries(ss)){
-      tA++;tL+=s.likes||0;tC+=s.comments||0;tSh+=s.shares||0;
-      const dot=s.status==='running'?'dot-r':s.status==='error'?'dot-e':'dot-s';
-      const el=sT[uid]?(Date.now()/1000-sT[uid]):0;
-      const rate=el>0?Math.round((s.likes||0)/el*3600):0;
-      html+=`<div class="s-card"><div style="display:flex;justify-content:space-between"><span class="nm">${s.account_name||uid}</span><span style="font-size:11px"><span class="dot ${dot}"></span>${s.status} | <b>${rate.toLocaleString()}</b>/ساعة</span></div><div class="st"><div>❤️<b>${(s.likes||0).toLocaleString()}</b></div><div>💬<b>${s.comments||0}</b></div><div>🔄<b>${s.shares||0}</b></div><div>❌<b>${s.errors||0}</b></div></div></div>`;
-    }
-    document.getElementById('sDiv').innerHTML=html||'<div style="color:var(--dim);font-size:12px">لايوجد حسابات</div>';
-    document.getElementById('sA').textContent=tA;
-    document.getElementById('sL').textContent=tL.toLocaleString();
-    document.getElementById('sC').textContent=tC;
-    document.getElementById('sS').textContent=tSh;
-    const allT=Object.values(sT).length?Math.min(...Object.values(sT)):0;
-    const el=allT?(Date.now()/1000-allT):0;
-    document.getElementById('sR').textContent=el>0?Math.round(tL/el*3600).toLocaleString():'0';
-  }catch(e){}
-  try{
-    const lg=await(await fetch(`/api/logs?since=${logI}`)).json();
-    const box=document.getElementById('lBox');
-    for(const l of(lg.logs||[])){
-      logI++;
-      box.innerHTML+=`<div class="log-entry ${l.level==='error'?'err':'ok'}"><span class="ts">[${l.ts}]</span> [${l.uid}] ${l.msg}</div>`;
-    }
-    box.scrollTop=box.scrollHeight;
-  }catch(e){}
-}
-
-addAcc();addAcc(); // Start with 2 account slots
-setInterval(poll,1200);poll();
-</script>
-</body>
-</html>"""
-
-if __name__ == '__main__':
-    add_log("🚀 TikTok Bot v4 — digg API + X-Bogus + Multi-Account")
-    port = int(os.environ.get('PORT', 7860))
-    app.run(host='0.0.0.0', port=port, debug=False)

xbogus.py

@@ -1,180 +0,0 @@
-"""
-TikTok X-Bogus Signature Generator — Pure Python Reimplementation
-
-Reverse-engineered from TikTok's client-side JavaScript (byted_acrawler / frontierSign).
-
-Algorithm:
-  1. Double-MD5 hash the URL query parameters
-  2. Double-MD5 hash the POST body (or empty string)
-  3. RC4-encrypt the User-Agent with key [0x00, 0x01, 0x0E], Base64 encode, then MD5
-  4. Build a 19-byte payload: [0x40, ua_key(3), params_md5(2), body_md5(2), ua_md5(2), timestamp(4), magic(4), xor_checksum(1)]
-  5. RC4-encrypt the payload with key [0xFF]
-  6. Prepend [0x02, 0xFF]
-  7. Custom Base64 encode with shifted alphabet
-
-No browser needed. No external TikTok libraries.
-"""
-
-import hashlib
-import base64
-import time
-import struct
-from urllib.parse import urlencode, urlparse, parse_qs, urljoin
-
-# TikTok's custom Base64 alphabet (shifted from standard)
-CUSTOM_B64_ALPHABET = "Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe="
-STANDARD_B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
-
-# RC4 key for User-Agent encryption
-UA_RC4_KEY = bytes([0x00, 0x01, 0x0E])
-
-# RC4 key for final payload encryption
-PAYLOAD_RC4_KEY = bytes([0xFF])
-
-# Magic constant for TikTok international (Douyin uses 0x20040510)
-MAGIC_CONSTANT = 0x4A41279F
-
-# Leading byte
-LEADING_BYTE = 0x40
-
-
-def _rc4(key: bytes, data: bytes) -> bytes:
-    """Standard RC4 encryption/decryption."""
-    S = list(range(256))
-    j = 0
-    for i in range(256):
-        j = (j + S[i] + key[i % len(key)]) % 256
-        S[i], S[j] = S[j], S[i]
-
-    result = bytearray()
-    i = j = 0
-    for byte in data:
-        i = (i + 1) % 256
-        j = (j + S[i]) % 256
-        S[i], S[j] = S[j], S[i]
-        result.append(byte ^ S[(S[i] + S[j]) % 256])
-    return bytes(result)
-
-
-def _md5_hex(data: bytes | str) -> str:
-    """MD5 hash returning hex digest."""
-    if isinstance(data, str):
-        data = data.encode("utf-8")
-    return hashlib.md5(data).hexdigest()
-
-
-def _hex_to_bytes(hex_str: str) -> bytes:
-    """Convert hex string to bytes (parse hex pairs)."""
-    return bytes.fromhex(hex_str)
-
-
-def _double_md5(data: bytes | str) -> bytes:
-    """
-    Double MD5: hash the data, convert hex digest to bytes, hash again.
-    Returns 16 raw bytes.
-    """
-    first_hex = _md5_hex(data)
-    first_bytes = _hex_to_bytes(first_hex)
-    second_hex = _md5_hex(first_bytes)
-    return _hex_to_bytes(second_hex)
-
-
-def _md5_user_agent(user_agent: str) -> bytes:
-    """
-    Process User-Agent: RC4 encrypt → Base64 encode → MD5.
-    Returns 16 raw bytes.
-    """
-    ua_bytes = user_agent.encode("utf-8")
-    rc4_encrypted = _rc4(UA_RC4_KEY, ua_bytes)
-    b64_encoded = base64.b64encode(rc4_encrypted).decode("iso-8859-1")
-    md5_hex = _md5_hex(b64_encoded)
-    return _hex_to_bytes(md5_hex)
-
-
-def _custom_base64_encode(data: bytes) -> str:
-    """Encode bytes using TikTok's custom Base64 alphabet."""
-    # Standard Base64 encode
-    standard = base64.b64encode(data).decode("ascii")
-    # Character substitution: standard alphabet → custom alphabet
-    trans = str.maketrans(STANDARD_B64_ALPHABET, CUSTOM_B64_ALPHABET)
-    return standard.translate(trans)
-
-
-def generate_xbogus(
-    query_string: str,
-    user_agent: str,
-    body: str = "",
-    timestamp: int | None = None,
-) -> str:
-    """
-    Generate X-Bogus signature for a TikTok API request.
-
-    Args:
-        query_string: The URL query string (without leading '?').
-                      e.g. "aid=1988&count=10&keyword=cooking"
-        user_agent: The User-Agent header value (must match what you send).
-        body: POST body string (empty for GET requests).
-        timestamp: Unix timestamp in seconds. Defaults to current time.
-
-    Returns:
-        The X-Bogus parameter value to append to the URL.
-    """
-    if timestamp is None:
-        timestamp = int(time.time())
-
-    # Step 1: Double-MD5 of query parameters
-    params_md5 = _double_md5(query_string)
-
-    # Step 2: Double-MD5 of POST body
-    body_md5 = _double_md5(body if body else "")
-
-    # Step 3: MD5 of RC4-encrypted + Base64-encoded User-Agent
-    ua_md5 = _md5_user_agent(user_agent)
-
-    # Step 4: Build 19-byte payload
-    payload = bytearray()
-    payload.append(LEADING_BYTE)                    # 1 byte: 0x40
-    payload.extend(UA_RC4_KEY)                       # 3 bytes: [0x00, 0x01, 0x0E]
-    payload.extend(params_md5[14:16])                # 2 bytes from params double-MD5
-    payload.extend(body_md5[14:16])                  # 2 bytes from body double-MD5
-    payload.extend(ua_md5[14:16])                    # 2 bytes from UA MD5
-    payload.extend(struct.pack(">I", timestamp))     # 4 bytes timestamp (big-endian)
-    payload.extend(struct.pack(">I", MAGIC_CONSTANT))  # 4 bytes magic (big-endian)
-
-    # XOR checksum of all 18 bytes
-    xor_check = 0
-    for b in payload:
-        xor_check ^= b
-    payload.append(xor_check & 0xFF)                 # 1 byte checksum → total 19 bytes
-
-    # Step 5: RC4 encrypt with key [0xFF]
-    encrypted = _rc4(PAYLOAD_RC4_KEY, bytes(payload))
-
-    # Step 6: Prepend [0x02, 0xFF]
-    final = bytes([0x02, 0xFF]) + encrypted          # 21 bytes total
-
-    # Step 7: Custom Base64 encode
-    xbogus = _custom_base64_encode(final)
-
-    return xbogus
-
-
-def sign_url(url: str, user_agent: str, body: str = "") -> str:
-    """
-    Sign a full TikTok API URL by appending the X-Bogus parameter.
-
-    Args:
-        url: Full URL with query string (e.g. "https://www.tiktok.com/api/search/...?aid=1988&...")
-        user_agent: User-Agent string.
-        body: POST body (empty for GET).
-
-    Returns:
-        The URL with X-Bogus appended.
-    """
-    parsed = urlparse(url)
-    query_string = parsed.query
-
-    xbogus = generate_xbogus(query_string, user_agent, body)
-
-    separator = "&" if query_string else "?"
-    return f"{url}{separator}X-Bogus={xbogus}"

youtube_api.py

@@ -0,0 +1,143 @@
+"""Google API transport and durable non-secret journal. No credentials in files/logs."""
+import copy, json, os, re, ssl, threading, time, uuid
+from datetime import datetime
+from zoneinfo import ZoneInfo
+from urllib.request import Request, urlopen
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode
+
+class APIError(RuntimeError):
+    def __init__(self, status, reason):
+        self.status=status
+        self.reason=re.sub(r'[^a-zA-Z0-9_.-]','',str(reason))[:100] or 'unknown'
+        super().__init__(f'YouTube API: {status or "network"} / {self.reason}')
+
+# V8 defaults: name/title/hashtags are pulled from the TikTok account itself.
+DEFAULT_SETTINGS={'name':'','privacy':'public','title':'{title}',
+    'description':'بث {name} المباشر\n👤 المذيع: {name} — @{username}\n🔗 https://www.tiktok.com/@{username}\n\n📅 {date} — ⏰ {time} بتوقيت بغداد\n{hashtags}'}
+OLD_DEFAULT_TITLE='{name} | بث مباشر | {date} — {time}'
+
+class Journal:
+    """Schema 7: multiple concurrent events + one reusable ingestion stream per account."""
+    def __init__(self,path):
+        self.path=path;self.lock=threading.RLock()
+        try:self.path.parent.mkdir(parents=True,exist_ok=True)
+        except OSError:pass
+        try:self.data=json.loads(path.read_text(encoding='utf-8'))
+        except FileNotFoundError:
+            self.data={'schema':7,'instance':uuid.uuid4().hex,'enabled':False,'channel':None,
+                'streams':{},'events':{},'history':[],'budget':{},'settings':dict(DEFAULT_SETTINGS)}
+            self.change(lambda d:None)
+        except (ValueError,OSError) as e:raise RuntimeError('تعذر قراءة سجل أحداث يوتيوب؛ لا تحذفه. يلزم إصلاح التخزين لمنع التكرار') from None
+        if not isinstance(self.data,dict) or self.data.get('schema') not in (6,7):
+            raise RuntimeError('سجل يوتيوب غير صالح؛ توقف آمن لمنع تكرار الأحداث')
+        if self.data['schema']==6:
+            self.data=self.migrate6(self.data)
+            self.change(lambda d:None)
+    @staticmethod
+    def migrate6(old):
+        """V6 had a single current event and a single reusable stream. V7 keeps one event
+        per live session and one reusable ingestion stream per TikTok account. The old
+        stream is kept for the account that was using it (legacy marker still accepted)."""
+        events={};streams={}
+        cur=old.get('current')
+        if isinstance(cur,dict) and cur.get('session_key') and cur.get('username'):
+            events[cur['session_key']]=cur
+            if old.get('stream_id') or old.get('stream_pending'):
+                streams[cur['username']]={'id':old.get('stream_id'),'pending':bool(old.get('stream_pending')),'legacy':True}
+        settings=old.get('settings') if isinstance(old.get('settings'),dict) else {}
+        clean={**DEFAULT_SETTINGS,**settings}
+        if clean.get('title')==OLD_DEFAULT_TITLE:
+            # Untouched V6/V7 default title -> switch to V8 per-account default.
+            clean['title']=DEFAULT_SETTINGS['title'];clean['name']=''
+        return {'schema':7,'instance':old.get('instance') or uuid.uuid4().hex,'enabled':bool(old.get('enabled')),
+            'channel':old.get('channel'),'streams':streams,'events':events,
+            'history':old.get('history') if isinstance(old.get('history'),list) else [],
+            'budget':old.get('budget') if isinstance(old.get('budget'),dict) else {},
+            'settings':clean}
+    def read(self):
+        with self.lock:return copy.deepcopy(self.data)
+    def change(self,fn):
+        with self.lock:
+            new=copy.deepcopy(self.data);fn(new)
+            tmp=self.path.with_suffix('.tmp')
+            tmp.write_text(json.dumps(new,ensure_ascii=False),encoding='utf-8')
+            tmp.replace(self.path)
+            self.data=new
+    def reserve(self,cost):
+        day=datetime.now(ZoneInfo('America/Los_Angeles')).strftime('%Y-%m-%d')
+        def mutate(d):
+            budget=d.get('budget',{})
+            if budget.get('day')!=day:budget={'day':day,'estimated_units':0}
+            if budget['estimated_units']+cost>int(os.getenv('YOUTUBE_DAILY_BUDGET','8000')):
+                raise APIError(429,'localDailyBudgetReached')
+            budget['estimated_units']+=cost;d['budget']=budget
+        self.change(mutate)
+
+class GoogleAPI:
+    def __init__(self,journal):
+        self.journal=journal;self.access=None;self.expires=0;self.lock=threading.Lock()
+    def configured(self):
+        return all(os.getenv(k,'').strip() for k in ('GOOGLE_CLIENT_ID','GOOGLE_CLIENT_SECRET','YOUTUBE_REFRESH_TOKEN'))
+    def _request(self,url,method='GET',data=None,headers=None):
+        # FIX C: retry transient TLS/network failures instead of single urlopen(timeout=25)
+        # Any ephemeral SSLError/URLError previously bubbled as a generic "internal error"
+        # and left a sticky note for 40 minutes. Now we retry with exponential backoff
+        # and only then surface networkOrInvalidResponse.
+        max_attempts = 3
+        for attempt in range(max_attempts):
+            req=Request(url,data=data,headers=headers or {},method=method)
+            try:
+                with urlopen(req,timeout=25) as response:
+                    raw=response.read();return json.loads(raw) if raw else {}
+            except HTTPError as e:
+                # Retry on transient 5xx / 429 (quota) before failing.
+                if e.code in (429, 500, 502, 503, 504) and attempt < max_attempts - 1:
+                    time.sleep(1.2 * (attempt + 1))
+                    continue
+                try:
+                    err=json.loads(e.read()).get('error',{})
+                    if isinstance(err,str):reason=err
+                    else:reason=(err.get('errors') or [{}])[0].get('reason') or err.get('status') or 'httpError'
+                except Exception:reason='httpError'
+                raise APIError(e.code,reason) from None
+            except (URLError, TimeoutError, OSError, ValueError, ssl.SSLError, ssl.SSLWantReadError, ssl.SSLWantWriteError, ssl.SSLEOFError) as e:
+                if attempt < max_attempts - 1:
+                    # exponential backoff: 1s, 2s
+                    time.sleep(1 * (2 ** attempt))
+                    continue
+                raise APIError(None,'networkOrInvalidResponse') from None
+            except Exception:
+                # Unexpected parse error etc. Don't retry silently; treat as network.
+                if attempt < max_attempts - 1:
+                    time.sleep(1 * (2 ** attempt))
+                    continue
+                raise APIError(None,'networkOrInvalidResponse') from None
+        raise APIError(None,'networkOrInvalidResponse')
+    def token(self):
+        with self.lock:
+            if self.access and time.time()<self.expires:return self.access
+            if not self.configured():raise APIError(401,'missingOAuthSecrets')
+            fields={'client_id':os.environ['GOOGLE_CLIENT_ID'].strip(),'client_secret':os.environ['GOOGLE_CLIENT_SECRET'].strip(),
+                    'refresh_token':os.environ['YOUTUBE_REFRESH_TOKEN'].strip(),'grant_type':'refresh_token'}
+            result=self._request('https://oauth2.googleapis.com/token','POST',urlencode(fields).encode(),{'Content-Type':'application/x-www-form-urlencoded'})
+            if not result.get('access_token'):raise APIError(401,'missingAccessToken')
+            self.access=result['access_token'];self.expires=time.time()+max(30,int(result.get('expires_in',3600))-90)
+            return self.access
+    def call(self,resource,method='GET',params=None,body=None):
+        token=self.token()
+        self.journal.reserve(1 if method=='GET' else 50) # conservative local estimate, not a Google quota meter
+        url='https://www.googleapis.com/youtube/v3/'+resource
+        if params:url+='?'+urlencode(params)
+        headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}
+        try:return self._request(url,method,json.dumps(body).encode() if body is not None else None,headers)
+        except APIError as e:
+            if e.status==401:self.access=None
+            raise
+    def items(self,resource,params,max_pages=10):
+        items=[];query=dict(params)
+        for _ in range(max_pages):
+            r=self.call(resource,params=query);items.extend(r.get('items',[]))
+            if not r.get('nextPageToken'):return items
+            query['pageToken']=r['nextPageToken']
+        raise APIError(None,'reconciliationPageLimit')

youtube_manager.py

@@ -0,0 +1,605 @@
+"""One managed YouTube event per live TikTok session, several events at the same time.
+Each event carries the name/title/hashtags of the TikTok account it relays, and each
+account gets its own reusable ingestion stream so concurrent events never mix.
+Fail closed on ambiguous remote creates."""
+import os, re, threading, time, uuid
+from datetime import datetime, timezone, timedelta
+from zoneinfo import ZoneInfo
+from urllib.parse import urlparse
+from curl_cffi import requests
+from relay import Sender
+from flv_bridge import FormatChanged
+from youtube_api import GoogleAPI, Journal, APIError
+
+class ManagedYouTube:
+    def __init__(self,ffmpeg,observe,log,accounts,path,headers_for=None):
+        self.ffmpeg=ffmpeg;self.observe=observe;self.log=log;self.accounts=accounts
+        self.headers_for=headers_for or (lambda user:{})
+        self.journal=Journal(path);self.api=GoogleAPI(self.journal)
+        self.operations=threading.RLock()
+        self.manager_thread=None;self.manager_stop=threading.Event()
+        self.senders={}      # session_key -> {'thread','stop','sender'}
+        self.destinations={} # username -> rtmps url (in-memory only, never persisted)
+        self.scan=max(15,int(os.getenv('YOUTUBE_SCAN_SECONDS','30')))
+        self.end_grace=max(30,int(os.getenv('YOUTUBE_END_GRACE','90')))
+        self.max_events=max(1,int(os.getenv('YOUTUBE_MAX_EVENTS','3')))
+        self.last_logged=None;self.status_text='متوقف'
+    def marker(self):return 'QUSAI-AUTO-'+self.journal.read()['instance']
+    @staticmethod
+    def video_sources(sources):
+        mode=os.getenv('YOUTUBE_VIDEO_MODE','original').strip().lower()
+        if mode=='h264':return [s for s in sources if any(c in s['label'].lower() for c in ('h264','avc'))]
+        if mode!='original':raise RuntimeError('YOUTUBE_VIDEO_MODE يجب أن يكون original أو h264')
+        supported=[s for s in sources if any(c in s['label'].lower() for c in ('h264','avc','h265','hevc'))]
+        # Strict top source: no silent quality downgrade in original mode.
+        return supported[:1]
+    @staticmethod
+    def extract_hashtags(text):
+        """Hashtags come from the TikTok live title itself, deduplicated, at most 12."""
+        seen=[];out=[]
+        for tag in re.findall(r'#[^\s#]+',text or ''):
+            if tag not in seen:seen.append(tag);out.append(tag)
+            if len(out)>=12:break
+        return ' '.join(out)[:400]
+    @staticmethod
+    def description_with_links(text,user,hashtags):
+        """Per-account footer: the broadcaster's own TikTok profile + hashtags of this live.
+        No cross-account links, so concurrent events never mix attributions."""
+        text=text.rstrip()
+        link=f'https://www.tiktok.com/@{user}'
+        if link not in text:
+            text+=f'\n\n🎵 حساب المذيع على تيك توك\n@{user}\n{link}'
+        if hashtags and hashtags not in text:text+='\n\n'+hashtags
+        return re.sub(r'\n{3,}','\n\n',text)
+
+    # ---------- journal helpers ----------
+    def event_update(self,key,**kw):
+        def change(d):
+            ev=d['events'].get(key)
+            if ev is not None:ev.update(kw)
+        self.journal.change(change)
+    def event_note(self,key,text):self.event_update(key,note=text)
+    def streams_change(self,user,**kw):
+        def change(d):d['streams'].setdefault(user,{}).update(kw)
+        self.journal.change(change)
+    def set_status(self,text):self.status_text=text
+    @staticmethod
+    def safe_error(e):
+        if isinstance(e,(APIError,RuntimeError,ValueError)):return str(e)
+        # Keep the message generic (no raw network/traceback text can leak), but name the
+        # exception class. Without it a KeyError from a stale saved template is
+        # indistinguishable from any other internal fault and cannot be diagnosed.
+        return 'خطأ داخلي في إدارة يوتيوب؛ التوقف عن الإنشاء لحماية الأحداث ('+type(e).__name__+')'
+    def _event_error(self,key,e):
+        text=self.safe_error(e)
+        ev=self.journal.read()['events'].get(key) or {}
+        if text!=ev.get('note'):self.log(ev.get('username') or key,text)
+        self.event_note(key,text)
+    def _clear_stale_error_note(self,key):
+        """FIX C: clear the sticky 'حماية الأحداث' / 'خطأ داخلي' note after recovery.
+        Previously _event_error wrote the note and nothing ever cleared it, so a transient
+        SSLError left the UI stuck for 40 min even though the stream was healthy."""
+        ev=self.journal.read()['events'].get(key)
+        if not ev:return
+        note=ev.get('note') or ''
+        if note and ('حماية الأحداث' in note or 'خطأ داخلي' in note or 'networkOrInvalidResponse' in note):
+            self.event_update(key, note='')
+
+    # ---------- channel / settings ----------
+    def check_channel(self):
+        result=self.api.call('channels',params={'part':'id,snippet','mine':'true'})
+        channels=result.get('items',[])
+        if len(channels)!=1:raise RuntimeError('لم نجد قناة واحدة مفوضة؛ أعد OAuth واختر قناة يوتيوب الصحيحة')
+        channel={'id':channels[0]['id'],'title':channels[0]['snippet']['title']}
+        old=self.journal.read()['channel']
+        if old and old['id']!=channel['id']:raise RuntimeError('القناة المفوضة تغيرت؛ توقف آمن لحماية أحداث القناة السابقة')
+        self.journal.change(lambda d:d.update(channel=channel))
+        return channel
+    def check(self):
+        with self.operations:return self.check_channel()
+    def settings(self,values):
+        with self.operations:
+            d=self.journal.read()
+            if d['enabled'] or d['events']:
+                raise ValueError('عطّل الأتمتة وانتظر إغلاق الأحداث قبل تعديل قوالب الأحداث')
+            clean={k:str(values.get(k,'')).strip() for k in ('name','privacy','title','description')}
+            if clean['privacy'] not in ('public','unlisted','private'):raise ValueError('خصوصية غير صالحة')
+            if len(clean['name'])>80:raise ValueError('الاسم الاحتياطي حتى 80 حرفًا (الاسم الفعلي يُجلب من حساب تيك توك)')
+            test={'name':'فلان','title':'بث تجريبي','hashtags':'#تجربة','date':'11-09-2026','time':'16:30:00','username':'example','room_id':'123',
+                  'nickname':'فلان','live_title':'بث تجريبي'}
+            try:title=clean['title'].format(**test);desc=clean['description'].format(**test)
+            except (KeyError,ValueError,IndexError,AttributeError):raise ValueError('متغير قالب غير مدعوم')
+            if not title or len(title)>100 or any(c in title+desc for c in '<>') or len(desc)>4500:
+                raise ValueError('العنوان الناتج حتى 100 حرف والوصف حتى 4500، وبدون < أو >')
+            # Prevent arbitrary attribute/index lookups in format templates.
+            import string
+            for template in (clean['title'],clean['description']):
+                for _,field,spec,conv in string.Formatter().parse(template):
+                    if field is not None and (field not in test or spec or conv):raise ValueError('استخدم متغيرات القالب البسيطة فقط')
+            self.journal.change(lambda x:x.update(settings=clean))
+    def snapshot(self):
+        d=self.journal.read()
+        events=[]
+        for key,ev in d['events'].items():
+            entry=self.senders.get(key)
+            s=entry['sender'].snapshot() if entry and entry['thread'].is_alive() else {}
+            events.append({'username':ev['username'],'nickname':ev.get('nickname',''),'room_id':ev['room_id'],
+                'title':ev['title'],'phase':ev.get('phase'),'youtube_status':ev.get('youtube_status'),
+                'closing':bool(ev.get('closing')),'broadcast_id':ev['broadcast_id'],'note':ev.get('note',''),
+                'status':s.get('status',''),'source':s.get('source',''),'output_seconds':s.get('output_seconds',0),
+                # YouTube's own verdict on the inbound stream, so the UI can show why
+                # viewers buffer instead of us guessing at the cause.
+                'youtube_health':ev.get('youtube_health',''),'youtube_issues':ev.get('youtube_issues','')})
+        # Effective ingestion mode, including the automatic anti-flap fallback, so the
+        # UI can show whether the constant-canvas protection has kicked in.
+        try:
+            probe_sender=Sender(self.ffmpeg,self.log,self.headers_for)
+            send_mode=probe_sender.send_mode()
+        except Exception:
+            send_mode=os.getenv('YOUTUBE_SEND_MODE','copy')
+        return {'status':self.status_text,'automatic':d['enabled'],'events':events,
+                'video_mode':os.getenv('YOUTUBE_VIDEO_MODE','original'),'configured':self.api.configured(),
+                'send_mode':send_mode,
+                'watched_accounts':list(self.accounts()),'channel':d['channel'],'settings':d['settings'],
+                'budget':d['budget'],'history_count':len(d['history']),'max_events':self.max_events}
+
+    # ---------- enable / disable / lifecycle ----------
+    def enable(self,expected_channel):
+        if os.getenv('YOUTUBE_VIDEO_MODE','original').strip().lower() not in ('original','h264'):raise ValueError('YOUTUBE_VIDEO_MODE يجب أن يكون original أو h264')
+        with self.operations:
+            if not self.api.configured():raise ValueError('أسرار OAuth الثلاثة غير مكتملة')
+            channel=self.check_channel()
+            if not expected_channel or expected_channel!=channel['id']:raise ValueError('افحص الربط وأكّد القناة الصحيحة قبل التفعيل')
+            if any(e.get('closing') for e in self.journal.read()['events'].values()):
+                raise ValueError('توجد أحداث قيد الإنهاء؛ انتظر اكتمال تنظيفها')
+            self.journal.change(lambda d:d.update(enabled=True));self.launch()
+    def disable(self):
+        with self.operations:
+            def change(d):
+                d['enabled']=False
+                for ev in d['events'].values():ev['closing']=True
+            self.journal.change(change)
+            for key in list(self.senders):self.stop_sender(key)
+            self.launch()
+            self.set_status('تعطيل الأتمتة وإنهاء الأحداث الجارية')
+    def launch(self):
+        if self.manager_thread and self.manager_thread.is_alive():return
+        self.manager_stop=threading.Event()
+        self.manager_thread=threading.Thread(target=self.run_manager,daemon=True);self.manager_thread.start()
+    def restore(self):
+        d=self.journal.read()
+        if d['enabled'] or d['events']:
+            self.launch()
+    def stop(self):
+        # Process shutdown is not a user-requested end. Preserve remote events for restart recovery.
+        self.manager_stop.set()
+        for key in list(self.senders):self.stop_sender(key)
+
+    # ---------- remote helpers ----------
+    def remote(self,resource,rid):
+        items=self.api.call(resource,params={'part':'id,snippet,status,contentDetails'+(',cdn' if resource=='liveStreams' else ''),'id':rid}).get('items',[])
+        return items[0] if items else None
+    def reconcile(self,resource,marker):
+        params={'part':'id,snippet,status,contentDetails','mine':'true','maxResults':50}
+        if resource=='liveBroadcasts':
+            params.pop('mine');params.update(broadcastStatus='all',broadcastType='all')
+        items=self.api.items(resource,params)
+        matches=[i for i in items if marker in i.get('snippet',{}).get('description','').splitlines()]
+        if len(matches)>1:raise RuntimeError('أحداث متكررة بنفس علامة التطبيق؛ توقف للمراجعة دون حذف تلقائي')
+        return matches[0] if matches else None
+
+    # ---------- per-account ingestion streams ----------
+    def stream_markers(self,user,legacy):
+        markers=[self.marker()+'-STREAM-'+user]
+        if legacy:markers.append(self.marker()+'-STREAM') # stream migrated from V6/V7
+        return markers
+    def ensure_stream(self,user):
+        d=self.journal.read();st=d['streams'].get(user) or {}
+        markers=self.stream_markers(user,bool(st.get('legacy')))
+        if not st.get('id'):
+            if st.get('pending'):
+                found=None
+                for m in markers:
+                    found=self.reconcile('liveStreams',m)
+                    if found:break
+                if not found:raise RuntimeError('إنشاء مصدر سابق غير محسوم؛ ننتظر المصالحة بدل إنشاء مفتاح مكرر')
+                self.streams_change(user,id=found['id'],pending=False)
+            else:
+                self.streams_change(user,pending=True)
+                try:
+                    r=self.api.call('liveStreams','POST',{'part':'snippet,cdn,contentDetails'},
+                        {'snippet':{'title':user+' — مصدر بث التطبيق القابل لإعادة الاستخدام','description':markers[0]},
+                         'cdn':{'ingestionType':'rtmp','resolution':'variable','frameRate':'variable'},'contentDetails':{'isReusable':True}})
+                except APIError as e:
+                    if e.status and 400<=e.status<500:self.streams_change(user,pending=False)
+                    raise
+                if not r.get('id'):raise RuntimeError('استجابة إنشاء المصدر غير محسومة؛ لن نكرر الإنشاء')
+                self.streams_change(user,id=r['id'],pending=False)
+        stream=self.remote('liveStreams',self.journal.read()['streams'][user]['id'])
+        if not stream or not any(m in stream.get('snippet',{}).get('description','').splitlines() for m in markers):
+            raise RuntimeError('مصدر التطبيق مفقود أو هويته تغيرت؛ لا ننشئ مفاتيح بديلة تلقائيًا')
+        ingest=stream.get('cdn',{}).get('ingestionInfo',{});key=ingest.get('streamName')
+        secure=ingest.get('rtmpsIngestionAddress')
+        if not secure:
+            # YouTube's secure endpoint; streamName remains in memory only.
+            secure='rtmps://a.rtmps.youtube.com:443/live2'
+        p=urlparse(secure)
+        if p.scheme!='rtmps' or not p.hostname or not p.hostname.endswith('.youtube.com') or not key:
+            raise RuntimeError('لم يُرجع يوتيوب عنوان إرسال آمنًا صالحًا')
+        self.destinations[user]=secure.rstrip('/')+'/'+key
+        return stream
+
+    # ---------- events ----------
+    def open_event(self,user,observation):
+        d=self.journal.read();key=user+':'+observation['room_id']
+        if key in d['events'] or any(h['session_key']==key for h in d['history']):return False
+        dt=datetime.now(ZoneInfo('Asia/Baghdad'));settings=d['settings']
+        nickname=str(observation.get('nickname') or '').strip()
+        live_title=str(observation.get('live_title') or '').strip()
+        name=nickname or user
+        title_value=live_title or (name+' — بث مباشر')
+        hashtags=self.extract_hashtags(live_title)
+        values={'name':name,'title':title_value,'hashtags':hashtags,'date':dt.strftime('%d-%m-%Y'),
+                'time':dt.strftime('%H:%M:%S'),'username':user,'room_id':observation['room_id'],
+                # Legacy aliases. Journals written by older builds keep their saved
+                # templates, and those used {nickname}/{live_title}. Without these the
+                # format() below raises KeyError, which safe_error() masks into a generic
+                # "internal error" — so no event is ever created and nothing goes to air.
+                'nickname':name,'live_title':live_title}
+        title=settings['title'].format(**values)[:100];marker=self.marker()+'-EVENT-'+uuid.uuid4().hex
+        desc=self.description_with_links(settings['description'].format(**values)[:4400],user,hashtags)+'\n\n'+marker
+        ev={'username':user,'room_id':observation['room_id'],'session_key':key,'marker':marker,
+            'nickname':name,'live_title':live_title,'title':title,'description':desc,
+            'privacy':settings['privacy'],'created_at':time.time(),'note':'',
+            'broadcast_id':None,'create_pending':False,'phase':'planned','bound':False,'was_live':False,
+            'closing':False,'last_poll':0,'offline_since':None,'offline_count':0}
+        def change(d):d['events'][key]=ev
+        self.journal.change(change);return True
+    def ensure_broadcast(self,key):
+        ev=self.journal.read()['events'][key]
+        if not ev['broadcast_id']:
+            if ev['create_pending']:
+                found=self.reconcile('liveBroadcasts',ev['marker'])
+                if not found:raise RuntimeError('إنشاء حدث سابق غير محسوم؛ لا نكرر POST لمنع التراكم. يلزم مراجعة إذا استمر')
+                self.event_update(key,broadcast_id=found['id'],create_pending=False,phase='created')
+            else:
+                self.event_update(key,create_pending=True,phase='creating')
+                body={'snippet':{'title':ev['title'],'description':ev['description'],
+                    'scheduledStartTime':(datetime.now(timezone.utc)+timedelta(seconds=30)).isoformat()},
+                    'status':{'privacyStatus':ev['privacy']},
+                    'contentDetails':{'enableAutoStart':False,'enableAutoStop':False,'enableDvr':True,
+                                      'recordFromStart':True,'monitorStream':{'enableMonitorStream':False}}}
+                try:r=self.api.call('liveBroadcasts','POST',{'part':'snippet,status,contentDetails'},body)
+                except APIError as e:
+                    if e.status and 400<=e.status<500:self.event_update(key,create_pending=False,phase='planned')
+                    raise
+                if not r.get('id'):raise RuntimeError('استجابة إنشاء الحدث غير محسومة')
+                self.event_update(key,broadcast_id=r['id'],create_pending=False,phase='created')
+        ev=self.journal.read()['events'][key];remote=self.remote('liveBroadcasts',ev['broadcast_id'])
+        if not remote:return None
+        if ev['marker'] not in remote.get('snippet',{}).get('description','').splitlines():
+            raise RuntimeError('علامة ملكية حدث التطبيق تغيرت؛ توقف آمن دون تعديل الحدث')
+        if remote.get('status',{}).get('privacyStatus')!=ev['privacy']:
+            raise RuntimeError('خصوصية الحدث في يوتيوب لا تطابق المطلوبة؛ راجع قيود مشروع API قبل النشر')
+        if remote.get('status',{}).get('lifeCycleStatus') not in ('complete','revoked') and not ev['bound']:
+            stream_id=(self.journal.read()['streams'].get(ev['username']) or {}).get('id')
+            if remote.get('contentDetails',{}).get('boundStreamId')!=stream_id:
+                self.api.call('liveBroadcasts/bind','POST',{'part':'id,contentDetails','id':ev['broadcast_id'],'streamId':stream_id})
+            self.event_update(key,bound=True,phase='bound')
+        return remote
+    def archive_event(self,key,outcome):
+        def change(d):
+            ev=d['events'].pop(key,None)
+            if ev is None:return
+            d['history'].append({'session_key':ev['session_key'],'broadcast_id':ev['broadcast_id'],
+                'title':ev['title'],'username':ev['username'],'nickname':ev.get('nickname','')})
+            d['history'][-1].update(outcome=outcome,ended_at=time.time())
+        self.journal.change(change)
+        self.stop_sender(key)
+    def finish_event(self,key):
+        ev=self.journal.read()['events'].get(key)
+        if not ev:return True
+        self.event_update(key,closing=True,phase='closing')
+        if not self.stop_sender(key):return False
+        ev=self.journal.read()['events'].get(key)
+        if not ev:return True
+        if not ev['broadcast_id']:
+            if ev['create_pending']:
+                found=self.reconcile('liveBroadcasts',ev['marker'])
+                if not found:raise RuntimeError('حدث غير محسوم عند الإنهاء؛ لا ننشئ أو نحذف بالتخمين')
+                self.event_update(key,broadcast_id=found['id'],create_pending=False)
+            else:self.archive_event(key,'cancelled_before_create');return True
+        ev=self.journal.read()['events'][key]
+        remote=self.remote('liveBroadcasts',ev['broadcast_id'])
+        if not remote:self.archive_event(key,'missing');return True
+        if ev['marker'] not in remote.get('snippet',{}).get('description','').splitlines():
+            raise RuntimeError('لا يمكن إنهاء حدث لا يحمل علامة هذه الجلسة')
+        status=remote.get('status',{}).get('lifeCycleStatus')
+        if status in ('complete','revoked'):
+            self.archive_event(key,status);return True
+        if status in ('live','testing'):
+            self.api.call('liveBroadcasts/transition','POST',{'part':'id,status','id':ev['broadcast_id'],'broadcastStatus':'complete'})
+            self.event_note(key,'طلب إنهاء الحدث أُرسل؛ التحقق من اكتماله');return False
+        # Never delete an event which actually started, even if local state missed the transition.
+        if status in ('created','ready') and not ev['was_live'] and not remote.get('snippet',{}).get('actualStartTime'):
+            self.api.call('liveBroadcasts','DELETE',{'id':ev['broadcast_id']})
+            self.archive_event(key,'empty_deleted');return True
+        self.event_note(key,'انتظار اكتمال انتقال حالة الحدث قبل إنهائه');return False
+
+    # ---------- senders ----------
+    def start_sender(self,key):
+        # FIX B: guard against 187 storm — don't push to RTMPS before YouTube ingest exists
+        # Previously called unconditionally from tick()/drive_event before broadcast was bound/ready,
+        # causing 7 ffmpeg failures in 5 min and 5:22 late start (~116s waste).
+        entry=self.senders.get(key)
+        if entry and entry['thread'].is_alive():return
+        ev=self.journal.read()['events'].get(key)
+        if not ev or ev.get('closing'):return
+        # Must be bound and have a destination; otherwise RTMPS will reject with 187
+        if not ev.get('bound') or not ev.get('broadcast_id'):
+            return
+        if ev.get('youtube_status') in ('complete','revoked','created'):
+            return
+        destination=self.destinations.get(ev['username'])
+        if not destination:raise RuntimeError('عنوان إرسال الحدث غير مهيأ')
+        stop=threading.Event();sender=Sender(self.ffmpeg,self.log,self.headers_for)
+        thread=threading.Thread(target=self.sender_loop,
+            args=(key,ev['username'],ev['room_id'],destination,stop,sender),daemon=True)
+        self.senders[key]={'thread':thread,'stop':stop,'sender':sender}
+        thread.start()
+    def stop_sender(self,key):
+        entry=self.senders.get(key)
+        if not entry:return True
+        entry['stop'].set()
+        entry['sender'].terminate()
+        if entry['thread'].is_alive():
+            entry['thread'].join(timeout=3)
+            if entry['thread'].is_alive():return False
+        self.senders.pop(key,None)
+        return True
+    def sender_loop(self,key,user,room_id,destination,stop,sender):
+        restart_at=0.0
+        while not stop.is_set():
+            try:
+                obs=self.observe(user)
+                if obs['status']!='live' or obs['room_id']!=room_id:return
+                sources=self.video_sources(obs['sources'])
+                for candidate in sources:
+                    if stop.is_set():return
+                    try:
+                        if sender.send(user,candidate,destination,stop):break
+                    except FormatChanged:
+                        # Source resolution/layout changed (PK round started or ended, app
+                        # resumed). Reconnect straight away so YouTube re-detects the new size.
+                        sender.note_format_change()
+                        self.log(user,'تغيرت أبعاد صورة المصدر أثناء البث؛ إعادة الاتصال فورًا بمقاس جديد')
+                        restart_at=time.monotonic();break
+                    except Exception:self.log(user,'تعثر إرسال الفيديو؛ نفس الحدث سيُستخدم')
+            except Exception:self.log(user,'تعذر تحديث مصدر الإرسال؛ لا ننشئ حدثًا إضافيًا')
+            # Skip the idle wait right after a resolution change; otherwise keep polling.
+            if restart_at and time.monotonic()-restart_at<30:restart_at=0.0;continue
+            stop.wait(15)
+    def probe(self,user,candidate):
+        # Check a readable FLV header before creating any public scheduled event.
+        r=requests.get(candidate['url'],impersonate='chrome',
+            headers={'Referer':'https://www.tiktok.com/',**self.headers_for(user)},stream=True,timeout=20)
+        try:
+            r.raise_for_status();prefix=b''
+            for chunk in r.iter_content():
+                prefix+=chunk
+                if len(prefix)>=3:return prefix[:3]==b'FLV'
+            return False
+        finally:r.close()
+    def _probe_ok(self,user,candidate):
+        try:return self.probe(user,candidate)
+        except Exception:return False
+
+    # ---------- main loop ----------
+    def tick(self):
+        d=self.journal.read()
+        accounts=list(self.accounts())
+        # 1) Close events that must close (user stop, disable, account removed).
+        for key,ev in list(d['events'].items()):
+            if ev.get('closing') or not d['enabled'] or ev['username'] not in accounts:
+                try:self.finish_event(key)
+                except Exception as e:self._event_error(key,e)
+        d=self.journal.read()
+        if not d['enabled']:
+            self.set_status('تعطيل الأتمتة وإنهاء الأحداث الجارية' if d['events'] else 'الأتمتة معطلة')
+            return
+        # 2) Discover new live sessions, one event per account, up to the concurrency cap.
+        cap=self.max_events;active=len(d['events']);capped=False
+        for user in accounts:
+            if active>=cap:capped=True;break
+            if any(e['username']==user for e in d['events'].values()):continue
+            try:obs=self.observe(user)
+            except Exception:continue
+            if obs['status']!='live':continue
+            key=user+':'+obs['room_id']
+            if key in d['events'] or any(h['session_key']==key for h in d['history']):continue
+            candidates=self.video_sources(obs['sources'])
+            if not candidates or not any(self._probe_ok(user,c) for c in candidates):continue
+            try:
+                self.ensure_stream(user)
+                if self.open_event(user,obs):active+=1
+            except Exception as e:self.log(user,self.safe_error(e))
+        # 3) Drive every open event independently.
+        for key in list(self.journal.read()['events'].keys()):
+            try:self.drive_event(key)
+            except Exception as e:self._event_error(key,e)
+        d=self.journal.read()
+        if capped:self.set_status('بلغنا الحد الأقصى للأحداث المتزامنة ('+str(cap)+')؛ حسابات إضافية تنتظر فراغها')
+        elif d['events']:self.set_status(str(len(d['events']))+' حدث/أحداث يوتيوب جارية')
+        else:self.set_status('انتظار بث قابل للإرسال من الحسابات المفعلة')
+    def drive_event(self,key):
+        ev=self.journal.read()['events'].get(key)
+        if not ev or ev.get('closing'):return
+        user=ev['username']
+        obs=self.observe(user)
+        if obs['status']=='offline':
+            self.stop_sender(key)
+            ev=self.journal.read()['events'].get(key)
+            if not ev:return
+            count=int(ev.get('offline_count') or 0)+1;since=ev.get('offline_since') or time.time()
+            self.event_update(key,offline_count=count,offline_since=since)
+            if count>=2 and time.time()-float(since)>=self.end_grace:self.finish_event(key)
+            else:self.event_note(key,'تأكيد انتهاء جلسة تيك توك؛ مهلة قبل إنهاء يوتيوب')
+            return
+        if obs['status']!='live':raise RuntimeError('حالة تيك توك غير مؤكدة؛ لا ننهي الحدث بسبب خطأ رصد')
+        if obs['room_id']!=ev['room_id']:
+            self.event_update(key,closing=True);self.finish_event(key);return
+        self.event_update(key,offline_since=None,offline_count=0)
+        # FIX C: clear sticky transient error note once TikTok is reachable again (recovery)
+        # Without this the 'التوقف عن الإنشاء لحماية الأحداث' message stayed 40 min.
+        if ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note'] or 'networkOrInvalidResponse' in ev['note']):
+            self._clear_stale_error_note(key)
+            ev=self.journal.read()['events'].get(key)
+            if not ev:return
+        if not self.video_sources(obs['sources']):
+            if not ev['was_live'] and time.time()-ev['created_at']>int(os.getenv('YOUTUBE_START_TIMEOUT','900')):
+                self.event_update(key,closing=True);self.finish_event(key)
+            else:self.event_note(key,'الجلسة مستمرة؛ انتظار المصدر المحدد للجودة')
+            return
+        if user not in self.destinations:
+            self.ensure_stream(user)
+            # recovery: stream succeeded after transient failure -> clear sticky note
+            ev=self.journal.read()['events'].get(key)
+            if ev and ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note']):
+                self._clear_stale_error_note(key)
+                ev=self.journal.read()['events'].get(key)
+        if not ev.get('bound'):
+            remote=self.ensure_broadcast(key)
+            if not remote:self.archive_event(key,'missing');return
+            ev=self.journal.read()['events'].get(key)
+            if not ev or not ev.get('bound'):
+                return
+            # FIX C: successful bind after transient TLS failure should clear the stuck note
+            if ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note']):
+                self._clear_stale_error_note(key)
+                ev=self.journal.read()['events'].get(key)
+            # FIX B: do NOT start sender here unconditionally. Fall through to gated check below
+            # which verifies YouTube lifecycle is ready/testing/live. This prevents the 187 storm
+            # that was caused by pushing to RTMPS before ingest existed (5:22 late, 116s waste).
+
+        # ---------- gated sender start (FIX B) ----------
+        ev=self.journal.read()['events'].get(key)
+        if not ev or not ev.get('broadcast_id') or not ev.get('bound'):
+            return
+        # Respect 45s poll interval for quota, but also gate sender on lifecycle status
+        # If we have a cached youtube_status we can gate without an extra API call
+        needs_poll = time.time()-float(ev.get('last_poll') or 0) >= 45
+        if needs_poll:
+            self.event_update(key,last_poll=time.time())
+            remote=self.remote('liveBroadcasts',ev['broadcast_id'])
+            if not remote:
+                self.event_update(key,closing=True);self.finish_event(key);return
+            if ev['marker'] not in remote.get('snippet',{}).get('description','').splitlines():
+                raise RuntimeError('تغيرت علامة الحدث؛ توقف آمن دون تعديل أحداث أخرى')
+            life=remote.get('status',{}).get('lifeCycleStatus');self.event_update(key,youtube_status=life)
+            ev=self.journal.read()['events'].get(key)
+            # FIX C: successful remote fetch means transport recovered -> clear stuck error
+            if ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note'] or 'network' in ev['note']):
+                self._clear_stale_error_note(key)
+                ev=self.journal.read()['events'].get(key)
+        else:
+            # Use cached status to gate sender without burning quota
+            life=ev.get('youtube_status')
+            # If status unknown or stale 'created', fetch once to avoid wrong gate
+            if not life or life == 'created':
+                remote=self.remote('liveBroadcasts',ev['broadcast_id'])
+                if not remote:
+                    self.event_update(key,closing=True);self.finish_event(key);return
+                life=remote.get('status',{}).get('lifeCycleStatus');self.event_update(key,youtube_status=life)
+                ev=self.journal.read()['events'].get(key)
+                if ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note']):
+                    self._clear_stale_error_note(key)
+                    ev=self.journal.read()['events'].get(key)
+            else:
+                remote=None
+
+        if life in ('complete','revoked'):
+            self.event_update(key,closing=True);self.finish_event(key);return
+        if life=='live':
+            if not ev['was_live']:
+                self.event_update(key,was_live=True,phase='live')
+                self.log(user,'يوتيوب أكد أن الحدث مباشر: '+ev['broadcast_id'])
+            # Now safe to ensure sender is running; viewer already watching
+            self.start_sender(key)
+            self.stream_health(key,user,ev)
+            return
+
+        # life is expected to be 'ready' or 'testing' for a newly bound event
+        if life not in ('ready','testing'):
+            # 'created' etc. -> ingest not yet receivable, don't push (prevents 187)
+            if life == 'created':
+                self.event_note(key,'تم ربط الحدث؛ انتظار جاهزية الاستقبال قبل الإرسال')
+            else:
+                self.event_note(key,'انتظار تأكيد استقبال يوتيوب قبل بدء الحدث')
+            self.stop_sender(key)
+            return
+
+        # life is ready/testing -> we need to push so streamStatus becomes active, then transition
+        self.start_sender(key)
+
+        # Transition to live if YouTube already sees an active stream
+        # Only when we did a full poll; otherwise defer transition to next poll
+        if needs_poll:
+            stream_id=(self.journal.read()['streams'].get(user) or {}).get('id')
+            stream=self.remote('liveStreams',stream_id) if stream_id else None
+            if stream and stream.get('status',{}).get('streamStatus')=='active' and life in ('ready','testing'):
+                self.api.call('liveBroadcasts/transition','POST',{'part':'id,status','id':ev['broadcast_id'],'broadcastStatus':'live'})
+                self.event_update(key,phase='starting');self.event_note(key,'يوتيوب يستقبل؛ طُلب بدء الحدث للعامة حسب الخصوصية')
+            elif time.time()-ev['created_at']>int(os.getenv('YOUTUBE_START_TIMEOUT','900')) and not ev['was_live']:
+                self.event_update(key,closing=True);self.finish_event(key)
+            else:
+                # keep waiting note, but ensure error note is cleared
+                if ev.get('note') and ('حماية الأحداث' in ev['note'] or 'خطأ داخلي' in ev['note']):
+                    self.event_update(key, note='انتظار تأكيد استقبال يوتيوب قبل بدء الحدث')
+                elif not ev.get('note'):
+                    self.event_note(key,'انتظار تأكيد استقبال يوتيوب قبل بدء الحدث')
+    def stream_health(self,key,user,ev):
+        """Read YouTube's own verdict on the inbound stream. The Live Streaming API reports
+        exactly why viewers buffer (videoIngestionStarved), why the picture can be rejected
+        (videoResolutionUnsupported / videoCodec) and why playback stalls (gopSizeLong /
+        openGop). Surfacing it replaces guesswork with ground truth. Polled on a slower
+        cadence than the life-cycle check so it stays inside the quota budget."""
+        interval=max(60,int(os.getenv('YOUTUBE_HEALTH_INTERVAL','180')))
+        if time.time()-float(ev.get('last_health') or 0)<interval:return
+        stream_id=(self.journal.read()['streams'].get(user) or {}).get('id')
+        if not stream_id:return
+        self.event_update(key,last_health=time.time())
+        stream=self.remote('liveStreams',stream_id)
+        if not stream:return
+        health=stream.get('status',{}).get('healthStatus') or {}
+        issues=[]
+        for i in (health.get('configurationIssues') or []):
+            sev=i.get('severity','')
+            if sev in ('warning','error'):
+                issues.append('%s [%s] %s'%(i.get('type',''),sev,i.get('reason','')))
+        text=' | '.join(issues)
+        prev=ev.get('last_issues')
+        self.event_update(key,youtube_health=health.get('status',''),youtube_issues=text,last_issues=text)
+        if text and text!=prev:
+            self.log(user,'يوتيوب يشخّص البث: '+text)
+    def run_manager(self):
+        checked=False
+        try:
+            while not self.manager_stop.is_set():
+                delay=self.scan
+                try:
+                    with self.operations:
+                        if not checked:self.check_channel();checked=True
+                        self.tick()
+                    d=self.journal.read()
+                    if not d['enabled'] and not d['events']:self.set_status('الأتمتة معطلة؛ لا إرسال ولا إنشاء أحداث')
+                except Exception as e:
+                    text=self.safe_error(e)
+                    if not isinstance(e,(APIError,RuntimeError,ValueError)):text+=' ('+type(e).__name__+')'
+                    self.set_status(text)
+                    if text!=self.last_logged:self.log('youtube',text);self.last_logged=text
+                    if isinstance(e,APIError) and (e.status in (401,403,429) or e.reason=='invalid_grant'):delay=300
+                    else:delay=60
+                self.manager_stop.wait(delay)
+        finally:
+            for key in list(self.senders):self.stop_sender(key)
+            self.set_status('مدير الأحداث متوقف؛ حالة الجلسات محفوظة')