fix(backend): pass YouTube cookies to yt-dlp to beat the datacenter bot check

YouTube now returns "Sign in to confirm you're not a bot" for yt-dlp from
datacenter IPs, blocking downloads, search and link-resolve. When a cookies file
is present (YTDLP_COOKIES, default /data/youtube-cookies.txt) every yt-dlp call
passes --cookies so it authenticates. Checked at call time (drop the file in, no
code change); absent → unchanged behaviour. Applied to the download cascade, the
YTM search probe, and the importer resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -88,6 +88,11 @@ to Android at parity with web, and fixes a batch of same-name-artist and player
   as avatar chips, matching the Android app (previously plain text).
 
 ### Fixed
+- **Downloads — YouTube bot check ("Sign in to confirm you're not a bot")** — YouTube now blocks
+  yt-dlp from datacenter IPs. The backend passes a **cookies file** to every yt-dlp call when present
+  (`YTDLP_COOKIES`, default `/data/youtube-cookies.txt`): drop a Netscape `cookies.txt` from a
+  logged-in (ideally throwaway) account into the data volume and downloads/search/resolve
+  authenticate again. Absent → yt-dlp runs exactly as before (no behaviour change).
 - **Artist pin — search & similar artists (Web + Android)** — a pinned artist now shows the correct
   Deezer photo in library search (not the wrong same-name person's), and its "Similar Artists" use
   Deezer's **related** for the pinned artist instead of Last.fm's list (which was keyed to the

backend/lib/config.js

@@ -1,13 +1,21 @@
+const path = require('path');
+
+const dataPath = process.env.DATA_PATH || '/data';
+
 const CONFIG = {
   port:            process.env.PORT             || 3700,
   musicPath:       process.env.MUSIC_PATH       || '/music',
-  dataPath:        process.env.DATA_PATH        || '/data',
+  dataPath,
   ytdlpBin:        process.env.YTDLP_BIN       || 'yt-dlp',
   audioFmt:        process.env.AUDIO_FMT       || 'mp3',
   audioQuality:    process.env.AUDIO_QUALITY   || '0',
   maxParallel:     parseInt(process.env.MAX_PARALLEL || '2', 10),
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'ytdlp').toLowerCase(),
   ticketmasterKey:     process.env.TICKETMASTER_API_KEY  || '',
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). Passing cookies from
+  // a logged-in (ideally throwaway) account fixes it. Drop a Netscape-format cookies.txt at this path
+  // (default: in the data volume) and every yt-dlp call uses it. No file → yt-dlp runs as before.
+  cookiesFile:     process.env.YTDLP_COOKIES   || path.join(dataPath, 'youtube-cookies.txt'),
 };
 
 module.exports = CONFIG;

backend/lib/ytdlp.js

@@ -134,6 +134,12 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
   // YTM ranking toward a same-named artist's full discography.
   const query = `${ytmArtist} ${searchTitle}`;
 
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). If a cookies file is
+  // present, pass it so yt-dlp authenticates. Checked at call time so dropping the file in takes
+  // effect without a code change; absent → no flag → unchanged behaviour.
+  const cookieArgs = () =>
+    (CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : [];
+
   const baseArgs = [
     '--extract-audio',
     '--audio-format',   CONFIG.audioFmt,
@@ -148,6 +154,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
     // "Art Track" / topic uploads are reachable. The android_vr client returns
     // "This video is not available" for many YTM tracks that play fine in the browser.
     '--extractor-args', 'youtube:player_client=web_music,default',
+    ...cookieArgs(),
   ];
 
   const spawnYtdlp = (args) => new Promise((resolve, reject) => {
@@ -217,6 +224,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // generic YouTube search and returns unrelated videos instead of the
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
+      ...cookieArgs(),
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
     proc.stdout.on('data', d => {
       const text = d.toString();

backend/novasonic-server.js

@@ -533,6 +533,9 @@ app.post('/api/youtube/resolve', async (req, res) => {
       execFile(CONFIG.ytdlpBin, [
         '--dump-json', '--flat-playlist', '--no-warnings',
         '--playlist-items', '1-50',
+        // Cookies (if present) let yt-dlp past YouTube's datacenter-IP bot check. Domain-scoped, so
+        // harmless for non-YouTube links. No file → runs as before.
+        ...((CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : []),
         url,
       ], { timeout: 45000, maxBuffer: 20 * 1024 * 1024 }, (err, out, stderr) => {
         if (err && !out?.trim()) return reject(new Error(stderr?.trim() || err.message));