fix: move persistent queue state writes off the event loop (#980)

PersistentQueue.put/delete wrote the whole queue inline: serialize, write
a temp file, fsync it, rename, then fsync the directory. All of that ran
synchronously inside async callers, so on a slow or contended filesystem
a single queue mutation stalled every other request for as long as the
two fsyncs took. Adds and completions are exactly when it fires, which
matches the reported "hiccups happen when something is pushing into the
queue".

put/delete are now coroutines. The payload is still serialized on the
event loop -- it is pure CPU and sub-millisecond -- and only the write
goes to a thread, so the writer never walks live DownloadInfo objects
while the loop mutates them. Each queue gets its own single-worker
executor rather than sharing the default one, because extract_info can
hold default-executor threads for minutes and would leave state writes
queued behind exactly when they are needed.

Awaiting the write makes interleaving possible where it was not before,
so a lock now covers the mutate-write-rollback section: the invariant
that in-memory state never diverges from what is on disk is unchanged,
including the rollback when a write fails. On shutdown the queues are
drained rather than cancelled, so a write in flight still lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -98,7 +98,7 @@ Enabling `writeinfojson` or `writethumbnail` in `YTDL_OPTIONS` also writes a fee
 * __HTTPS__: Use `https` instead of `http` (__CERTFILE__ and __KEYFILE__ required). Defaults to `false`.
 * __CERTFILE__: HTTPS certificate file path.
 * __KEYFILE__: HTTPS key file path.
-* __CORS_ALLOWED_ORIGINS__: Comma-separated list of origins permitted to make cross-origin requests to the MeTube API; `*` allows all. When unset or empty, all cross-origin requests are denied. Required for browser extensions and bookmarklets — see [Sending links to MeTube](#-sending-links-to-metube).
+* __CORS_ALLOWED_ORIGINS__: Comma-separated list of origins permitted to make cross-origin requests to the MeTube API; `*` allows all. When unset or empty, all cross-origin requests are denied. Required for browser extensions and bookmarklets — see [Sending links to MeTube](#-sending-links-to-metube). Naming origins explicitly also lets them send credentials (a login cookie, or the `Authorization` header a reverse proxy checks), which `*` deliberately does not: it would let any site you visit drive your instance with your own session.
 * __ROBOTS_TXT__: A path to a `robots.txt` file mounted in the container.
 
 ## 🎛️ Configuring yt-dlp options
@@ -243,7 +243,7 @@ __Browser extensions__ allow right-clicking videos and sending them directly to
 * __Chrome:__ contributed by [Rpsl](https://github.com/rpsl) — install from the [Chrome Webstore](https://chrome.google.com/webstore/detail/metube-downloader/fbmkmdnlhacefjljljlbhkodfmfkijdh) or [from sources](https://github.com/Rpsl/metube-browser-extension).
 * __Firefox:__ contributed by [nanocortex](https://github.com/nanocortex) — install from [Firefox Addons](https://addons.mozilla.org/en-US/firefox/addon/metube-downloader) or get sources [here](https://github.com/nanocortex/metube-firefox-addon).
 
-__Bookmarklets__ send the currently open page to MeTube with one click. Add the origins of the sites where you use them to `CORS_ALLOWED_ORIGINS`, e.g. `https://www.youtube.com,https://www.vimeo.com`. The code (Chrome and Firefox variants, contributed by [kushfest](https://github.com/kushfest) and [shoonya75](https://github.com/shoonya75)) is in the [Bookmarklets wiki page](https://github.com/alexta69/metube/wiki/Bookmarklets).
+__Bookmarklets__ send the currently open page to MeTube with one click. Add the origins of the sites where you use them to `CORS_ALLOWED_ORIGINS`, e.g. `https://www.youtube.com,https://www.vimeo.com`. If your instance sits behind authentication, list the origins individually rather than using `*` — only named origins are allowed to send credentials. The code (Chrome and Firefox variants, contributed by [kushfest](https://github.com/kushfest) and [shoonya75](https://github.com/shoonya75)) is in the [Bookmarklets wiki page](https://github.com/alexta69/metube/wiki/Bookmarklets).
 
 __iOS Shortcut:__ [rithask](https://github.com/rithask) created an [iOS shortcut](https://www.icloud.com/shortcuts/66627a9f334c467baabdb2769763a1a6) for sending URLs to MeTube from Safari's share menu; it prompts for your instance address on first use.
 

app/main.py

@@ -116,6 +116,17 @@ class Config:
         if not self.URL_PREFIX.endswith('/'):
             self.URL_PREFIX += '/'
 
+        # Strip trailing slashes from the download directories. get_custom_dirs()
+        # builds the folder dropdown by removing the base path as a prefix from
+        # each subdirectory, and the base directory's own path does not carry the
+        # trailing slash — so 'DOWNLOAD_DIR=/downloads/' failed to match itself
+        # and leaked 'downloads' into the dropdown as a bogus folder option.
+        # Runs after the '%%' indirection above so AUDIO_DOWNLOAD_DIR is resolved.
+        for attr in ('DOWNLOAD_DIR', 'AUDIO_DOWNLOAD_DIR', 'TEMP_DIR', 'STATE_DIR'):
+            val = getattr(self, attr)
+            if isinstance(val, str) and len(val) > 1 and val.endswith('/'):
+                setattr(self, attr, val.rstrip('/') or '/')
+
         # A blank PUBLIC_HOST_AUDIO_URL (e.g. set empty in a compose file) bypasses the
         # default via os.environ.get, which would leave audio links root-relative and 404.
         # Fall back to the 'audio_download/' route that serves AUDIO_DOWNLOAD_DIR. When
@@ -335,6 +346,12 @@ async def state_dir_guard(request, handler):
 
 app = web.Application(middlewares=[state_dir_guard])
 _cors_origins = [o.strip() for o in config.CORS_ALLOWED_ORIGINS.split(',') if o.strip()] if config.CORS_ALLOWED_ORIGINS else []
+if '*' in _cors_origins and len(_cors_origins) > 1:
+    log.warning(
+        "CORS_ALLOWED_ORIGINS mixes '*' with named origins %s. '*' wins, and credentialed "
+        "cross-origin requests stay disabled for every origin in the list. Remove '*' if you "
+        "need a bookmarklet to reach an authenticated instance.",
+        [o for o in _cors_origins if o != '*'])
 sio = socketio.AsyncServer(cors_allowed_origins=_cors_origins if _cors_origins else [])
 sio.attach(app, socketio_path=config.URL_PREFIX + 'socket.io')
 routes = web.RouteTableDef()
@@ -725,6 +742,7 @@ def parse_download_options(post: dict) -> dict:
     playlist_item_limit = post.get('playlist_item_limit')
     auto_start = post.get('auto_start')
     split_by_chapters = post.get('split_by_chapters')
+    sponsorblock = bool(post.get('sponsorblock'))
     chapter_template = post.get('chapter_template')
     subtitle_language = post.get('subtitle_language')
     subtitle_mode = post.get('subtitle_mode')
@@ -845,6 +863,7 @@ def parse_download_options(post: dict) -> dict:
         'playlist_item_limit': playlist_item_limit,
         'auto_start': auto_start,
         'split_by_chapters': split_by_chapters,
+        'sponsorblock': sponsorblock,
         'chapter_template': chapter_template,
         'subtitle_language': subtitle_language,
         'subtitle_mode': subtitle_mode,
@@ -890,6 +909,7 @@ async def add(request):
         o['ytdl_options_overrides'],
         o['clip_start'],
         o['clip_end'],
+        sponsorblock=o['sponsorblock'],
     )
     return web.Response(text=serializer.encode(status))
 
@@ -970,6 +990,7 @@ async def subscribe(request):
         subtitle_mode=o['subtitle_mode'],
         ytdl_options_presets=o['ytdl_options_presets'],
         ytdl_options_overrides=o['ytdl_options_overrides'],
+        sponsorblock=o['sponsorblock'],
         title_regex=post.get('title_regex'),
         skip_subscriber_only=skip_subscriber_only,
         clip_start=sub_clip_start,
@@ -1059,6 +1080,30 @@ async def start(request):
 
 COOKIES_PATH = os.path.join(config.STATE_DIR, 'cookies.txt')
 
+
+def warn_if_cookiefile_shadowed():
+    """Warn before an uploaded cookies file displaces an operator-configured one.
+
+    Uploaded cookies deliberately win: the upload exists so cookies can be
+    refreshed without restarting the container, and letting YTDL_OPTIONS win
+    would leave a visible UI button doing nothing. But set_runtime_override
+    writes straight into YTDL_OPTIONS, so the configured path is gone from the
+    live config the moment an uploaded file is applied — after that, nothing
+    downstream can report the conflict (delete_cookies' has_manual_cookiefile
+    check cannot fire once the value has been replaced). This is the only point
+    where both are still visible, so it is the only place the warning can be
+    issued. Must be called before set_runtime_override. See issue #881, where
+    the silence cost the reporter days of debugging.
+    """
+    configured = config.YTDL_OPTIONS.get('cookiefile')
+    if isinstance(configured, str) and configured and configured != COOKIES_PATH:
+        log.warning(
+            'Uploaded cookies at %s take precedence over the cookiefile configured in '
+            'YTDL_OPTIONS (%s), which will not be used. Delete the uploaded cookies from '
+            'the UI to go back to the configured file.',
+            COOKIES_PATH, configured)
+
+
 @routes.post(config.URL_PREFIX + 'upload-cookies')
 async def upload_cookies(request):
     reader = await request.multipart()
@@ -1088,6 +1133,7 @@ async def upload_cookies(request):
     except OSError as exc:
         log.warning(f'Could not restrict permissions on cookies file: {exc}')
     os.replace(tmp_cookie_path, COOKIES_PATH)
+    warn_if_cookiefile_shadowed()
     config.set_runtime_override('cookiefile', COOKIES_PATH)
     log.info(f'Cookies file uploaded ({size} bytes)')
     return web.Response(text=serializer.encode({'status': 'ok', 'msg': f'Cookies uploaded ({size} bytes)'}))
@@ -1282,9 +1328,44 @@ app.router.add_route('OPTIONS', config.URL_PREFIX + 'delete-cookies', add_cors)
 
 async def on_prepare(request, response):
     origin = request.headers.get('Origin')
-    if origin and _cors_origins and ('*' in _cors_origins or origin in _cors_origins):
-        response.headers['Access-Control-Allow-Origin'] = origin
-        response.headers['Access-Control-Allow-Headers'] = 'Content-Type'
+    if not origin or not _cors_origins:
+        return
+
+    # Naming an origin in CORS_ALLOWED_ORIGINS is a deliberate trust grant, so
+    # such an origin may send credentials: the cookie or Authorization header
+    # that a reverse proxy in front of MeTube checks. Without this a bookmarklet
+    # cannot reach an authenticated instance at all (issue #155).
+    #
+    # The '*' wildcard is emphatically not such a grant — it matches origins the
+    # operator never enumerated, including every site the user happens to visit.
+    # Echoing the origin back (which we must do, since '*' is illegal alongside
+    # credentials) and allowing credentials would let any page drive the user's
+    # instance with the user's own session. So the wildcard keeps exactly the
+    # uncredentialed behaviour it has always had, and a wildcard anywhere in the
+    # list disables credentials for every origin in it.
+    #
+    # Derived here rather than held in a second module global so the wildcard
+    # test and the membership test can never disagree about the same list.
+    wildcard = '*' in _cors_origins
+    trusted = not wildcard and origin in _cors_origins
+    if not (wildcard or trusted):
+        return
+
+    response.headers['Access-Control-Allow-Origin'] = origin
+    # Authorization rides on the same grant: allowing it under the wildcard
+    # would let an arbitrary page attempt credentials against an instance it
+    # can already reach, from inside the victim's network.
+    response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization' if trusted else 'Content-Type'
+    if trusted:
+        response.headers['Access-Control-Allow-Credentials'] = 'true'
+
+    # The response now differs per Origin, so a shared cache must not hand one
+    # origin's Allow-Origin to another.
+    vary = response.headers.get('Vary')
+    if not vary:
+        response.headers['Vary'] = 'Origin'
+    elif 'origin' not in (v.strip().lower() for v in vary.split(',')):
+        response.headers['Vary'] = f'{vary}, Origin'
 
 app.on_response_prepare.append(on_prepare)
 
@@ -1310,6 +1391,7 @@ if __name__ == '__main__':
 
     # Auto-detect cookie file on startup
     if os.path.exists(COOKIES_PATH):
+        warn_if_cookiefile_shadowed()
         config.set_runtime_override('cookiefile', COOKIES_PATH)
         log.info(f'Cookie file detected at {COOKIES_PATH}')
 

app/subscriptions.py

@@ -182,6 +182,7 @@ class SubscriptionInfo:
     auto_start: bool = True
     playlist_item_limit: int = 0
     split_by_chapters: bool = False
+    sponsorblock: bool = False
     chapter_template: str = ""
     subtitle_language: str = "en"
     subtitle_mode: str = "prefer_manual"
@@ -242,6 +243,7 @@ def _subscription_to_record(sub: SubscriptionInfo) -> dict[str, Any]:
         "auto_start": sub.auto_start,
         "playlist_item_limit": sub.playlist_item_limit,
         "split_by_chapters": sub.split_by_chapters,
+        "sponsorblock": sub.sponsorblock,
         "chapter_template": sub.chapter_template,
         "subtitle_language": sub.subtitle_language,
         "subtitle_mode": sub.subtitle_mode,
@@ -487,6 +489,7 @@ class SubscriptionManager:
         ytdl_options_overrides: Optional[dict[str, Any]] = None,
         clip_start: Optional[float] = None,
         clip_end: Optional[float] = None,
+        sponsorblock: bool = False,
     ) -> tuple[list[str], list[str]]:
         queued_ids: list[str] = []
         queue_errors: list[str] = []
@@ -519,6 +522,7 @@ class SubscriptionManager:
                 ytdl_options_overrides,
                 clip_start,
                 clip_end,
+                sponsorblock=sponsorblock,
             )
             if isinstance(result, dict) and result.get("status") == "error":
                 msg = str(result.get("msg") or f"Queueing failed for {vurl}")
@@ -606,6 +610,7 @@ class SubscriptionManager:
         subtitle_mode: str,
         ytdl_options_presets: Optional[list[str]] = None,
         ytdl_options_overrides: Optional[dict[str, Any]] = None,
+        sponsorblock: bool = False,
         title_regex: Any = None,
         skip_subscriber_only: Any = None,
         clip_start: Optional[float] = None,
@@ -689,6 +694,7 @@ class SubscriptionManager:
                 auto_start=bool(auto_start),
                 playlist_item_limit=int(playlist_item_limit),
                 split_by_chapters=bool(split_by_chapters),
+                sponsorblock=bool(sponsorblock),
                 chapter_template=chapter_template or "",
                 subtitle_language=subtitle_language,
                 subtitle_mode=subtitle_mode,
@@ -942,6 +948,7 @@ class SubscriptionManager:
             dl_plimit = cur.playlist_item_limit
             dl_autostart = cur.auto_start
             dl_split = cur.split_by_chapters
+            dl_sponsorblock = cur.sponsorblock
             dl_chapter = cur.chapter_template
             dl_sublang = cur.subtitle_language
             dl_submode = cur.subtitle_mode
@@ -1010,6 +1017,7 @@ class SubscriptionManager:
             playlist_item_limit=dl_plimit,
             auto_start=dl_autostart,
             split_by_chapters=dl_split,
+            sponsorblock=dl_sponsorblock,
             chapter_template=dl_chapter or "",
             subtitle_language=dl_sublang,
             subtitle_mode=dl_submode,

app/tests/test_api.py

@@ -366,6 +366,25 @@ async def test_subscribe_passes_clip_bounds(mock_dqueue, monkeypatch):
     assert kwargs["clip_end"] == pytest.approx(204.0)
 
 
+@pytest.mark.asyncio
+async def test_subscribe_passes_sponsorblock(mock_dqueue, monkeypatch):
+    monkeypatch.setattr(main.submgr, "add_subscription", AsyncMock(return_value={"status": "ok"}))
+    req = _json_request(
+        {**_valid_video_add_body(), "check_interval_minutes": 60, "sponsorblock": True}
+    )
+    resp = await main.subscribe(req)
+    assert resp.status == 200
+    assert main.submgr.add_subscription.await_args.kwargs["sponsorblock"] is True
+
+
+@pytest.mark.asyncio
+async def test_subscribe_defaults_sponsorblock_off(mock_dqueue, monkeypatch):
+    monkeypatch.setattr(main.submgr, "add_subscription", AsyncMock(return_value={"status": "ok"}))
+    req = _json_request({**_valid_video_add_body(), "check_interval_minutes": 60})
+    await main.subscribe(req)
+    assert main.submgr.add_subscription.await_args.kwargs["sponsorblock"] is False
+
+
 @pytest.mark.asyncio
 async def test_subscribe_without_clip_fields_stores_none(mock_dqueue, monkeypatch):
     monkeypatch.setattr(main.submgr, "add_subscription", AsyncMock(return_value={"status": "ok"}))
@@ -506,3 +525,130 @@ async def test_download_blocks_state_dir_files(monkeypatch):
         (download_dir / "video.mp4").unlink(missing_ok=True)
         (download_dir / percent_filename).unlink(missing_ok=True)
         state_dir.rmdir()
+
+# --- CORS (issue #155) -------------------------------------------------------
+#
+# The security property under test: credentials are granted only to an origin
+# the operator named explicitly, and never under the '*' wildcard. Each test
+# builds a fresh Application because main.app binds to the first event loop
+# that runs it; the logic under test lives entirely in main.on_prepare, and the
+# real main.add_cors preflight handler is mounted so the preflight path is the
+# production one.
+
+async def _cors_version(request):
+    return web.Response(text="v")
+
+
+def _cors_app():
+    app = web.Application()
+    app.router.add_route("OPTIONS", "/add", main.add_cors)
+    app.router.add_get("/version", _cors_version)
+    app.on_response_prepare.append(main.on_prepare)
+    return app
+
+
+async def _cors_headers(monkeypatch, origins, origin, path="/add", method="OPTIONS"):
+    monkeypatch.setattr(main, "_cors_origins", origins)
+    async with TestClient(TestServer(_cors_app())) as client:
+        resp = await client.request(
+            method, path,
+            headers={
+                "Origin": origin,
+                "Access-Control-Request-Method": "POST",
+                "Access-Control-Request-Headers": "content-type,authorization",
+            },
+        )
+        return resp.headers
+
+
+@pytest.mark.asyncio
+async def test_cors_listed_origin_gets_credentials(monkeypatch):
+    h = await _cors_headers(monkeypatch, ["https://www.youtube.com"], "https://www.youtube.com")
+    assert h["Access-Control-Allow-Origin"] == "https://www.youtube.com"
+    assert h["Access-Control-Allow-Credentials"] == "true"
+    assert "Authorization" in h["Access-Control-Allow-Headers"]
+    assert "Origin" in h["Vary"]
+
+
+@pytest.mark.asyncio
+async def test_cors_wildcard_never_grants_credentials(monkeypatch):
+    h = await _cors_headers(monkeypatch, ["*"], "https://evil.example")
+    # The wildcard still reflects the origin, exactly as before...
+    assert h["Access-Control-Allow-Origin"] == "https://evil.example"
+    # ...but must not hand out the user's session, nor let a page attempt
+    # credentials of its own.
+    assert "Access-Control-Allow-Credentials" not in h
+    assert h["Access-Control-Allow-Headers"] == "Content-Type"
+
+
+@pytest.mark.asyncio
+async def test_cors_wildcard_mixed_with_named_origin_still_denies_credentials(monkeypatch):
+    # '*' anywhere in the list disables credentials for everyone in it, so a
+    # stray wildcard cannot silently widen a named grant.
+    h = await _cors_headers(monkeypatch, ["*", "https://www.youtube.com"], "https://www.youtube.com")
+    assert h["Access-Control-Allow-Origin"] == "https://www.youtube.com"
+    assert "Access-Control-Allow-Credentials" not in h
+    assert h["Access-Control-Allow-Headers"] == "Content-Type"
+
+
+@pytest.mark.asyncio
+async def test_cors_unlisted_origin_gets_nothing(monkeypatch):
+    h = await _cors_headers(monkeypatch, ["https://www.youtube.com"], "https://evil.example")
+    assert "Access-Control-Allow-Origin" not in h
+    assert "Access-Control-Allow-Credentials" not in h
+
+
+@pytest.mark.asyncio
+async def test_cors_disabled_by_default(monkeypatch):
+    h = await _cors_headers(monkeypatch, [], "https://www.youtube.com")
+    assert "Access-Control-Allow-Origin" not in h
+    assert "Access-Control-Allow-Credentials" not in h
+
+
+@pytest.mark.asyncio
+async def test_cors_credentials_apply_to_actual_response_not_just_preflight(monkeypatch):
+    # The browser checks Allow-Credentials on the real response too, so a
+    # preflight-only grant would still fail.
+    h = await _cors_headers(
+        monkeypatch, ["https://www.youtube.com"], "https://www.youtube.com",
+        path="/version", method="GET")
+    assert h["Access-Control-Allow-Credentials"] == "true"
+
+
+@pytest.mark.asyncio
+async def test_cors_origin_match_is_exact(monkeypatch):
+    # Substring or suffix matching here would be a bypass.
+    for impostor in (
+        "https://www.youtube.com.evil.example",
+        "https://evilwww.youtube.com",
+        "http://www.youtube.com",
+        "https://www.youtube.com:8443",
+    ):
+        h = await _cors_headers(monkeypatch, ["https://www.youtube.com"], impostor)
+        assert "Access-Control-Allow-Origin" not in h, impostor
+        assert "Access-Control-Allow-Credentials" not in h, impostor
+
+
+@pytest.mark.asyncio
+async def test_cors_null_origin_is_not_trusted(monkeypatch):
+    # Sandboxed iframes and some file:// contexts send Origin: null.
+    h = await _cors_headers(monkeypatch, ["https://www.youtube.com"], "null")
+    assert "Access-Control-Allow-Origin" not in h
+    assert "Access-Control-Allow-Credentials" not in h
+
+
+@pytest.mark.asyncio
+async def test_cors_vary_appends_to_existing_value(monkeypatch):
+    # Static responses can already carry a Vary; clobbering it would break
+    # content negotiation.
+    monkeypatch.setattr(main, "_cors_origins", ["https://www.youtube.com"])
+
+    async def handler(request):
+        return web.Response(text="x", headers={"Vary": "Accept-Encoding"})
+
+    app = web.Application()
+    app.router.add_get("/v", handler)
+    app.on_response_prepare.append(main.on_prepare)
+    async with TestClient(TestServer(app)) as client:
+        resp = await client.get("/v", headers={"Origin": "https://www.youtube.com"})
+        assert resp.headers["Vary"] == "Accept-Encoding, Origin"

app/tests/test_config.py

@@ -77,6 +77,34 @@ class ConfigTests(unittest.TestCase):
         self.assertEqual(c.PUBLIC_HOST_URL, "https://ytdl.example.com/")
         self.assertEqual(c.PUBLIC_HOST_AUDIO_URL, "https://audio.example.com/")
 
+    def test_download_dirs_lose_trailing_slash(self):
+        # get_custom_dirs strips the base path as a prefix from each subdirectory,
+        # and the base directory's own path has no trailing slash -- so a trailing
+        # slash here leaked the absolute path into the folder dropdown.
+        with patch.dict(os.environ, _base_env(
+            DOWNLOAD_DIR="/downloads/",
+            AUDIO_DOWNLOAD_DIR="/audio/",
+            TEMP_DIR="/tmp/",
+            STATE_DIR="/state/",
+        ), clear=False):
+            c = Config()
+        self.assertEqual(c.DOWNLOAD_DIR, "/downloads")
+        self.assertEqual(c.AUDIO_DOWNLOAD_DIR, "/audio")
+        self.assertEqual(c.TEMP_DIR, "/tmp")
+        self.assertEqual(c.STATE_DIR, "/state")
+
+    def test_root_download_dir_survives_normalisation(self):
+        with patch.dict(os.environ, _base_env(DOWNLOAD_DIR="/", AUDIO_DOWNLOAD_DIR="///"), clear=False):
+            c = Config()
+        self.assertEqual(c.DOWNLOAD_DIR, "/")
+        self.assertEqual(c.AUDIO_DOWNLOAD_DIR, "/")
+
+    def test_download_dirs_without_trailing_slash_unchanged(self):
+        with patch.dict(os.environ, _base_env(DOWNLOAD_DIR="/downloads", AUDIO_DOWNLOAD_DIR="."), clear=False):
+            c = Config()
+        self.assertEqual(c.DOWNLOAD_DIR, "/downloads")
+        self.assertEqual(c.AUDIO_DOWNLOAD_DIR, ".")
+
     def test_ytdl_options_json_loaded(self):
         opts = {"quiet": True, "no_warnings": True}
         with patch.dict(

app/tests/test_download_queue.py

@@ -330,7 +330,7 @@ async def test_retry_restores_playlist_output_context(dq_env):
         chapter_template="",
     )
     failed_info.status = "error"
-    dq.done.put(Download(None, None, None, None, "best", "any", {}, failed_info))
+    await dq.done.put(Download(None, None, None, None, "best", "any", {}, failed_info))
 
     def fake_extract(self, extracted_url, *_args, **_kwargs):
         return {
@@ -389,7 +389,7 @@ async def test_retry_keeps_playlist_context_through_url_indirection(dq_env):
     dq = DownloadQueue(dq_env, notifier)
     url = "https://example.com/watch?v=1"
     resolved = "https://example.com/resolved?v=1"
-    dq.done.put(Download(None, None, None, None, "best", "any", {}, _failed_playlist_item(url)))
+    await dq.done.put(Download(None, None, None, None, "best", "any", {}, _failed_playlist_item(url)))
 
     def fake_extract(self, extracted_url, *_args, **_kwargs):
         if extracted_url == url:
@@ -427,7 +427,7 @@ async def test_retry_reapplies_current_options_gates(dq_env):
         ytdl_options_presets=["Still There", "Removed Preset"],
         ytdl_options_overrides={"paths": {"home": "/etc"}},
     )
-    dq.done.put(Download(None, None, None, None, "best", "any", {}, info))
+    await dq.done.put(Download(None, None, None, None, "best", "any", {}, info))
 
     def fake_extract(self, extracted_url, *_args, **_kwargs):
         return {
@@ -457,7 +457,7 @@ async def test_retry_keeps_overrides_while_still_allowed(dq_env):
     dq = DownloadQueue(dq_env, notifier)
     url = "https://example.com/watch?v=1"
     info = _failed_playlist_item(url, ytdl_options_overrides={"writesubtitles": True})
-    dq.done.put(Download(None, None, None, None, "best", "any", {}, info))
+    await dq.done.put(Download(None, None, None, None, "best", "any", {}, info))
 
     def fake_extract(self, extracted_url, *_args, **_kwargs):
         return {
@@ -476,6 +476,32 @@ async def test_retry_keeps_overrides_while_still_allowed(dq_env):
     assert dq.queue.get(url).info.ytdl_options_overrides == {"writesubtitles": True}
 
 
+@pytest.mark.asyncio
+async def test_retry_carries_the_sponsorblock_flag(dq_env):
+    notifier = AsyncMock()
+    dq = DownloadQueue(dq_env, notifier)
+    url = "https://example.com/watch?v=1"
+    await dq.done.put(
+        Download(None, None, None, None, "best", "any", {}, _failed_playlist_item(url, sponsorblock=True))
+    )
+
+    def fake_extract(self, extracted_url, *_args, **_kwargs):
+        return {
+            "_type": "video",
+            "id": "vid1",
+            "title": "Test Video",
+            "url": extracted_url,
+            "webpage_url": extracted_url,
+        }
+
+    with patch.object(DownloadQueue, "_DownloadQueue__extract_info", fake_extract), \
+         patch.object(DownloadQueue, "_DownloadQueue__start_download", new=AsyncMock()):
+        result = await dq.retry(url)
+
+    assert result["status"] == "ok"
+    assert dq.queue.get(url).info.sponsorblock is True
+
+
 @pytest.mark.asyncio
 async def test_add_entry_duplicate_while_pending_is_skipped_not_clobbered(dq_env):
     notifier = AsyncMock()
@@ -1415,9 +1441,9 @@ async def test_post_download_cleanup_clears_filename_on_error(dq_env):
     notifier = AsyncMock()
     dq = DownloadQueue(dq_env, notifier)
     download = _make_download(dq_env, status="downloading", filename="../tmp/partial.mp4")
-    dq.queue.put(download)
+    await dq.queue.put(download)
 
-    dq._post_download_cleanup(download)
+    await dq._post_download_cleanup(download)
 
     assert download.info.status == "error"
     assert download.info.filename is None
@@ -1430,9 +1456,9 @@ async def test_post_download_cleanup_keeps_captured_subtitles_on_error(dq_env):
     dq = DownloadQueue(dq_env, notifier)
     download = _make_download(dq_env, download_type="captions", status="downloading", filename="en.srt")
     download.info.subtitle_files = [{"filename": "en.srt", "size": 42}]
-    dq.queue.put(download)
+    await dq.queue.put(download)
 
-    dq._post_download_cleanup(download)
+    await dq._post_download_cleanup(download)
 
     assert download.info.status == "error"
     assert download.info.filename == "en.srt"
@@ -1452,7 +1478,7 @@ async def test_clear_skips_deletion_outside_download_directory(dq_env):
     # A crafted/legacy relative filename that escapes DOWNLOAD_DIR via '..'.
     escaping_filename = os.path.relpath(outside_file, dq_env.DOWNLOAD_DIR)
     download = _make_download(dq_env, status="finished", filename=escaping_filename)
-    dq.done.put(download)
+    await dq.done.put(download)
 
     await dq.clear([download.info.url])
 

app/tests/test_main_helpers.py

@@ -313,3 +313,40 @@ class GetCustomDirsTests(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class WarnIfCookiefileShadowedTests(unittest.TestCase):
+    """Issue #881: an uploaded cookies file wins over an operator-configured
+    cookiefile, and used to do so with no way for anyone to notice."""
+
+    def setUp(self):
+        self._saved = main.config.YTDL_OPTIONS
+        main.config.YTDL_OPTIONS = dict(self._saved)
+
+    def tearDown(self):
+        main.config.YTDL_OPTIONS = self._saved
+
+    def test_warns_when_a_different_cookiefile_is_configured(self):
+        main.config.YTDL_OPTIONS["cookiefile"] = "/cookies/cookies.txt"
+        with self.assertLogs("main", level="WARNING") as cm:
+            main.warn_if_cookiefile_shadowed()
+        joined = "\n".join(cm.output)
+        self.assertIn("/cookies/cookies.txt", joined)
+        self.assertIn(main.COOKIES_PATH, joined)
+
+    def test_silent_when_no_cookiefile_configured(self):
+        main.config.YTDL_OPTIONS.pop("cookiefile", None)
+        with self.assertNoLogs("main", level="WARNING"):
+            main.warn_if_cookiefile_shadowed()
+
+    def test_silent_when_configured_file_is_the_uploaded_one(self):
+        # The steady state after an upload: re-running must not nag.
+        main.config.YTDL_OPTIONS["cookiefile"] = main.COOKIES_PATH
+        with self.assertNoLogs("main", level="WARNING"):
+            main.warn_if_cookiefile_shadowed()
+
+    def test_silent_on_non_string_or_empty_values(self):
+        for value in (None, "", 0, [], {}):
+            main.config.YTDL_OPTIONS["cookiefile"] = value
+            with self.assertNoLogs("main", level="WARNING"):
+                main.warn_if_cookiefile_shadowed()

app/tests/test_persistent_queue.py

@@ -2,8 +2,11 @@
 
 from __future__ import annotations
 
+import asyncio
 import json
 import os
+import threading
+import time
 import shelve
 import sys
 import tempfile
@@ -69,22 +72,22 @@ def _create_legacy_shelf(path: str, *infos: DownloadInfo) -> None:
             shelf[info.url] = info
 
 
-class PersistentQueueTests(unittest.TestCase):
-    def test_put_get_delete_roundtrip(self):
+class PersistentQueueTests(unittest.IsolatedAsyncioTestCase):
+    async def test_put_get_delete_roundtrip(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq = PersistentQueue("queue", path)
             dl = _FakeDownload(_make_info("http://a.example"))
-            pq.put(dl)
+            await pq.put(dl)
             self.assertTrue(os.path.exists(path + ".json"))
             self.assertTrue(pq.exists("http://a.example"))
             self.assertFalse(pq.empty())
             got = pq.get("http://a.example")
             self.assertEqual(got.info.url, "http://a.example")
-            pq.delete("http://a.example")
+            await pq.delete("http://a.example")
             self.assertFalse(pq.exists("http://a.example"))
 
-    def test_saved_items_sorted_by_timestamp(self):
+    async def test_saved_items_sorted_by_timestamp(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq = PersistentQueue("queue", path)
@@ -92,16 +95,16 @@ class PersistentQueueTests(unittest.TestCase):
             b = _FakeDownload(_make_info("http://second.example"))
             a.info.timestamp = 100
             b.info.timestamp = 200
-            pq.put(a)
-            pq.put(b)
+            await pq.put(a)
+            await pq.put(b)
             keys = [k for k, _ in pq.saved_items()]
             self.assertEqual(keys, ["http://first.example", "http://second.example"])
 
-    def test_load_restores_from_json(self):
+    async def test_load_restores_from_json(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq1 = PersistentQueue("queue", path)
-            pq1.put(_FakeDownload(_make_info("http://load.example")))
+            await pq1.put(_FakeDownload(_make_info("http://load.example")))
             pq2 = PersistentQueue("queue", path)
             pq2.load()
             self.assertTrue(pq2.exists("http://load.example"))
@@ -115,7 +118,7 @@ class PersistentQueueTests(unittest.TestCase):
             self.assertTrue(pq.exists("http://legacy.example"))
             self.assertTrue(os.path.exists(path + ".json"))
 
-    def test_queue_persists_only_compact_entry_subset(self):
+    async def test_queue_persists_only_compact_entry_subset(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq = PersistentQueue("queue", path)
@@ -128,7 +131,7 @@ class PersistentQueueTests(unittest.TestCase):
                 "formats": [{"id": "huge"}],
                 "description": "very large payload",
             }
-            pq.put(_FakeDownload(info))
+            await pq.put(_FakeDownload(info))
 
             with open(path + ".json", encoding="utf-8") as f:
                 payload = json.load(f)
@@ -146,7 +149,7 @@ class PersistentQueueTests(unittest.TestCase):
             self.assertNotIn("formats", record["entry"])
             self.assertNotIn("description", record["entry"])
 
-    def test_completed_queue_persists_only_failed_retry_context(self):
+    async def test_completed_queue_persists_only_failed_retry_context(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "completed")
             pq = PersistentQueue("completed", path)
@@ -161,7 +164,7 @@ class PersistentQueueTests(unittest.TestCase):
                 "formats": [{"id": "huge"}],
             }
             info.filename = "done.mp4"
-            pq.put(_FakeDownload(info))
+            await pq.put(_FakeDownload(info))
 
             with open(path + ".json", encoding="utf-8") as f:
                 payload = json.load(f)
@@ -180,7 +183,7 @@ class PersistentQueueTests(unittest.TestCase):
             self.assertEqual(record["filename"], "done.mp4")
 
             info.status = "finished"
-            pq.put(_FakeDownload(info))
+            await pq.put(_FakeDownload(info))
             with open(path + ".json", encoding="utf-8") as f:
                 payload = json.load(f)
             self.assertNotIn("entry", payload["items"][0]["info"])
@@ -256,7 +259,7 @@ class PersistentQueueTests(unittest.TestCase):
             self.assertNotIn("speed", record)
             self.assertNotIn("eta", record)
 
-    def test_put_rollbacks_in_memory_queue_when_state_write_fails(self):
+    async def test_put_rollbacks_in_memory_queue_when_state_write_fails(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq = PersistentQueue("queue", path)
@@ -272,18 +275,18 @@ class PersistentQueueTests(unittest.TestCase):
 
             with patch("ytdl.AtomicJsonStore.save", bad_save):
                 with self.assertRaises(OSError):
-                    pq.put(dl)
+                    await pq.put(dl)
 
             self.assertFalse(pq.exists("http://rollback.example"))
 
-    def test_put_rollbacks_to_previous_download_when_replace_fails(self):
+    async def test_put_rollbacks_to_previous_download_when_replace_fails(self):
         with tempfile.TemporaryDirectory() as tmp:
             path = os.path.join(tmp, "queue")
             pq = PersistentQueue("queue", path)
             first = _FakeDownload(_make_info("http://same.example"))
             second = _FakeDownload(_make_info("http://same.example"))
             second.info.title = "Replaced title"
-            pq.put(first)
+            await pq.put(first)
 
             orig_save = __import__("state_store").AtomicJsonStore.save
 
@@ -294,10 +297,68 @@ class PersistentQueueTests(unittest.TestCase):
 
             with patch("ytdl.AtomicJsonStore.save", bad_save):
                 with self.assertRaises(OSError):
-                    pq.put(second)
+                    await pq.put(second)
 
             self.assertEqual(pq.get("http://same.example").info.title, "Title")
 
 
+class StateWriteOffEventLoopTests(unittest.IsolatedAsyncioTestCase):
+    """State writes fsync twice; on a slow disk that must not stall the loop.
+
+    Before this, put()/delete() wrote inline, so a queue mutation blocked every
+    other request the server was serving for as long as the filesystem took.
+    See issue #980.
+    """
+
+    async def test_save_runs_off_the_event_loop_thread(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            pq = PersistentQueue("queue", os.path.join(tmp, "queue"))
+            self.addCleanup(pq.close)
+            loop_thread = threading.get_ident()
+            save_threads = []
+
+            orig_save = __import__("state_store").AtomicJsonStore.save
+
+            def recording_save(store, data):
+                save_threads.append(threading.get_ident())
+                return orig_save(store, data)
+
+            with patch("ytdl.AtomicJsonStore.save", recording_save):
+                await pq.put(_FakeDownload(_make_info("http://a.example")))
+
+            self.assertEqual(len(save_threads), 1)
+            self.assertNotEqual(save_threads[0], loop_thread)
+
+    async def test_a_slow_write_does_not_stall_other_coroutines(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            pq = PersistentQueue("queue", os.path.join(tmp, "queue"))
+            self.addCleanup(pq.close)
+            orig_save = __import__("state_store").AtomicJsonStore.save
+
+            def slow_save(store, data):
+                time.sleep(0.3)
+                return orig_save(store, data)
+
+            ticks = 0
+
+            async def ticker():
+                nonlocal ticks
+                while True:
+                    await asyncio.sleep(0.01)
+                    ticks += 1
+
+            ticking = asyncio.create_task(ticker())
+            try:
+                with patch("ytdl.AtomicJsonStore.save", slow_save):
+                    await pq.put(_FakeDownload(_make_info("http://a.example")))
+            finally:
+                ticking.cancel()
+
+            # An inline write would have starved the loop for the whole 0.3s and
+            # left ticks at 0.
+            self.assertGreater(ticks, 5)
+            self.assertTrue(pq.exists("http://a.example"))
+
+
 if __name__ == "__main__":
     unittest.main()

app/tests/test_subscriptions.py

@@ -479,6 +479,69 @@ class SubscriptionPersistenceTests(unittest.IsolatedAsyncioTestCase):
             self.assertEqual(reloaded.get(sub_id).clip_start, 12.5)
             self.assertIsNone(reloaded.get(sub_id).clip_end)
 
+    async def test_check_now_applies_subscription_sponsorblock(self):
+        """Subscriptions download unattended, so the sponsor-segment removal has
+        to reach every entry the subscription queues, not just manual adds."""
+        with tempfile.TemporaryDirectory() as tmp:
+            queue = _Queue()
+            mgr = SubscriptionManager(_Config(tmp), queue, _Notifier())
+
+            with patch(
+                "subscriptions.extract_flat_playlist",
+                side_effect=[
+                    (
+                        {"_type": "channel", "title": "Channel"},
+                        [{"id": "v1", "title": "One", "webpage_url": "https://example.com/v1"}],
+                    ),
+                    (
+                        {"_type": "channel", "title": "Channel"},
+                        [
+                            {"id": "v2", "title": "Two", "webpage_url": "https://example.com/v2"},
+                            {"id": "v1", "title": "One", "webpage_url": "https://example.com/v1"},
+                        ],
+                    ),
+                ],
+            ):
+                result = await mgr.add_subscription(
+                    "https://example.com/channel",
+                    check_interval_minutes=60,
+                    download_type="video",
+                    codec="auto",
+                    format="any",
+                    quality="best",
+                    folder="",
+                    custom_name_prefix="",
+                    auto_start=True,
+                    playlist_item_limit=0,
+                    split_by_chapters=False,
+                    chapter_template="",
+                    subtitle_language="en",
+                    subtitle_mode="prefer_manual",
+                    sponsorblock=True,
+                )
+                sub_id = result["subscription"]["id"]
+                self.assertTrue(mgr.get(sub_id).sponsorblock)
+                await mgr.check_now([sub_id])
+
+            self.assertEqual(len(queue.entries), 1)
+            _entry, _args, kwargs = queue.entries[0]
+            self.assertIs(kwargs["sponsorblock"], True)
+
+    async def test_sponsorblock_survives_reload_and_defaults_to_false(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            cfg = _Config(tmp)
+            mgr = SubscriptionManager(cfg, _Queue(), _Notifier())
+            sub_id = await self._add_one_subscription(mgr)
+            # Records written before the field existed simply take the default.
+            self.assertFalse(mgr.get(sub_id).sponsorblock)
+
+            mgr.get(sub_id).sponsorblock = True
+            async with mgr._lock:
+                mgr._save_locked()
+
+            reloaded = SubscriptionManager(cfg, _Queue(), _Notifier())
+            self.assertTrue(reloaded.get(sub_id).sponsorblock)
+
     async def test_check_now_queues_subscriber_only_when_skip_disabled(self):
         with tempfile.TemporaryDirectory() as tmp:
             queue = _Queue()

app/tests/test_url_guard.py

@@ -12,7 +12,7 @@ from url_guard import (
     _address_allowed_at_connect,
     _address_is_global,
     _guarded_getaddrinfo,
-    _proxy_endpoint,
+    _url_endpoint,
     install_socket_guard,
 )
 
@@ -121,19 +121,19 @@ class ConnectAddressPolicyTests(unittest.TestCase):
         self.assertFalse(_address_allowed_at_connect("::1"))
 
     def test_loopback_allowed_only_when_opted_in(self):
-        self.assertTrue(_address_allowed_at_connect("127.0.0.1", is_proxy_endpoint=True))
-        self.assertTrue(_address_allowed_at_connect("::1", is_proxy_endpoint=True))
+        self.assertTrue(_address_allowed_at_connect("127.0.0.1", is_allowed_endpoint=True))
+        self.assertTrue(_address_allowed_at_connect("::1", is_allowed_endpoint=True))
 
     def test_proxy_opt_in_covers_any_internal_range(self):
         # A proxy is just as legitimately on the LAN or a VPN range as on
         # loopback (#1055): the allowance follows the operator's configured
         # endpoint, not a particular address family.
-        self.assertTrue(_address_allowed_at_connect("10.1.20.30", is_proxy_endpoint=True))
-        self.assertTrue(_address_allowed_at_connect("192.168.1.10", is_proxy_endpoint=True))
-        self.assertTrue(_address_allowed_at_connect("fd00::1", is_proxy_endpoint=True))
+        self.assertTrue(_address_allowed_at_connect("10.1.20.30", is_allowed_endpoint=True))
+        self.assertTrue(_address_allowed_at_connect("192.168.1.10", is_allowed_endpoint=True))
+        self.assertTrue(_address_allowed_at_connect("fd00::1", is_allowed_endpoint=True))
 
     def test_opt_in_still_rejects_non_addresses(self):
-        self.assertFalse(_address_allowed_at_connect("not-an-ip", is_proxy_endpoint=True))
+        self.assertFalse(_address_allowed_at_connect("not-an-ip", is_allowed_endpoint=True))
 
     def test_link_local_metadata_blocked(self):
         self.assertFalse(_address_allowed_at_connect("169.254.169.254"))
@@ -187,36 +187,36 @@ class TunnelledIPv4Tests(unittest.TestCase):
             self.assertIsNotNone(validate_url("http://nat64.example/x"))
 
 
-class ProxyEndpointParsingTests(unittest.TestCase):
+class EndpointParsingTests(unittest.TestCase):
     def test_explicit_port(self):
-        self.assertEqual(_proxy_endpoint("http://127.0.0.1:9050"), ("127.0.0.1", 9050))
+        self.assertEqual(_url_endpoint("http://127.0.0.1:9050"), ("127.0.0.1", 9050))
 
     def test_default_port_per_scheme(self):
-        self.assertEqual(_proxy_endpoint("socks5://127.0.0.1"), ("127.0.0.1", 1080))
-        self.assertEqual(_proxy_endpoint("http://127.0.0.1"), ("127.0.0.1", 80))
+        self.assertEqual(_url_endpoint("socks5://127.0.0.1"), ("127.0.0.1", 1080))
+        self.assertEqual(_url_endpoint("http://127.0.0.1"), ("127.0.0.1", 80))
 
     def test_bare_host_port(self):
-        self.assertEqual(_proxy_endpoint("127.0.0.1:8080"), ("127.0.0.1", 8080))
+        self.assertEqual(_url_endpoint("127.0.0.1:8080"), ("127.0.0.1", 8080))
 
     def test_hostname_lowercased(self):
-        self.assertEqual(_proxy_endpoint("http://LocalHost.:9050"), ("localhost", 9050))
+        self.assertEqual(_url_endpoint("http://LocalHost.:9050"), ("localhost", 9050))
 
     def test_ipv6_literal(self):
-        self.assertEqual(_proxy_endpoint("http://[::1]:9050"), ("::1", 9050))
+        self.assertEqual(_url_endpoint("http://[::1]:9050"), ("::1", 9050))
 
     def test_empty_and_invalid(self):
-        self.assertIsNone(_proxy_endpoint(""))
-        self.assertIsNone(_proxy_endpoint("   "))
-        self.assertIsNone(_proxy_endpoint(None))
-        self.assertIsNone(_proxy_endpoint("http://"))
+        self.assertIsNone(_url_endpoint(""))
+        self.assertIsNone(_url_endpoint("   "))
+        self.assertIsNone(_url_endpoint(None))
+        self.assertIsNone(_url_endpoint("http://"))
 
 
 class GuardedGetaddrinfoTests(unittest.TestCase):
     def setUp(self):
         # Default state: no proxy configured, so no loopback destination allowed.
-        saved = set(url_guard._allowed_proxy_endpoints)
-        url_guard._allowed_proxy_endpoints = set()
-        self.addCleanup(lambda: setattr(url_guard, "_allowed_proxy_endpoints", saved))
+        saved = set(url_guard._allowed_endpoints)
+        url_guard._allowed_endpoints = set()
+        self.addCleanup(lambda: setattr(url_guard, "_allowed_endpoints", saved))
 
     def test_internal_only_raises(self):
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("169.254.169.254")):
@@ -235,27 +235,27 @@ class GuardedGetaddrinfoTests(unittest.TestCase):
             with self.assertRaises(socket.gaierror):
                 _guarded_getaddrinfo("127.0.0.1", 9999)
 
-    def test_loopback_allowed_at_configured_proxy_endpoint(self):
-        url_guard._allowed_proxy_endpoints = {("127.0.0.1", 9050)}
+    def test_loopback_allowed_at_configured_url_endpoint(self):
+        url_guard._allowed_endpoints = {("127.0.0.1", 9050)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
             results = _guarded_getaddrinfo("127.0.0.1", 9050)
         self.assertEqual([r[4][0] for r in results], ["127.0.0.1"])
 
     def test_loopback_blocked_at_other_port_on_proxy_host(self):
         # Same host as the proxy, different port: still off limits.
-        url_guard._allowed_proxy_endpoints = {("127.0.0.1", 9050)}
+        url_guard._allowed_endpoints = {("127.0.0.1", 9050)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
             with self.assertRaises(socket.gaierror):
                 _guarded_getaddrinfo("127.0.0.1", 9999)
 
     def test_proxy_reachable_by_hostname(self):
-        url_guard._allowed_proxy_endpoints = {("localhost", 9050)}
+        url_guard._allowed_endpoints = {("localhost", 9050)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
             results = _guarded_getaddrinfo("localhost", 9050)
         self.assertEqual([r[4][0] for r in results], ["127.0.0.1"])
 
     def test_string_port_is_normalised(self):
-        url_guard._allowed_proxy_endpoints = {("127.0.0.1", 9050)}
+        url_guard._allowed_endpoints = {("127.0.0.1", 9050)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
             results = _guarded_getaddrinfo("127.0.0.1", "9050")
         self.assertEqual([r[4][0] for r in results], ["127.0.0.1"])
@@ -263,22 +263,38 @@ class GuardedGetaddrinfoTests(unittest.TestCase):
     def test_lan_proxy_reachable(self):
         # #1055: a socks5 proxy on the LAN, refused while the allowance was
         # loopback-only, which pushed operators to ALLOW_PRIVATE_ADDRESSES.
-        url_guard._allowed_proxy_endpoints = {("10.1.20.30", 1080)}
+        url_guard._allowed_endpoints = {("10.1.20.30", 1080)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("10.1.20.30")):
             results = _guarded_getaddrinfo("10.1.20.30", 1080)
         self.assertEqual([r[4][0] for r in results], ["10.1.20.30"])
 
     def test_other_lan_host_still_blocked(self):
         # The allowance is the proxy's endpoint, not its subnet.
-        url_guard._allowed_proxy_endpoints = {("10.1.20.30", 1080)}
+        url_guard._allowed_endpoints = {("10.1.20.30", 1080)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("10.1.20.31")):
             with self.assertRaises(socket.gaierror):
                 _guarded_getaddrinfo("10.1.20.31", 1080)
 
+    def test_pot_provider_reachable_on_loopback(self):
+        # #1064: the bundled PO token provider listens on loopback, and blocking
+        # it left every default install downloading YouTube without a token.
+        url_guard._allowed_endpoints = {("127.0.0.1", 4416)}
+        with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
+            results = _guarded_getaddrinfo("127.0.0.1", 4416)
+        self.assertEqual([r[4][0] for r in results], ["127.0.0.1"])
+
+    def test_other_loopback_service_still_blocked(self):
+        # MeTube's own port is one hop away on the same interface: allowing the
+        # token provider must not allow the rest of loopback.
+        url_guard._allowed_endpoints = {("127.0.0.1", 4416)}
+        with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("127.0.0.1")):
+            with self.assertRaises(socket.gaierror):
+                _guarded_getaddrinfo("127.0.0.1", 8081)
+
     def test_proxy_address_not_borrowable_by_another_host(self):
         # Matching is on the configured host string: a manifest URL that resolves
         # to the proxy's address under its own name gets no allowance.
-        url_guard._allowed_proxy_endpoints = {("10.1.20.30", 1080)}
+        url_guard._allowed_endpoints = {("10.1.20.30", 1080)}
         with mock.patch("url_guard._real_getaddrinfo", return_value=_addrinfo("10.1.20.30")):
             with self.assertRaises(socket.gaierror):
                 _guarded_getaddrinfo("evil.example", 1080)
@@ -312,9 +328,9 @@ class AllowPrivateBypassTests(unittest.TestCase):
 
 class InstallSocketGuardTests(unittest.TestCase):
     def setUp(self):
-        original, saved = socket.getaddrinfo, set(url_guard._allowed_proxy_endpoints)
+        original, saved = socket.getaddrinfo, set(url_guard._allowed_endpoints)
         self.addCleanup(lambda: setattr(socket, "getaddrinfo", original))
-        self.addCleanup(lambda: setattr(url_guard, "_allowed_proxy_endpoints", saved))
+        self.addCleanup(lambda: setattr(url_guard, "_allowed_endpoints", saved))
         # Keep the host's own environment out of the assertions below.
         patcher = mock.patch("url_guard.urllib.request.getproxies", return_value={})
         self.getproxies = patcher.start()
@@ -329,26 +345,45 @@ class InstallSocketGuardTests(unittest.TestCase):
 
     def test_no_proxy_means_no_loopback_allowance(self):
         install_socket_guard()
-        self.assertEqual(url_guard._allowed_proxy_endpoints, set())
+        self.assertEqual(url_guard._allowed_endpoints, set())
 
     def test_explicit_proxy_is_registered(self):
         install_socket_guard(proxy_urls=("socks5://127.0.0.1:9050",))
-        self.assertEqual(url_guard._allowed_proxy_endpoints, {("127.0.0.1", 9050)})
+        self.assertEqual(url_guard._allowed_endpoints, {("127.0.0.1", 9050)})
 
     def test_unset_proxy_option_is_ignored(self):
         # ytdl_opts.get('proxy') is None when the operator configured no proxy.
         install_socket_guard(proxy_urls=(None,))
-        self.assertEqual(url_guard._allowed_proxy_endpoints, set())
+        self.assertEqual(url_guard._allowed_endpoints, set())
 
     def test_environment_proxies_are_registered(self):
         self.getproxies.return_value = {"http": "http://127.0.0.1:8080"}
         install_socket_guard()
-        self.assertEqual(url_guard._allowed_proxy_endpoints, {("127.0.0.1", 8080)})
+        self.assertEqual(url_guard._allowed_endpoints, {("127.0.0.1", 8080)})
+
+    def test_service_url_is_registered(self):
+        install_socket_guard(service_urls=("http://127.0.0.1:4416",))
+        self.assertEqual(url_guard._allowed_endpoints, {("127.0.0.1", 4416)})
+
+    def test_service_and_proxy_endpoints_coexist(self):
+        install_socket_guard(
+            proxy_urls=("socks5://10.1.20.30:1080",),
+            service_urls=("http://127.0.0.1:4416",),
+        )
+        self.assertEqual(
+            url_guard._allowed_endpoints,
+            {("10.1.20.30", 1080), ("127.0.0.1", 4416)},
+        )
+
+    def test_service_urls_reset_between_installs(self):
+        install_socket_guard(service_urls=("http://127.0.0.1:4416",))
+        install_socket_guard()
+        self.assertEqual(url_guard._allowed_endpoints, set())
 
     def test_endpoints_reset_between_installs(self):
         install_socket_guard(proxy_urls=("http://127.0.0.1:8080",))
         install_socket_guard(proxy_urls=(None,))
-        self.assertEqual(url_guard._allowed_proxy_endpoints, set())
+        self.assertEqual(url_guard._allowed_endpoints, set())
 
 
 if __name__ == "__main__":

app/tests/test_ytdl_utils.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import os
 import pickle
 import signal
@@ -11,7 +12,8 @@ import threading
 import types
 import unittest
 from pathlib import Path
-from unittest.mock import MagicMock, patch
+from concurrent.futures import ThreadPoolExecutor
+from unittest.mock import AsyncMock, MagicMock, patch
 
 fake_yt_dlp = types.ModuleType("yt_dlp")
 fake_networking = types.ModuleType("yt_dlp.networking")
@@ -77,6 +79,7 @@ from ytdl import (
     MusicMetadataPreProcessor,
     _compact_persisted_entry,
     _convert_srt_to_txt_file,
+    _pot_provider_urls,
     _AlbumArtistPostProcessor,
     _resolve_outtmpl_fields,
     _sanitize_entry_for_pickle,
@@ -678,6 +681,69 @@ class DownloadResultTests(unittest.TestCase):
         )
 
 
+def _capture_ytdl_params(download: Download) -> dict:
+    """Run ``_download`` far enough to capture the params it builds."""
+    fake_ydl = MagicMock()
+    fake_ydl.download.return_value = 0
+    download.status_queue = types.SimpleNamespace(put=lambda _: None)
+
+    with patch('ytdl.install_socket_guard'), \
+            patch.object(Download, '_make_youtube_dl', return_value=fake_ydl) as make:
+        download._download()
+
+    params, = make.call_args.args
+    return params
+
+
+class SponsorBlockPostprocessorTests(unittest.TestCase):
+    def test_no_sponsorblock_postprocessors_when_disabled(self):
+        download = _make_test_download()
+
+        params = _capture_ytdl_params(download)
+
+        keys = [pp['key'] for pp in params.get('postprocessors', [])]
+        self.assertNotIn('SponsorBlock', keys)
+        self.assertNotIn('ModifyChapters', keys)
+
+    def test_sponsorblock_pair_matches_the_cli(self):
+        download = _make_test_download()
+        download.info.sponsorblock = True
+
+        params = _capture_ytdl_params(download)
+
+        self.assertEqual(
+            params['postprocessors'],
+            [
+                {
+                    'key': 'SponsorBlock',
+                    'categories': ['sponsor'],
+                    'when': 'after_filter',
+                },
+                {
+                    'key': 'ModifyChapters',
+                    'remove_sponsor_segments': ['sponsor'],
+                    'force_keyframes': False,
+                },
+            ],
+        )
+
+    def test_segment_removal_runs_before_the_chapter_split(self):
+        # yt-dlp runs same-stage postprocessors in list order, so ModifyChapters
+        # has to rewrite the chapter list before FFmpegSplitChapters cuts the
+        # file up -- the order the CLI builds for
+        # --sponsorblock-remove sponsor --split-chapters.
+        download = _make_test_download()
+        download.info.sponsorblock = True
+        download.info.split_by_chapters = True
+        download.info.chapter_template = '%(section_number)s.%(ext)s'
+
+        params = _capture_ytdl_params(download)
+
+        keys = [pp['key'] for pp in params['postprocessors']]
+        self.assertEqual(keys, ['SponsorBlock', 'ModifyChapters', 'FFmpegSplitChapters'])
+        self.assertEqual(params['outtmpl']['chapter'], '%(section_number)s.%(ext)s')
+
+
 class ProgressThrottleTests(unittest.TestCase):
     def test_downloading_ticks_are_throttled(self):
         dl = _make_test_download()
@@ -1071,5 +1137,103 @@ class ShortTitleForFailedUrlTests(unittest.TestCase):
         self.assertEqual(_short_title_for_failed_url(malformed), malformed)
 
 
+class PotProviderUrlsTests(unittest.TestCase):
+    """#1064: the connect-time guard must let the download reach the PO token
+    provider, so it has to know every endpoint yt-dlp might dial for one."""
+
+    def test_bundled_provider_by_default(self):
+        self.assertEqual(_pot_provider_urls({}), ("http://127.0.0.1:4416",))
+
+    def test_configured_base_url_is_added(self):
+        urls = _pot_provider_urls({
+            "extractor_args": {"youtubepot-bgutilhttp": {"base_url": ["http://pot:4416"]}},
+        })
+        # The bundled server runs regardless, so both stay reachable.
+        self.assertEqual(urls, ("http://127.0.0.1:4416", "http://pot:4416"))
+
+    def test_deprecated_base_url_arg_is_honoured(self):
+        urls = _pot_provider_urls({
+            "extractor_args": {"youtube": {"getpot_bgutil_baseurl": ["http://pot:4416"]}},
+        })
+        self.assertEqual(urls, ("http://127.0.0.1:4416", "http://pot:4416"))
+
+    def test_unrelated_extractor_args_are_ignored(self):
+        urls = _pot_provider_urls({
+            "extractor_args": {"youtube": {"player_client": ["web"]}},
+        })
+        self.assertEqual(urls, ("http://127.0.0.1:4416",))
+
+    def test_malformed_extractor_args_do_not_raise(self):
+        # YTDL_OPTIONS is operator-supplied JSON and reaches here unvalidated.
+        for opts in (
+            {"extractor_args": None},
+            {"extractor_args": "youtube:player_client=web"},
+            {"extractor_args": {"youtubepot-bgutilhttp": "http://pot:4416"}},
+            {"extractor_args": {"youtubepot-bgutilhttp": {"base_url": []}}},
+        ):
+            with self.subTest(opts=opts):
+                self.assertEqual(_pot_provider_urls(opts), ("http://127.0.0.1:4416",))
+
+
 if __name__ == "__main__":
+
     unittest.main()
+
+
+class UpdateStatusFileStatTests(unittest.IsolatedAsyncioTestCase):
+    """The progress path must not touch the filesystem on the event loop.
+
+    yt-dlp reports 'filename' on every progress tick, but until the download
+    finishes that path does not exist yet -- the bytes are in 'tmpfilename'.
+    Stating it per tick meant blocking syscalls on the event loop twice a
+    second per download, always answering None. See issue #980.
+    """
+
+    async def _run_update_status(self, statuses):
+        import queue as _queue
+
+        download = _make_test_download()
+        download.download_dir = "/tmp"
+        source = _queue.Queue()
+        for status in statuses:
+            source.put(status)
+        source.put(None)
+        download.status_queue = source
+        download.loop = asyncio.get_running_loop()
+        download._executor = ThreadPoolExecutor(max_workers=1)
+        notifier = MagicMock()
+        notifier.updated = AsyncMock()
+        download.notifier = notifier
+
+        stat_calls = []
+
+        def record_exists(path):
+            stat_calls.append(path)
+            return False
+
+        try:
+            with patch("ytdl.os.path.exists", side_effect=record_exists):
+                await download.update_status()
+        finally:
+            download._executor.shutdown(wait=True)
+        return download, stat_calls
+
+    async def test_downloading_ticks_do_not_stat_the_output_file(self):
+        ticks = [
+            {"status": "downloading", "filename": "/tmp/v.mp4",
+             "tmpfilename": "/tmp/v.mp4.part", "downloaded_bytes": i}
+            for i in range(1, 6)
+        ]
+        download, stat_calls = await self._run_update_status(ticks)
+
+        self.assertEqual(stat_calls, [])
+        self.assertEqual(download.info.filename, "v.mp4")
+
+    async def test_finished_status_still_stats_the_output_file(self):
+        download, stat_calls = await self._run_update_status([
+            {"status": "downloading", "filename": "/tmp/v.mp4", "downloaded_bytes": 1},
+            {"status": "finished", "filename": "/tmp/v.mp4"},
+        ])
+
+        self.assertEqual(stat_calls, ["/tmp/v.mp4"])
+        self.assertIsNone(download.info.size)

app/url_guard.py

@@ -37,8 +37,8 @@ log = logging.getLogger('url_guard')
 
 _ALLOWED_SCHEMES = ('http', 'https')
 
-# Ports to assume when a configured proxy URL omits one, per proxy scheme.
-_PROXY_DEFAULT_PORTS = {
+# Ports to assume when a configured endpoint URL omits one, per scheme.
+_SCHEME_DEFAULT_PORTS = {
     'http': 80,
     'https': 443,
     'socks4': 1080,
@@ -129,31 +129,32 @@ def _address_is_global(addr: str) -> bool:
     return bool(ips) and all(ip.is_global for ip in ips)
 
 
-def _address_allowed_at_connect(addr: str, is_proxy_endpoint: bool = False) -> bool:
+def _address_allowed_at_connect(addr: str, is_allowed_endpoint: bool = False) -> bool:
     """True if *addr* may be connected to at download time.
 
     Permits global addresses, and anything at all when the destination is an
-    operator-configured proxy (see ``_is_proxy_endpoint``). Internal addresses
-    are otherwise refused with no blanket exception: media URLs that yt-dlp
-    derives from a remote manifest are attacker-controlled and reach this policy
-    without passing ``validate_url``, so any range opened here is a range a
-    hostile playlist can read from the server's own network. Blocks link-local
+    endpoint the operator or the image configured — a proxy, or the PO token
+    provider (see ``_is_allowed_endpoint``). Internal addresses are otherwise
+    refused with no blanket exception: media URLs that yt-dlp derives from a
+    remote manifest are attacker-controlled and reach this policy without passing
+    ``validate_url``, so any range opened here is a range a hostile playlist can
+    read from the server's own network. Blocks link-local
     (cloud metadata at 169.254.169.254), private (RFC1918), loopback,
     unique-local and every other non-global range.
     """
     ips = _ips_to_judge(addr)
     if not ips:
         return False
-    return is_proxy_endpoint or all(ip.is_global for ip in ips)
+    return is_allowed_endpoint or all(ip.is_global for ip in ips)
 
 
-def _proxy_endpoint(proxy_url: str):
-    """Parse a proxy URL into a ``(hostname, port)`` pair, or ``None`` if it has
-    no usable host. Used to scope the internal-address allowance to that endpoint
-    alone."""
-    if not isinstance(proxy_url, str) or not proxy_url.strip():
+def _url_endpoint(url: str):
+    """Parse a configured URL into a ``(hostname, port)`` pair, or ``None`` if it
+    has no usable host. Used to scope the internal-address allowance to that
+    endpoint alone."""
+    if not isinstance(url, str) or not url.strip():
         return None
-    candidate = proxy_url.strip()
+    candidate = url.strip()
     if '://' not in candidate:
         # Bare host:port, as accepted by the *_proxy environment variables.
         candidate = '//' + candidate
@@ -165,23 +166,28 @@ def _proxy_endpoint(proxy_url: str):
     if not hostname:
         return None
     if port is None:
-        port = _PROXY_DEFAULT_PORTS.get(parts.scheme.lower())
+        port = _SCHEME_DEFAULT_PORTS.get(parts.scheme.lower())
     return (hostname.rstrip('.').lower(), port)
 
 
+def _endpoints(urls) -> set:
+    """The parseable endpoints among *urls*, dropping any that name no host."""
+    return {ep for ep in map(_url_endpoint, urls) if ep is not None}
+
+
 def _collect_proxy_endpoints(proxy_urls) -> set:
     """Endpoints of every proxy this download may legitimately dial: the explicit
     yt-dlp ``proxy`` option plus the ``*_proxy`` environment variables yt-dlp falls
     back to. All are operator-configured, unlike the URLs inside fetched media."""
     candidates = list(proxy_urls) + list(urllib.request.getproxies().values())
-    return {ep for ep in map(_proxy_endpoint, candidates) if ep is not None}
+    return _endpoints(candidates)
 
 
 # Captured at import so re-installing the guard never wraps the wrapper.
 _real_getaddrinfo = socket.getaddrinfo
 
 # Populated by install_socket_guard; empty means no internal destination is allowed.
-_allowed_proxy_endpoints: set = set()
+_allowed_endpoints: set = set()
 
 
 def _normalise_port(port):
@@ -196,28 +202,29 @@ def _normalise_port(port):
     return port
 
 
-def _is_proxy_endpoint(host, port) -> bool:
-    """True when host:port is exactly an endpoint the operator configured as a
-    proxy. Matching is on the configured host *string*, not on the resolved
-    address, so a hostile media URL cannot borrow the allowance by resolving to
-    the same address under a different name."""
-    if not _allowed_proxy_endpoints or host is None:
+def _is_allowed_endpoint(host, port) -> bool:
+    """True when host:port is exactly one of the endpoints this download is
+    configured to dial — a proxy or the PO token provider. Matching is on the
+    configured host *string*, not on the resolved address, so a hostile media URL
+    cannot borrow the allowance by resolving to the same address under a
+    different name."""
+    if not _allowed_endpoints or host is None:
         return False
-    return (str(host).rstrip('.').lower(), _normalise_port(port)) in _allowed_proxy_endpoints
+    return (str(host).rstrip('.').lower(), _normalise_port(port)) in _allowed_endpoints
 
 
 def _guarded_getaddrinfo(host, *args, **kwargs):
     results = _real_getaddrinfo(host, *args, **kwargs)
     # Mirrors getaddrinfo(host, port, ...): port is the first optional argument.
     port = args[0] if args else kwargs.get('port')
-    is_proxy = _is_proxy_endpoint(host, port)
-    allowed = [r for r in results if _address_allowed_at_connect(r[4][0], is_proxy)]
+    is_configured = _is_allowed_endpoint(host, port)
+    allowed = [r for r in results if _address_allowed_at_connect(r[4][0], is_configured)]
     if not allowed:
         raise socket.gaierror(f'Refusing to connect to non-global address for host {host!r}')
     return allowed
 
 
-def install_socket_guard(allow_private: bool = False, proxy_urls=()) -> None:
+def install_socket_guard(allow_private: bool = False, proxy_urls=(), service_urls=()) -> None:
     """Enforce the no-internal-hosts policy at actual connection time.
 
     ``validate_url`` only checks the *submitted* URL string; yt-dlp then follows
@@ -230,12 +237,16 @@ def install_socket_guard(allow_private: bool = False, proxy_urls=()) -> None:
     isolation as the backstop.
 
     *proxy_urls* are the operator's configured proxies (yt-dlp's ``proxy`` option;
-    the ``*_proxy`` environment variables are picked up automatically). A proxy is
-    reachable at its own host:port wherever it lives — loopback, the LAN, a VPN
-    range — and nothing else internal is. That costs proxied setups nothing and
-    gives away nothing: yt-dlp resolves the proxy itself at exactly that host:port,
-    and a media URL is either handed to the proxy unresolved or resolved on its own
-    merits — never inheriting the proxy's allowance.
+    the ``*_proxy`` environment variables are picked up automatically), and
+    *service_urls* the helper services the download itself has to reach — the PO
+    token provider this image ships and starts on loopback. Each is reachable at
+    its own host:port wherever it lives — loopback, the LAN, a VPN range — and
+    nothing else internal is. That costs those setups nothing and gives away
+    little: yt-dlp dials each at exactly that host:port, and a media URL is either
+    handed to the proxy unresolved or resolved on its own merits — never
+    inheriting the allowance. A hostile media URL naming an allowed endpoint
+    reaches only what is listening there: a proxy that would have fetched it
+    anyway, or a token server with two endpoints and nothing to read.
 
     When *allow_private* is set (``ALLOW_PRIVATE_ADDRESSES``), the guard is not
     installed at all, so proxy/VPN setups that route through private or Fake-IP
@@ -243,10 +254,13 @@ def install_socket_guard(allow_private: bool = False, proxy_urls=()) -> None:
     """
     if allow_private:
         return
-    _allowed_proxy_endpoints.clear()
-    _allowed_proxy_endpoints.update(_collect_proxy_endpoints(proxy_urls))
-    for host, port in sorted(_allowed_proxy_endpoints, key=lambda ep: (ep[0], ep[1] or 0)):
-        log.info(f'Allowing connections to configured proxy {host}:{port}')
+    proxy_endpoints = _collect_proxy_endpoints(proxy_urls)
+    service_endpoints = _endpoints(service_urls) - proxy_endpoints
+    _allowed_endpoints.clear()
+    _allowed_endpoints.update(proxy_endpoints | service_endpoints)
+    for label, endpoints in (('proxy', proxy_endpoints), ('service', service_endpoints)):
+        for host, port in sorted(endpoints, key=lambda ep: (ep[0], ep[1] or 0)):
+            log.info(f'Allowing connections to configured {label} {host}:{port}')
     socket.getaddrinfo = _guarded_getaddrinfo
 
 

app/ytdl.py

@@ -92,6 +92,36 @@ class _DownloadYtdlLogger:
 # vanish in the child can deadlock it silently before it does any work. This
 # app creates background threads (executors, notifier callbacks) well before
 # any download starts, so forcing fork there reproduces exactly that hazard.
+# The image ships yt-dlp's bgutil PO token provider and starts it on loopback
+# (docker-entrypoint.sh); the plugin dials this URL unless pointed elsewhere.
+# Without a token YouTube serves 403s, so the connect-time guard has to let the
+# download subprocess reach it.
+_POT_PROVIDER_DEFAULT_URL = 'http://127.0.0.1:4416'
+
+# extractor-arg keys the bgutil HTTP provider reads its base URL from: the
+# current one first, then the deprecated form it still honours.
+_POT_PROVIDER_BASE_URL_ARGS = (
+    ('youtubepot-bgutilhttp', 'base_url'),
+    ('youtube', 'getpot_bgutil_baseurl'),
+)
+
+
+def _pot_provider_urls(ytdl_opts: dict) -> tuple:
+    """Every PO token provider endpoint this download may dial: the bundled one,
+    plus any the operator pointed yt-dlp at through ``extractor_args``. The
+    bundled server runs either way, so it stays allowed even when a base URL is
+    configured."""
+    urls = [_POT_PROVIDER_DEFAULT_URL]
+    extractor_args = ytdl_opts.get('extractor_args')
+    if isinstance(extractor_args, dict):
+        for ie_key, arg in _POT_PROVIDER_BASE_URL_ARGS:
+            section = extractor_args.get(ie_key)
+            values = section.get(arg) if isinstance(section, dict) else None
+            if values:
+                urls.append(values[0])
+    return tuple(urls)
+
+
 _MP_CTX = (
     multiprocessing.get_context("fork")
     if sys.platform.startswith("linux") and "fork" in multiprocessing.get_all_start_methods()
@@ -453,6 +483,7 @@ class DownloadInfo:
         clip_end=None,
         live_status=None,
         live_release_timestamp=None,
+        sponsorblock=False,
     ):
         self.id = id if len(custom_name_prefix) == 0 else f'{custom_name_prefix}.{id}'
         self.title = title if len(custom_name_prefix) == 0 else f'{custom_name_prefix}.{title}'
@@ -472,6 +503,7 @@ class DownloadInfo:
         self.entry = _sanitize_entry_for_pickle(entry) if entry is not None else None
         self.playlist_item_limit = playlist_item_limit
         self.split_by_chapters = split_by_chapters
+        self.sponsorblock = sponsorblock
         self.chapter_template = chapter_template
         self.subtitle_language = subtitle_language
         self.subtitle_mode = subtitle_mode
@@ -541,6 +573,8 @@ class DownloadInfo:
             self.playlist_item_limit = 0
         if not hasattr(self, "split_by_chapters"):
             self.split_by_chapters = False
+        if not hasattr(self, "sponsorblock"):
+            self.sponsorblock = False
         if not hasattr(self, "chapter_template"):
             self.chapter_template = ""
         if not hasattr(self, "subtitle_language"):
@@ -585,6 +619,7 @@ _PERSISTED_DOWNLOAD_FIELDS = (
     "custom_name_prefix",
     "playlist_item_limit",
     "split_by_chapters",
+    "sponsorblock",
     "chapter_template",
     "subtitle_language",
     "subtitle_mode",
@@ -764,10 +799,15 @@ class Download:
         # Re-validate every outbound connection at fetch time. validate_url only
         # saw the submitted URL string; this catches redirects, DNS rebinding and
         # attacker-controlled media URLs pulled from a remote manifest, none of
-        # which it can see. The configured proxy is passed so that a proxy on an
-        # internal address stays reachable at its own host:port without opening up
-        # anything else. Skipped when ALLOW_PRIVATE_ADDRESSES trusts the environment.
-        install_socket_guard(self.allow_private, proxy_urls=(self.ytdl_opts.get('proxy'),))
+        # which it can see. The configured proxy and the PO token provider are
+        # passed so that each stays reachable at its own host:port without opening
+        # up anything else. Skipped when ALLOW_PRIVATE_ADDRESSES trusts the
+        # environment.
+        install_socket_guard(
+            self.allow_private,
+            proxy_urls=(self.ytdl_opts.get('proxy'),),
+            service_urls=_pot_provider_urls(self.ytdl_opts),
+        )
         log.info(f"Starting download for: {self.info.title} ({self.info.url})")
         # Bound outside the try so the except branch can read what was captured
         # before the error was raised.
@@ -822,6 +862,27 @@ class Download:
             # this logger, so a user-supplied one must not replace it.
             ytdl_params['logger'] = ytdl_logger
 
+            # SponsorBlock: mark sponsor segments and cut them out, the same
+            # postprocessor pair the CLI's --sponsorblock-remove sponsor builds.
+            # This has to stay above the chapter-splitting block: yt-dlp runs
+            # same-stage postprocessors in list order, and ModifyChapters must
+            # rewrite the chapter list before FFmpegSplitChapters cuts the file
+            # up, or the chapter files keep the sponsor segments and the
+            # removal desyncs the remaining chapter timings.
+            if getattr(self.info, 'sponsorblock', False):
+                if 'postprocessors' not in ytdl_params:
+                    ytdl_params['postprocessors'] = []
+                ytdl_params['postprocessors'].append({
+                    'key': 'SponsorBlock',
+                    'categories': ['sponsor'],
+                    'when': 'after_filter',
+                })
+                ytdl_params['postprocessors'].append({
+                    'key': 'ModifyChapters',
+                    'remove_sponsor_segments': ['sponsor'],
+                    'force_keyframes': False,
+                })
+
             # Add chapter splitting options if enabled
             if self.info.split_by_chapters:
                 ytdl_params['outtmpl']['chapter'] = self.info.chapter_template
@@ -966,7 +1027,17 @@ class Download:
                     if not rel_name.lower().endswith(allowed_caption_exts):
                         continue
                 self.info.filename = rel_name
-                self.info.size = os.path.getsize(fileName) if os.path.exists(fileName) else None
+                # Stat only on a terminal status. yt-dlp documents 'filename' as
+                # always present in a progress hook, but until the download
+                # finishes the bytes are in tmpfilename and 'filename' is a
+                # destination that does not exist yet -- so this was two
+                # blocking syscalls on the event loop, twice a second per
+                # active download, to arrive at None. A stat that takes seconds
+                # on a contended filesystem stalls every other request the
+                # server is serving. Nothing displays the size before
+                # completion: the Downloading table has no size column.
+                if status.get('status') == 'finished':
+                    self.info.size = os.path.getsize(fileName) if os.path.exists(fileName) else None
                 if getattr(self.info, 'download_type', '') == 'thumbnail':
                     # The thumbnail convertor always emits a .jpg, but yt-dlp may
                     # report the pre-conversion media/thumbnail extension
@@ -1040,6 +1111,19 @@ class PersistentQueue:
         self.path = f"{path}.json"
         self.store = AtomicJsonStore(self.path, kind=f"persistent_queue:{name}")
         self.dict = OrderedDict()
+        # A state write fsyncs twice (the file and its directory). On a slow or
+        # contended filesystem that is seconds, and running it inline in an
+        # async caller blocked the event loop -- every other request stalled
+        # behind a single queue mutation. One dedicated thread keeps the writes
+        # off the loop and, being single, keeps them ordered. The default
+        # executor is not usable for this: extract_info shares it and can hold
+        # its threads for minutes, which is exactly when state writes happen.
+        self._store_executor = ThreadPoolExecutor(
+            max_workers=1, thread_name_prefix=f"state-{name}")
+        # Guards the mutate-write-rollback section. The write is awaited now, so
+        # without this two callers could interleave between changing self.dict
+        # and persisting it, and a rollback could revert the wrong entry.
+        self._lock = asyncio.Lock()
 
     def load(self):
         for k, v in self.saved_items():
@@ -1080,8 +1164,14 @@ class PersistentQueue:
             for key, download in self.dict.items()
         ]
 
-    def _save_dict(self):
-        self.store.save({"items": self._serialize_items()})
+    async def _save_dict_async(self):
+        # Serialize on the event loop -- it is pure CPU and sub-millisecond --
+        # and hand the finished payload to the writer thread. Serializing in the
+        # thread instead would have it walk live DownloadInfo objects while the
+        # loop mutates them.
+        payload = {"items": self._serialize_items()}
+        await asyncio.get_running_loop().run_in_executor(
+            self._store_executor, self.store.save, payload)
 
     def _load_state_items(self):
         payload = self.store.load()
@@ -1122,32 +1212,39 @@ class PersistentQueue:
         self.store.save({"items": items})
         return items
 
-    def put(self, value):
+    async def put(self, value):
         key = value.info.url
-        old = self.dict.get(key)
-        self.dict[key] = value
-        try:
-            self._save_dict()
-        except Exception:
-            if old is None:
-                del self.dict[key]
-            else:
-                self.dict[key] = old
-            raise
-
-    def delete(self, key):
-        if key in self.dict:
-            old = self.dict[key]
-            del self.dict[key]
+        async with self._lock:
+            old = self.dict.get(key)
+            self.dict[key] = value
             try:
-                self._save_dict()
+                await self._save_dict_async()
             except Exception:
-                self.dict[key] = old
+                if old is None:
+                    del self.dict[key]
+                else:
+                    self.dict[key] = old
                 raise
 
+    async def delete(self, key):
+        async with self._lock:
+            if key in self.dict:
+                old = self.dict[key]
+                del self.dict[key]
+                try:
+                    await self._save_dict_async()
+                except Exception:
+                    self.dict[key] = old
+                    raise
+
     def empty(self):
         return not bool(self.dict)
 
+    def close(self):
+        # wait=True so a write already in flight reaches disk before the
+        # process exits; there is at most one, and it is the newest state.
+        self._store_executor.shutdown(wait=True)
+
 class DownloadQueue:
     def __init__(self, config, notifier):
         self.config = config
@@ -1324,8 +1421,8 @@ class DownloadQueue:
                 if not info.error:
                     info.error = str(exc)
                 self._unregister_scheduled(url)
-                self.queue.delete(url)
-                self.done.put(download)
+                await self.queue.delete(url)
+                await self.done.put(download)
                 await self.notifier.completed(info)
             else:
                 log.warning(
@@ -1359,9 +1456,9 @@ class DownloadQueue:
         await self.notifier.updated(info)
         bg_tasks.create_task(self.__start_download(download), name="start_download")
 
-    def _schedule_upcoming_download(self, download: Download) -> None:
+    async def _schedule_upcoming_download(self, download: Download) -> None:
         download.info.status = 'scheduled'
-        self.queue.put(download)
+        await self.queue.put(download)
         self._register_scheduled(download)
 
     def _force_start_scheduled(self, download: Download) -> None:
@@ -1380,9 +1477,9 @@ class DownloadQueue:
                 log.info(f"Download {download.info.title} was canceled, skipping start.")
                 return
             await download.start(self.notifier, self._download_executor)
-            self._post_download_cleanup(download)
+            await self._post_download_cleanup(download)
 
-    def _post_download_cleanup(self, download):
+    async def _post_download_cleanup(self, download):
         if download.info.status != 'finished':
             if download.tmpfilename and os.path.isfile(download.tmpfilename):
                 try:
@@ -1402,11 +1499,11 @@ class DownloadQueue:
                 download.info.size = None
         download.close()
         if self.queue.exists(download.info.url):
-            self.queue.delete(download.info.url)
+            await self.queue.delete(download.info.url)
             if download.canceled:
                 bg_tasks.create_task(self.notifier.canceled(download.info.url), name="notify_canceled")
             else:
-                self.done.put(download)
+                await self.done.put(download)
                 bg_tasks.create_task(self.notifier.completed(download.info), name="notify_completed")
                 try:
                     clear_after = int(self.config.CLEAR_COMPLETED_AFTER)
@@ -1514,12 +1611,12 @@ class DownloadQueue:
         )
         if auto_start is True:
             if is_upcoming:
-                self._schedule_upcoming_download(download)
+                await self._schedule_upcoming_download(download)
             else:
-                self.queue.put(download)
+                await self.queue.put(download)
                 bg_tasks.create_task(self.__start_download(download), name="start_download")
         else:
-            self.pending.put(download)
+            await self.pending.put(download)
         await self.notifier.added(dl)
 
     def __write_feed_metadata_sync(self, entry, etype, download_type, folder,
@@ -1619,6 +1716,7 @@ class DownloadQueue:
         already,
         _add_gen=None,
         retry_entry=None,
+        sponsorblock=False,
     ):
         if not entry:
             return {'status': 'error', 'msg': "Invalid/empty data was given."}
@@ -1662,6 +1760,7 @@ class DownloadQueue:
                 already,
                 _add_gen,
                 retry_entry,
+                sponsorblock=sponsorblock,
             )
         elif etype == 'playlist' or etype == 'channel':
             if etype == 'playlist' and self.__is_channel_extraction(entry):
@@ -1729,6 +1828,7 @@ class DownloadQueue:
                         clip_end,
                         already,
                         _add_gen,
+                        sponsorblock=sponsorblock,
                     )
                 )
             if any(res['status'] == 'error' for res in results):
@@ -1769,6 +1869,7 @@ class DownloadQueue:
                 clip_end=clip_end,
                 live_status=entry.get('live_status'),
                 live_release_timestamp=entry.get('release_timestamp'),
+                sponsorblock=sponsorblock,
             )
             await self.__add_download(dl, auto_start)
             return {'status': 'ok'}
@@ -1824,7 +1925,7 @@ class DownloadQueue:
         info.status = 'error'
         info.msg = msg
         download = Download(None, None, None, None, quality, format, {}, info)
-        self.done.put(download)
+        await self.done.put(download)
         await self.notifier.completed(info)
 
     async def add(
@@ -1849,13 +1950,14 @@ class DownloadQueue:
         already=None,
         _add_gen=None,
         retry_entry=None,
+        sponsorblock=False,
     ):
         if ytdl_options_presets is None:
             ytdl_options_presets = []
         log.info(
             f'adding {url}: {download_type=} {codec=} {format=} {quality=} {already=} {folder=} {custom_name_prefix=} '
             f'{playlist_item_limit=} {auto_start=} {split_by_chapters=} {chapter_template=} '
-            f'{subtitle_language=} {subtitle_mode=} {ytdl_options_presets=} {clip_start=} {clip_end=}'
+            f'{subtitle_language=} {subtitle_mode=} {ytdl_options_presets=} {clip_start=} {clip_end=} {sponsorblock=}'
         )
         if already is None:
             _add_gen = self._add_generation
@@ -1918,6 +2020,7 @@ class DownloadQueue:
             already,
             _add_gen,
             retry_entry,
+            sponsorblock=sponsorblock,
         )
 
     async def retry(self, id):
@@ -1954,6 +2057,7 @@ class DownloadQueue:
             info.clip_start,
             info.clip_end,
             retry_entry=info.entry,
+            sponsorblock=info.sponsorblock,
         )
 
     async def add_entry(
@@ -1975,6 +2079,7 @@ class DownloadQueue:
         ytdl_options_overrides=None,
         clip_start=None,
         clip_end=None,
+        sponsorblock=False,
     ):
         if ytdl_options_presets is None:
             ytdl_options_presets = []
@@ -2000,17 +2105,18 @@ class DownloadQueue:
             clip_end,
             already,
             None,
+            sponsorblock=sponsorblock,
         )
 
     async def start_pending(self, ids):
         for id in ids:
             if self.pending.exists(id):
                 dl = self.pending.get(id)
-                self.pending.delete(id)
+                await self.pending.delete(id)
                 if getattr(dl.info, 'live_status', None) == 'is_upcoming':
-                    self._schedule_upcoming_download(dl)
+                    await self._schedule_upcoming_download(dl)
                 else:
-                    self.queue.put(dl)
+                    await self.queue.put(dl)
                     bg_tasks.create_task(self.__start_download(dl), name="start_download")
                 continue
             if self.queue.exists(id):
@@ -2026,7 +2132,7 @@ class DownloadQueue:
             # Track URL so playlist add loop won't re-queue it
             self._canceled_urls.add(id)
             if self.pending.exists(id):
-                self.pending.delete(id)
+                await self.pending.delete(id)
                 await self.notifier.canceled(id)
                 continue
             if not self.queue.exists(id):
@@ -2039,7 +2145,7 @@ class DownloadQueue:
                 dl.cancel()
             else:
                 dl.canceled = True
-                self.queue.delete(id)
+                await self.queue.delete(id)
                 await self.notifier.canceled(id)
         return {'status': 'ok'}
 
@@ -2077,7 +2183,7 @@ class DownloadQueue:
                             pass
                         except OSError as e:
                             log.warning(f'deleting file "{rel_name}" for download {id} failed with error message {e!r}')
-            self.done.delete(id)
+            await self.done.delete(id)
             await self.notifier.cleared(id)
         return {'status': 'ok'}
 
@@ -2095,3 +2201,7 @@ class DownloadQueue:
             if download.started() and download.running():
                 download.cancel()
         self._download_executor.shutdown(wait=False, cancel_futures=True)
+        # Unlike the download executor these are drained, not cancelled: a
+        # queued write is the newest state and must reach disk before exit.
+        for queue in (self.queue, self.pending, self.done):
+            queue.close()

ui/src/app/app.html

@@ -399,6 +399,16 @@
                 </div>
                 <div class="col-12">
                   <div class="row g-2 align-items-center">
+                    <div class="col-auto">
+                      <div class="form-check form-switch">
+                        <input class="form-check-input" type="checkbox" role="switch" id="checkbox-sponsorblock"
+                          name="sponsorblock" [(ngModel)]="sponsorblock" (change)="sponsorblockChanged()"
+                          [disabled]="addInProgress || subscribeInProgress || downloads.loading">
+                        <label class="form-check-label" for="checkbox-sponsorblock"
+                          ngbPopover="Cut out sponsor segments using SponsorBlock's crowd-sourced markers (YouTube only)."
+                          triggers="hover" container="body">Remove sponsor segments</label>
+                      </div>
+                    </div>
                     <div class="col-auto">
                       <div class="form-check form-switch">
                         <input class="form-check-input" type="checkbox" role="switch" id="checkbox-split-chapters"

ui/src/app/app.spec.ts

@@ -413,4 +413,64 @@ describe('App', () => {
     expect(errorSpy).toHaveBeenCalledWith('Subscription name must not be empty');
     errorSpy.mockRestore();
   });
+  // Issue #533: the server picks AUDIO_DOWNLOAD_DIR on download_type alone
+  // (ytdl.py), so the UI's choice of URL base has to use the same rule. It used
+  // to also treat any .mp3 as audio, which pointed the link at audio_download/
+  // for files the server had written to DOWNLOAD_DIR.
+  describe('download links follow the server directory rule (#533)', () => {
+    const makeDownload = (over: Partial<Download>): Download => ({
+      id: 'vid1',
+      title: 'Test',
+      url: 'https://example.com/v',
+      download_type: 'video',
+      quality: 'best',
+      format: 'any',
+      folder: '',
+      custom_name_prefix: '',
+      playlist_item_limit: 0,
+      status: 'finished',
+      msg: '',
+      percent: 100,
+      speed: 0,
+      eta: 0,
+      filename: 'song.mp4',
+      checked: false,
+      ...over,
+    } as Download);
+
+    const appWithDirs = () => {
+      const fixture = TestBed.createComponent(App);
+      const app = fixture.componentInstance;
+      const downloads = TestBed.inject(DownloadsService) as unknown as DownloadsServiceStub;
+      downloads.configuration['PUBLIC_HOST_URL'] = 'download/';
+      downloads.configuration['PUBLIC_HOST_AUDIO_URL'] = 'audio_download/';
+      return app;
+    };
+
+    it('uses the audio base for an audio download', () => {
+      const app = appWithDirs();
+      const link = app.buildDownloadLink(makeDownload({ download_type: 'audio', filename: 'song.mp3' }));
+      expect(link).toBe('audio_download/song.mp3');
+    });
+
+    it('uses the video base for an mp3 produced by a video download', () => {
+      const app = appWithDirs();
+      const link = app.buildDownloadLink(makeDownload({ download_type: 'video', filename: 'song.mp3' }));
+      expect(link).toBe('download/song.mp3');
+    });
+
+    it('uses the video base for a video download', () => {
+      const app = appWithDirs();
+      const link = app.buildDownloadLink(makeDownload({ filename: 'clip.mp4' }));
+      expect(link).toBe('download/clip.mp4');
+    });
+
+    it('applies the same rule to chapter links', () => {
+      const app = appWithDirs();
+      const dl = makeDownload({ download_type: 'video' });
+      expect(app.buildChapterDownloadLink(dl, 'ch1.mp3')).toBe('download/ch1.mp3');
+      const audio = makeDownload({ download_type: 'audio' });
+      expect(app.buildChapterDownloadLink(audio, 'ch1.mp3')).toBe('audio_download/ch1.mp3');
+    });
+  });
 });

ui/src/app/app.ts

@@ -86,6 +86,7 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
   autoStart: boolean;
   playlistItemLimit!: number;
   splitByChapters: boolean;
+  sponsorblock: boolean;
   chapterTemplate: string;
   clipStart = '';
   clipEnd = '';
@@ -259,6 +260,7 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
     this.quality = this.cookieService.get('metube_quality') || 'best';
     this.autoStart = this.cookieService.get('metube_auto_start') !== 'false';
     this.splitByChapters = this.cookieService.get('metube_split_chapters') === 'true';
+    this.sponsorblock = this.cookieService.get('metube_sponsorblock') === 'true';
     // Will be set from backend configuration, use empty string as placeholder
     this.chapterTemplate = this.cookieService.get('metube_chapter_template') || '';
     this.clipStart = this.cookieService.get('metube_clip_start') || '';
@@ -855,6 +857,10 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
     this.cookieService.set('metube_auto_start', this.autoStart ? 'true' : 'false', { expires: this.settingsCookieExpiryDays });
   }
 
+  sponsorblockChanged() {
+    this.cookieService.set('metube_sponsorblock', this.sponsorblock ? 'true' : 'false', { expires: this.settingsCookieExpiryDays });
+  }
+
   splitByChaptersChanged() {
     this.cookieService.set('metube_split_chapters', this.splitByChapters ? 'true' : 'false', { expires: this.settingsCookieExpiryDays });
   }
@@ -1111,6 +1117,7 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
       playlistItemLimit: overrides.playlistItemLimit ?? this.playlistItemLimit,
       autoStart: overrides.autoStart ?? this.autoStart,
       splitByChapters: overrides.splitByChapters ?? this.splitByChapters,
+      sponsorblock: overrides.sponsorblock ?? this.sponsorblock,
       chapterTemplate: overrides.chapterTemplate ?? this.chapterTemplate,
       subtitleLanguage: overrides.subtitleLanguage ?? this.subtitleLanguage,
       subtitleMode: overrides.subtitleMode ?? this.subtitleMode,
@@ -1277,7 +1284,12 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
 
   buildDownloadLink(download: Download) {
     let baseDir = this.downloads.configuration["PUBLIC_HOST_URL"];
-    if (download.download_type === 'audio' || download.filename.endsWith('.mp3')) {
+    // Must match the server's directory rule exactly: ytdl.py writes to
+    // AUDIO_DOWNLOAD_DIR on download_type alone. Treating any .mp3 as audio
+    // sent the link to audio_download/ for mp3s produced under a video-type
+    // download (a postprocessor, a preset, or a legacy record), which the
+    // server had written to DOWNLOAD_DIR -- a 404 whenever the two differ.
+    if (download.download_type === 'audio') {
       baseDir = this.downloads.configuration["PUBLIC_HOST_AUDIO_URL"];
     }
 
@@ -1375,7 +1387,8 @@ export class App implements AfterViewInit, OnInit, OnDestroy {
 
   buildChapterDownloadLink(download: Download, chapterFilename: string) {
     let baseDir = this.downloads.configuration["PUBLIC_HOST_URL"];
-    if (download.download_type === 'audio' || chapterFilename.endsWith('.mp3')) {
+    // Same server-side rule as buildDownloadLink above.
+    if (download.download_type === 'audio') {
       baseDir = this.downloads.configuration["PUBLIC_HOST_AUDIO_URL"];
     }
 

ui/src/app/interfaces/download.ts

@@ -11,6 +11,7 @@ export interface Download {
   custom_name_prefix: string;
   playlist_item_limit: number;
   split_by_chapters?: boolean;
+  sponsorblock?: boolean;
   chapter_template?: string;
   subtitle_language?: string;
   subtitle_mode?: string;

ui/src/app/services/downloads.service.spec.ts

@@ -36,6 +36,7 @@ function basePayload(): AddDownloadPayload {
     playlistItemLimit: 0,
     autoStart: true,
     splitByChapters: false,
+    sponsorblock: false,
     chapterTemplate: '',
     subtitleLanguage: 'en',
     subtitleMode: 'prefer_manual',

ui/src/app/services/downloads.service.ts

@@ -17,6 +17,7 @@ export interface AddDownloadPayload {
   playlistItemLimit: number;
   autoStart: boolean;
   splitByChapters: boolean;
+  sponsorblock: boolean;
   chapterTemplate: string;
   subtitleLanguage: string;
   subtitleMode: string;
@@ -148,6 +149,7 @@ export class DownloadsService {
       playlist_item_limit: payload.playlistItemLimit,
       auto_start: payload.autoStart,
       split_by_chapters: payload.splitByChapters,
+      sponsorblock: payload.sponsorblock,
       chapter_template: payload.chapterTemplate,
       subtitle_language: payload.subtitleLanguage,
       subtitle_mode: payload.subtitleMode,

ui/src/app/services/subscriptions.service.spec.ts

@@ -0,0 +1,77 @@
+import { TestBed } from '@angular/core/testing';
+import { provideHttpClient } from '@angular/common/http';
+import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
+import { Subject } from 'rxjs';
+import { SubscriptionsService, SubscribePayload } from './subscriptions.service';
+import { MeTubeSocket } from './metube-socket.service';
+
+class MeTubeSocketStub {
+  private subjects: Record<string, Subject<string>> = {};
+
+  fromEvent(event: string) {
+    if (!this.subjects[event]) {
+      this.subjects[event] = new Subject<string>();
+    }
+    return this.subjects[event].asObservable();
+  }
+}
+
+function basePayload(): SubscribePayload {
+  return {
+    url: 'https://example.com/channel',
+    downloadType: 'video',
+    codec: 'auto',
+    quality: 'best',
+    format: 'any',
+    folder: '',
+    customNamePrefix: '',
+    playlistItemLimit: 0,
+    autoStart: true,
+    splitByChapters: false,
+    sponsorblock: false,
+    chapterTemplate: '',
+    subtitleLanguage: 'en',
+    subtitleMode: 'prefer_manual',
+    ytdlOptionsPresets: [],
+    ytdlOptionsOverrides: '',
+    clipStart: '',
+    clipEnd: '',
+    checkIntervalMinutes: 60,
+    titleRegex: '',
+    skipSubscriberOnly: false,
+  };
+}
+
+describe('SubscriptionsService', () => {
+  let httpMock: HttpTestingController;
+  let service: SubscriptionsService;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      providers: [
+        SubscriptionsService,
+        provideHttpClient(),
+        provideHttpClientTesting(),
+        { provide: MeTubeSocket, useValue: new MeTubeSocketStub() },
+      ],
+    }).compileComponents();
+
+    service = TestBed.inject(SubscriptionsService);
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  it('subscribe() carries the sponsorblock flag', () => {
+    service.subscribe({ ...basePayload(), sponsorblock: true }).subscribe();
+    const req = httpMock.expectOne('subscribe');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.body).toEqual(expect.objectContaining({ sponsorblock: true }));
+    req.flush({ status: 'ok' });
+  });
+
+  it('subscribe() sends the flag off by default', () => {
+    service.subscribe(basePayload()).subscribe();
+    const req = httpMock.expectOne('subscribe');
+    expect(req.request.body).toEqual(expect.objectContaining({ sponsorblock: false }));
+    req.flush({ status: 'ok' });
+  });
+});

ui/src/app/services/subscriptions.service.ts

@@ -92,6 +92,7 @@ export class SubscriptionsService {
       playlist_item_limit: payload.playlistItemLimit,
       auto_start: payload.autoStart,
       split_by_chapters: payload.splitByChapters,
+      sponsorblock: payload.sponsorblock,
       chapter_template: payload.chapterTemplate,
       subtitle_language: payload.subtitleLanguage,
       subtitle_mode: payload.subtitleMode,

uv.lock

@@ -1236,11 +1236,11 @@ wheels = [
 
 [[package]]
 name = "yt-dlp"
-version = "2026.7.4"
+version = "2026.8.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/47/c5/9972af4b472b0d55badf841ebafd2f98944cb0ae0f46e11d01f363ea5b91/yt_dlp-2026.7.4.tar.gz", hash = "sha256:b094813404f87a9dd2186f00815231df32e5fd8a5403be0f807b3bb2d21a4432", size = 3049326, upload-time = "2026-07-04T22:42:14.837Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1e/e0/832fa4ca334b766a06933a196066edc3dba37cdb6f14cd98d59bcc69a4b4/yt_dlp-2026.8.19.tar.gz", hash = "sha256:9e213e48cea35c66b378e4447903f118f6392a5fa380a2b6d7070ec86f4e0af1", size = 3052025, upload-time = "2026-08-19T23:48:59.291Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f9/8a/cd4c9b02c10c563adfe78118310129641900e1cd6de888cfae2452072696/yt_dlp-2026.7.4-py3-none-any.whl", hash = "sha256:f11f2b11d5a8ac4059f9bdf29fa4407dc7c6bb00c5097e95ca22a7a9db518266", size = 3184705, upload-time = "2026-07-04T22:42:12.989Z" },
+    { url = "https://files.pythonhosted.org/packages/69/b2/8cd1613f56eed7ceb64fbd4df3f1c01246bfb098e6f398228bafda22b80b/yt_dlp-2026.8.19-py3-none-any.whl", hash = "sha256:1d57897e94c6665a0a6f9bc54b34e584284e32c034ffab3a7df25d8f7b24eedf", size = 3185533, upload-time = "2026-08-19T23:48:56.925Z" },
 ]
 
 [package.optional-dependencies]