fix: auto-generate PO tokens headlessly for datacenter IP bypass

YouTube blocks ALL datacenter IPs regardless of client type.
ANDROID_VR works on residential IPs but fails on HF Spaces.

New approach with cascading fallback:
1. Try ANDROID_VR, ANDROID_MUSIC, WEB_KIDS, WEB_CREATOR (no PO token)
2. If all fail, generate PO token headlessly via Node.js
(npx youtube-po-token-generator — DOM simulation, no browser)
3. Use WEB client with the generated PO token

The PO token makes YouTube think the request comes from a real
browser, bypassing datacenter IP blocking.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pipeline_runner.py

@@ -153,37 +153,95 @@ def _is_youtube_url(url: str) -> bool:
     return bool(_YT_RE.search(url))
 
 
+def _generate_po_token() -> tuple[str, str]:
+    """Generate YouTube PO token headlessly via Node.js.
+
+    Uses youtube-po-token-generator (npm) which runs a JS DOM simulation
+    to create valid {visitorData, poToken} pairs without a browser.
+    """
+    import json
+    import subprocess
+
+    print("[po-token] Generating PO token via Node.js...")
+    try:
+        result = subprocess.run(
+            ["npx", "--yes", "youtube-po-token-generator"],
+            capture_output=True, text=True, timeout=60,
+        )
+        if result.returncode != 0:
+            raise RuntimeError(f"npx failed: {result.stderr.strip()}")
+        data = json.loads(result.stdout.strip())
+        visitor_data = data["visitorData"]
+        po_token = data["poToken"]
+        print(f"[po-token] Generated: visitorData={visitor_data[:20]}... poToken={po_token[:20]}...")
+        return visitor_data, po_token
+    except json.JSONDecodeError:
+        raise RuntimeError(f"Invalid JSON from po-token-generator: {result.stdout[:200]}")
+    except subprocess.TimeoutExpired:
+        raise RuntimeError("PO token generation timed out (60s)")
+
+
 def _download_youtube(url: str, output_path: str) -> str:
-    """Download a YouTube video using pytubefix ANDROID_VR client.
+    """Download a YouTube video using pytubefix with auto-generated PO token.
 
-    The ANDROID_VR client bypasses YouTube's bot detection without needing
-    PO tokens or cookies. The DoH monkey-patch (applied at import time)
-    handles DNS resolution on HF Spaces where youtube.com is blocked.
+    YouTube blocks datacenter IPs. We bypass this by:
+    1. DoH monkey-patch resolves youtube.com via Cloudflare (bypass DNS block)
+    2. youtube-po-token-generator creates valid PO tokens headlessly (bypass bot detection)
+    3. pytubefix WEB_CREATOR client downloads with the PO token
     """
     from pytubefix import YouTube
 
     os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
     print(f"[pytubefix] Downloading {url} ...")
 
-    # ANDROID_VR client: no PO token needed, no bot detection
-    yt = YouTube(url, client="ANDROID_VR")
+    # Try clients that DON'T need PO tokens first (fastest)
+    for client_name in ("ANDROID_VR", "ANDROID_MUSIC", "WEB_KIDS", "WEB_CREATOR"):
+        try:
+            print(f"[pytubefix] Trying {client_name} client...")
+            yt = YouTube(url, client=client_name)
+            title = yt.title
+            print(f"[pytubefix] Title: {title} ({yt.length}s)")
+            stream = (
+                yt.streams
+                .filter(progressive=True, file_extension="mp4")
+                .order_by("resolution")
+                .desc()
+                .first()
+            ) or yt.streams.filter(progressive=True).first()
+            if stream:
+                print(f"[pytubefix] Stream: {stream.resolution} {stream.mime_type}")
+                out_dir = os.path.dirname(output_path) or "."
+                out_name = os.path.basename(output_path)
+                stream.download(output_path=out_dir, filename=out_name)
+                file_size = os.path.getsize(output_path)
+                print(f"[pytubefix] Done: {output_path} ({file_size / 1024 / 1024:.1f} MB)")
+                return output_path
+        except Exception as exc:
+            print(f"[pytubefix] {client_name} failed: {exc}")
+            continue
+
+    # All simple clients failed — generate PO token and use WEB client
+    print("[pytubefix] All simple clients blocked. Generating PO token...")
+    visitor_data, po_token = _generate_po_token()
+
+    def _po_verifier():
+        return visitor_data, po_token
+
+    yt = YouTube(url, client="WEB", po_token_verifier=_po_verifier)
     print(f"[pytubefix] Title: {yt.title} ({yt.length}s)")
 
-    # Get best progressive stream (video+audio in one file)
     stream = (
         yt.streams
         .filter(progressive=True, file_extension="mp4")
         .order_by("resolution")
         .desc()
         .first()
-    )
-    if not stream:
-        stream = yt.streams.filter(progressive=True).first()
+    ) or yt.streams.filter(progressive=True).first()
+
     if not stream:
         raise RuntimeError("No downloadable stream found for this video.")
 
     print(f"[pytubefix] Stream: {stream.resolution} {stream.mime_type}")
-
     out_dir = os.path.dirname(output_path) or "."
     out_name = os.path.basename(output_path)
     stream.download(output_path=out_dir, filename=out_name)