perf: use latest stable Deno for YouTube extraction (#534)

* perf: use latest stable Deno for YouTube extraction

* style: apply rustfmt to Deno runtime changes

* fix: update tests for Deno runtime migration

* style: finish rustfmt cleanup for Deno switch

Author: Linuxuser67

Cargo.lock

@@ -16,6 +16,8 @@ libadwaita = { version = "0.9", features = ["v1_4", "v1_5", "v1_6", "v1_7", "v1_
 glib = "0.22"
 gio = "0.22"
 url = "2"
+# Read the single verified Deno executable from the official release ZIP.
+zip = { version = "8.6.0", default-features = false, features = ["deflate", "deflate-flate2-zlib-rs"] }
 percent-encoding = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

Cargo.toml

@@ -93,13 +93,14 @@ Undo with `flatpak override --user --reset io.github.linuxuser67.Grab`.
 
 ### Media tool installs
 
-Grab fetches yt-dlp, gallery-dl, and quickjs from their upstream GitHub
-releases on first run; Preferences → Check for Updates keeps those tools
-current. FFmpeg and ffprobe are resolved from `/app/bin` or the GNOME runtime
-on Flatpak, or from system `PATH` on other builds. Grab does not download or
-update FFmpeg. Each downloaded tool is verified against the SHA-256 digest
-published in the same GitHub release before installation; a missing digest
-refuses the install.
+Grab fetches yt-dlp and gallery-dl from upstream GitHub releases.
+Flatpak builds provision the latest stable Deno release for YouTube extraction;
+tarball/dev builds require a supported Deno installation. Preferences → Check
+for Updates keeps these tools current. FFmpeg and ffprobe are resolved from
+`/app/bin` or the GNOME runtime on Flatpak, or from system `PATH` on other
+builds. Grab does not download or update FFmpeg. Each downloaded tool is
+verified against the SHA-256 digest published in the same GitHub release
+before installation; a missing digest refuses the install.
 
 That digest detects corrupted or truncated downloads, not a compromised
 release — it shares the release's trust root. If you need a separate trust

README.md

@@ -1,7 +1,9 @@
 # Tool installer trust model
 
-Grab downloads yt-dlp, gallery-dl, and quickjs from GitHub releases. Those
-downloads are SHA-256 verified before installation.
+Grab downloads yt-dlp, gallery-dl, and Deno from GitHub releases. Downloads
+are SHA-256 verified before installation. Deno is downloaded as the official
+Linux ZIP archive; Grab extracts only the expected executable after checking
+the archive digest and enforcing compressed and uncompressed size limits.
 
 Grab does not download or update FFmpeg. Flatpak resolves `ffmpeg` and
 `ffprobe` from `/app/bin` or the GNOME runtime (`/usr/bin`). Other builds

docs/installer-trust.md

@@ -390,7 +390,7 @@ msgstr ""
 
 #: src/install_help.rs:76
 msgid ""
-"Install yt-dlp, ffmpeg and quickjs yourself and make sure they are on your "
+"Install yt-dlp, ffmpeg, Deno and gallery-dl yourself and make sure they are on your "
 "PATH, then press Check Again."
 msgstr ""
 
@@ -422,8 +422,8 @@ msgstr ""
 msgid "yt-dlp install progress"
 msgstr ""
 
-#: src/install_progress.rs:163
-msgid "quickjs install progress"
+#: src/install_progress.rs:183
+msgid "deno install progress"
 msgstr ""
 
 #: src/inline_add.rs:125

po/grab.pot

@@ -212,6 +212,13 @@ async fn stage_cookie_file(
     page_url: &str,
     timeout: Duration,
 ) -> Option<PathBuf> {
+    // Every YouTube yt-dlp invocation pins Deno, including this cookie-export
+    // probe. Prepare it first so a fresh install doesn't silently lose browser
+    // cookies while the metadata lookup provisions the runtime concurrently.
+    if let Err(error) = crate::video_tools::ensure_deno(page_url).await {
+        tracing::debug!(error = %error, "Deno unavailable for YouTube cookie export");
+        return None;
+    }
     use std::sync::atomic::{AtomicU64, Ordering};
     static SEQ: AtomicU64 = AtomicU64::new(0);
     let dir = crate::download_net::cookie_staging_dir()?;

src/cookies.rs

@@ -755,7 +755,7 @@ pub(crate) fn cookie_staging_dir() -> Option<PathBuf> {
     Some(dir)
 }
 
-/// Client builder for tool installs (ffmpeg, quickjs, yt-dlp): honors env
+/// Client builder for tool installs (ffmpeg, Deno, yt-dlp): honors env
 /// proxies via reqwest's default. See `tool_client_builder_proxied` for the
 /// variant that also honors Grab's app proxy (Preferences → Network).
 pub(crate) fn tool_client_builder() -> reqwest::ClientBuilder {

src/download_net.rs

@@ -135,77 +135,35 @@ pub(crate) async fn resolve_gallery_auth(url: &str, browser: &str) -> GalleryAut
 /// export step, so it starts immediately; gallery-dl resolves its auth first
 /// (`resolve_gallery_auth`).
 pub(crate) async fn dual_probe(ctx: DualProbeCtx<'_>) -> DualProbeOutcome {
-    let started = std::time::Instant::now();
     let url = ctx.url.to_string();
-    let browser = ctx.browser;
-    let proxy = ctx.proxy;
-    let tool = ctx.tool;
-    let libs = ctx.libs;
-    let newest_first = ctx.newest_first;
-
-    // Keep both probes: yt-dlp resolves video and playlist metadata while
-    // gallery-dl determines whether the URL also exposes a selectable gallery.
-    let ytdlp_browser = browser.clone();
-    let ytdlp_proxy = proxy.clone();
-    let ytdlp_fut = async {
-        let phase_started = std::time::Instant::now();
-        let result = crate::video::fetch_video_infos(
-            libs,
-            url.clone(),
-            ytdlp_browser,
-            newest_first,
-            ytdlp_proxy,
-            None,
-        )
-        .await;
-        tracing::info!(
-            elapsed_ms = phase_started.elapsed().as_millis() as u64,
-            success = result.is_ok(),
-            "yt-dlp URL lookup completed"
-        );
-        result
-    };
-
-    // Auth preparation is timed separately because exporting browser cookies
-    // may be a substantial fraction of lookup latency on some configurations.
+    // yt-dlp starts immediately: it uses the handoff jar or
+    // --cookies-from-browser, not the exported file below.
+    let ytdlp_fut = crate::video::fetch_video_infos(
+        ctx.libs,
+        url.clone(),
+        ctx.browser.clone(),
+        ctx.newest_first,
+        ctx.proxy.clone(),
+        None,
+    );
+    // gallery-dl needs its auth first (handoff jar preferred); the export
+    // runs while yt-dlp is already probing.
     let gallery_fut = async {
-        let auth_started = std::time::Instant::now();
-        let auth = resolve_gallery_auth(&url, &browser).await;
-        tracing::info!(
-            elapsed_ms = auth_started.elapsed().as_millis() as u64,
-            has_cookies = auth.cookies_path.is_some(),
-            has_user_agent = auth.user_agent.is_some(),
-            "gallery-dl authentication preparation completed"
-        );
-
-        let probe_started = std::time::Instant::now();
-        let result = crate::gallery_probe::probe_gallery_with_proxy(
-            &tool,
+        let auth = resolve_gallery_auth(&url, &ctx.browser).await;
+        let r = crate::gallery_probe::probe_gallery_with_proxy(
+            &ctx.tool,
             &url,
             auth.cookies_path.as_deref(),
             auth.user_agent.as_deref(),
-            proxy.as_ref(),
+            ctx.proxy.as_ref(),
         )
         .await;
         // The auth (and its staged jar) must outlive the probe.
         drop(auth);
-        tracing::info!(
-            elapsed_ms = probe_started.elapsed().as_millis() as u64,
-            success = result.is_ok(),
-            has_items = matches!(&result, Ok(Some(items)) if !items.is_empty()),
-            "gallery-dl URL lookup completed"
-        );
-        result
+        r
     };
 
     let (ytdlp, gallery) = tokio::join!(ytdlp_fut, gallery_fut);
-    tracing::info!(
-        host = %crate::video_probe::page_host(&url),
-        elapsed_ms = started.elapsed().as_millis() as u64,
-        ytdlp_success = ytdlp.is_ok(),
-        gallery_success = gallery.is_ok(),
-        "dual-backend URL lookup completed"
-    );
     DualProbeOutcome::Complete { gallery, ytdlp }
 }
 

src/inline_gallery.rs

@@ -1,4 +1,4 @@
-//! Guided yt-dlp/ffmpeg/quickjs install for tarball/dev builds (Flatpak Install is the only sandbox path).
+//! Guided yt-dlp/ffmpeg/Deno install for tarball/dev builds (Flatpak Install is the only sandbox path).
 
 use adw::prelude::*;
 use gettextrs::gettext;
@@ -7,6 +7,8 @@ use gtk4::glib;
 use gtk4::prelude::*;
 use libadwaita as adw;
 
+const DENO_RELEASES_URL: &str = "https://github.com/denoland/deno/releases";
+
 /// Show the install-help dialog; `on_check` re-resolves tools and refreshes the caller.
 pub fn show(parent: &impl glib::object::IsA<gtk4::Widget>, on_check: impl Fn() + 'static) {
     let dialog = adw::AlertDialog::new(
@@ -26,19 +28,16 @@ pub fn show(parent: &impl glib::object::IsA<gtk4::Widget>, on_check: impl Fn() +
                 .title(pkgs.distro.clone())
                 .build();
             command_row(&group, &gettext("Install tools"), &pkgs.install_all);
-            // No distro quickjs package: the command above installs only
-            // yt-dlp and ffmpeg, so link the upstream quickjs releases
-            // instead of dead-ending.
-            for (tool, url) in extra_link_rows(&pkgs) {
-                link_row(&group, tool, url);
-            }
+            // Deno is installed from the verified upstream release, not a
+            // distro package; always show its official release page.
+            link_row(&group, "Deno", DENO_RELEASES_URL);
             content.append(&group);
         }
         None => {
             let group = adw::PreferencesGroup::builder()
                 .title(gettext("Install the tools manually"))
                 .description(gettext(
-                    "Install yt-dlp, ffmpeg, quickjs and gallery-dl yourself and make sure they are on your PATH.",
+                    "Install yt-dlp, ffmpeg, Deno and gallery-dl yourself and make sure they are on your PATH.",
                 ))
                 .build();
             link_row(
@@ -47,11 +46,7 @@ pub fn show(parent: &impl glib::object::IsA<gtk4::Widget>, on_check: impl Fn() +
                 "https://github.com/yt-dlp/yt-dlp#installation",
             );
             link_row(&group, "ffmpeg", "https://ffmpeg.org/download.html");
-            link_row(
-                &group,
-                "quickjs",
-                "https://github.com/quickjs-ng/quickjs/releases",
-            );
+            link_row(&group, "Deno", DENO_RELEASES_URL);
             link_row(
                 &group,
                 "gallery-dl",
@@ -117,18 +112,6 @@ pub(crate) fn command_row(
     row
 }
 
-/// Link rows the distro group needs beyond the install command: the upstream
-/// quickjs releases when the distro has no quickjs package (the command then
-/// covers only yt-dlp and ffmpeg). Pure so tests pin the dialog's rows
-/// without needing a display.
-fn extra_link_rows(pkgs: &crate::video_tools::DistroPackages) -> Vec<(&'static str, &'static str)> {
-    if pkgs.has_quickjs_package {
-        Vec::new()
-    } else {
-        vec![("quickjs", "https://github.com/quickjs-ng/quickjs/releases")]
-    }
-}
-
 /// One outbound-link row for the manual fallback.
 fn link_row(group: &adw::PreferencesGroup, tool: &str, url: &'static str) {
     let row = adw::ActionRow::builder().title(tool).build();
@@ -147,29 +130,12 @@ fn link_row(group: &adw::PreferencesGroup, tool: &str, url: &'static str) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::video_tools::DistroPackages;
-
-    fn pkgs(has_quickjs_package: bool) -> DistroPackages {
-        DistroPackages {
-            distro: "Void".to_string(),
-            install_all: "sudo xbps-install -S yt-dlp ffmpeg".to_string(),
-            has_quickjs_package,
-        }
-    }
 
     #[test]
-    fn quickjs_link_row_appears_without_distro_package() {
-        // The dialog must not dead-end on distros without a quickjs package:
-        // the upstream releases link has to be among the group's rows.
+    fn official_deno_release_link_is_stable_upstream() {
         assert_eq!(
-            extra_link_rows(&pkgs(false)),
-            vec![("quickjs", "https://github.com/quickjs-ng/quickjs/releases")]
+            DENO_RELEASES_URL,
+            "https://github.com/denoland/deno/releases"
         );
     }
-
-    #[test]
-    fn no_quickjs_link_row_with_distro_package() {
-        // The install command already covers quickjs here; no extra row.
-        assert!(extra_link_rows(&pkgs(true)).is_empty());
-    }
 }

src/install_help.rs

@@ -171,16 +171,16 @@ pub fn run(
     };
     let do_yt = include("yt-dlp");
     let do_gdl = include("gallery-dl");
-    let do_js = include("quickjs");
+    let do_deno = include("deno");
 
-    // Order: yt-dlp, gallery-dl (under yt-dlp), then quickjs.
+    // Order: yt-dlp, gallery-dl (under yt-dlp), then Deno.
     let yt = ToolRow::new("yt-dlp", &gettext("yt-dlp install progress"), &active);
     let gdl = ToolRow::new(
         "gallery-dl",
         &gettext("gallery-dl install progress"),
         &active,
     );
-    let js = ToolRow::new("quickjs", &gettext("quickjs install progress"), &active);
+    let deno = ToolRow::new("Deno", &gettext("deno install progress"), &active);
 
     let rows = gtk4::Box::new(gtk4::Orientation::Vertical, 12);
     // HIG card padding: 12, matching the rest of the app (not 18).
@@ -194,8 +194,8 @@ pub fn run(
     if do_gdl {
         rows.append(&gdl.widget());
     }
-    if do_js {
-        rows.append(&js.widget());
+    if do_deno {
+        rows.append(&deno.widget());
     }
     let pop = gtk4::Popover::new();
     pop.set_child(Some(&rows));
@@ -264,22 +264,22 @@ pub fn run(
                 .flatten();
             gdl.set_installed(version);
         }
-        if do_js {
-            // quickjs-ng is the JS runtime Grab pins for YouTube; installed up
+        if do_deno {
+            // Deno is Grab's JavaScript runtime for YouTube; installed up
             // front so YouTube spawns never wait on a lazy install.
-            js.set_downloading();
-            let js_path = match crate::video::install_quickjs().await {
+            deno.set_downloading();
+            let deno_path = match crate::video::install_deno().await {
                 Ok(path) => path,
                 Err(e) => {
                     let message = e.to_string();
-                    js.set_failed(&message);
+                    deno.set_failed(&message);
                     RUNNING.with(|r| r.set(false));
                     on_error(message);
                     return;
                 }
             };
-            let version = crate::video_tools::tool_display_version(js_path, "--version").await;
-            js.set_installed(version);
+            let version = crate::video_tools::tool_display_version(deno_path, "--version").await;
+            deno.set_installed(version);
         }
 
         // Linger on checkmarks so completion registers, then close.