extension/background.js

// Service worker: watch the player's videoplayback requests and capture the gvs PO token.
//
// YouTube's web player fetches video data from *.googlevideo.com/videoplayback?...&pot=...
// where `pot` is the gvs Proof-of-Origin token and `c` is the client (e.g. WEB). We read
// it (read-only; no blocking) and stash the latest into session storage for the popup.

const FILTER = { urls: ["*://*.googlevideo.com/videoplayback*"] };

chrome.webRequest.onBeforeRequest.addListener(
  (details) => {
    try {
      const u = new URL(details.url);
      const pot = u.searchParams.get("pot");
      if (!pot) return;
      const client = u.searchParams.get("c") || "";
      // Prefer WEB tokens (what yt-dlp's web client needs); still record others as backup.
      chrome.storage.session.get(["gvsPot", "gvsClient"]).then((cur) => {
        const haveWeb = cur.gvsClient === "WEB";
        if (!haveWeb || client === "WEB") {
          chrome.storage.session.set({
            gvsPot: pot,
            gvsClient: client,
            potTime: Date.now(),
          });
        }
      });
    } catch (e) {
      // ignore malformed URLs
    }
  },
  FILTER
);