proton-stream/README.md

proton-stream

A Netflix-style desktop client for Proton Drive public links.

Paste a share URL and its password; get a browsable, streamable library. No Proton account, no server to host, no download step — episodes start playing in seconds and the seek bar works.

Built on proton-sdk-rs, a pure-Rust Proton Drive SDK.

Why it works

A Proton Drive file's content blocks are each a self-contained PGP packet decrypted under one shared session key. There is no sequential streaming session to resume, so seeking costs exactly the blocks the seek lands on — a 2 GB episode is playable without downloading 2 GB of it.

Status

Early, but it plays, and there is a window now. The SDK streaming surface, the catalog, the streaming layer and the player are done and verified against a real share; the app has a library wall, a page per title with seasons and episodes, resume-where-you-left-off, a transport bar and share management. The picture still lands in mpv's own window — embedding it in the app's surface is next. See docs/DEVELOPMENT.md.

cargo run --release -p pstr-app          # the app

Working today, via the pstr CLI:

cargo run -p pstr-cli -- add --name anime 'https://drive.proton.me/urls/TOKEN#fragment'
cargo run -p pstr-cli -- crawl
cargo run -p pstr-cli -- list
cargo run --release -p pstr-cli -- play --file Frieren --disk-cache
cargo run --release -p pstr-cli -- bench --file Frieren --verify

On a 761 MiB, 26-minute 1080p HEVC episode over a real password-protected link: 2.3 s to first frame, ~1.5 s to resume after dragging to an arbitrary point, 61 MiB fetched for the first 38 seconds of playback. Watch it again and the disk cache serves it with no network at all — 0.3 s to first frame.

bench measures the same file without a player, reporting cold seek latency, sustained throughput and peak memory, and --verify cross-checks a mid-file read against the SDK's own range download.

Design

Topology	Fat client. No server; each viewer's app talks to Proton directly.
Auth	Public links only — but several, merged into one library.
Player	Embedded libmpv: HEVC 10-bit, HDR and ASS subtitles with hardware decode. Volume, audio-track, subtitle and chapter pickers; skip-the-opening; next/previous episode and autoplay. The language picked is preferred for the next file too.
Transcoding	None. mpv demuxes and decodes natively.
UI	egui/eframe on glow; mpv renders into the same GL context.
Metadata	Filename parsing, with optional AniList/TMDB enrichment — off by default, because enabling it sends your library's titles to a third party.
Platforms	Linux and Windows.

Building

Rust 2024, MSRV 1.96.

cargo build --release

pstr-player needs libmpv development headers (mpv ≥ 2.0). On Windows, libmpv-2.dll is bundled next to the executable.

Privacy

• The share URL fragment is the decryption password. It and any custom password live in the OS credential store — Secret Service on Linux, Credential Manager on Windows — never in a config file.
• Nothing leaves your machine except requests to Proton, unless you turn metadata enrichment on. The player is fed through an in-process mpv stream callback, not a local HTTP server: there is no port for another process on the machine to ask for the plaintext, and mpv is handed an opaque token rather than a URL that would put a share secret in its log and window title.
• The block cache holds decrypted content. It lives in your cache directory and can be deleted at any time the app is not running.

License

MIT.