Adopts the compact icon-only timeline toolbar (#1557): the Guide button is
now an icon-only `epg-timeline__iconbtn` with its label in the tooltip and
aria-label, so the unused EPG.TIMELINE.GUIDE key is dropped from all locales.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
While the programme guide is open the docked player carries
`data-player-shortcuts-suspended`, which `ControlsShortcuts` now honours
alongside `[inert]` — the arrows moved the player's volume instead of the
guide's row focus. The external-player strip loses its Collapse toggle
(nothing to reveal, no preference to write), the header action and its
palette command report `disabled` when the guide cannot open, the docked
strip derives its programme from the active channel's own schedule instead
of the retained NgRx value, switching playlists closes the guide, and the
collapsed strip can reach 48 px on phones.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(live-tv): keep a hidden channel list discoverable and scoped per surface
The second report in #1458 ("all channels disappear after clearing the
playback history, reset does not bring them back") was not data loss: the
history write never touches playlist items. The reporter's screenshot shows
a collapsed channel rail, a state persisted under one localStorage key
shared by the M3U player, the Xtream/Stalker live layouts and the
favorites/recent live tab. It survived restart, "Remove all playlists" and
re-import, and the only way back was a 32px chevron or Ctrl/Cmd+B.
- LiveLayoutSidebarStateService keeps the state per surface (m3u / portal /
collection) under live-sidebar-state:<surface>; the M3U player now goes
through the service instead of its own signal. The legacy shared key is
forgotten on startup and never read, so the update itself restores the
list for everyone who got stuck.
- The workspace header renders a view_sidebar toggle on every route that
renders its own rail (M3U all/groups, Xtream live, Stalker itv/radio), so
the control exists in both states instead of disappearing with the rail.
Collection pages keep their own toggle beside the content switch.
- While the rail is collapsed and nothing plays, every live host shows
app-channel-list-hidden-state (title, shortcut hint, full-size "Show
channels list" button) instead of asking to pick from a list that is not
on screen. app-portal-empty-state gained optional hint/action inputs.
- New LAYOUT.CHANNELS_LIST_HIDDEN(_HINT) strings in en plus 18 locales.
Tests: service, empty-state, hidden-state and header component specs, a
separate video-player-sidebar spec (the main M3U spec sits at the test
line budget), and an Electron E2E covering history clearing, restore via
button/header/shortcut across restart and re-import, per-surface scoping
against an Xtream portal, and legacy-key cleanup.
Refs #1458
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(live-tv): mirror the EPG offset setting in the sidebar spec mock
Master's player reads `resolvedEpgOffsetMinutes` from the settings store; the
new sidebar spec was cloned from the movie-gate harness before that field
landed, so its playing-channel case threw inside the EPG effect.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(web-e2e): scope the Stalker radio rail toggles to the rail
The workspace header now carries a second "Hide/Show channels list" toggle,
so the role+name locators matched more than one button and tripped
Playwright's strict mode. Target the rail's own chevron and the floating
restore button, and assert the header toggle mirrors the state.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(live-tv): honour Cmd/Ctrl+B on collection pages and hide the header rail toggle on phones
Codex review follow-ups on #1555:
- The hidden-list state advertises Cmd/Ctrl+B, but the favorites/recent
collection page had no handler; only the routed M3U/Xtream/Stalker live
layouts did. The page now toggles the collection surface while its live
tab is on screen, with the same typing/inert guards as the other hosts.
- At the phone breakpoint the header already holds the drawer toggle,
switcher, search and Add; the live rail is a bottom drawer with its own
toggle there, so the header rail toggle is hidden below 640px.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(live-tv): migrate the live navigation helpers to the per-surface sidebar API
master (#1554) added `XtreamLiveChannelNavigationService` and
`stalker-live-navigation.ts`, which expand the rail through
`sidebar.setState('expanded')` on the pre-split signature. Point them at the
`portal` surface and update their specs; drop the now-unused hidden-state
stub from the Xtream layout spec, which master pushed to the max-lines
budget.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(xtream): try advertised TS after initial web HLS HTTP failure
* refactor(playback): extract fullscreen channel panel state
* test(xtream): keep synthetic media within the mock project
* feat(epg): compact timeline toolbar with icon-only Now and cycling zoom
Replace the 96px zoom range slider with a single icon button that cycles
day overview → by hour → detailed, make the Now button icon-only (label in
tooltip + aria-label), and add Ctrl/⌘ + wheel zoom around the cursor on the
ribbon (preventDefault keeps Chromium from page-zooming the same gesture).
Zoom math moves into TimelineZoomController so the component stays under
the max-lines limit. The channel/programme heading no longer carries a 60%
width cap and takes the space the controls free up.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(epg): coalesce wheel-zoom anchoring and make the e2e zoom reset deterministic
- TimelineZoomController keeps a logical pending scrollLeft across a burst
of wheel/pinch events and applies it in one animation frame, so every
event anchors on the same minute instead of the stale DOM position
- the e2e settles on the detail preset from whichever band the wheel
landed in (contrast checks need the block's time line, hidden at
narrower tiers)
- zoom tooltip advertises ⌘/Ctrl per the repo's shortcut convention
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(portals): preserve live channel navigation while browsing
* test(portals): await media source assertion in remote E2E
* fix(xtream): capture destination queue for live auto-open
* fix(stalker): keep live search within the selected category
* test(stalker): assert retained video ownership without source timing
* test(stalker): distinguish paged All Items from the initial cache grid
* fix(stalker): reveal remote selections in uncached search results
* test(stalker): wait for category rows and retain settled playback
* fix(migration): recover legacy desktop sources without replacing current data
* test(migration): cover legacy recovery IPC contracts
* test(migration): use static legacy Electron bootstrap
* fix(playback): apply themes to player and EPG panels
* test(playback): verify active recording icon theme
* fix(epg): keep loading shimmer visible in both themes
* fix(playback): close legacy picture-in-picture on video replacement
* test(playback): wait for the selected video before PiP setup
* test(playback): await changed settings before PiP navigation
* fix(playback): release legacy WebKit picture-in-picture
The native-view addons and the external MPV launch path already run with
`ytdl=no`, but the frame-copy helper left mpv's default, so a refused HTTP
open fell through to ytdl_hook and yt-dlp before failing. That delayed the
`error` transition the auto-reconnect policy waits for and could leave the
session error reading "youtube-dl failed: unexpected error occurred"
instead of the load error.
Set `ytdl=no` in the helper's built-in block, before the stdin
`mpv-options` loop, so a user `ytdl=yes` session option still overrides
it. Document the helper's built-in block next to the other session-option
transports and add a release note.
Verified by rebuilding the helper against Homebrew libmpv and driving the
binary by hand against a connection-refused URL: the built-in default logs
only the ffmpeg/stream errors, while a `ytdl=yes` stdin line spawns yt-dlp.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Adds a global EPG display-time offset (Settings → EPG, whole minutes, ±720) for guides whose provider labels programme times with the wrong timezone. Display-only: parsed XMLTV values, SQLite rows, catch-up URLs and recording snapshots keep the provider's own times, so changing it needs no guide refresh. Closes the global part of #50.
The contract lives in `libs/shared/interfaces/src/lib/epg-display-offset.util.ts` with two equivalent forms: `epgDisplayTimeMs` shifts a programme for display, `epgProviderClockMs` shifts "now" into the provider's clock for every "currently airing" decision — the batched `GET_CURRENT_PROGRAMS_BATCH` lookup takes an explicit `nowMs`, and the channel lists, the Xtream/Stalker previews, the M3U player's current-programme mirror, the unified collection resolver, the dashboard live cards and the recording overlap all pick the same programme the guide renders as "now". Portal short-EPG windows start at the provider's own "now", so under a non-zero offset the Xtream preview surfaces cut their window from the full guide at the provider clock, Stalker short-EPG requests are widened for negative offsets, and every per-stream memory of the previous offset is retired together when the setting changes.
Co-authored-by: Mark Jardine <markjardine27@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(playback): seek Embedded MPV steps relative to mpv's own position
Arrow keys and the ±10 s buttons in the Embedded MPV player advanced only
about a second per press when pressed repeatedly or held. The shortcuts
already asked for 5 s steps, but `EmbeddedMpvCommandRunner.seekBy` turned
each step into an absolute `seek` computed from `session.positionSeconds`,
which is floored to whole seconds, polled every 500 ms (helper snapshots at
most every 250 ms) and not refreshed by the seek reply. Every press inside
that window therefore landed on the same target.
Steps now go through a new `EMBEDDED_MPV_SEEK_BY` IPC / `seekEmbeddedMpvBy`
bridge method that every backend forwards as mpv `seek <delta>
relative+exact`: `seekBy` exports in the macOS addon and the Windows/Linux
`wid` addon (Linux over its JSON IPC socket), and a `seek-by` stdin command
in the frame-copy helper. mpv resolves the delta against its own position
and merges queued relative seeks, so presses accumulate as in mpv itself.
The absolute form survives only as a fallback for a preload without the
method or an addon binary without `seekBy`; the timeline scrub still
commits an absolute target.
Validated with a real mpv 0.39 IPC probe: three relative seeks in a burst
advance +15 s, three absolute seeks from one stale base advance +5 s.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(playback): drop speculative position update from relative Embedded MPV seeks
Review follow-up for the relative seek path.
The macOS and Windows/Linux `seekBy` exports advanced `snapshot.positionSeconds`
by the delta after dispatching the mpv command. That is not idempotent the way
the absolute seek's optimistic write is: the observer (mpv event thread, or
the Linux IPC poll) can already have stored the post-seek `time-pos` under the
same mutex, so adding the delta on top counted the step twice, and while paused
nothing corrected it. On Linux it also advertised a position that a failed
socket delivery never reached. Relative steps now leave the snapshot alone;
only the observed `time-pos` updates the position.
The packaged Linux frame-copy smoke now drives `seekEmbeddedMpvBy` through the
built app: a burst of three +2 s steps issued without waiting for snapshots has
to land on 6 s, and a -60 s step has to clamp at 0. The generated Y4M fixture
grows from 2 s to 12 s (about 415 KB) so the burst and the playing section that
follows stay inside the clip. Replayed against a local mpv 0.39 with the same
fixture and media server: burst -> 6.0, -60 -> 0.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(agents): mirror the Embedded MPV relative-seek contract into AGENTS.md
Review follow-up: the Shared Player Controls section documents the frame-copy
commands and shortcuts, so the relative seekEmbeddedMpvBy invariant lives
there too, next to the CLAUDE.md note.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(playback): reject a Linux relative seek the mpv IPC socket did not accept
Review follow-up: the Linux branch of SeekBy discarded the socket transaction
result and returned normally, so a step that never reached mpv looked like a
seek still awaiting observation. It now throws like a failed mpv_command_async
on the in-process engines; the renderer swallows the rejection and resyncs
from the next snapshot, and the main process logs it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Follow-up to #1516 for the vendor-chrome path (shared controls opted out). With
Video.js's own controls, Chromium leaves a clicked control-bar button focused,
and a focused Video.js component captures the keyboard entirely, so after
clicking fullscreen Space left fullscreen instead of pausing and the seek,
volume and mute keys did nothing until the user clicked the video. ArtPlayer
and the native HTML5 controls were verified unaffected.
The legacy Video.js chrome now releases the focus a pointer interaction leaves
on a control (vjs-pointer-focus-release.ts). The release is scoped to the
.vjs-control-bar and pointer-attributed, and runs on both focusin (focus
landing on a control, e.g. a menu handing focus to its button) and click (a
control clicked while already focused, which fires no focusin); keyboard Tab
focus and modal-dialog focus traps are preserved. The eligibility helper is
shared with ControlsSurface via pointer-focus-release.ts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Extra libmpv options (Settings > Playback) reach every embedded engine off the command line (createSession array on Windows/macOS, a 0600 --include file on Linux native-view, a stdin preamble for the frame-copy helper); the keys the embed depends on are refused, and keys libmpv rejects are reported once per session. Dropped streams reload automatically (error, or ended on live) with 2 s -> 30 s backoff, six attempts per outage and a 30 s stability reset, only for a load that already played; engine failures stay terminal, a running recording is filed as interrupted and restarted after the reload, and an external subtitle file is re-added. Settings.embeddedMpvAutoReconnect (default on) opts out; the player shows 'Reconnecting... attempt N of M'.
Started by Bpl5966 in #1515 and finished by the maintainers in the same PR.
Co-authored-by: Bpl5966 <amine.b1959@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Publish "How to Connect a Stalker or Ministra Portal to IPTVnator": the
portal URL shapes discovery accepts, MAC normalization, the optional
serial/device-ID/signature fields and the pinning rules behind the
"generate device IDs" toggle, what endpoint discovery does on Add, the
sections a portal source gets, Account info, and a troubleshooting list
built from the app's own refusal messages, plus a seven-question FAQ.
The guide is cross-linked from the download pages and llms.txt.
Guide screenshots come from the capture script. Shots that walk into a
Stalker portal start the stalker-mock-server and seed its marketing-demo
portal for that run only, so release shots never gain a third source
card. The frame guard allowlists exactly that scenario's MAC and keeps
rejecting every other MAC-shaped string.
To keep the live-TV frame free of third-party images, the fictional live
channel list and the channel-logo SVG renderer move into
@iptvnator/shared/marketing-fixtures; both mocks now serve
/assets/marketing/logo/<slug>.svg, the Stalker marketing-demo scenario
builds its ITV categories, channels and schedule from those fixtures
instead of faker names with picsum logos, and the mock resolves asset
URLs on get_all_channels too, which is the response the app renders
the channel list from.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Switching the Live TV or radio category in the shell context panel tore
down the Stalker player: `onStalkerCategoryClicked` cleared the selected
item for every section, and the live layout gates its player on
`selectedItem`. Xtream live (#936) and M3U groups already keep the channel
playing across a category/group switch.
- Context panel: return before `clearSelectedItem()` for `itv`/`radio`;
VOD/series clicks still drop the open detail before navigating.
- Live layout: the category-change reset effect no longer wipes the
playing channel's short-EPG fallback or cancels a fallback load in
flight; only a section change (itv <-> radio) does that now.
- Regression coverage in the context panel spec, the live layout spec and
a new web E2E scenario; docs and a `.changes/` note added.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Chromium focuses a clicked <button>, and a focused control captures the
keyboard: Space and Enter activate it again, and ControlsShortcuts yields
to any interactive element in the key's path. After a click on the
fullscreen button, Space left fullscreen instead of pausing and the seek,
volume and mute keys did nothing until a click on the video took focus
away. Follow-up to #1512, which stopped that focus from pinning the bar
but left it on the button.
A completed pointer click now releases the focus it left on the control
(onBarClick -> ControlsSurface.releasePointerFocus). The click is
attributed by its pointerType (empty for Enter/Space activation and
element.click()), with the legacy MouseEvent fallback answered once per
recorded press, so keyboard activation keeps focus where Tab put it.
Only buttons and range sliders are released. Chromium keeps its
sequential-focus starting point at the blurred control, so a later Tab
continues from it. The release dispatches a focusout while the pointer
still rests on the control, so the volume anchor ignores it instead of
closing the popover under the hovering mouse.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Publish "How to Add an Xtream Codes Account to IPTVnator" as the first
evergreen guide: what the server URL, username and password are, the
Add playlist flow with the connection test and its four verdicts, the
Auto-detect method for pasted provider messages, what the import syncs,
Account info, refresh, troubleshooting and a seven-question FAQ. The
guide is cross-linked from the three download pages and llms.txt.
Blog posts gain an optional `faq` frontmatter list: BlogPost.astro
renders it as an accordion after the body and emits FAQPage JSON-LD
next to the BlogPosting entry. LinkCards and PostButton keep internal
links in the same tab.
Guide screenshots come from the release capture script: manifest shots
may carry a `group`, `--group guides` captures only those into
apps/website/public/blog/guides/screenshots/, and a release run skips
them. New setup actions open the Add playlist dialog with the mock's
fictional Xtream credentials (connection test shown), the Auto-detect
method with a labeled hand-out, and the Xtream Live TV view. Dialog
helpers and fixture identities move into shared modules so the driver
and the navigation actions cannot import each other cyclically.
tools/testing/website-guides.test.mjs checks the FAQPage schema, the
download-hub link and the shipped screenshots of every guide;
screenshot-guards.test.mjs covers group validation and output routing.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`release:notes:blog` used to emit the notes as a type-grouped inventory with
area prefixes and the highlight sections buried after the feature list; the
v0.23 post shipped in exactly that form and had to be restructured after
publication. The scaffold now starts from the shape the posts end up in:
a "What changed" table with one row per highlight, one `##` section per
highlight ahead of everything else, breaking changes on their own, the
remaining features folded into reader-facing themed sections instead of
conventional-commit scopes, Performance, every remaining fix under a Spoiler
grouped by theme, and the before-updating alert, Thanks and Download cards
(including the compare link to the previous version). Only the components a
post uses are imported.
The blog renderer moves to `release-notes-blog.mjs`; `release-notes-render.mjs`
keeps the GitHub/CHANGELOG renderers and exports the shared text helpers.
Editorial work stays editorial and is marked with TODOs: which fixes deserve
promotion out of the spoiler, one-line bullets, lead-ins, intro and thanks.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Settings > General gains "Window on startup" (normal / maximized /
fullscreen), Electron only, mirrored into the main-process config by
SETTINGS_UPDATE and applied at the next window creation. `--fullscreen`
forces one fullscreen launch (consumed by the first window). F11 toggles
OS-level fullscreen through WINDOW:TOGGLE_FULLSCREEN — the exit path on
Windows/Linux where the title bar is hidden — and is skipped while the
player owns document.fullscreenElement.
attachWindowStateEvents tracks native and HTML fullscreen as two flags,
since Electron leaves only the HTML state when the window was already
natively fullscreen. macOS ignores the constructor `fullscreen` option on a
hidden window, so ready-to-show repeats the request after show(). Toggles
are decided by an observe-only, event-fed tracker
(native-fullscreen-transitions.ts), never against isFullScreen().
Closes#1455
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Chromium focuses a clicked <button>, so the shared controls bar treated every
mouse click on a control (fullscreen, mute, ...) as keyboard navigation and
pinned itself open until a click on the viewport took focus away — a click
that also paused playback. Most visible on Embedded MPV frame-copy after
entering fullscreen; reproduces on HTML5, Video.js and ArtPlayer too.
Only keyboard-originated focus pins the bar now: pointer-attributed focus
reveals without a pin, the press record is discarded on the first bar focus
event or any keydown, a pointerdown inside the bar releases a keyboard pin,
and a keydown bubbling out of a bar control re-pins it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* perf(database): commit catalog writes in row-budgeted transactions
Refreshing or deleting a large Xtream playlist spent most of its time in
"Removing cached content": every 100 rows were deleted in their own
transaction, so a 300k-row catalog cost ~3,000 commits, each flushing an
FTS5 segment, re-appending dirty index pages to the WAL and, about every
4 MB, running an fsync-ing auto-checkpoint. Measured on a 900k-row copy of
a real database the delete took 13 s where a single set-based statement
takes 3 s, with 2 GB of WAL traffic instead of 140 MB. The re-import wrote
its rows the same way.
Deletes now read content row counts per category from the covering
indexes, pack categories into groups of about 5,000 rows and issue one
set-based DELETE per group, then drop the categories (and, for playlist
removal, the user-data tables) with one scoped statement each. Inserts keep
100-row statements but commit fifty of them at a time. Cancellation still
lands between commits and progress still reports after each one; the
worker additionally throttles progress events to one per 100 ms with
summed increments, so a large operation no longer floods the renderer.
Same subset, same machine: 13.0 s -> 5.6 s for the delete, 16.7 s -> 8.6 s
for the insert; the fsync-bound share is larger on Windows and spinning
disks.
Closes#1292
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(database): pin the row budget and the worker-side progress flush
Review follow-up: the default 5,000-row budget and the 50-statement insert
commit were only exercised with explicit overrides or sub-budget inputs, and
nothing covered the worker controller flushing a coalesced progress report
before its terminal event. Both are now pinned, and the docs no longer claim
the insert path reports SQLite `changes` or binds 1,600 parameters per
statement (it binds the eleven columns a value supplies).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(e2e): keep the stress suites on 100-row commits via a test-only budget knob
The Xtream responsiveness and playlist-switcher suites slow the database
worker down with IPTVNATOR_DB_WORKER_BATCH_DELAY_MS so they can observe an
import mid-flight; the stress catalog is 1,920 rows per type, which at the
production budget of 5,000 rows per commit is a single commit per type and
too few progress events for their assertions. The new companion knob
IPTVNATOR_DB_WORKER_ROWS_PER_TRANSACTION restores 100-row commits for those
runs only; unset or invalid it leaves the default untouched.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(database): scope refresh and cache-clear deletes to the captured category ids
The row-budgeted rewrite deleted a refreshed playlist's categories with a
playlist-wide predicate. The worker serves other requests between commits,
so a newer import of the same playlist could create categories in that
window and lose them to the older refresh, after which its content inserts
fail their foreign keys. Count and delete now use the ids the collection
step read, as the chunked code did; playlist removal keeps its playlist
scope because its final playlist-row delete cascades the same set.
deleteCategoriesWhere runs every filter through requireScopedFilter.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
The HTML5 player chose its engine by exclusion: anything that was not
mpd/ts/mp4 went to hls.js, so .mkv (the default Xtream series/VOD
container), .webm, .avi, .mov and .m4v were fed to hls.js as manifests.
hls.js raised a manifest error and the player showed the network/provider
diagnostic over media Chromium plays natively.
Add resolvePlaybackUrlSourceKind() to @iptvnator/playback/util as the one
URL-to-engine rule (mpd -> dash, m3u8/m3u -> hls, ts/m2ts/extension-less
-> mpegts, everything else -> native) and read it from both the HTML5
player and ArtPlayer's getArtPlayerVideoType(), so the two engines agree.
ArtPlayer serves every native container through a single
ART_PLAYER_NATIVE_SOURCE_TYPE custom type, keeping the source session the
owner of teardown and controls binding. The HTML5 native <source> carries
the video/mp4 hint only for MP4-family files: a hint the browser's
canPlayType() rejects makes it skip the source, and Chromium demuxes
containers it does not advertise there.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
WebPlayerViewComponent remounts the engine component for every playback
application, and the DOM Fullscreen API exits the moment its element leaves
the document. The fullscreen element was the engine shell, so every next-
episode click, autoplay hand-off, channel zap and alternative-source switch
dropped the viewer back to the page.
app-player-controls gains a `fullscreenTarget` input; HTML5, Video.js,
ArtPlayer and Embedded MPV forward it, and WebPlayerViewComponent passes its
own host element, which spans all applications of one mount. Keeping
fullscreen exposed a latent bug: the Electron header handoff set plain
fields under OnPush hosts and was only rendered thanks to the fullscreen
exit's stage resize; `channel`/`vjsOptions` are signals now.
Covered by unit regressions (fullscreen target, WebPlayerView remount, OnPush
handoff), a web-e2e run through a manual and an automatic episode switch, and
a manual Electron check. Docs and release note updated.
Closes#1498
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The publish-snap verifier had never run against a real release and
encoded three stale expectations that the tag build's own validators do
not share:
- it required the app under usr/lib/iptvnator inside the snap, while
Electron Builder's snap target ships the app at the snap root
(/iptvnator.bin, /resources/**) — the layout the packaged smoke tests
exercise;
- it validated the source archive's runtime manifest with the raw
source-build validator, but the archive carries the STAGED manifest
(origin "vendored-lgpl" + sourceBuildOrigin) written by
stage-runtime.mjs; the staged envelope is now checked explicitly and
the remaining fields still go through the shared validator via an
origin projection;
- it deep-equaled the snap's bundled sourceRuntime against the archive
manifest, but the snap bundles the builder view (no staging
envelope); the binding now projects the envelope away first.
Verified end-to-end in a Linux container against the real v0.23.0
release assets: release-snap-assets.cjs verify now passes and emits the
sealed snapshot receipt. Regression tests cover the legacy usr/lib
layout and staged-envelope mismatches.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
An ancestor re-layout can translate the player host without resizing it
(sidebar content settling, EPG panel loading below the player).
ResizeObserver reports size changes only and no DOM event observes
"position changed", so the native child window silently kept its stale
coordinates and rendered offset from the DOM stage.
The session controller now polls the host bounds every 500 ms while a
session is active, compares them against the last synced bounds with a
half-pixel tolerance, and re-syncs only on drift — idle cost is one
getBoundingClientRect per tick with no IPC. The interval is registered
via NgZone.runOutsideAngular and never re-enters the zone, so zone change
detection does not run every tick for the whole stream. Frame-copy
sessions skip the measurement entirely: the canvas is laid out by the DOM
and moves with the layout, so only the native-view child window can go
stale on a position-only shift.
Fixes#1428
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(search): keep a trailing space when the trimmed q echo lands after the debounce
The #1432 guard only held while a debounce was still pending. Once it
fired, the router echo of our own trimmed q (replaceUrl navigation)
reset the one-way-bound search box to the trimmed term, deleting the
just-typed trailing space — typing "Bein Sports" collapsed into
"BeinSports".
Applied terms are now always trimmed at the apply choke point (URL sync
and portal stores only ever act on the trimmed form anyway), so the
echoed q compares directly, and the echo guard no longer requires a
pending debounce. Back/forward stays authoritative via the untouched
imperative-trigger check.
Residual part of #1338.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(search): make the trimmed-applied-term invariant structural and update the shell contract doc
Review follow-ups on the echo-guard widening:
- setSearchState now trims too, so URL-sourced terms (deep links with
?q=Bein%20, actor/discover prefills passing raw provider titles) cannot
put an untrimmed term into appliedSearchQuery — previously that path
failed the echo guard's equality check, snapped the box, and dispatched
the portal search twice. Regression spec added.
- docs/architecture/workspace-shell.md item 8 updated: the applied-term
echo is now always ignored, not only while input is still debouncing.
- The facade spec's router mock exposes a mutable navigation trigger so
facade-level tests can exercise the popstate branch.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(search): compare the echoed q in trimmed form in the echo guard
Adoption trims, so a same-page imperative navigation still carrying a
not-yet-rewritten untrimmed q adopts to exactly the applied state —
syncing it could only cancel a pending debounce. Comparing the trimmed
form closes that window.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(dashboard): detail-first continue watching cards with quick actions (#1441)
Continue Watching cards now open the detail page on click like movie
cards; resuming the saved episode, marking it watched, and removing the
entry from history move into a per-card ⋮ menu. Series details land on
the earliest season with unwatched episodes (or the latest once all are
watched) instead of always season 1.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(dashboard): address review findings and season auto-select regressions
- A session's own watched toggles no longer re-resolve the selected
season when the positions map first fills — marking season 1 watched
used to jump the view to season 2 (CI regression in the web and
Electron season-watched-toggle E2Es).
- The all-watched season fallback skips loaded-but-empty seasons and
picks the latest season that has episodes (Greptile P1).
- Mark as Watched uses the strict failure-propagating save boundary
(Codex P2), and both card mutations surface persistence failures via
a snackbar with the new WORKSPACE.DASHBOARD.ACTION_FAILED key in all
19 languages (Greptile P2).
- Season E2Es now assert the intended post-reload behavior: the fresh
mount lands on the earliest unwatched season while season 1 keeps its
watched state behind its tab.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(downloads): track live-TV recordings in the download manager
Embedded MPV recordings were written to disk and forgotten: no list, no
reveal/play, no missing-file handling, and the channel/EPG context was lost
the moment the recording stopped. Recordings now live beside downloads:
- New `recordings` table (no unique index, no playlist FK — recordings
survive source deletion; playlist name stored via playlistDisplayLabel).
- EmbeddedMpvRecordingTracker persists the lifecycle: start/stop hooks plus
a session-snapshot observer for implicit stops (stream-replacement
auto-stop, frame-copy helper crash, session error/close); startup repair
turns rows a hard kill left behind into playable `interrupted` partials.
- Channel/EPG metadata is captured at recording START in all four live
hosts (M3U, Xtream, Stalker ITV, unified live tab); a clean stop triggers
renderer-side enrichment with every program overlapping the recorded
window, keyed by target path — covering recordings that span a program
boundary. Provider EPG never reaches SQLite, so post-hoc lookup is
impossible by design.
- Own RECORDINGS_* IPC surface + RECORDINGS_UPDATE_EVENT ping and a
separate supportsRecordings capability gate (the supportsDownloads
allowlist is all-or-nothing and stays untouched). Reveal/play shell IPCs
are gated on the recordings table, so the renderer-supplied recording
directory stays a write-location preference, not a shell-access grant.
- Manager UI: `recording` filter chip, "Recording now" queue section (REC
pulse, elapsed, live file size — no percentage, the length is unknown),
16:9 channel-logo Recordings library, Needs attention with Remove only,
focused detail at /workspace/downloads/recording/:recordingId.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): close the stop-enrichment race and repair player stubs
Greptile spotted a real ordering bug: the stop IPC returns as soon as mpv
acknowledges, while the recording row's terminal-state update is still queued
in the tracker. The renderer answers that snapshot with stop enrichment, whose
handler only accepts a terminal row — so the covered-program metadata could be
silently dropped with "Recording not found".
- EmbeddedMpvRecordingTracker.whenSettled() exposes the serialized write
chain; RECORDINGS_UPDATE_PROGRAMS awaits it before the terminal-row lookup.
Regression covered from both sides: the handler must not touch the database
until the barrier resolves, and the barrier must imply a committed row.
CI also caught spec stubs that had not learned the new player inputs (my local
run-many had been an Nx cache hit, so the failures only surfaced in CI):
- Teach the `app-web-player-view` and `app-embedded-mpv-player` stubs the
`recordingMetadata` input and `recordingStopped` output across the m3u,
Xtream, Stalker, unified-live-tab and web-player-view specs.
- The races spec now asserts the metadata argument explicitly instead of
matching a two-argument call.
- Extract the Stalker and unified-live-tab spec stubs into sibling
`*.spec-stubs.ts` files (the pattern ui/playback already uses) so both specs
stay under the 1200-line test limit without shaving assertions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(downloads): make the recordings events spec a module
The spec deliberately has no static imports — every dependency is swapped
through jest.doMock before the harness's dynamic import — which also made it a
TS script rather than a module, so its top-level `registeredHandlers` landed in
the global scope and collided with the same-named const in stream-probe.spec.ts
(TS2451). Local per-project runs compile the specs separately and stayed green;
only the Tier A coverage suite builds them into one program, so CI caught it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): address Codex review on recording lifecycle
Four findings from the Codex review, all real:
- P1: `addon.stopRecording()` only dispatches — native-view uses
`mpv_set_property_async`, frame-copy writes a helper command — so
finalizing inside the stop hook could stat a file mpv had not flushed and
even unlink bytes still being written. The tracker now treats the hook as a
request and finalizes on the acknowledged inactive snapshot, with a 10 s
bound so a lost acknowledgement cannot strand the row. Only a recording
that never went active has its empty reservation removed. Stop enrichment
follows through `whenFinalized(targetPath)` (bounded) instead of merely
draining the write queue.
- Live file size: `file_size_bytes` is written at finalization only, so the
manager's 15 s refresh reported nothing while recording. Active rows are
now decorated with a current `fs.stat` size.
- Manager-initiated Stop bypassed both player stop paths, so recordings
spanning program boundaries kept only the start-time program.
`EmbeddedMpvPlayerComponent` now owns the active→inactive edge and emits
`recordingStopped` for every trigger; the adapter and legacy toggle no
longer emit it themselves.
- Startup recovery could terminate a row another live instance was still
writing under IPTVNATOR_ALLOW_MULTIPLE_INSTANCES. Rows carry `owner_pid`
and recovery skips those whose owner process is alive.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): derive the enrichment wait from the stop fallback
Greptile caught the seam my previous fix left: the enrichment barrier waited
5 s while the tracker's acknowledgement fallback only finalizes at 10 s, so a
stop mpv never confirms let the terminal-row lookup expire early and drop the
covered programs with no retry — precisely the case the fallback exists for.
The wait is now derived from the acknowledgement bound (fallback + 1 s), with
a regression test that fails if the two ever drift apart again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): address the second Codex pass on recordings
Four more findings, all real:
- P1 (macOS native-view): `StopRecording` clears `recordingActive` *before*
dispatching the async property set and restores it if the request is
rejected, so the first inactive snapshot is optimistic, not an
acknowledgement — the tracker could finalize (and stat) a file mpv was
still writing, and a rejected stop would leave the row `completed` while
recording continued. An inactive snapshot now has to survive a 1.5 s settle
window (three poll cycles); a revived recording cancels the pending
finalization.
- Removing a failed row unlinked its path unconditionally, which takes the
file of a newer recording that reused the freed name within the same
timestamp second. The cleanup now runs only while no other row claims it.
- The All chip and the header's active badge ignored recordings, so a manager
holding only recordings read "All 0" and an active recording never showed
up in the badge.
- Switching channels auto-stops the recording, but by the time the host
handled the stop its `activeChannel`/EPG already described the NEW channel,
so the old recording was enriched with the wrong schedule (and an unrelated
program could be promoted to its title). The stop event now carries the EPG
key captured while the recording was active and every host compares it
before enriching.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): close the persistence race and two recording UX gaps
- Greptile P1: the enrichment deadline (fallback + 1 s) still raced the
terminal write — if the tracker queue or the UPDATE took longer than the
remaining margin, `whenFinalized` returned while the row was still
`recording` and the one-shot enrichment was dropped. The deadline now
bounds only the wait for mpv; `finalize()` removes the entry synchronously,
so once it has started the wait follows the write itself.
- Codex: `RECORDINGS_STOP` ignored `owner_pid`. Session ids restart per
process, so under IPTVNATOR_ALLOW_MULTIPLE_INSTANCES stopping another
instance's row could stop an unrelated local recording. Foreign rows are
now refused.
- Codex: the In progress chip counted active recordings while its filter
deliberately hid them, so clicking it showed "no matches". Active
recordings now belong to that filter — a chip whose count disagrees with
its page is a lie.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(downloads): drop the enrichment barrier instead of tuning it
Three review rounds circled the same class: synchronizing mpv's asynchronous
stop acknowledgement with a one-shot program enrichment. Each fix moved the
deadline (5 s → fallback+1 s → wait-on-the-write) without removing the reason
a deadline existed at all — the handler insisted on a *terminal* row.
It never needed one. `openSync('wx')` makes the reserved path exclusive while
a recording owns it, so the newest row for that path IS the recording that was
stopped, and `finalize()` writes only status/end time/size and never
`programs_json`. Enrichment and finalization are therefore order-independent:
- `RECORDINGS_UPDATE_PROGRAMS` matches the newest row for the path in any
status and awaits only the tracker's write queue, which exists solely to
guarantee the INSERT committed (a recording stopped milliseconds after it
started).
- `whenFinalized`, its deadline constant, and the per-entry finalized promise
are gone; the tracker keeps only the settle window and fallback that make
*finalization* itself correct.
No behavior is lost and the whole timing class disappears with the code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): bind recording finalization to its entry and shield live rows from startup repair
Two races from the Codex review:
- Tracker timers finalized by reusable session id, so a stop followed by an
immediate restart on the same session let the old settle timer finalize
the NEW row (marked completed while mpv kept writing) and strand the old
row in 'recording'. Finalization is now bound to the exact open entry,
and replacing a session's entry arms the old entry's settle timer so an
unobserved stop still finalizes it.
- reconcileStaleRecordings() runs after the renderer is interactive; a
recording started during bootstrap has ownerPid === process.pid and was
repaired to interrupted/failed mid-write. Recovery now skips rows the
tracker reports as actively tracked (activeRowIds()).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): harden recording startup repair against recycled pids and stale renderer lists
Second Codex pass on the recovery path:
- A live ownerPid alone no longer shields a row: after a crash the OS can
recycle the pid for an unrelated process, which would park the row in
'recording' with no instance able to finalize it. Recovery now also
checks (best-effort, ps/tasklist) that the process looks like an
IPTVnator/Electron instance; an unreadable name stays conservative and
keeps the skip.
- The renderer loads before the repair pass runs and may already hold the
pre-repair list with a stale Stop affordance; recovery now broadcasts
one RECORDINGS_UPDATE_EVENT after changing any rows.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): defer teardown finalization behind the flush window and bound the live-size stat
Third Codex pass:
- A synthetic error/closed snapshot from disposeSession() arrives while
the frame-copy helper may still be flushing (0.5 s quit grace + 2 s
SIGTERM grace before SIGKILL). Finalizing there statted a file mid-write
— short captures became terminal 'failed', longer rows persisted a
truncated size, and startup recovery could repair neither. The tracker
now defers that finalization behind a 2.5 s flush window; the row stays
'recording' (repairable) meanwhile, and an already-acknowledged stop's
settle timer keeps its 'completed' verdict instead of being relabelled
'interrupted'.
- The active row's live file size used a bare await stat(): one stat
hanging on a dead network filesystem wedged every RECORDINGS_GET_LIST.
The probe now mirrors the availability probe's contract — in-flight
coalescing plus a 1 s deadline degrading to no size.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): unmask recycled recording owners, guard the PWA recording route, and unblock file probes
Fourth Codex pass:
- Recycled-pid discrimination no longer stops at the process-name family
check (any Electron app could shield the row): a live holder must also
not provably have started after the recording did (ps -o etime= /
PowerShell StartTime). A pid frees only when its previous owner dies, so
a recycled pid's holder is always younger than the recording; unreadable
evidence stays conservative.
- /workspace/downloads/recording/:recordingId gets a supportsRecordings
capability guard redirecting the PWA to the manager — RecordingsService
never becomes authoritative there, so the detail rendered a permanently
blank workspace.
- Finalization and startup repair stat through a bounded async probe (3 s
deadline, ENOENT/ENOTDIR as the only proof of absence) instead of
main-thread statSync: a dead network mount no longer freezes the main
thread or the tracker queue, repair leaves unjudgeable rows recoverable,
and finalization keeps the requested status with an unknown size rather
than branding a likely-good file failed. The 0-byte reservation unlink
is fire-and-forget for the same reason.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): keep inconclusive recording probes out of Needs attention and bound repair batches
Fifth Codex pass:
- Recording list decoration now uses the bounded availability variant that
preserves 'unknown': a timed-out or permission-errored probe is not
proof of absence, so a good recording on a slow mount no longer lands in
Needs attention with its Play/Reveal hidden.
ElectronRecordingItem.fileAvailability widens accordingly; consumers
already gate on === 'missing'.
- Startup repair probes its whole batch concurrently, so main.ts awaits
roughly one 3 s deadline instead of one per stale row.
Cross-process ping propagation under IPTVNATOR_ALLOW_MULTIPLE_INSTANCES
stays out of scope (debug-only flag, same single-window design as
DOWNLOADS_UPDATE_EVENT) — rationale left on the review thread.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): fix duration rounding at hour boundaries and bound owner-process probes
Sixth Codex pass:
- The recording duration formatter rounded minutes after flooring hours,
so 59:45 read '60 min' and 1:59:45 read '1 h 60 min'. One shared
recordingDurationLabel() now rounds the total minutes before splitting
(both the detail page and the library card used a duplicated copy).
- Startup repair's synchronous ps/tasklist/PowerShell ownership probes get
a 2 s spawn timeout and are memoized per unique pid, so a batch of rows
from one crashed instance costs at most one name query and one
start-time query, and a hung process query degrades to the conservative
fallback instead of blocking the main thread.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): return to the manager through history from the recording detail
Seventh Codex pass (single finding): with a validated returnUrl the manager
is already the previous history entry, so Back now uses Location.back()
instead of pushing a third entry that made the browser Back button reopen
the detail; router navigation remains the fallback for direct links —
matching the offline-detail navigation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): bound removal cleanup and shell gates, date interrupted rows by file mtime
Eighth Codex pass:
- RECORDINGS_REMOVE no longer awaits an unbounded unlink of a failed
row's leftover reservation: cleanup is raced against the 1 s deadline,
so a hung network unlink cannot keep the Remove action busy — the row
deletion is what matters.
- Reveal/Play swap the synchronous lstat gate for the bounded async
availability probe: a dead mount no longer blocks the main process, and
only PROVEN absence refuses the action — an inconclusive probe lets the
shell try and answer honestly.
- Startup repair dates an interrupted row's endedAt from the captured
file's mtime (mpv's last write) instead of the repair time, so an
overnight shutdown no longer inflates a five-minute capture into an
hours-long recording; the repair-time fallback remains when mtime is
unreadable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): keep recording-start program metadata fresh across EPG boundaries
Ninth Codex pass (single finding): the unified live tab's
recordingMetadata computed cached its Date.now() verdict — starting a
recording after an EPG boundary snapshotted the previous show. It now
tracks the existing 30 s progress tick. The Stalker live layout's
currentProgram had the same memoization (feeding recording metadata, the
EPG panel summary, and external-player metadata); it gains a 30 s clock
tick with interval cleanup in ngOnDestroy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): re-select the Xtream current program against the 30 s tick at recording start
Tenth Codex pass (single finding): the Xtream live layout's recording
snapshot read withEpg().currentEpgItem, a computed whose Date.now()
verdict stays cached until epgItems changes — a recording started after
an EPG boundary snapshotted the previous show. The selection logic is
extracted as the pure findCurrentEpgItem(items, nowMs), the store
computed delegates to it unchanged, and recordingMetadata re-selects
with the layout's existing 30 s currentTimeMs tick.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): scope stop enrichment to the exact recorded list item
Eleventh Codex pass (single finding): the stop-enrichment guard compared
only the EPG key, which is not unique for M3U items — two list entries
sharing a tvgId (or the display-name fallback) could hand the first
item's recording the second item's schedule after a switch-triggered
auto-stop. RecordingStartMetadata/RecordingStoppedEvent gain an opaque
sourceItemKey (unified tab: item.uid; M3U player: channel.id), captured
while the recording is active exactly like the EPG key, carried through
the player's stop edge, and compared by the hosts before enriching.
Xtream/Stalker keys are already playlist+id-scoped and need no extra key.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): derive the M3U start-snapshot program from the active channel's schedule
Twelfth Codex pass (single finding): the M3U recording snapshot read the
NgRx currentEpgProgram, which retains its last value across a channel
switch and through EPG gaps (the mirror effect only dispatches when a
program exists) — a recording started on a channel with no airing
program could persist the previous channel's title, which stop
enrichment deliberately never overwrites. The snapshot now derives the
program from the active channel's own schedule against the existing 30 s
clock, and an EPG gap snapshots no program.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): keep finalizing rows in the recovery ledger and guard the repair update
Thirteenth Codex pass (single finding): finalize() removes an entry from
the open map before its queued terminal update commits, so
activeRowIds() briefly omitted a row still persisted as 'recording' —
startup recovery overlapping a clean stop could relabel it interrupted,
after which the tracker's status-guarded update could not restore
'completed'. Finalizing entries now stay in a dedicated ledger until the
update settles, and the repair UPDATE itself is guarded on
status='recording' as a second belt against a finalization that commits
between recovery's SELECT and its write.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(downloads): register update listeners before the initial list load
Fourteenth Codex pass (single finding): RecordingsService awaited its
initial RECORDINGS_GET_LIST before subscribing to the update ping — a
recording transition during that request pinged into the void while the
response still reflected the pre-transition state, and recording pings
are rare enough that nothing self-healed until the 15 s poll (armed only
once an active row is visible). The listener now registers first so the
load-state coalescing queues the trailing refresh. DownloadsService had
the same latent window and gets the same reorder.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: 4gray <fourgray@proton.me>
