40 Commits

Include renames

Author	SHA1	Message	Date
3 people	650da4a1d3	ci(test): type-check Jest spec programs and gate it in CI (#1705) ... * build(test): make spec tsconfigs resolve what Jest resolves Lib spec tsconfigs used module: commonjs with node10 resolution, which cannot see Angular's exports-only secondary entry points, and dropped global.d.ts, so tsc reported thousands of resolution errors and no window.electron typing. Switch them to module: preserve with bundler resolution (ts-jest still forces CommonJS emit outside ESM mode), add global.d.ts to every spec program, type jest.unstable_mockModule for the ESM workspace, include the ui-epg and ui-playback specs that jest.web-esm.workspace.ts runs under the web spec config, and drop the snack-bar stub that shadowed the real Material types. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * ci(test): gate spec type-checking with typecheck:spec Add tools/typecheck/spec-typecheck.mjs, which runs tsc --noEmit over every tsconfig.spec.json with a small pool and fails on any diagnostic, wire it into the unit-and-typecheck job after typecheck:ci, and document the gate and the spec tsconfig conventions in the validation map. Also bring the non-Tier-A spec configs (remote-control-web, ui-remote-control, stalker-mock-server) to the same conventions so the gate covers the whole workspace. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test: fix the spec type errors surfaced by typecheck:spec With the spec programs resolving modules and ambient typings correctly, tsc reported 432 genuine errors across the Tier A projects: read-only capability flags assigned on Partial<> doubles, signal-store values used as types, fixtures missing required fields, index-signature property access, partial bridge doubles cast through incompatible shapes, and deferred resolvers narrowed to never. Type the doubles instead of casting to any: writable mapped types for capability flags, InstanceType<typeof StalkerStore>, typed jest.fn signatures, protectedState: false on test signal stores, and completed fixtures. Production changes are limited to bracket access for index-signature properties under the libs' noPropertyAccessFromIndexSignature setting and two narrowing guards in the global favorites loader. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(playback): use the ESM setup's jest global in the controls fixtures The fixture imported jest from @jest/globals, which is not a direct dependency. Jest provides that module at runtime, so tests passed, but on a clean pnpm install tsc cannot resolve it and typecheck:spec failed in CI. The ESM test setup already installs import.meta.jest as the global, typed by @types/jest, as the other ESM specs use it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: type the parental lock doubles merged since the gate was written The parental lock feature (#1601) and the Stalker actor route landed on master with spec doubles declared as zero-argument jest.fn()s that the tests then drive with the real arguments, plus a copy of the ResizableDirective override imported from a library that does not export it. Give the doubles the lock service's real signatures, drop the dead override as in the sibling layout specs, use bracket access for the actor route's personId param, and keep the Stalker layout spec within the 1200-line limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: 4gray <fourgray@proton.me> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-27 20:54:27 +02:00
3 people	e45cd85a78	feat(settings): PIN-protected parental lock for categories (#285) (#1601) ... * feat(settings): add PIN-protected parental lock for categories (#285) Locks are per category (Xtream category ids, Stalker genre ids, M3U group titles) and kept in one renderer lock store persisted to app_state / localStorage; `categories.locked` is the SQLite index re-stamped from it. While the lock is active the DB worker filters every content read, the PWA data source, the Stalker store and the M3U channel list filter in memory, and the enforcement service reloads the stores and steps off withheld selections. Settings → Parental lock sets the PIN (PBKDF2, never in Settings), the relock timeout and Lock now; lock toggles live in the Xtream/M3U management dialogs and a new Stalker lock dialog, all behind the PIN. Backups carry the locks per playlist entry. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): harden the parental lock after review - The M3U group dialog opens only after the PIN, like the Xtream and Stalker dialogs: it lists locked group names and can rewrite the locks. - Change PIN and Disable always verify the stored hash, even while the session is unlocked, so an app left unlocked cannot lose its lock. - Stalker paging judges progress on the raw portal page: withheld ids the list has not seen count as progress, a page made only of locked rows requests the next one itself, and the VOD total is reduced by withheld ids so the grid stops asking once every visible row is in. - Parental lock contract linked from the agent context map after the guidance reorganization; bridge helpers split out to stay under the file-size cap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): guard locked categories on routes, PWA search and paging - Xtream and Stalker `:categoryId` routes carry a parental-lock guard: a locked category reached by URL prompts for the PIN and redirects to the section root on refusal (Electron row ids are mapped to provider ids). - PWA search filters withheld categories like the catalog reads. - Electron warm-cache detection confirms an empty, lock-filtered read with the unfiltered existence check instead of refetching from the provider. - A Stalker lock flip past page 1 drops withheld rows at once and restarts the list from page 1 instead of appending onto stale pages. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): compile the PIN hashing helper in the Node backend build The web backend compiles the shared interfaces library without DOM typings, so the DOM-only `SubtleCrypto` / `BufferSource` names broke its Docker build. The helper now describes the WebCrypto surface it needs structurally and reaches it through `globalThis`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): close the remaining parental-lock gaps from review - Detail routes check the item's own category: a locked movie or series paired with an unlocked category id in the URL is still refused. - `requestUnlock()` awaits the settings load before it can answer "not active", so a slow startup cannot open a management dialog unguarded. - `SETTINGS_UPDATE` only persists the `parentalLockEnabled` mirror and releases the worker on switch-off; it no longer re-locks the worker on every ordinary settings save under a renderer that shows "unlocked". Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): cover PWA cold navigation, Stalker search and the PWA lock editor - The Xtream detail guard hydrates the PWA session cache before judging an item on a cold navigation and fails closed when the catalog cannot place the item. - The dedicated Stalker search route filters withheld genres, re-fires on lock changes, judges paging on the raw page and restarts from page 1 on a lock flip. - The Xtream category dialog loads its lock candidates through the capability-selected data source; the PWA source now lists its raw categories with lock flags, so locks can be configured there too. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): arm the relock timer on enable and harden Stalker search relock - The idle timer follows the unlocked transition instead of `active`, so the session that just enabled the lock still locks itself later. - Stalker search closes an open detail whose genre became withheld on relock and advances by itself past pages made only of locked rows (only while they add ids the list has not seen). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): close lock editors on relock and clear withheld details opened from All The Xtream, Stalker and M3U category editors are gated by the PIN only when they open; an idle relock left them on screen listing locked names with a lock-rewriting Save. Each now closes itself when the session relocks. ParentalLockEnforcementService also judges the selected Xtream/Stalker item by its own category: a detail opened from All, recently added or search has no selected category to vanish with, so it stayed open after a relock. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): fail closed on unreadable settings and finish relock clean-up - Unreadable settings (IndexedDB load failure) left the feature switch at its default and announced "unlocked" to the main process. A stored PIN now stands in for the switch, and without one nothing is announced, so the worker keeps its mirrored locked default. - Lock applies run one at a time and abandon superseded results; the Electron data source keys its in-flight share by lock version so a relock can never reuse an unlock refresh's unfiltered rows. - The stored in-portal Xtream search is re-run on a lock change. - Stalker live/radio selections are judged by tv_genre_id, and both live layouts drop the playback of a channel whose category became withheld. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): fail closed on an unreadable lock store and make lock writes reliable - A lock store that cannot be read is no longer treated as empty: while the lock is active every category is withheld (renderer predicates and set-based filters alike) until the PIN is entered or the store reads again, and writes are refused meanwhile so an empty in-memory store can never wipe the persisted locks. The lock set now lives in its own ParentalLockLockStore service. - The M3U group dialog's lock write is awaited and a failed save is reported in a snackbar instead of being silently dropped. - The Electron categories.locked re-stamp clears and re-locks inside one transaction, so a failed restamp keeps the previous index. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): drop pre-relock Stalker search pages and fail closed on a corrupt lock store - A Stalker search page issued before a relock was filtered with the pre-relock withheld set and could still be applied after it; the staleness check now includes the parental lock version. - A lock store payload that does not parse or is not an object is a failed read (everything withheld until it reads again), no longer an empty store. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): close the startup, re-stamp, relock-refresh and switch-persistence gaps - The window before the initial lock store read settles now withholds everything, like an unreadable store: settings can report the feature as on before the locks are known. - The store commits before the SQLite index re-stamp; a failed re-stamp now rolls the store back, a failed rollback re-stamps on the next access, and every launch re-derives the index from the store. - Xtream category/content reloads fail closed: a rejected reload empties the affected lists (content types drop back to idle) instead of keeping rows read under the previous lock state. - Enabling/disabling the feature persists through one guarded path that undoes the in-memory switch and skips the Electron mirror on a failed settings write. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(xtream): move the parental-lock reload specs beside the content spec The content feature spec sits at the 1200-line spec cap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): await the startup lock-index reconciliation and withhold genre-less rows when failing closed - The lock store is readable only once the SQLite index has been re-derived from it, and a re-stamp that keeps failing keeps the session fail-closed, so catalog reads can never serve rows stamped unlocked by a stale index. - While everything is withheld, Stalker rows without a genre are withheld as well (the store filter and the renderer predicate). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): await the enablement mirror, restore partial lock stamps and validate nested lock-store entries - The Electron mirror of the feature switch is awaited; a mirror that cannot be written undoes the settings write, so a reload never starts from a mirror that disagrees with the persisted switch. - A failed multi-type re-stamp rolls the store back AND re-stamps every touched type from it, since earlier types may already carry the new locks; a failed rollback keeps the playlist stale (fail-closed). - A persisted lock store whose nested entries are not what writeLocks produces is a failed read, not an empty store. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): withhold the Xtream catalog at relock time, keep exact M3U titles in backups, roll back a failed relock-timeout save - A relock now fails closed immediately: the selected detail is stepped off against the lock store, the catalog lists and stored search results are emptied, and the filtered reloads publish only while the captured lock version is still current. - Backups carry M3U lock titles verbatim (exact dedup), since the locks match group titles exactly. - A relock-timeout write that fails reverts the in-memory value and shows the settings save-failure snackbar. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): clear the lock index before a playlist's last lock leaves the store, retry failed PIN reads, guard backups on the lock store - A write that removes a playlist's last lock clears the SQLite index first and drops the store key afterwards, so an interruption between the two can only leave a state the startup reconcile repairs toward locked. - A PIN hash read failure is distinct from an absent PIN: the session stays locked and every PIN-protected step re-reads it first. - Backup export awaits parental lock initialization and refuses to run while the lock store is not readable, since an absent lock field means "no opinion" on restore. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): withhold Electron Xtream reads while locks are unknown, persist the switch when settings are unreadable, re-stamp after a recovered read - ElectronXtreamDataSource serves no categories, content or search hits while the lock store withholds everything; its SQLite index may still carry a stale stamp. - setupPin decides whether to persist the switch from the settings value before the PIN is stored, since enabled follows hasPin while the switch is unknown. - A lock store recovered by a later read marks its playlists stale so the index is re-derived, a persisted entry must carry all three lists, and a stale Stalker search page is dropped before touching the withheld-id bookkeeping. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): keep unlocked category routes reachable and defer a relock reload that overtakes the initial hydration - The Xtream category guard no longer runs the item check on category-only routes (Number(null) is 0), which prompted for the PIN on every unlocked VOD and series category while the lock was active. - A lock change during the initial Xtream hydration withholds the rows the hydration publishes and runs the filtered reload once it has settled, on every path that marks the content initialized. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): resolve hidden live categories before relocking playback and reload categories in the deferred hydration path - The Xtream live layout resolves a playing channel's category through the unfiltered rows when the visible list lacks it (search can play a hidden category's channel); until that lookup lands the category is unknown and a relock stops the channel. - A relock that overtakes the initial hydration now withholds the category publications too and reloads categories with the content. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): step off the M3U channel and Stalker selection before awaiting the Xtream relock reload The Xtream store stays populated after leaving that portal, so its reload runs on every apply; a locked M3U channel no longer keeps playing behind a slow database or provider read. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): gate the workspace on parental lock init, edit only a readable lock store, guard the deferred reload, validate backup lock entries - The workspace route resolver awaits ParentalLockService.initialize() next to the settings load, so no route or catalog activates before the PIN and lock store are known. - Every lock write re-reads a failed store before building its edit, so a recovered store is edited rather than overwritten. - The deferred hydration reload runs under the publish guard of the request that deferred it. - Backup import validates every parental lock entry and rejects a damaged list instead of erasing the persisted locks on restore. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): discard stale hidden-category lookups and key withheld Stalker rows by their real identity - A hidden-category lookup that lands after a later playback (same provider id, another playlist) no longer overwrites the newer channel's category; resolutions are generation- and playlist-checked. - Withheld Stalker rows are keyed by id, stream_id, movie_id, series_id or the row's cmd/name, so id-less rows no longer collapse onto one key and stall paging past locked pages. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): gate the Electron cached category/content reads while locks are unknown The warm-route hydration reads the cache directly; it now returns nothing while the lock store withholds everything, like the live reads. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): retire in-flight searches on relock clearing and publish lock revisions after the stamps - clearSearchResults() advances the search request version, so a search issued under the previous lock state cannot republish what a relock just cleared. - A lock write publishes its store revision only once every touched type is stamped, so a reload triggered by it cannot read a later type through its old stamps. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): retire a resolving Stalker live playback when the session relocks The embedded player defers selecting the channel until its stream resolves, so the enforcement service's cleared selection could not retire the request; it now carries the lock version it was issued under and is dropped when a relock happened meanwhile. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * feat(settings): one lock entry point per rail plus a right-click Lock/Unlock - Stalker's dedicated lock button becomes the same "Manage categories" (tune) button the Xtream rail has; it opens the lock-only dialog, so every portal type shares one entry point and the rail header keeps three actions. - Right-clicking a category (Xtream, Stalker) or an M3U group offers a single-row Lock / Unlock through the shared CategoryLockMenuComponent, behind the same PIN gate and lock store as the dialog. - The settings hint explains where locks are set; group lock strings added to all locales (ru/de translated). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(settings): serialize lock-store writes and drop a deleted playlist's locks - Lock-store mutations run through one write queue: each rewrites the whole persisted store, so overlapping edits could otherwise snapshot the same store and the later write would drop the earlier edit. - Deleting a playlist removes its locks through the PLAYLIST_DELETE_CLEANUP hook; "Remove all playlists" clears the lock store once the deletion has succeeded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): apply single-row lock toggles inside the lock store's write queue The right-click Lock/Unlock (portal categories and M3U groups) built the new list before entering the queue, so two quick toggles shared one snapshot and the second dropped the first. Lock writes now accept an edit of the current list, evaluated inside the queue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): retry a failed settings read before any parental-lock settings write updateSettings writes the whole settings object, which after a failed startup read is the defaults; enabling the lock or changing the relock timeout then replaced the user's persisted preferences. The read is retried first and the write refused while settings stay unreadable. The settings writes move to parental-lock-settings-writer.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): show the locked-groups row on the M3U rail and roll the relock timeout back to the recovered value - The M3U groups rail now renders the same "N locked · Enter PIN to show" row as the portal category rail, so locked groups no longer vanish without an in-context unlock. - A failed relock-timeout write rolls back to the value read after the settings retry, not to the pre-retry default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): retry a failed clear-all of the lock store and keep restored new playlists free of stale locks A lock-store clear that failed after "Remove all playlists" only logged, so a later restore reusing a playlist id could inherit the deleted playlist's locks. The in-memory store now empties at once and the persisted clear is retried on the next access; a restore that creates a playlist starts it from empty locks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): count radio playback as lock activity and read the lock store before a restore's stale-id check - The idle relock no longer interrupts a playing radio station: playing <audio> counts as activity, like video. - A restore retries a failed lock-store read before checking a reused id for stale locks, and aborts while the store stays unreadable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): drop withheld Stalker search rows at relock time and keep the M3U unlock row when every group is locked - A relock during a page-1 Stalker search now filters the rows already on screen at once, so old unlocked results are not clickable while the replacement page is pending. - When every M3U group is locked the groups rail still renders, with its "N locked · Enter PIN to show" row, instead of the plain empty state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf(settings): keep the PIN dialog and the Stalker enforcement step off the initial path Master (#1712) moved the UI component barrel and the Stalker data layer out of main.js and tightened the initial budget to 2 MB. The parental-lock prompt imported the PIN dialog through the ui/components barrel and the enforcement service injected the Stalker store at startup, which pulled both back in (2.55 MB, over budget). The PIN dialog now loads through a local lazy file on the first prompt, and the Stalker step loads only while a Stalker route is open: initial total 1.65 MB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): restore the lock index when an emptying write fails and publish rollbacks after re-stamping - Removing a playlist's last lock clears the SQLite index first; if the clear or the store write then fails, the index is re-stamped from the previous locks at once. Title matching and multi-source discovery query the worker directly and trust the index, so the stale flag alone did not protect them. - A rollback publishes its store revision only after every type is re-stamped, so a reload cannot read a later type through the attempted stamps. - docs: restore the index rules the earlier surfaces rewrite dropped from the contract, now in the Lock store lifetime section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): keep the M3U groups view when every group is locked With every group locked the filtered channel list is empty, so the container showed its generic empty state and the groups rail's "N locked · Enter PIN to show" row never appeared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): fail closed when the lazy Stalker enforcement step cannot load A rejected chunk (e.g. a stale PWA page after a deployment) escaped applyStalker(), so a locked Stalker selection kept playing after a relock and the Xtream step was skipped. The step now leaves the Stalker route on a load failure, which clears the selection and stops playback, and the Xtream step still runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): defer a stale Xtream hydration as soon as the catalog is withheld On Electron a relock that overtook the initial content hydration waited for the category reload before the content reload set the deferral flag; the older unlocked hydration could publish its streams in that window. withholdCatalog() now sets the flag itself, before anything is awaited. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): restore backup locks after the Xtream merge and snapshot the Stalker lock dialog's categories - A backup restore now writes the parental locks last, so a failed Xtream merge leaves the playlist's previous locks in place instead of the backup's possibly smaller set. - The Stalker lock dialog snapshots the category list before its lazy import and opens only if the route is unchanged, so another portal's categories can never be saved under this playlist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): fail closed on relock ahead of the apply queue and judge Xtream selections by the lock store - On relock the synchronous fail-closed steps (M3U channel, Stalker selection, the locked Xtream detail, catalog lists, stored search) run immediately instead of queueing behind an earlier apply that may still wait on a slow or hung read. - The post-reload Xtream checks decide by the lock store through the unfiltered category rows rather than by absence from the reloaded list, which also omits merely hidden categories; unreadable rows fail closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): require the PIN for lock-bearing backup restores and fail closed during index re-stamps - A backup carrying lock lists replaces the matching playlists' locks, possibly with an emptier set; the import now asks for the PIN (after the file was chosen) and aborts when it is refused. - While a write re-stamps the SQLite index the playlist counts as stale, so a relock inside that window reloads fail-closed instead of through the old stamps. The internal store write now needs only a readable store, so a rollback can still land. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): drop parental-lock Xtream reloads once the playlist is switched A reload issued for playlist A no longer publishes into the shared Xtream store after the user opened playlist B: the store's reloads guard on the playlist they read for, and the enforcement apply retires its search refresh and selection checks on a playlist switch as on a newer lock version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): re-ask the PIN before a relocked backup merge and keep the PIN cooldown across prompts A backup merge now asks for the PIN again right before it replaces a playlist's locks when the app relocked during the import, instead of relying on the answer given at the start. The wrong-PIN count and the 30-second pause move from the dialog into the lock service, so dismissing and reopening the prompt no longer resets them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): refuse lock removals that commit after a relock and keep the index stale until the store write lands Lock edits that take a lock away now commit only while the session is unlocked, checked inside the write queue at commit time, so an editor save still in flight (or queued) when the app relocks cannot remove locks. Adding locks stays allowed. The Xtream category dialog drops its lock draft after a relock, and a backup restore re-asks the PIN only when it would remove a lock. Clearing a playlist's last lock keeps its index stale until the store write has landed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): clear an Xtream detail from a hidden category synchronously on relock The synchronous relock step now clears a selected Xtream item whose category the visible category list cannot place (a manually hidden category opened through search), instead of leaving it usable until the awaited reloads and lookup finish. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): fail closed when the Electron bridge lacks the parental lock worker filter A new runtime capability requires the lock-state and index-stamping IPC. When Electron reads Xtream through the SQLite worker without it (a partial or older preload), the locked session withholds every category instead of trusting a worker that never learned the lock state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): re-check lock removals at their durable commit points A lock removal that passed the unlocked check before its write is asked again right after the store write and, for Xtream, after the index stamps. A relock in between writes the previous store back or rolls the stamps back before anything is published. The stale-index bookkeeping, index stamping and store merge move into helpers to keep the lock store within the file size limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): retry a failed revert of a refused lock removal and fail closed meanwhile When writing the previous store back after a relock-refused removal fails, the lock store now keeps a pending rewrite, is not readable (the locked session withholds everything) and rewrites the persisted store from memory on the next access, so a restart cannot load the removal. A failed "Remove all playlists" clear shares the same retry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): authorize lock removals when issued and close genre-less Stalker details in fail-closed mode A lock removal is now authorized right before its first write is issued; a relock that lands after that is ordered after the write, which completes. This drops the post-write rollback, whose own failure could leave the persisted store diverged from memory across a restart. The Stalker search closes a detail without a genre on relock while every category is withheld. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): restore the previous locks when an Xtream rollback write fails When an Xtream lock edit's re-stamp fails and the rollback store write fails too, memory now goes back to the previous locks and a pending rewrite persists them on the next store access before the index is re-stamped, so the failed edit cannot take effect through that re-stamp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(stalker): cover page-one rows leaving the screen on relock while the reload hangs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): offer the portal unlock row in fail-closed mode When the lock store cannot be read every portal category is withheld but no locked ids are known, so the rail showed no "Enter PIN to show" row. It now shows the row without a count in that state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): fail closed for direct worker title lookups and capture the Stalker lock dialog context before the PIN Catalog title matching and multi-source discovery query the SQLite worker directly; they now return nothing while the parental lock withholds everything (unreadable store or a bridge without the worker filter). The Stalker lock dialog captures its playlist, provider and section before the PIN prompt and re-checks them after it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): retire multi-source alternatives on a lock change and keep reconcile off in-flight stamps The VOD multi-source host keys its discovery session to the parental lock version: a lock change drops the discovered sources, retires discoveries and switches in flight, and rediscovers through the worker's new lock state. Stale-index entries of a write still stamping are no longer retried by a concurrent reconcile, which could re-stamp from a store the write had not committed yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): fail closed on a rejected worker lock sync, tear down Stalker synchronously and capture the Xtream dialog context before the PIN - A rejected lock-state sync to the SQLite worker makes the locked session withhold everything until a later sync succeeds. - The Stalker enforcement chunk is preloaded when a Stalker route opens; a relock runs it synchronously, or leaves the route at once while it is not loaded, instead of awaiting the chunk. - Xtream "Manage categories" captures playlist, provider and section before the PIN prompt and re-checks them after it and after the dialog import. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): keep the relock timeout behind the PIN and bind M3U group lock toggles to their playlist A locked session can no longer change the relock timeout: the Settings selector is disabled until the PIN is entered and the service refuses the change while locked. An M3U right-click lock toggle now captures its playlist before the PIN prompt and is saved only if that playlist is still open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): reset a locked M3U channel however it becomes active The enforcement service now checks the active M3U channel whenever it changes while locked, so numeric zapping, next/previous and remote commands, which select from the full channel list, cannot start a channel of a locked group. Numeric zapping also skips such a channel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): bind the M3U group management result to its playlist The groups view captures the playlist before the PIN prompt and drops the management dialog's hidden and locked group lists once another playlist is open, so they cannot be saved under that playlist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(parental-lock): record the accepted restart case of a failed rollback write Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): build bulk lock drafts only from a readable lock store The Xtream and M3U management dialogs offer lock toggles, and the Stalker lock dialog opens, only once the lock store has been read. A draft built from the empty fail-closed snapshot would otherwise replace the real locks with nothing on Save if storage recovered in between. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): keep the parental lock switch on the saved state and roll back to the recovered value The Settings switch snaps back to the saved state when clicked and follows it once the PIN action succeeds, so a cancelled or refused PIN no longer leaves it showing the opposite state. A failed switch write is undone to the value read after the settings retry instead of the hard-coded inverse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): match noncanonical PWA Xtream category ids against their locks The PWA data source compared raw provider category ids such as "009" with locks stored as numbers, so such a category stayed visible while locked. Both sides are now compared in canonical numeric form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(settings): close the M3U group editor on any relock The group management dialog lists every group name, locked ones included, even when it opened without lock toggles (unreadable lock store). It now closes on any relock, and the groups view re-checks the lock state before opening it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: 4gray <fourgray@proton.me> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-27 16:38:34 +02:00
4grayandClaude Fable 5.1	8ebb7e3424	perf(ci): run Tier A coverage concurrently with isolatedModules ts-jest (#1701) ... Tier A coverage runs projects a few at a time (largest first, bounded Jest workers, buffered output, fail-fast kept) and ts-jest transpiles with isolatedModules instead of type-checking per process; five type re-exports become export type, two decorated inputs use import type. Unit Tests and Typechecks job: 26 min -> 9 min (Tier A step 23 min -> 6.5 min). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-26 23:05:26 +02:00
4grayandClaude Opus 5	975b1f7f74	refactor(collections): split the unified collection page and live tab (#1642) ... * refactor(collections): split the unified collection page and live tab Both files sat far above the workspace's 400-line hard maximum and were only green because `tools/eslint/max-lines-baseline.mjs` exempted them. No behavior change: every template binding, public signal and handler the components exposed still resolves the same way, and the two baseline entries are gone. `unified-collection-page.component.ts` (966 → 398 lines) keeps the view surface and delegates: - `unified-collection-data.service.ts` — component-provided; owns the rows, the favorite uid set, the loading/reload indicators and every mutation, plus `loadedRequest` (the PR #1636 invariant, now read through one `mutationRequest` computed instead of two ad-hoc fallbacks) - `unified-collection-load.ts` — the reload key and the load effect - `unified-collection-scope.ts` — the This-playlist/All-playlists toggle - `unified-collection-content-type.ts` — the Live/Movies/Series tab - `unified-collection-history.ts` — the `window.history.state` view entry - `unified-collection-detail-state.ts` / `-detail-navigation.ts` — the inline detail and where an item this route cannot render goes instead - `unified-collection-clear-action.ts`, `-labels.ts`, `-favorites-sort.ts` `unified-live-tab.component.ts` (1051 → 426 lines) continues the pattern its siblings already established: - `unified-live-selection.ts` (+ `-selection-generation.ts`) — activating a row while the mounted player stays alive - `unified-live-selection-view.ts` — what the selection implies about the source and the player surface - `unified-live-epg-view.ts`, `unified-live-epg-map.ts` — the EPG panel and the rail's now-playing map - `unified-live-catchup.ts` — the timeshift override - `unified-live-recording-metadata.ts`, `unified-live-channel-rows.ts` Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(collections): move the collection data service into data-access Codex review on PR #1642: `UnifiedCollectionDataService` loads and persists favorites/recent rows, which CLAUDE.md places in `@iptvnator/portal/shared/data-access`, not in the `type:ui` project that renders them — and the dialog-scoped `SourceCleanupService` already sets that precedent for a component-provided stateful collection service. It was also the only non-root `@Injectable()` in `portal-shared-ui`. `collection-reload-indicator.ts` moves with it: `type:data-access` may not depend on `type:ui`, and the indicator is the service's own loading state machine rather than a view. Both are exported from the data-access collection barrel, so the boundary is now lint-enforced instead of conventional. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-20 19:51:34 +02:00
4gray	e9eca1c386	chore(deps): upgrade Angular to 22.1 and Nx to 23.2 (#1603) ... * chore(deps): upgrade Angular to 22.1 and Nx to 23.2 * fix(deps): complete Angular migrations after rebasing on master * fix(ci): use the Node pin for Windows runtime refresh * docs(deps): synchronize the workspace-shell Node requirements	2026-09-14 19:02:40 +02:00
4gray	17b8aa309d	fix(m3u): restore DASH playback from favorites and recently viewed (#1597)	2026-09-13 11:17:55 +02:00
4gray	bd848aaad6	feat(playlist): clean up selected inactive desktop sources (#1593) (#1596)	2026-09-13 10:39:14 +02:00
4gray	62655a8b5d	feat(playlist): show desktop health indicators for network sources (#1592)	2026-09-12 23:05:17 +02:00
4grayandClaude Fable 5.1	97b0264dee	fix(xtream): render catch-up start times in the panel timezone (#1563) ... * fix(xtream): render catch-up start times in the panel timezone The `{Y-m-d:H-M}` segment of an Xtream timeshift URL is read by the panel with `strtotime()` in ITS timezone (`server_info.timezone`), never the viewer's. The timezone was learned in memory only, by the store's `checkPortalStatus()`, so the Favorites / Recent catch-up resolver — which reads the STORED playlist row — always fell back to the viewer's local clock and asked the panel for the wrong programme (#1562). - Normalize the panel's clock once (`resolveXtreamServerTimezone`): an ICU-resolvable name is kept, otherwise a `UTC±HH:MM` offset is derived from the `time_now` / `timestamp_now` clock pair, so spellings such as `UTC+3` no longer silently mean "local time". - Persist it on the playlist row through `transformPlaylistMeta` (no-op when unchanged) and project it back from the payload in `DB_GET_PLAYLIST`, so both catch-up entry points and a restart see it. - Format with `hourCycle: 'h23'` (server midnight is `00`, never `24`) and read timestamp-less EPG `start`/`end` strings in the panel's clock. - Mock: `tzoffset:tzoffset` scenario with an unusable timezone name and a +03:00 clock pair; Electron e2e covers Live TV, Favorites, a restart into Global favorites, and the clock-pair derivation at a UTC-3 viewer. Closes #1562 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): guard the account-info answer by playlist identity and reject rolled-over dates Review follow-ups (Greptile): - A source switch while `get_account_info` is in flight no longer hands playlist A's status or clock to playlist B: the store is patched only while the asking playlist is still selected, the timezone is persisted under the asking playlist's id regardless, and a late failure cannot mark the newly selected playlist unavailable. - `parseNaiveUtcMs` reads the constructed date back, so out-of-range panel strings (`2026-13-01 25:00:00`) are rejected instead of silently rolling over into a real instant. - Document that a clock-derived fixed offset is a DST-less snapshot, refreshed by every account-info check and only ever used for non-standard servers. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): drop a panel clock that no longer belongs to the source Review follow-ups (Codex + Greptile): - A metadata update or DB_UPDATE_PLAYLIST that points the source at another server drops the persisted `serverTimezone` (payload-only) until the next account-info check, so Favorites / Recent cannot keep rendering the OLD panel's clock; an update that supplies a clock keeps it. - A late account-info answer is persisted only onto a row that still points at the panel it came from — an edit that moved the source during the request keeps the clock the edit flow dropped. - The PWA data source and the route-session converter carry the persisted timezone into the store playlist, so a later response without a usable clock has a previous value to preserve. - Mirror the catch-up timezone contract into AGENTS.md. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): drop the stale panel clock inside the UPDATE statement Review follow-up (Codex): the database worker interleaves requests, so a read-modify-write of the playlist payload could hand a concurrent upsert's newer payload back to the past. The `serverTimezone` removal on a server URL change is now one `CASE … json_remove(payload, '$.serverTimezone')` expression inside the same UPDATE, guarded by `json_valid`; the spec runs the real statement against Electron's SQLite on the actual `playlists` table (moved, renamed, clock-less, malformed-payload and NULL-URL rows). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor(xtream): split the server-clock primitives out of the timezone util Review follow-up (Greptile): `xtream-server-timezone.util.ts` had grown past the 300-line file guideline. The zone-agnostic wall-clock primitives (stored forms, Intl parts, naive parsing) now live in `xtream-server-clock.util.ts`; the timezone util keeps the Xtream policy and re-exports the public helpers, so every import and the spec are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): offer the learned panel clock to storage on every check Review follow-up (Codex): a transient storage failure left the clock in the store but not on the row, and the next check compared the answer with the in-memory value and never retried. The resolved timezone is now always handed to `transformPlaylistMeta`, whose row-level equality check keeps the common case a read without a write; a failed write is retried by the next account-info check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): apply an account-info answer only to the panel it came from Review follow-up (Codex): an in-place edit keeps the playlist id while moving the source, so an answer already on the wire for the OLD panel passed the id-only guard and patched the new panel's status and clock into the store. One `answersFor(candidate, credentials)` predicate now gates the store patch, the error path and the persisted-row transform alike. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): never report another panel's status for the selected playlist Review follow-up (Greptile): callers gate content initialization on the value `checkPortalStatus()` returns for whatever is selected NOW. When the answer no longer describes the selected playlist (source switch or in-place edit during the request), the store's own verdict about the current selection is returned instead of the old panel's status — on success and on failure alike. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): persist the panel clock with one conditional UPDATE Review follow-up (Codex): `transformPlaylistMeta` reads the row and then upserts it whole, while the Xtream edit dialog saves through `DB_UPDATE_PLAYLIST` outside `PlaylistsService`'s queue and the database worker interleaves requests — an edit landing between that read and the upsert was silently undone. Persistence now goes through `IXtreamDataSource.rememberServerTimezone`: - Electron: new `DB_SET_PLAYLIST_SERVER_TIMEZONE` worker op — one UPDATE that `json_set`s the payload only while the row still points at the request's connection and does not already carry the value; a malformed payload is never rewritten (CASE, not AND, so json_extract cannot run before json_valid). Wired through the worker types, main handler, preload, bridge interface, both IPC contract tables and `DatabaseService.setXtreamPlaylistServerTimezone`. - PWA: `transformPlaylistMeta`, whose read and write share one IndexedDB readwrite cursor transaction, plus the localStorage copy. The store no longer injects `PlaylistsService`; it offers the resolved clock to the data source and keeps only its in-memory guards. Real-SQLite coverage for the op (fresh / same / moved / NULL / malformed / missing rows), delegation specs for both data sources, docs updated. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(xtream): keep the stored panel clock across clockless full upserts Review follow-up (Codex): a `PlaylistsService` mutation that read the row before `DB_SET_PLAYLIST_SERVER_TIMEZONE` landed and upserted afterwards replaced the payload with its clockless snapshot. `DB_UPSERT_APP_PLAYLIST(S)` now carry the STORED clock into a snapshot that has none while the row still points at the same connection (`playlistConflictUpdate`, nested CASE so the json_* readers never run on a malformed payload); a snapshot with its own clock, or one that moves the source, wins as is. Real-SQLite coverage for kept / moved / own-clock / batch rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor(release): split capture-navigation under the max-lines cap `tools/release/capture-navigation.ts` had grown to 567 counted lines, past the 400-line rule, which failed `release-tools:lint` and — because the file was not in the baseline — the max-lines baseline test on master and on every PR branched from it. The 19 named setup actions are now grouped by subject over one leaf module of shared page helpers: - `capture-navigation-helpers.ts`: playlist-id registry, dialog handling, navigation moves, `settleUi` - `capture-navigation-setup-actions.ts`: add-playlist dialogs, settings sections, remote control - `capture-navigation-portal-actions.ts`: portal catalogs, live lists, alternative sources (the two identical live-category flows share one helper) - `capture-navigation-download-actions.ts`: the download manager shots - `capture-navigation.ts`: the `runAction` dispatcher, theme switching and the re-exported API the seeding driver and the capture script import Actions call their siblings directly instead of recursing through `runAction`, so no module depends on the dispatcher. The action vocabulary is unchanged (same 19 names, same waits and timeouts); every file is under 300 lines and the new modules are listed in the `release-tools` lint target. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor(electron): move the panel-clock SQL into its own operations module Review follow-up (Greptile): the timezone persistence, invalidation, upsert-preservation and row projection had landed in `playlist.operations.ts`, a baselined 1,000-line file. They now live in `playlist-server-timezone.operations.ts` (155 lines) — the three SQL shapes plus the payload projection — and the playlist operations compose them; the baselined file shrinks by 107 lines. Behaviour and the real-SQLite coverage are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 19:40:47 +02:00
4gray	61b06b9f31	fix(portals): preserve live channel navigation while browsing (#1554) ... * fix(portals): preserve live channel navigation while browsing * test(portals): await media source assertion in remote E2E * fix(xtream): capture destination queue for live auto-open	2026-09-06 10:22:07 +02:00
3 people	d8d36476e6	feat(epg): add global EPG display time offset (#1489) ... Adds a global EPG display-time offset (Settings → EPG, whole minutes, ±720) for guides whose provider labels programme times with the wrong timezone. Display-only: parsed XMLTV values, SQLite rows, catch-up URLs and recording snapshots keep the provider's own times, so changing it needs no guide refresh. Closes the global part of #50. The contract lives in `libs/shared/interfaces/src/lib/epg-display-offset.util.ts` with two equivalent forms: `epgDisplayTimeMs` shifts a programme for display, `epgProviderClockMs` shifts "now" into the provider's clock for every "currently airing" decision — the batched `GET_CURRENT_PROGRAMS_BATCH` lookup takes an explicit `nowMs`, and the channel lists, the Xtream/Stalker previews, the M3U player's current-programme mirror, the unified collection resolver, the dashboard live cards and the recording overlap all pick the same programme the guide renders as "now". Portal short-EPG windows start at the provider's own "now", so under a non-zero offset the Xtream preview surfaces cut their window from the full guide at the provider clock, Stalker short-EPG requests are widened for negative offsets, and every per-stream memory of the previous offset is retired together when the setting changes. Co-authored-by: Mark Jardine <markjardine27@gmail.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-04 18:46:10 +02:00
4grayandClaude Fable 5	36c2867d36	feat(xtream): recognize more language tags in VOD multi-source (#1417) ... * feat(xtream): recognize more language tags in VOD multi-source The sources popover's language filter and copy chips now read prefixes with Unicode pipe lookalikes, brackets and spaced dashes, Cyrillic tags and MULTI. When a stream title carries no tag, the language falls back to what the stream's visible categories unambiguously state ("EN | Netflix") — discovery aggregates category names per (playlist, stream) in SQL, and category prefixes must pass a known-language gate because everyday category words like new/top/hot are real ISO 639-3 codes. Both signals stay parsed guesses: browse filter and chips only, never ranking, failover or dub-warning inputs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(xtream): address Codex review on multi-source language detection Gate the new bracket and dash title forms through isKnownLanguageTag: those positions carry quality/rip tags ([HD], [CAM], NEW -) whose fabricated "language" would outrank and mask a real category-derived one. The legacy pipe form stays permissive. Overlay a late-arriving route category onto the existing route row in the same-key refresh path — cold/direct routes load categories after discovery, and the category is outside the movie key on purpose. The mid-flight case is redelivered by the bind() effect re-running on the controller's sources signal; that tracked read is now documented as load-bearing and pinned by a session spec. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(xtream): pair brackets and strip the new tag forms when matching Greptile: the bracket prefix chose its opening and closing delimiter independently, so a malformed "[EN)" was read as a language tag. Codex: recognizing a prefix is only half the job — normalizeTitleKeys has to strip the same tag, or the tagged copy never matches the bare one and multi-source cannot offer the film at all. Its leading-tag rule now shares the pipe-lookalike set and, on the pipe branch only, takes the same Latin+Cyrillic any-case alphabet with no required trailing space. Dash and colon keep their uppercase-Latin spaced form: those are ordinary punctuation, and loosening them would amputate "ОНО: Часть 2" the way a case-insensitive rule amputates "It: Chapter Two". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(xtream): keep normalization uppercase-only, measured on real catalogs The previous commit widened the pipe branch of normalizeTitleKeys to any case and to Cyrillic, on the theory that nothing but a tag precedes a pipe. Checked against 1.27M real catalog titles that theory is wrong in two ways at once: "Akira | 1988" and "Coco | 2017" put the film's name before the pipe and the year after it, and Russian catalogs write "Момо | Momo" — localized title, then original. The widening corrupted 349 keys and rescued none, so it is reverted. What survives is what the data supports: the pipe-lookalike set (0 changed keys, and correct for panels that use them) and dropping the required space after a pipe (35 changed keys, genuine welded tags like "EN|Dark Shadows" and "|FR|VO|Le dernier empereur"). A leading-tag guard that refused to strip when no letter remained is also dropped: it fixes "AKA | 2023" but breaks "IT - 65", so telling those apart needs a tag vocabulary and belongs in its own change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(xtream): cite the measured evidence for the category language gate The gate's rationale named hypothetical category shapes. On a real catalog the four it actually turns away are VOD (5,245 movies), KIDS (1,010), SHOW and WWE — without it the language select offers "VOD" and "KIDS" as languages. Comments, doc and one spec case only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(xtream): restore the docblock currentSourceRow lost to an insertion routeCategoryLanguage was added between currentSourceRow's docblock and its signature, so the paragraph describing "the row standing for the source the route is already playing" ended up introducing a function that returns a language string. Moved below; no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(xtream): stop grouping the scan tier, it can drop a matching source content is unique per (category, type, stream), so one stream sitting in several categories is several rows and nothing forces their titles to agree. The GROUP BY added for group_concat let SQLite keep an arbitrary row's title, and the normalized confirmation then rejected the whole stream on a title a sibling row would have matched — the source vanished. The FTS tier can afford that grouping because its window makes it necessary; the scan tier takes no window at all, so it now returns a row per category and their names are merged per stream in TypeScript, which also keeps the rejected sibling's category in the language derivation. Found by Codex. Latent rather than active on the catalog I measured (0 streams currently carry differing titles across categories), but the schema permits it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(xtream): record why category names stay scoped to matched rows Codex flagged that the FTS predicate runs before the aggregate, so a sibling row under a localized title contributes no category. True, and deliberate: the field is a guess feeding a chip and a browse filter, and completing it costs measured latency — 0.74s to 2.0s for a correlated subquery on a 3.9GB catalog, 19.7s for a second bounded lookup — to correct a cosmetic guess in a shape that occurs 0 times in 2.7M rows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-12 07:59:07 +02:00
4gray	6ad9f3ff8a	feat(stalker): discover portal endpoints on add and edit (#1391) ... * feat(stalker): discover portal connection on edit * docs(stalker): document smart endpoint discovery * fix(stalker): make edited connection persistence atomic * fix(stalker): serialize edit discovery * fix(stalker): fence all edit authentication * fix(stalker): serialize overlapping edits * fix(stalker): hydrate playlist identity before edit * test(stalker): await edit hydration * fix(stalker): release abandoned edit fences * fix(stalker): reject stale repairs before discovery * fix(stalker): fence stale portal modes * test(stalker): align simple portal session guard * fix(stalker): reject superseded portal responses * test(stalker): await settled append failure * fix(stalker): retain abandoned auth fences * fix(stalker): fence abandoned discovery retries * fix(stalker): retire restored repair overrides * fix(stalker): verify repair override retirement * fix(stalker): preserve edit-owned repair tokens * fix(stalker): defer repair retirement during edits * fix(stalker): fence repair history reads * fix(stalker): fingerprint portal URL credentials * fix(stalker): persist submitted identity after navigation * fix(stalker): merge late connection saves * fix(stalker): keep edits off Xtream save path * fix(stalker): preserve concurrent edit state * fix(stalker): reject replaced late edit targets * fix(stalker): guard every resolved edit write * fix(stalker): make pwa edit guard transactional * fix(stalker): migrate pwa flags transactionally * fix(stalker): reserve pwa edits across tabs * fix(stalker): coordinate playlist replacements with edit * fix(stalker): reserve lazy repairs across tabs * fix(stalker): drain local repair before edit lock * fix(stalker): block queued repairs during edit drain	2026-08-09 22:34:49 +02:00
4gray	fd96b85c19	feat(playback): recommend recovery actions (#1374) ... * docs(playback): design recovery recommendations * docs(playback): plan recovery recommendations * refactor(playback): extract diagnostic utilities * feat(playback): define recovery recommendation contracts * feat(playback): rank recovery recommendations * feat(playback): track session recovery attempts * feat(playback): identify content recovery sessions * feat(ui): add ranked playback diagnostic panel * feat(playback): switch temporarily to recommended players * test(playback): cover temporary player recommendation * test(playback): verify recommendation capability guards * docs(playback): document recovery recommendations * fix(playback): keep recovery keys credential-free * fix(playback): remove derived tracking ownership * fix(playback): preserve distinct recovery fallbacks * fix(playback): reset resume for new sources * fix(playback): preserve desktop recovery guidance * docs(playback): clarify recovery policy exceptions * fix(playback): reject stale progress updates * fix(playback): keep protected recovery guidance neutral * test(playback): cover stale progress output * fix(playback): neutralize protected diagnostic copy * fix(playback): harden runtime guidance ownership * fix(playback): stabilize recovery application ownership * fix(ci): classify playback util coverage * fix(e2e): preserve playback fixture bytes	2026-08-08 01:04:39 +02:00
4gray	d2a83164ec	feat(stalker): protocol-correct auth lifecycle (#1354)	2026-08-03 23:06:47 +02:00
4grayandClaude Opus 5	e197409b10	fix(stalker): only mint a temporary link when the row asks for one (#1364) ... * fix(stalker): only mint a temporary link when the row asks for one `create_link` ran on every Stalker playback. The reference client — the portal's own `player.js`, mirrored by Kodi's pvr.stalker — mints a link only when the catalog row sets `use_http_tmp_link` or `use_load_balancing`; otherwise it plays the static `cmd` that `get_all_channels` / `get_ordered_list` already returned. Neither flag was read anywhere in the codebase, so every channel paid a round trip and gained a failure point the reference client does not have. One helper now owns the decision (`resolveStalkerStaticPlaybackUrl`), used by `fetchStalkerPlaybackLink()` for ITV/VOD/radio, by the download path, and by `StreamResolverService` for Favorites/Recently Viewed. Its guards are deliberately wider than the flags alone and can only route a row back onto the `create_link` path: no row to read flags from, a relative or query-only command (the VOD `has_files` rewrite), a non-HTTP scheme, or a loopback host. An episode always mints, since `series` selects it server-side. Radio joins the same decision, so a station the portal proxies now gets its link instead of playing a URL the portal never meant to serve. Temporary links live ~5 s, so the audit that came with this: favorites and recently-viewed persist the `cmd`, playback positions store ids, and the main-process context map stores headers keyed by origin+path — none replay a resolved URL. Downloads are the documented exception, and honouring the flags shrinks even that, since an unflagged movie now yields a permanent URL that survives retry. `forced_storage` and `play_token` stay unwired, with the reasoning recorded in the docs rather than left ambiguous. The mock's ITV/radio rows now carry both flags, and the new `static-channel-cmd` scenario (MAC 00:1A:79:00:00:0A) serves unflagged rows with a playable command so the e2e can assert that NO `create_link` request reaches the portal — verified to fail when the change is reverted, with a companion test proving the recorder sees a link when one is due. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): keep temporary-link flags across VOD normalization Codex P1 on #1364, and it is real. `buildStalkerSelectedVodItem()` narrows a raw portal row to an explicit whitelist, and the two flags were not on it. It feeds both `selectedItem()` — which the VOD playback path reads as `linkFlags` — and, through `createStalkerVodItem`, the download payload. So a flagged VOD row with an absolute HTTP `cmd` arrived looking unflagged and took the static path, playing the portal's non-final URL instead of minting a link. The direction of the failure is what makes it a P1: a dropped flag reads as "no temporary link needed", so the whitelist fails OPEN. Both flags now sit on `StalkerVodSource` / `StalkerSelectedVodItem` and on the whitelist, with the consequence spelled out at the normalizer so the next edit does not quietly undo it, and specs pinning all three normalizers plus a store-level test that a flagged VOD still mints. Also two things from re-reading my own diff: - The radio path called `resolveStalkerStaticPlaybackUrl` and then handed the same row to `fetchStalkerPlaybackLink`, which runs that exact check again. Two copies of one decision is the divergence this PR exists to remove, so the outer call and its now-unreachable guard are gone. - `portal-catalog-facade.ts` spells the flag shape out instead of importing `StalkerLinkFlagSource`; it now says why (`type:util`/`domain:portal-shared` may not depend on `type:data-access`/`domain:stalker`), so the obvious "reuse the type" cleanup does not get made and break the boundary lint. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): authenticate before serving a static collection stream Second Codex P1 on #1364, and a regression this PR introduced. `create_link` was also the request that warmed the portal session. Tokens live in memory only (`StalkerSessionService.tokenCache` is a plain Map), and the collection header builder reads the raw `getCachedToken()`. So a cold start from global Favorites or Recently Viewed — the portal never opened this session — took the static path, found no token, and handed a same-host gated stream headers with no `Authorization`: a 403 on exactly the streams the header contract exists for. The same raw accessor cannot tell a token negotiated for a pre-edit identity from a current one. `StreamResolverService` now calls `ensureToken()` before building a static playback. It is the right primitive: handshake + `get_profile` with no link minted, identity fingerprint validated, concurrent callers deduped, and an immediate null for simple portals — and calling it keeps this change out of `stalker-session.service.ts`, which PR 6 (#1354) is splitting. Best-effort by design: a static URL may point at a CDN that needs no credentials, so a failed handshake degrades to the token-less header set instead of costing the user their playback. Both halves are pinned by tests, and removing the call makes the cold-start test fail. The portal routes need no equivalent and do not get one: an item cannot be selected before its catalog has loaded, and every catalog load authenticates. That reasoning is now written down rather than assumed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): warm the session at the choke point; keep downloads authenticated Two more Codex findings on #1364, and the first one shows my previous commit message reasoned too broadly. P1 — I claimed the portal routes are "structurally warm" because an item cannot be selected before its catalog loads. That is true of the routed portal views, but not of the global collection detail, which calls `setCurrentPlaylist()` and `setSelectedItem()` straight from a persisted row with no catalog load in between and then goes through the STORE playback path. A VOD opened from Favorites on a cold start therefore still played a same-host gated stream with no Bearer token. Rather than extend the per-route argument, the warm-up moved to the one place every static return passes through: `fetchStalkerPlaybackLink()` now calls the session before short-circuiting, covering ITV, VOD, radio and downloads at once. `StreamResolverService` keeps its own call — its static branch does not go through that function — but both now share a single primitive, `ensureStalkerSession()` in `stalker-request.utils.ts`, so the two routes cannot drift on when a session is required. Still best-effort, still outside `stalker-session.service.ts` (PR 6 territory). P2 — downloads cannot use that escape hatch at all: the main-process stored header allowlist is User-Agent/Origin/Referer only, no Cookie or Authorization, so a static same-host URL 401s where a minted one worked. `startStalkerVodDownload` now classifies the candidate with the shared `isStalkerStreamCredentialSafe()` and withholds the row — forcing `create_link` — for anything portal-owned. A CDN-hosted movie keeps the permanent URL that survives retry; a portal-hosted one keeps the minted URL that carries its own token. Both fixes mutation-checked: each reverted change fails exactly one test. Docs corrected, including the overreaching "structurally warm" claim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(stalker): record the cached-token revalidation trade-off Codex flagged that the static path no longer self-heals a retired token, since `ensureToken` returns a same-identity cache entry without a network call — whereas `create_link` used to refresh it through `makeAuthenticatedRequest`'s auth-failure retry. The mechanism it posits does not exist on stock Stalker: per the 4.9.35 reference, handshake tokens have no TTL, and not sending the watchdog does not invalidate auth (it only clears the admin panel's "online" flag). The real residual vector is another device calling `get_profile` on the same MAC, which is common enough on shared subscriptions to be worth naming. Revalidating on every static playback would cost exactly the round trip this change removes, so it is deliberately not done. Recorded as a known trade-off with its mitigation (a running watchdog still self-heals within a ping cycle) and handed to PR 6, where a refresh on an OBSERVED playback authorization failure belongs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(stalker): tighten the token-revalidation trade-off wording Greptile review feedback: the watchdog mitigation was the most important part of that paragraph and sat behind the caveat. It now follows the MAC-sharing vector directly, and the paragraph ends by naming what is actually left uncovered — a same-host static stream played while no watchdog is up — so a future reader can size the residual without re-deriving it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): prefer the live playlist row over a stale favorite snapshot Codex P1 on #1364, and mine. `resolveStalker` reads its portal coordinates as `item.stalkerPortalUrl ?? playlist?.portalUrl` — item first. The create_link branch quietly corrected for that afterwards by re-reading `applyOverride(playlist).portalUrl`, so the row won wherever it existed, which is what the comment right above it already promised: "when the row exists it wins over the item's snapshot of the portal URL (a repaired endpoint must beat a stale favorite)". The static branch I added returns before that correction, so it shipped the stale snapshot. Consequences after a playlist edit: a same-host static URL matching the OLD host gets the newly negotiated token and identity headers sent to the previous portal, and a MAC-only edit pairs the new token with the old MAC cookie — precisely the pairing `stalkerIdentityFingerprint` exists to prevent. Both branches now derive the coordinates once, row-first with the repair override applied, and fall back to the item's snapshot only for a playlist that no longer exists — which is the role `buildStalkerPlayback` already documents for it. Mutation-checked: restoring item-first precedence fails the new test alone. Also documents a local-only e2e hazard found while re-running the suite: `mode: 'serial'` orders tests within one project, but chromium/firefox/webkit run the file concurrently against the same mock server, so one project's beforeEach reset can drop a session another is mid-test on — which is what a lone auth-spec failure that passes on rerun actually is. CI never sees it; the Web E2E job runs --project=chromium alone, and that command is clean (22/22). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): warm the session against the repaired portal configuration Found while auditing my own static branch against the create_link path rather than waiting for the next review round. `executeStalkerRequest` applies the lazy-repair override on its first line, so the create_link path always talks to the configuration a completed repair proved good. The session warm-up I added did not: it handed `ensureToken` the caller's pre-repair row, so a portal whose endpoint or mode had been repaired would handshake against the configuration the repair had already rejected — stranding the session precisely on the portals repair exists to rescue. The override now happens inside `ensureStalkerSession`, mirroring `executeStalkerRequest`'s first line, so every caller inherits the rule instead of each having to remember it. Mutation-checked: dropping the override fails the new test alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): fall back to create_link when a portal-owned static url has no session Codex P1 on #1364. `create_link` was also the request that could FAIL, and a failure is what triggers the lazy portal repair. A playlist still misclassified as token-free, or pointing at an unrepaired endpoint, used to self-heal on that failure and then play; the static path issues no request, so nothing fires and the stream just 401s. Its suggested remedy — routing a skipped warm-up through `repairPortal()` — cannot be taken literally: a skipped warm-up is the NORMAL case for the many legitimately token-free reseller panels, and probing each of them on every playback would cost far more than the round trip this PR removes. What is decidable without a request is whether we are about to serve a stream we already know will fail. `ensureStalkerSession` now reports whether the session can serve credentialed playback — true for a portal needing no token and for one holding a usable token, false for a full portal left without one — and both static call sites act on it: - foreign-host URL: served regardless, it never needed the session; - portal-owned URL with a usable session: served, as before; - portal-owned URL with no usable session: falls back to `create_link`, which mints a URL carrying its own token AND re-enters the only path that can observe a failure and repair. That covers the unrepaired-endpoint half exactly. The misclassified-as-simple half stays open by construction — no request means no evidence, and "simple portal" is indistinguishable from "misclassified" without one. It belongs with the other reactive-repair work already handed to PR 6: refresh and repair on an OBSERVED playback authorization failure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): require flag evidence before trusting a row as unflagged Two Codex findings on #1364. P1 — legacy persisted snapshots. Favorites and Recently Viewed rows saved before this change went through `buildStalkerSelectedVodItem`'s whitelist, which dropped both flags, and `buildStalkerFavoritePayload` spreads that whitelisted object. So a legacy row is flagless because WE stripped it, not because the portal said no — and the helper was reading it as "explicitly unflagged". With an absolute HTTP `cmd` from a load-balanced portal that meant playing a non-final URL. There is no migration or provenance marker for those rows. A stock portal returns both flags on every row, so their PRESENCE is itself the provenance signal, and it is the only one available without a refetch. `resolveStalkerStaticPlaybackUrl` now requires at least one flag key to be present; absence reads as "no evidence" and routes back to `create_link`, which is the pre-PR behaviour. This costs the optimization on panels that omit the flags entirely — the honest price for not being able to tell them apart from our own stripped rows. Radio is the one documented exception. It has always played a directly usable command without `create_link`, so a flagless radio row keeps that rather than newly minting — a portal whose radio `create_link` never worked would otherwise lose playback it has today. ITV and VOD have no such history and stay conservative. P2 — loopback range. IPv4 reserves all of `127.0.0.0/8`, so `127.0.0.2` was being handed to the player as a real address. Classified by range now, with a test that `127.0.0.1.cdn.example` is still treated as the ordinary hostname it is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): classify every portal-local IPv6 placeholder Codex P2 on #1364, same class as the 127.0.0.0/8 one. `http://[::]/ch/1234_` and the IPv4-mapped loopback forms slipped past the exact-name set and would have been handed to the player as real addresses. Checked how `URL` actually normalizes these rather than guessing at the spelling a portal might use: brackets are kept, `[0:0:0:0:0:0:0:1]` collapses to `[::1]`, and an IPv4-mapped address is rewritten to hex — `[::ffff:127.0.0.1]` arrives as `[::ffff:7f00:1]`. The guard now strips the brackets, matches `::1` and `::`, and decodes the mapped form by its high byte, so the whole of the mapped 127.0.0.0/8 range is covered along with the mapped unspecified address. The dotted tail is still accepted for any engine that leaves it alone. Routable hosts are unaffected, pinned by tests for `[2001:db8::1]` and `[::ffff:203.0.113.7]`. Mutation-checked: dropping `::` and the mapped-IPv4 decode fails five tests and nothing else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): normalize hostname and scheme spelling before the static verdict Two Codex P2s on #1364, both about trusting how a portal spells things. `http://localhost./ch/1234_` — a trailing dot is the DNS root and resolves identically, but `URL` keeps it for names while dropping it for IP literals (`127.0.0.1.` arrives bare, `localhost.` does not). The exact-name check read that as a remote host and would have pointed the player at its own loopback. Stripped before classifying. `HTTP://cdn.example/a.ts` — RFC 3986 makes the scheme case-insensitive. The case-sensitive tests failed SAFE, minting a link instead, but that defeats the contract for a portal that spells it this way, and one whose `create_link` cannot resolve an already-playable row would break. There were five such tests, and only one was on the new static path: the other three live in `resolveStalkerPlaybackUrl`, the create_link RESPONSE resolver, where `ffrt3 HTTP://…` failed to split its solution prefix and a query-only reply was appended to the portal base instead of to the command. That is pre-existing, but it is the same bug in the same shared normalizer, and fixing only the half this PR introduced would leave exactly the divergence this PR keeps removing. All five now go through one `hasHttpScheme()`. The response resolver had only indirect coverage, so it gains a direct spec alongside the static-path tests. Mutation-checked: reverting the dot strip and the case-insensitive scheme fails ten tests and nothing else. Also carries a docblock fix noticed on a read-through: the guard list still pointed at `PORTAL_LOCAL_HOSTNAMES` after the logic moved into `isPortalLocalHostname`, which now covers considerably more than that set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): normalize DNS root dots in the shared credential classifier Codex P2 on #1364, extending the `localhost.` fix into `isStalkerStreamCredentialSafe()`. It compared hostnames literally, so a portal on `portal.example` serving `https://portal.example./movie.mkv` classified its own stream as third-party. Wider than the download guard it was reported against: this predicate is the single rule BOTH the renderer playback-header builder and the Electron main-process fallback use to decide whether a stream may carry the mac cookie and Bearer token. A portal-owned stream spelled with the root dot was getting the credential-free profile and would 401 — pre-existing, and exactly the "only VLC works" class this contract exists to prevent. My PR added two new dependencies on the same predicate (the download static guard and the portal-owned fallback), which is how it surfaced. Both sides are normalized, so it stays symmetric, and it can only widen toward "same host" — never toward handing credentials to a different one. A test pins that `evil.portal.example.` is still rejected. Also carries the authority guard found by probing the same class myself rather than waiting for it to be reported: `http:///ch/1` has no authority and `URL` quietly reinterprets the first path segment as the host, so a malformed command reached the player as a nonsense address instead of going to the portal. `isPlayableHttpUrl()` now requires a non-empty authority. The other exotic spellings I probed were already covered — `URL` canonicalizes `127.1`, `2130706433` and `0x7f000001` to `127.0.0.1`, uppercases and expanded IPv6 normalize too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * perf(stalker): classify the static url before authenticating Codex P2 on #1364. Both static call sites awaited the session warm-up and only then asked whether the stream needed portal credentials at all — so a movie or channel on a foreign CDN paid for a handshake whose result was immediately discarded. That is not free: non-`create_link` requests carry a 15 s timeout (`stalker.events.ts`), so a portal that is slow or offline stalled playback of a stream the CDN would have served instantly. Cold Favorites/Recently Viewed starts are exactly where this bites, since that is where the session is not warm already. Classification now runs first. Foreign host returns immediately, portal-owned still warms and still falls back to `create_link` without a usable session. Behaviour is otherwise unchanged; only the order and the wasted wait are gone. Two tests moved with it: the foreign-host case now asserts the portal is not contacted at all rather than merely not asked for a link, and the repaired-endpoint case had been written against a foreign-host command, which under the new ordering correctly never reaches the handshake it was meant to be testing — it uses a portal-owned command now. Mutation-checked: restoring warm-before-classify fails the foreign-host test alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(stalker): repoint two handshake tests at the path they claim to cover Self-audit, prompted by the previous round: the reorder exposed one test that was asserting through a path it no longer reached, so I checked the rest of that class rather than assume it was the only one. Two more had the same defect, both mine. `still returns the static url when the handshake fails` (both specs) mocked `ensureToken` to reject, but used a FOREIGN-host command. Now that classification runs before authentication, that command returns before the handshake is ever attempted — the rejection was never exercised and the test passed on the early return instead of the mechanism in its name. Worse, the foreign case is already covered by the test added alongside the reorder, so these were asserting nothing new. Both now use a portal-owned command, which is what actually reaches the handshake, and assert what a throw really produces: `ensureStalkerSession` swallows it, the verdict is false, and the row falls back to `create_link` rather than being served as a known 401. Each asserts `ensureToken` was in fact called, so neither can silently drift back into testing an early return. Docs corrected with them: the "best-effort degrades to the token-less header set" wording described behaviour the reorder removed. A foreign-host URL is now returned before any handshake, and a failed one routes to `create_link`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(stalker): make the simple-portal skip test prove portal mode Fourth test found passing through the wrong exit, from auditing all ten in the block rather than waiting to trip over another one. `skips the handshake for a simple portal` used a foreign-host command, so the classification step returned before the warm-up was reached. `ensureToken` was indeed not called — but because the host was foreign, not because the portal was simple, and the assertion could not tell those apart. The command is now portal-owned, so the skip can only come from the mode, and the test also pins the returned URL and that no request was made. Mutation-checked properly this time: removing the simple-portal early return from `ensureStalkerSession` now fails this test. Under the old command it would not have. Also records the pattern where the next person will meet it. The decision chain has several exits — no flag evidence, unresolvable command, `series` set, foreign host, unusable session — and more than one can satisfy the same assertion, so a foreign-host command silently stands in for "simple portal" or "handshake failed". Mutation testing does not catch that class: it proves a test is coupled to its target, not that it reached the mechanism it names. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): key the radio fallback on flag evidence, not snapshot presence Codex P2 on #1364, and a divergence I introduced myself. `withStalkerPlayer`'s radio branch checks `hasStalkerLinkFlagEvidence(item)` before synthesizing the zero flags. `StreamResolverService` used `??`, which only falls back when the snapshot is absent entirely. A radio Favorite or Recent row persisted before the flags were carried HAS a snapshot — the old whitelist just stripped the flags out of it — so the `??` selected that flagless object, the helper found no evidence, and the collection route began minting for exactly the rows that used to play directly. That breaks portals whose radio `create_link` is unsupported, which is the case the radio exception exists for. The two paths now apply the identical rule. The divergence came from fixing them in different rounds and is precisely the class this PR keeps closing, so the comment on each side now points at the other. The existing radio test carries no `stalkerItem` at all, so it exercises the missing-snapshot arm and stayed green throughout — the same "passes through a different exit" pattern documented in the section above. The new test supplies a present-but-flagless snapshot. Mutation-checked: restoring the presence check fails it alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(stalker): treat every reserved localhost name as portal-local Codex P2 on #1364, the fourth in this class. RFC 6761 §6.3 reserves `localhost` AND every name ending in `.localhost` for the loopback interface, and resolvers honour it — so `http://stream.localhost/ch/1234_` reached the player's own machine instead of being sent to the portal to resolve. Closed the class rather than adding one more name: the suffix is matched, and `localhost.localdomain` goes in with it as the conventional `/etc/hosts` alias for 127.0.0.1 on most Linux systems. Together with the earlier rounds the predicate now covers `localhost` and `*.localhost`, `localhost.localdomain`, `127.0.0.0/8`, `0.0.0.0`, `::1`, `::`, the IPv4-mapped forms `URL` rewrites to hex, and a terminal DNS root dot on any of them. Only the suffix is reserved, so the guard must not over-match: tests pin that `localhost.cdn.example` and `notlocalhost` remain ordinary routable names and keep playing statically. Mutation-checked: dropping the suffix rule and the localdomain alias fails four tests and nothing else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-03 18:36:56 +02:00
4gray	96facd6f49	feat(downloads): queue season episode downloads (#1357) ... * docs(downloads): specify season queueing * docs(downloads): plan season queue implementation * feat(downloads): define episode queue identity * fix(downloads): align episode identity contract * feat(downloads): coordinate season queue submissions * fix(downloads): keep queue coordination provider neutral * fix(downloads): reconcile legacy episode identities * fix(downloads): fail closed on invalid stored coordinates * refactor(downloads): adapt Xtream episode requests * fix(downloads): use canonical Stalker episode ids * test(downloads): cover Stalker adapter reactivity * feat(downloads): add selected season queue action * refactor(downloads): extract season download presenter * feat(downloads): localize season queue feedback * test(downloads): cover series batch queue flow * test(downloads): harden series queue fixtures * docs(downloads): describe season queueing * docs(downloads): clarify season queue IPC contract * fix(downloads): isolate season header build warnings * fix(downloads): label season view toggles * fix(downloads): preserve Xtream episode headers * fix(downloads): fail closed on stale episode state * fix(downloads): align renderer queue safeguards * fix(downloads): block ambiguous episode actions * fix(downloads): accept nullable legacy coordinates * fix(downloads): preserve scoped episode ownership * fix(downloads): probe restored files asynchronously * fix(downloads): bound restored file probes * fix(downloads): release timed out file probes * fix(downloads): bound file probe callers * fix(downloads): refresh stable season skips * fix(downloads): fail closed before provider prep * fix(downloads): preserve retained partial ownership * fix(downloads): reconcile partial cleanup completion * fix(downloads): await authoritative list refresh * fix(downloads): coalesce list refreshes * fix(downloads): preserve specials season identity * fix(stalker): preserve specials season mapping * fix(downloads): distinguish missing Xtream seasons	2026-08-03 08:53:44 +02:00
4grayandClaude Fable 5	0010dd7351	feat(portals): rework the VOD sources popup and action row (#1359) ... * feat(portals): rework the VOD sources popup and action row The Sources popup now anchors above its button and always fits on screen: the overlay caps it to the space beside the chip, only the source list scrolls so the header, search, filter chips and footer stay visible, and it flips below the button when the space above is too small. Filter chips (All / Available / HD+ / language) compose with the playlist search, and "Available" runs check-all itself when nothing has been checked yet. Expanded copy rows no longer repeat the playlist domain: each copy shows its parsed language chip, the provider's raw stream title, and only the tags that differ from the parent copy. Availability checks run at most four at a time and settled verdicts are remembered per movie and source for ten minutes, so reopening a movie no longer re-contacts every foreign portal. Favorites and Download become icon-only buttons with real state: a filled heart when favorited, and a download icon that turns into a progress ring and then a checkmark that reveals the finished file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(portals): match the movie detail's icon-only favorite button The Xtream movie detail's favorite control is now an icon-only button, so the shared "add this detail to favorites" helpers no longer found it by class. They are used against series and Stalker details too, which still render the labeled variant, so they now select by accessible name — the icon button carries the same label in aria-label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(portals): keep provider playback for a downloaded movie Once a movie is downloaded the primary button plays the local file, and the sources popover only exists when another playlist carries the same film. The icon-only rework left those as the only two paths, so a downloaded movie in a single-playlist library had no way at all to stream the provider's copy — the labeled action that used to do it was gone. Restores it as an icon button beside the downloaded checkmark, under the same condition the old one used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-02 22:27:24 +02:00
4grayandClaude Fable 5	b92503feae	feat(stalker): endpoint probing + behavior-based portal mode with lazy repair (#1344) ... * feat(stalker): endpoint probing + behavior-based portal mode with lazy repair Replace the URL-shape guess behind isFullStalkerPortal with real endpoint discovery: at import, probe portal.php -> server/load.php -> stalker_portal/server/load.php (the pasted .php endpoint first) and classify the portal by observed behavior — a token-less itv/get_genres answering data proves a token-free panel, the middleware's plain-text auth failure proves the endpoint enforces the token, confirmed by the real handshake + get_profile. The proven endpoint and mode are persisted. The three diverging portal-mode predicates (import, session service, legacy migration) collapse into one shared helper in @iptvnator/shared/interfaces; executeStalkerRequest becomes the single request choke point (search and the collection stream resolver fold in), and the production-dead makeStalkerRequest copy is removed. Existing misclassified playlists repair themselves lazily: only after a request actually fails with the plain-text auth bodies, HTTP 404, or a terminal handshake error, at most once per playlist per session, and only a configuration discovery proved to answer is persisted — via a minimal portalUrl/isFullStalkerPortal patch, so favorites, recents and playback positions survive. Working reseller panels are never probed or rewritten; there is deliberately no eager one-shot migration, because tolerant portal.php panels cannot be told apart from misclassified canonical portals without probing. The Electron handler now embeds the HTTP status code in the error message (ipcRenderer.invoke strips custom properties from rejections), and probe requests carry silent:true so expected 404s do not toast error snackbars. The stalker mock gains a portal.php-less /ministra host so e2e can prove the 404 fallthrough end to end. Fixes #850, #686, #755. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): sync watchdog, PWA proxy errors and cmd resolution with lazy repair Review round 1 (Greptile P1, Codex P1/P2): - A successful repair now re-syncs the ACTIVE watchdog playlist via the new StalkerSessionService.refreshActiveWatchdogPlaylist(): a simple-to-full repair starts the required keepalive mid-session, full-to-simple stops it, and an endpoint change repoints the pings instead of leaving them on the activation-time snapshot. - PwaService.forwardStalkerRequest surfaces the web-backend proxy's normalized { message, status } no-payload envelope as an HTTP error carrying the status, so endpoint discovery and the lazy repair can classify upstream 404s in the PWA too (previously payload unwrapping returned undefined and dead endpoints were unrepairable there). Probe requests pass silent:true and skip the error snackbar. - fetchStalkerPlaybackLink and the collection StreamResolverService re-apply the repair override AFTER the request, so a relative create_link reply resolves against the endpoint that actually answered (the resolver keeps the /stalker_portal path segment as base, so this matters beyond origin). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): parse candidate URLs and tie repair overrides to their source config Review round 2 (Codex P2 x2): - Endpoint candidates are now derived from the parsed origin + pathname: a pasted URL carrying a query or fragment (host/c?key=value) no longer gets /portal.php bolted onto the query, which made every probe hit /c and persisted the non-API URL. - A repair override is tied to the failing configuration it replaced. Playlists carrying anything else (the user edited the portal URL or mode through the playlist dialog) drop the override and re-arm the once-per-session probe latch, so edited metadata is used verbatim and may repair again if it fails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): auth-gated probes, normalized offline fallback, mock docs sync Review round 3 (Codex P1 x2, P2): - A probe answered with HTTP 401/403 now classifies the endpoint as auth-required and attempts the real handshake instead of skipping the candidate: non-standard middlewares answer 401 where the stock server sends HTTP 200 + plain text, and such portals authenticated fine before discovery existed. - The unreachable-host import fallback normalizes the pasted URL (origin + pathname) before the legacy /c -> portal.php rewrite, so a query or fragment can no longer make it persist the browser page URL - a 200 HTML answer from /c is not a repair trigger, which would have left the playlist empty for good. - The stalker mock-server README and architecture doc now describe behavior-based discovery and the /ministra host instead of the retired URL-shape rule and its "known inconsistency" note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): recognize JSON auth failures and guard repairs against mid-probe edits Review round 4 (Codex P1 + P2): - isStalkerAuthFailureResponse() recognizes the JSON envelope some panels answer instead of the plain-text body ({js:{error:"Authorization failed"}} / {js:{msg:...}}). Probe classification treats it as auth-required instead of token-free data, and the lazy-repair trigger fires on it at runtime — previously such a portal was persisted simple with no repair path at all. - A repair is committed only after re-reading the persisted row and verifying it still carries the configuration that failed: a user who edits the portal URL (or deletes the playlist) during the multi-second probe now wins over the in-flight repair result for the old URL. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): probe past endpoint 5xx, sibling fallbacks, identity-aware repair guard Review round 5 (Codex P2 x3): - A probe that fails with a RESOLVABLE HTTP status keeps discovery going: a broken /portal.php handler answering 500 must not hide a healthy sibling endpoint. Only status-less failures (true network level) stop the loop. The Electron handler now gives real HTTP 5xx responses the same parseable "HTTP Error <code>" message shape as 4xx, so the renderer can tell them apart from ECONNREFUSED/timeouts after ipcRenderer strips the object shape. - Standard fallback candidates for a nonstandard pasted endpoint (.../cp/api.php) derive from its DIRECTORY, so recovery probes hit /cp/portal.php instead of /cp/api.php/portal.php. - The repair's row re-verification also compares the MAC and all Stalker identity fields: a probe authenticated as the old identity must not install its token/watchdog or persist onto a row whose credentials were edited mid-probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): reactivation-safe watchdog, wider JSON auth phrases, per-config probe latch Review round 6 (Greptile 4/5 concern + Codex P1/P2): - setCurrentPlaylist applies the repair override before feeding the watchdog and store state: re-activating the portal route with the stale NgRx meta no longer stops or repoints the repaired keepalive back to the broken configuration. - The structured js.error/js.msg fields accept the full phrase set the session service recognizes (Invalid token, Auth failed, bare unauthorized/authorization) — panels answering those envelopes were still classified token-free. Plain-text body matching stays narrow on purpose (HTML false positives). - The once-per-session probe latch is keyed by the SOURCE configuration fingerprint (endpoint, mode, MAC, identity) instead of the playlist id: a repair discarded because of a mid-probe edit no longer blocks the edited configuration from repairing, while stale snapshots of an already-probed configuration still cannot loop the probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): identity-aware override invalidation and timeout-tolerant probing Review round 7 (Greptile P1 + Codex P2): - The repair override records the identity fingerprint the probe authenticated as. Editing the MAC or any Stalker identity field afterwards drops the override, the per-config probe latch AND the cached token, so requests and watchdog pings never pair the edited identity with a session negotiated for the previous one. - A status-less probe failure that is a TIMEOUT (renderer budget, axios request timeout, ETIMEDOUT) continues to the next candidate — one hanging handler must not hide healthy siblings; connection-level failures (refused, unresolvable host) still stop discovery, so dead hosts keep failing fast. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): watchdog pings authenticate as the persisted row Review round 8 (Greptile 4/5 concern): The watchdog held its activation-time playlist snapshot for the whole session, so portal metadata edited (or repaired) mid-session kept the keepalive authenticating as the previous identity/endpoint — its pings could keep the old session alive and repopulate the playlist-scoped token cache with a token for the pre-edit identity. Each ping now resolves the playlist from the persisted row first (the single source of truth), falling back to the snapshot only when the store cannot be read, and refreshes the snapshot on every successful read. Any edit — identity, endpoint or mode — reaches the keepalive within one ping cycle; a row now marked simple (or deleted) stops the watchdog. The in-flight guard is claimed before the row read so overlapping pings cannot double-fire. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): identity-tagged tokens, watchdog override overlay, retire-on-failure Review round 9 (Greptile 4/5 concern + Codex P2): - The session token cache is tagged with the identity fingerprint (MAC + all Stalker identity fields) the session was negotiated for; ensureToken re-authenticates instead of handing an edited identity the previous token. The fingerprint helper is shared (stalker-identity.utils) with the repair layer's override/latch checks. - Watchdog pings overlay the repair layer's in-session override on the resolved row (registered decorator, no import cycle): a simple-to-full repair whose persistence is pending or failed no longer reads the stale row and stops the freshly started keepalive. - makeAuthenticatedRequest retires a failed token even on the no-retry path (watchdog pings), so a dead session is never handed to the next caller. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): pending authentications are identity-scoped Review round 10 (Greptile 4/5 concern): pendingAuth entries carry the identity fingerprint they authenticate as. A request for an edited identity no longer adopts an in-flight result negotiated for the previous identity: it waits the old authentication out (a competing handshake would strand it with a dead token on strict portals) and then negotiates its own session. This was the last id-only-keyed session structure — override, probe latch, token cache, watchdog snapshot and pending auth are now all identity-aware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): atomic repair persistence, full probe history, normalized offline classify Review round 11 (Codex P2 x3 + P1 docs): - The repair's row verification and patch now run ATOMICALLY inside the per-playlist write queue via the new PlaylistsService.transformPlaylistMeta(): a user edit that is queued but not yet committed wins over the repair — the transform sees the edited row and aborts instead of overwriting it. Write failures after a successful verification keep the session-only override, read failures discard the repair. - The per-playlist probe latch keeps EVERY attempted source fingerprint, so alternating edits (A -> B -> A) cannot evict a fingerprint and let stale snapshots re-run discovery. - The unreachable-host import fallback classifies the normalized origin+pathname, so a query merely mentioning /server/load.php cannot make a panel URL look canonical and abort the offline import. - docs/architecture/stalker-portal.md documents the actual probe sequencing: any resolvable HTTP status (incl. 5xx) and timeouts continue, 401/403 classify as auth-required, only connection-level failures abort. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): collision-proof session fingerprints Review round 12 (Greptile P1): identity values are unrestricted strings, so the delimiter-joined fingerprint could alias distinct identity tuples (serial "a|b" + empty device vs serial "a" + device "b") and bypass the identity invalidation. Both the identity fingerprint and the repair source fingerprint are JSON-encoded now; regression test pins the exact aliasing pair. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): preserve URL authority in normalization; document per-config latch Review round 13 (Codex P1 docs + P2): - normalizeStalkerPortalInputUrl mutates the parsed URL (clear query/ fragment, trim pathname) instead of rebuilding from origin, and the candidate builder swaps only the path — file: URLs (origin "null") no longer make the builder throw, and basic-auth credentials are not silently dropped before probing. - The canonical docs and the repair service JSDoc now describe the actual loop guard: at most one probe per SOURCE CONFIGURATION (endpoint, mode, MAC, identity) per playlist per session, not once per playlist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): HTTP 401/403 failures trigger the lazy repair Review round 14 (Codex P1): discovery classifies 401/403 endpoints as auth-required, but the repair trigger accepted only 404 — a legacy playlist misclassified token-free against an HTTP-auth-gated middleware could never reach discovery and stayed unusable. 401/403 now qualify; endpoint-specific 5xx still do not. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): re-enter repair for edited configurations after a pending probe Review round 15 (Codex P2): a request carrying an edited configuration that raced an in-flight probe only awaited it and inherited its outcome — the edited fingerprint stayed unattempted and the first request failed without triggering its own discovery. repairPortal now re-enters after awaiting the pending probe, so the per-config latch decides: already attempted -> reapply, never attempted -> own probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): probe history remembers outcomes so restored configs repair again Review round 16 (Greptile P1): the per-config latch kept A's fingerprint after an edit to B dropped A's override, so restoring A left it latched with nothing to reapply — broken until restart. The history now stores each probe's OUTCOME (override or null): a restored configuration reinstalls its remembered repair without a second discovery, and the anti-ping-pong property (A<->B alternation never re-runs discovery from stale snapshots) is preserved. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playlist): serialize deletion behind the per-playlist write queue Review round 17 (Codex P2): deletePlaylist bypassed serializePlaylistWrite, so a queued mutation (e.g. the Stalker portal repair's conditional transform) finishing after an unserialized delete could upsert the row back and resurrect the playlist. Deletion now runs through the same queue: queued writes commit first, the delete lands last, and a transform enqueued after the delete reads a missing row and aborts. Regression test pins the write-then-delete ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): reinstalled repairs re-sync the watchdog like fresh ones Review round 18 (Greptile P1): the restored-configuration branch reinstalled the remembered override without the watchdog refresh the fresh-repair path performs — if the intermediate edit stopped the keepalive, the restored full-portal session recovered requests but never its pings. The reinstall now calls refreshActiveWatchdogPlaylist with the override applied, symmetric with a fresh repair. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): discarded probes retry once their configuration is restored Review round 19 (Greptile P1): the pre-probe history reservation survived the row-mismatch discard, so restoring the original configuration hit the latch with nothing to reinstall — lazy repair stayed disabled for the session. Probe records are now explicit (override / no-change / discarded): a discarded configuration probes again once one cheap row read confirms the row was RESTORED to it, while stale snapshots of it stay declined without a discovery run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): IPC-safe transport errors, repairable profile path, nested base paths Review round 20 (Codex P2 x4): - The Electron handler throws a real Error for axios failures without a response: Electron serializes rejections via toString(), so a plain object arrived as "[object Object]" and discovery could not tell a timeout (keep probing) from a dead host (stop). - isAuthorizationError parses HTTP 401/403 out of the IPC-wrapped message, so an expired-token 403 retires the token and re-authenticates instead of surfacing as a plain failure. - The account-info full-profile path (which bypasses executeStalkerRequest) routes repair-trigger failures through StalkerPortalRepairService and retries with the repaired playlist, so opening the dialog can fix a stale endpoint. - resolveStalkerPlaybackUrl derives the installation base from the endpoint's API suffix instead of a fixed stalker_portal|c|portal allowlist: relative create_link replies now resolve correctly under arbitrary discovered installations such as /cp/server/load.php. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): strict probe data shape, mode-aware profile retry, docs API name Review round 21 (Codex P1 docs + P2 x2): - Probe classification requires the real get_genres shape (array, or a {data: []} envelope without an error) instead of a bare `js` key: a 200 error envelope ({js:{error:"Unknown action"}}, {js:false}) no longer ends discovery on a broken candidate and persists an empty catalog. - After a repair that flips the portal to simple mode, the account-info retry re-enters the mode routing and uses get_main_info instead of handshaking against a token-free panel again. - docs/architecture/stalker-portal.md names transformPlaylistMeta and its atomic source-check invariant (plus the serialized deletion) rather than the race-prone updatePlaylistMeta. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): account dialog re-routes after a simple-to-full repair Review round 22 (Codex P2): fetchViaMainInfo runs through executeStalkerRequest, whose lazy repair retries the SAME action, so a repair proving the portal is actually full left the dialog calling get_main_info — canonical installations publish subscription details only through handshake + get_profile, leaving the dialog empty. The routing is now symmetric with the full-to-simple case: an empty main-info result whose repair flipped the mode re-enters the profile flow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): row-gate override reinstall; document mode-based account routing Review round 23 (Codex P2 + P1 docs): - Reinstalling a remembered override now requires the persisted row to actually carry that configuration again. A stale request for A while the row holds an unrelated C no longer resurrects A's override, which would retry against B and repoint the active watchdog away from C. (The edit-back-to-A case stays as documented: there the row IS A.) - docs/architecture/stalker-portal.md and CLAUDE.md describe account-info routing by the observed portal MODE instead of the endpoint shape — a token-enforcing portal.php is a full portal now — and note the mode-change re-routing in both directions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): share the auth-failure predicate; prefer profile over partial main-info Review round 24 (Codex P1 + P2): - isAuthorizationError now reuses isStalkerAuthFailureResponse, so the phrases discovery and the lazy repair already classify as auth failures (Access denied., Unauthorized request., and their JSON envelopes) also retire the session token. Previously a full portal expiring with either phrase kept its dead token: the repair rediscovered the same endpoint/mode, recorded no-change, and every later request stayed broken. - After a simple-to-full repair, even a PARTIAL get_main_info answer no longer wins over the profile flow — expiry and tariff live only behind handshake + get_profile. The partial facts are kept only if the profile path itself publishes nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): keep a literal c installation directory in candidate derivation Review round 25 (Codex P2): the /c landing-page rewrite ran after the endpoint file was stripped, so `/tenant/c/portal.php` collapsed to `/tenant` and the sibling probes went one level too high, rejecting a valid portal whose installation directory is literally named `c`. The rewrite now applies only when the pathname itself ends in `/c` (no endpoint file); pasted endpoints strip only the file part. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): route rejected post-repair main-info retries to the profile flow Review round 26 (Codex P2): a simple-to-full repair during fetchViaMainInfo makes executeStalkerRequest retry the same action against the repaired full portal, and installations that do not implement get_main_info answer 404 — the rejection escaped before the repaired-mode check, so the dialog failed instead of switching to get_profile. The rejection is captured and reaches the same check; without a mode change it is rethrown unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): full predicate for wrapped denials; record the removed store prop Review round 27 (Codex P2 + P1 docs): - The repair trigger applies the shared auth-failure predicate to the error MESSAGE too, so authentication's wrapped structured denials (Error('Profile error: Access denied.')) reach the repair instead of bypassing it and leaving a healthy sibling endpoint unprobed. - docs/architecture/stalker-store-api-baseline.md records makeStalkerRequest as removed, with the reason it gets no facade alias: it was production-dead and held a fourth private copy of the portal-mode branch that the shared predicate exists to prevent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): complete auth predicate for wrapped error messages Review round 28 (Codex P2): the plain-text BODY matcher deliberately knows only the three middleware phrases, so passing an error message through it let authenticate()'s wrapped denials — Error('Profile error: Invalid token') / 'Auth failed' — bypass both the repair trigger and the session auth predicate. A dedicated isStalkerAuthFailureMessage() applies the wide phrase set to controlled error strings, while arbitrary portal bodies keep the narrow matcher that cannot false-positive on HTML pages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(stalker): reject denied profiles during confirmation; document all repair triggers Review round 29 (Codex P2 + P1 docs): - Full-portal confirmation validates the get_profile envelope with the shared structured predicate: a handshake can hand out a token whose profile still answers {js:{error:"Invalid token"}}, and authenticate() inspects only msg/block_msg — discovery would have persisted an unusable endpoint and stopped before the healthy sibling. authenticate() now returns the raw profile response for that check. - The canonical lazy-repair contract lists the complete trigger set: the plain-text bodies AND their JSON envelopes, HTTP 404, HTTP 401/403, and terminal handshake/profile errors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-02 18:01:45 +02:00
4grayandClaude Fable 5	fc7f23b229	feat(playback): forward portal Cookie/Authorization to built-in players (#1335) ... * feat(playback): forward portal Cookie/Authorization to built-in players The web players (HTML5/hls.js, Video.js, ArtPlayer, Shaka) could only ever receive User-Agent/Referer/Origin, so any Stalker stream gated on the portal session cookie or Bearer token played exclusively in external MPV/VLC — the long-running "only VLC works" cluster (#849, #910, #732). - request-header-overrides.service: the scoped override now carries Cookie and Authorization, attached only to requests on the exact stream origin, in-memory only, dropped on replace/clear. Unscoped (playlist-level) calls drop credentials fail-closed; control characters in header values are rejected. Chosen over session.cookies.set(): jar cookies attach only to credentialed requests, which would force withCredentials into every engine and break against the Access-Control-Allow-Origin:* IPTV panels send, and jar scoping is port-blind. - WebPlayerViewComponent is now the single owner of the scoped override for every built-in player: it extracts the full header set from the resolved playback, configures the override BEFORE handing the source over (players render only once the source exists), and clears the scoped layer on destroy. HtmlVideoPlayerComponent's own three-header call is removed — it would overwrite the credentialed override. - Stalker VOD, series episodes and radio now build the same portal header set ITV already had (they previously carried no portal headers at all); same-origin playback sends the real User-Agent alongside X-User-Agent. - Stream classification is host-based via one shared predicate (isStalkerStreamCredentialSafe): same-host port changes and scheme upgrades keep the portal profile (the #1158 class), a foreign host or https->http downgrade keeps the credential-free KSPlayer profile. The main-process fallback context uses the same predicate so isStalkerDirectStreamProfile can no longer discard renderer headers. - setUserAgent bridge gains an optional credentials parameter; preload, ipcMain handler and ElectronBridgeApi updated together. - stalker-mock-server: gated-stream scenario (MAC 00:1A:79:00:00:09) whose create_link returns a local /stream/gated/video.mp4 that 403s without the mac cookie + current Bearer token; new Electron e2e proves a built-in player actually plays it (and that the gate refuses bare requests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): apply header override to Stalker radio, redact mock cookie log Address Codex review feedback on #1335: - The radio branch of the Stalker live layout renders the dedicated audio player, never WebPlayerViewComponent, so the resolved portal headers were built but never applied — an auth-gated radio stream still 403'd. The override sync is extracted into ElectronStreamHeadersService (single owner of the scoped override slot, with clear-only-while-owning semantics so a destroyed consumer cannot wipe a newer consumer's override), applied by WebPlayerViewComponent for video players and by the radio branch before the audio element gets its URL. The service feature-detects the bridge method so partial bridges behave like the PWA instead of throwing. - The gated-stream mock no longer logs the raw Cookie header on 403 — presence only, matching the Authorization logging. - The gated scenario now serves an audio fixture for radio create_link and the Electron e2e covers the radio path end-to-end (bare request 403s, built-in audio player advances past the gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): claim radio header ownership before awaiting the IPC Codex round-2 P2: leaving the radio route while the header IPC was still in flight left the portal cookie/token installed — ngOnDestroy saw a null scope URL (it was recorded only after the await) and could not clear the override. Ownership is now claimed synchronously before awaiting, destroy invalidates the pending playback continuation, and the apply's stillCurrent verdict is honored. Regression test covers destroy-during-pending-IPC. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): carry portal headers into collection playback Codex round-3 P1: Stalker channels opened from Favorites/Recently Viewed resolved through StreamResolverService.resolveStalker(), which returned no portal headers — the video path handed the header owner an empty set and collection radio bypassed it entirely, so auth-gated streams still 403'd from collections. - resolveStalker() now builds the same profile as the live layout via the shared classifier: portal-owned streams get mac cookie/Bearer token/MAG UA/portal Origin+Referer, foreign hosts keep the credential-free KSPlayer profile (both create_link results and direct radio URLs). - UnifiedLiveTabComponent applies the scoped override for radio before the audio element gets its URL (ownership claimed before awaiting the IPC, round-2 lesson), and clears it on close and destroy. - Regression tests: resolver header profiles for portal-host and foreign streams; unified tab radio apply-then-clear. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): release the radio override when a new selection mounts no player Codex round-4 P2: after radio installed its credentials, selecting an item that never mounts a player surface (external video playback, failed resolution) left the old Cookie/Authorization installed — no WebPlayerViewComponent, close, or destroy cleanup runs on that path. Both radio hosts (unified collection tab and the Stalker live layout, which has the identical hole) now release the previously owned radio scope at the start of every new selection; the slot-ownership semantics keep this a no-op when another playback already owns the override. Regression test in the live-layout spec pins the failed-selection path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(playback): state the exact override release points Codex round-5 P2 flagged that the media 'ended' event does not clear the scoped override while the player stays mounted. That is deliberate, not a gap: a mounted player still owns the session — replay or a seek into an unbuffered range must keep working against a gated stream, and clearing on 'ended' would 403 exactly the streams this PR fixes. The credentials only ever travel to the exact origin that issued them, and every dismount path (channel/source change, player close/destroy, radio close, playerless selection) releases them. The security doc and the release note now say precisely that instead of the ambiguous "cleared when playback ends". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(playback): fit the release note back under the 400-character cap Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-02 10:51:12 +02:00
4grayandClaude Fable 5	297e9fbef8	fix(stalker): send cmd in the reference MAG wire format (#1334) ... * fix(stalker): send cmd in the reference MAG wire format A real MAG sends cmd unencoded and the portal decodes its query exactly once, so a cmd that already contains percent sequences (%3A tokens, pre-encoded path segments) must pass through untouched. The previous encodeURIComponent transport (2c032cd3c, 0.22) double-encoded such cmds (%3A -> %253A): strict portals and reseller panels that compare cmd literally, and stock create_link handlers matching the decoded value, saw a different string than a real STB sends. The new shared encodeStalkerCmdValue() reproduces the reference wire bytes: % passes through verbatim, characters the WHATWG URL serializer keeps raw in a query stay raw (so the bytes survive the axios/new URL transport unchanged), and everything else is percent-encoded. That preserves the 0.22 injection protection - &, # (and ; for PHP setups with a ; argument separator) inside cmd cannot append or truncate query parameters; they decode back to the original byte server-side. Both transports now share the format: the Electron query builder is extracted to buildStalkerRequestUrl() and the web-backend /stalker proxy appends cmd to the portal URL itself instead of letting axios turn slashes into %2F (the opposite divergence). Also unifies the two divergent response-side cmd normalizers: the cross-portal collection resolver now uses the Stalker store's normalizeStalkerPlaybackCommand/resolveStalkerPlaybackUrl, so playing from Favorites/global collections resolves relative (/media/...) and query-only (?token=...) create_link replies against the portal base instead of handing the player a bare relative path. The mock portal's create_link response gains mock-only cmd_received/ query_keys_received diagnostics; a new Electron e2e pins the contract end-to-end (single decode, injection blocked). Unit corpus tests cover the encoder, the Electron builder, the web-backend proxy, and the resolver. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(pwa): sanitize portal URL before appending stalker cmd A registered portal URL carrying a fragment would swallow the appended cmd (everything after # is never transmitted), and a trailing bare '?' produced '??cmd='. Drop the hash and pick the separator from the sanitized href before appending. Flagged by Greptile/Codex on #1334. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(pwa): make stalker cmd append visibly query-only for CodeQL Rebuild the /stalker request URL through the URL object and concatenate the encoded cmd strictly behind a literal '?', so static analysis can see the tainted value never reaches host or path (js/request-forgery alert on the previous separator ternary). Behavior unchanged; the fragment/bare-'?' regression tests still pin the wire format. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-02 07:38:11 +02:00
4grayandClaude Opus 5	063662028a	feat(portals): find the same movie in your other playlists (#1286) ... * feat(portals): find the same movie in your other playlists A movie that exists in several imported Xtream playlists now shows a "Sources N" chip on its detail page and in the player. Switching playlist mid-film keeps the timecode, a preferred source can be pinned per movie, and a failed stream offers the alternatives instead of a dead end. The governing rule is that a guess is never presented as a fact. Every metadata value carries where it came from — `api` (the provider said so), `parsed` (inferred from the title) or `probe` (we contacted the stream). Facts render as plain tags, guesses are prefixed `~` in a warning colour, and an unknown value renders no tag at all plus a "check" affordance. Ranking and failover read through `factualOnly()`, so a filename claiming 4K is structurally unable to outrank a source that was actually reached. A probe that could not complete reports "unknown", never "unavailable". Scope is deliberately narrow: Xtream to Xtream, movies only, Electron only. Stalker never reaches the `content` table and M3U is a JSON blob whose search forces live content; both are additive later, since the candidate type already carries all three portal kinds. In the PWA every entry point is gated off and the chip renders nothing. Auto-failover is opt-in and off by default. Each source is tried at most once per session, so it terminates structurally, and the switch is never silent — the toast names the new playlist, offers an undo, and warns that the dub may differ only when both sides state an audio track as fact. Notable details: - Playlist names are routinely the pasted URL, credentials included. They are never rendered raw; a short host-only label is derived instead. - Quality is derived from pixel width, not height: a 2.39:1 1080p master is 1920x800, and bucketing that by height would publish "720p" as a fact. - Switching is a single `inlinePlayback.set()` so the player and engine survive and re-seek; the carried position is read before the 15s persistence throttle so it does not rewind. - Sources from one playlist collapse into a group, since the same film often appears there several times under different stream ids. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop stale source resolutions from committing Addresses three defects Greptile found in the multi-source review. **Concurrent switches committed out of order.** Selecting a second source before the first resolution returned let the slower request overwrite the newer selection and repoint Undo at itself. `switchTo` now takes a sequence number and drops its result if a newer switch already committed. **Stale switches crossed movie sessions.** Navigating to another film while a resolution was in flight let the continuation activate the old film's source inside the new controller — and restart it from that session's zero resume position. The controller is now snapshotted per operation and the movie session is revalidated after every await. `check()` had the same hazard across its two awaits and is guarded the same way. **Short titles skipped discovery entirely.** The trigram tokenizer cannot index tokens under three characters, so "Up", "It" or "Us" produced an empty MATCH expression and the query was discarded before SQLite was consulted — the chip could never appear for those films. Discovery now falls back to a bounded scan when FTS structurally cannot serve the title; the existing two-tier normalized confirmation still rejects loose hits like "Upgrade". Each fix carries a regression test; all three were mutation-checked by removing the guard and confirming exactly those tests fail. The previous test asserting that short titles return nothing encoded the bug and has been replaced. The host spec passed 400 lines, so its fixtures moved to a shared module and the race suite into its own file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): make the pin decide playback and keep failover going Second round of Greptile review findings. **A pin had no behavioural effect.** Loading a stored pin only decorated the row: Play still started the route's playlist and failover ranking ignored `isPinned`, so "make this the main source" survived a restart as an icon and nothing else. The primary action now starts from the pinned source when one is set, and the pin outranks everything else in failover ranking. **Failover stopped at the first unresolvable candidate.** An expired account or a failing `get_vod_info` on the top-ranked source ended the attempt, and since production calls `failover()` only once — on the original playback failure — a healthy lower-ranked source was never reached. It now continues through untried candidates. `switchTo` reports why it stopped so the loop can tell "could not resolve, try the next one" from "something newer owns the screen"; without that distinction a superseded switch would have spun forever, because only the former marks the candidate tried. **Identity ignored enrichment.** The key was `playlistId:contentId:title`, so when `get_vod_info` added a TMDB id and release year to an unchanged title the host saw no change, never reloaded, and kept yearless discovery and title-only pin keys — a `tmdb:`-keyed pin could never be found. The key now covers every field that affects matching. **A server refusing HEAD read as unavailable.** Some stream hosts answer 405 or 501 to HEAD yet serve the media over GET. The probe now retries once with the ranged GET the main process already supported, instead of caching a working source as failed and penalising it during failover. Greptile also flagged a missing token check after the resolve await in `switchTo`; that guard landed in 4db3a2fd and sits on the line directly below. Answered on the thread rather than changed. The host service passed 400 lines again, so the pin, probe, switch-notice and current-row concerns moved into focused modules beside it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(portals): record the behaviour the review rounds changed The architecture doc and CLAUDE.md described the feature as first written, not as it now behaves: pins were documented as a stored preference without saying they decide playback, failover was described as stopping at the first unresolvable candidate, the probe as HEAD-only, and discovery as pure FTS with no mention that short titles cannot be tokenized at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): invalidate the session while the movie identity is empty The staleness guard added in 4db3a2fd bumped the session only inside `load()`, which leaves a window the guard does not cover: route navigation empties the movie identity first, and `load()` for the replacement runs only once a title is knowable again. A resolution completing in that interval still carried a session number that matched, so it passed the check and started the previous movie's source over the page the user was navigating to. The binding effect now bumps the session as soon as the identity goes null, so anything already in flight is invalidated at the moment the old movie stops being the one on screen rather than when the next one finishes loading. `lastMovieKey` is deliberately left alone: returning to the same movie should not re-run discovery, and the controller's state is still correct — only the in-flight operations needed invalidating. Regression test added and mutation-checked: removing the bump fails exactly that test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop the source list from losing the real alternatives Six review findings, all in how multi-source decides what to show and what it is playing. Discovery: the current playlist is now excluded in SQL rather than after the fact, so its own duplicate rows can no longer spend the whole row budget before a single alternative is read. The short-title scan matches the token as a word instead of a substring and orders by title length in a wider window, so "Titanic" and "The Italian Job" cannot push the real "It" out of it. Session: metadata enrichment re-runs discovery for the film already on screen. That is a refresh, not a new session — a second identity key (playlistId:contentId) now separates the two, so the source the user switched to keeps playing and stays named, the tried set stays burned, the position survives and a switch in flight still commits. Resume: the multi-source controller no longer records the engine's pre-seek timeupdate at ~0. The playback service's one-shot latch now reports whether the position can be believed, and until it can, the requested start time stands in — so a switch during the initial seek does not restart the film. UI: the in-player sources picker gets the same auto-failover setting and match kind as the detail page's, instead of always rendering the default and dropping the toggle. The caption counts distinct playlists, not stream variants, since the popover groups a portal's copies under that portal. Session mechanics and the pin toggle move into their own modules to keep the host service inside the line budget. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the playing row when the refined year rejects it Follow-on from keeping the session across a rediscovery. The rerun can legitimately drop the row that is playing: enrichment supplies the release year, and the year gate then rejects a copy the yearless search had admitted — "Dune" 1984 while the user is watching the 2021 film. Off the list is right; it is not the same film. Off the screen is not. It is what is streaming, so it stays as a row and keeps the playing badge, rather than letting the caption name a playlist that is not sending any bytes. Also covers the new session key directly in the identity spec. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a pin write from landing on the next movie Two findings from the review of the previous round. A pin write is an IPC round-trip, and the user can navigate during it. The continuation then applied one film's answer to another film's controller — and because unpinning returns "nothing pinned", it would clear the pin the new movie had just loaded and its Play action would quietly stop starting from the preferred source. It now commits only while the same film is still on screen, like every other async path here. The short-title scan drops its row limit. FTS keeps its window because it ranks by relevance, so what it keeps is what matters; a scan cannot rank, so a window there silently decides which valid sources the user is allowed to see. It also bought nothing: the GLOB cannot use an index, so SQLite reads every row either way and the limit only truncated the answer. What bounds the scan is its predicate — reaching it means the whole title is one or two characters. The switch-notice type moves to the module that builds it, which also removes a circular type import between the two. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep external playback, the pin and the resume point honest Five findings from the round-5 review. An external player launched for an alternative carries that playlist's ids, so the page disowned its own session: the primary button never became Stop, stopping found nothing to stop, and another click opened a second player. Multi-source now tells playback which source is actually active, and the matcher accepts either that or the route's own stream. Stop also has to beat the pin. The primary action consults the pin first — that is what makes a pin decide where playback starts — but while a session is running the same button reads Stop, and consulting the pin there made the control do the opposite of its label. A pinned source started from the Resume button resolved at zero, because nothing reports a live position until the first timeupdate. The controller is now seeded from the persisted position, one-way: a live value always wins, since the stored one lags it and applying it would rewind. A pin whose write failed was still shown as pinned, promising a preference that reopening the movie would not have. Portal failures in this path logged raw errors. An Xtream error message carries the stream URL, and that URL is built out of the username and password, so they now go through the redacting logger. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): make every alias of a pin agree, and stop losing rows Four findings from the latest review pass. A pin lookup accepts several aliases of the same movie, but a write only touched the most-trusted one — so after enrichment the title alias still pointed at whatever was pinned before, and a reopen that read it (because TMDB had not landed yet, or its request failed) started the source the user had just replaced. Writes now go to every alias. That alias set was also missing one. Enrichment supplies the year as well as the id, so a pin set before either existed is stored yearless; the candidate list skipped that form entirely and orphaned the row. Discovery could lose whole playlists: one playlist listing a film in dozens of categories produces identically ranked rows that fill the window before another playlist is read. The collapse now happens in SQL, before the limit, rather than in TypeScript afterwards where the missing rows are already gone. And an abandoned source pick finishing late cleared the spinner from the row the user was actually waiting on. Removes `isExhausted()` from the host service — no caller outside its own tests, where the assertion above it already proved the same thing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): probe like playback, and stop the pin answering for a remake Five findings from the latest review pass. Writing a pin to every alias — last round's fix for stale aliases — was wrong in the other direction: `title:{base}:` is shared by every remake, so a known-year decision stored there answers for a different film. Pin Dune (2021), open Dune (1984) before its year arrives, and it would start the 2021 source. A write now clears every alias and stores only the canonical key, which retires the stale ones without making any of them ambiguous. The probe checked a bare URL while playback sends the playlist's User-Agent, Referer and Origin. A panel that requires them answers 401/403, so a stream that plays perfectly was reported dead and penalised in failover ranking. The switch toast interpolated the raw playlist name. Users routinely name a playlist after the URL they pasted, so that line could put credentials over the video; the notice now carries the same safe label the rows use. External players have no timeupdate, so their polled position IS the live one. Feeding it through the seed — which stops at the first value — froze the resume point where playback started, and a switch an hour in rewound to the beginning. And auto-failover concluded "nowhere to go" when a stream failed before discovery answered, stranding the user on the error screen. Moves `switchTo` into the session module, which is where the rest of the switch mechanics already live, and splits the route spec along the same rendering/behaviour seam the other suites use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): re-check the movie after waiting, and follow the alternative Three findings, two of them regressions from the previous round. Awaiting a pending discovery before failover let the user navigate during that wait: the continuation then ran against whatever controller was current and could answer one film's playback failure by starting another film's alternative. Both waits — failover and pinned Play — now re-check that the same movie still owns the screen. Pinned Play also needed the wait it did not have. Pressing Play while the pin lookup was still out concluded "nothing is pinned" and started the route's own source, making a persisted preference depend on worker latency. And the position bridge still accepted only the route's ids, so an external player running an alternative had every progress update discarded: the resume point stayed where playback began and a switch an hour in rewound the lot. The session matcher and the bridge now share one ownership predicate, since a page that shows Stop for a session whose progress it throws away is the bug in two halves. The test for the external case previously set the position signal directly, which bypassed the very filter that was broken; it now drives the bridge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a remake matching, and let a pin survive its own playlist Three findings from the latest review pass. `normalizeTitleKeys` strips bracketed segments as tag noise, so "Dune (1984)" normalizes to exactly "dune" — an EXACT match for the 2021 film, ranked above every fuzzy one, with the year never consulted because that tier skipped the gate. Auto-failover could switch the user to the other film entirely. The year is now read out of brackets too, and a stated disagreement rejects the row on either tier. Playback positions are keyed by (playlist, stream), so watching through a pinned alternative stores progress under ITS ids while the page loads the route copy's row. Starting the pin therefore resumed from a position belonging to a different copy — usually zero. It now loads its own. And a pin can point at another copy of the film inside the playlist being viewed, which discovery excludes wholesale: the pinned row was absent from the list, so nothing showed as pinned and Play ignored the preference. The pin is now read before discovery, which keeps that one row. Moves the pin-shaped decisions into the pin module, where the persistence helpers already live. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep a pinned play, a same-playlist copy and Check honest Five findings from the latest review pass. Reading a pinned source's own position is a database round-trip, and the user can navigate across it — the continuation then handed one film's source id to whichever movie now owned the screen. Guarded, like every other await here. Allowing a pinned copy to live in the current playlist made "is this the route's own source?" a two-part question, and the ownership check still asked only about the playlist: an external session for that copy was disowned, so Stop vanished and its progress was dropped. The yearless title alias is shared by every remake, so clearing every alias before a write could delete a different film's pin. Writes and unpins now touch only keys that name one film — plus the ambiguous row this session actually read, which is the one the user is looking at and the one whose absence would make an unpin come back. Restart left the seeded position in the controller, so a failure before the first timeupdate resolved the next source back at it. And the alternative rows on the playback-error screen had a Check button wired to nothing at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop a rediscovery restoring the pin it started with A same-movie rediscovery read the pin, then held that snapshot across its source lookup and applied it afterwards. A pin made while the lookup was out was therefore overwritten by the older value: the row and the primary Play action named a source the database no longer held. The snapshot is now applied as soon as it is read, so a later write simply wins on ordering rather than needing to be detected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): write the pin before retiring it, and keep the badge honest Three findings from the latest review pass. Repinning cleared the old rows and then wrote the new one, so a write that failed after the clear left nothing persisted while the row still showed the old pin. The order is reversed: the new key is stored first and the stale ones retired only once it landed. Lookups are most-trusted-first, so a leftover alias never outranks what was just written. Starting a source from the picker, or letting a pin decide the primary Play, never recorded the movie as recently viewed — unlike every other way of playing it. And closing an alternative's player and pressing Play started the route stream while the controller still marked the alternative active, so the picker and caption named a source that was not running. Moves the discovery pass into the session module beside the switch and failover mechanics, and splits the pin spec along the persistence/playback seam, both to stay inside the file-size rule. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop claiming playback, a cached answer and a resolution Three findings, all of them the same rule: never state as fact something the app has not established. The "Playing from …" caption appeared as soon as discovery marked a source active — before Play was pressed, and again after the player was closed. It now requires a player that is actually running. Probe answers were cached by URL alone, but the request now carries the playlist's headers. Two playlists sharing a stream URL could therefore be told the other's answer, marking a source dead without ever asking it. And any width below 900 was labelled 480p, published with `api` provenance: a 640x360 stream stated 480p as a fact, and a 720x576 PAL source likewise. Widths below HD only resolve with the height — 720 is NTSC 480p or PAL 576p — so an unrecognised shape now carries no quality tag at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): match the sub-HD formats, and drop the caption on failure Two follow-ups to the previous round, both the same rule again. The 800-wide band still answered from the width alone, so 800x600 and 800x450 were labelled 480p — published with `api` provenance, so read as a measurement. Sub-HD formats are now matched against known shapes with the same 5% tolerance the height path uses, and anything unrecognised carries no tag at all. And "Playing from ..." survived a playback failure: the inline host stays mounted while the diagnostic is on screen, so the page named a source for a stream it had just reported it could not play. The caption now clears on failure and returns when the engine produces time again. Splits the route playback spec along the "what it does" / "what it claims" seam and lifts the repeated active-source stub into one helper. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let the height veto a width match, and hold the failure state Two follow-ups to the previous round, both in code it introduced. A width that matched exactly one sub-HD format ignored the height entirely, so 640x480 came back as 360p — a measurement the numbers contradict. The height now vetoes, but only in the direction that can be wrong: cropping removes lines, so a SHORTER frame is a letterboxed master of that format and the width still names it, while a taller one is a different shape and gets no tag. That keeps the reason width is preferred in the first place. And picking a source off the error screen cleared the failure state before the switch resolved, so an alternative that could not be resolved left the diagnostic on screen while the caption went back to claiming playback. The flag now clears only once a switch actually starts something. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): release the resume latch when the target cannot be reached Carrying a position into a shorter cut of the same film — two hours into a 90-minute source — leaves the engine unable to ever report that time, so the one-shot latch never released: every position save was suppressed for the rest of the session, and the impossible start time kept being reported to multi-source for the next switch. The latch now also opens when a known duration puts the requested point out of reach, while a reachable one still waits as before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): say "Playing" only while something is playing `isActive` means "the source a switch or Play would use". Discovery sets it the moment the page opens and it survives closing the player, so it could not back the two claims the UI made in the present tense: the "Playing from" caption and the source row's Playing badge. Both appeared on a page where nothing had started, and came back after the player was closed. `playbackLive` is now that statement, and both read it. Inline it needs a timeupdate — `inlinePlayback()` is only the REQUEST to play, non-null while the engine is still opening the stream and still non-null after it fails — and external it needs the session past `launching`. A row that is merely selected reads "Current" (new key, filled for all 19 locales). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): start a never-watched pinned source from the beginning Positions are keyed by (playlist, stream). When the pin points at a copy the user has never opened, the lookup returns nothing and the controller was left holding the ROUTE copy's position — so Play dropped them 42 minutes into an unstarted film, and the first save wrote that timecode back under the pinned source's key, making it permanent. The spec asserted the old behaviour, so it is flipped rather than extended; a second case covers the host that supplies no lookup at all, where "never watched" was never established and the position must be left alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): describe the copy the primary button will actually play Two gaps found by review. A pin makes the primary button play a copy the page never loaded a position for — positions are keyed by (playlist, stream). The label, timecode and Restart affordance still came from the route copy's row, so the button could read "Resume 42:18" and start an unwatched copy at zero, or read "Play" and jump into the middle of one already watched. `createPrimaryActionPosition` lets the pinned copy's row govern, including when that row is absent: never watched is an answer, not a fallback to someone else's progress. A manual source switch also mounts a DIFFERENT stream in the same host while marking the new source active at once, so the previous stream's timeupdate was still vouching for it — the caption and the badge claimed the new source while it was still opening. That path now clears the latch like Play and Restart do. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the route's own resume point, and honour a closed pin Two more from review, both variations on "selected is not playing". `vodPlaybackPosition` followed whichever copy last reported — so after an alternative played, Resume and its label described that copy's row while starting the route's stream, jumping it to a timecode nobody reached in it. It now splits: `vodPlaybackPosition` stays the last position seen (the progress bar and the switch handoff want the stream on screen), and `routePlaybackPosition` holds the route copy's own row for everything that acts on the route's stream. `pinnedSourceAwaitingPlay` skipped the pin whenever its row was active, but `isActive` means selected — the pinned row stays selected after its player is closed, so the next Play went to the route copy and ignored the stored preference until the page was reopened. It now takes `playbackLive` too. The host service crossed the 400-line cap on the way, so the four derived alternative counts moved into `vod-multi-source-counts.ts`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep the primary button honest across navigation and pins Four follow-ups from review, all consequences of splitting the position signals. - Route reuse (the Similar rail) cleared only `vodPlaybackPosition`, so the button kept the previous movie's Resume label — and start point — until the new lookup landed. Both signals and the playback latch now reset together. - The primary button's fall-through past an unresolvable pin reached the service directly, skipping the bookkeeping a route start needs: the controller kept the alternative's timecode and the old stream's timeupdate still vouched for the new one. It now goes through the route's own wrappers, and Resume seeds the controller with the ROUTE copy's position. - `alternativePlaylistCount` counted the playlist being watched whenever it held a second copy, so "also found in 2 other playlists" could mean one. - The pinned copy's stored row went stale the moment the user watched it; its live position now wins while it is the one playing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): do not spend a source's failover turn on mere selection `setActiveSource` marked the source tried, but discovery calls it the moment the page opens and a pin or the picker can call it before anything plays. So opening a movie burned the route copy's turn: if a pinned alternative then failed, failover skipped a healthy untouched source — and with only one alternative, reported the options exhausted. Selection and attempt are now separate. `setActiveSource` selects; `markPlaying` also spends the turn, and only the three places that really start playback call it. `runFailover` additionally retires whatever is on screen before picking, so the failing source is spent however it got there — relying on the start paths alone would leave one hole per path, and the cost of missing it is a ping-pong between two sources. One existing spec asserted the old behaviour (a route copy burned by a switch it never played); it now plays first, so it still covers what it meant to — that the tried set survives a rediscovery. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(portals): carry VOD source pins through playlist backup The new pins table was invisible to backup: exporting a playlist and re-importing it on a new machine silently dropped every "main source" choice, with nothing in the archive to say the choice had ever been made. Pins now ride along under the playlist they point AT — carrying them anywhere else would restore a preference for a portal the archive never contained. `matchKey` names the film rather than the portal, so it survives untouched and only the playlist id is remapped to the imported copy. `sourcePins` is the one optional collection in the Xtream user state: archives written before multi-source existed simply do not have it, so its absence is age rather than damage. Only a wrong type is rejected, and pins without a usable match key or content id are dropped, since writing one would occupy the unique key of a film it does not describe. Adds `DB_LIST_VOD_SOURCE_PINS` through the usual six seams (operation, worker case, event, preload, bridge contract, service). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(portals): follow the normalized restore state's new collection `normalizeXtreamPendingRestoreState` now always emits `sourcePins`, like every other collection it canonicalizes, so three specs that assert the exact normalized shape had to follow. Adds coverage for the sanitizing itself: a pin without a usable match key or content id is dropped, and a non-string `updatedAt` is discarded rather than carried. Caught by CI, not locally — the earlier full run served `playlist-shared-ui` from the Nx cache, so it reported green on a stale result. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(portals): lift the VOD route's orchestration out of the component The details route had grown to 864 lines — the repository's hard maximum is 400, and while the file predates the rule, a baselined exemption is not a budget to spend. Three component-provided services now hold what the component was accumulating: `VodDetailsMultiSourceUiService` (the playback-evidence latch, the caption, the primary button's position, source actions and the failover toast), `VodDetailsSimilarService` (the rail and its cross-portal lookup), and `VodDetailsDownloadsService`. The component keeps its public API, so the template and the existing specs are untouched. 864 -> 566 lines. The downloads move also fixes a latent bug: `downloadVod` and `playFromLocal` read `route.snapshot.params`, which is stale once the router reuses this component for detail-to-detail navigation (the Similar rail) — so a download started from a film reached that way fetched the previous one. They now read the same route-params signal everything else uses, with a regression test. Also from review: pins are applied on the FRESH-import path too. A new playlist has no content when the archive is read, so its user state is parked and replayed after the import — the merge path I wired first never ran there, and every pin was dropped. A failed pin write now propagates instead of being ignored: the backup entry is reported failed, and the parked state is kept so a transient failure can be retried rather than silently losing the preference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): read array-shaped codecs, bound short-title scans, honour alias clears Three from review. `info.video`/`info.audio` are declared — and sent by the mock server and many panels — as string arrays, but the resolver only read the ffprobe object shape. Every array response therefore lost the provider's codec, so those source rows showed no codec fact and the "dub may differ" warning could never fire. `readStreamInfo` now accepts both, and states nothing when the provider stated nothing. The FTS-empty fallback scan matched only the FIRST token, which is fine for a one-word short title but not for "I Am": every catalog row containing the word "i" came back for TypeScript to throw away — a full scan of a large catalog on the single database worker, just to open a detail page. Every token must now appear. `writePin` reported success when the canonical write landed but retiring the old alias failed. Lookups read aliases before the canonical key, so reopening the movie before enrichment would start the source the user just replaced, with the icon promising otherwise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): write a pin and retire its aliases in one transaction Split across two calls, a half-failure had no honest outcome. Reporting success left a surviving alias to win the next lookup and start the source the user had just replaced; reporting failure — which the previous round changed it to — left the canonical row durable while the UI showed a pin that was no longer the stored one. Review was right both times, which is the tell that the two-step shape was the problem. `setVodSourcePin` now takes the keys to retire and does both inside one `db.transaction()`, with the synchronous `.run()` form the better-sqlite3 driver requires there (issue #1137's lesson). `retireKeys` rides through the worker op, the IPC contract, the preload bridge and the service, so there is one call and one outcome. Also corrects the architecture doc: the scan path is reached whenever no token clears the trigram minimum, not only when the whole title is one or two characters — the claim the previous commit's code change had already falsified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): tell a superseded pinned play from an unusable pin Double-clicking Play while a pinned source resolves put both handlers into `playPinnedSource()`. The second supersedes the first, so the first returned `false` — which the route read as "no usable pin" and answered by starting the route source over the playback the second click had just begun. `playPinnedSource` now reports `played` / `superseded` / `unavailable`, and only `unavailable` falls through. This is the same distinction `runFailover` already draws between "keep going" and "stop, something newer owns the screen"; the pinned path simply never had it. The host crossed the 400-line cap again on the way, so the pinned-play errand (wait out an in-flight discovery, re-check the session, start the source) moved into the pin module beside `playPinned`, and the pin-toggle commit went with it. 388 lines. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): restart honours the pin, and a switch replaces the player Three from review, all in the pinned-playback seam. A pinned copy watched through resolved to its stored seconds, so the button read Play — the label uses the in-progress rule — and then started near the end. Both now go through one `isResumablePosition`, so the label and the start point cannot disagree. Restart sat beside a Resume that honours a foreign pin, but called `playVod` and started the ROUTE copy — silently switching the user's playlist. It now restarts whatever the primary button acts on, falling back to the route source only when there is no usable pin. Switching sources left a running external player alone. With MPV or VLC and instance reuse off the backend spawns a second detached process, so both sources kept playing and Stop owned only the newer one. Also merges master, and puts the five host specs on a shared harness — they each carried the same 31-line TestBed, which is what pushed two of them over the file-size cap as cases were added. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): find short Unicode titles, and stop two pickers racing Five from review. Greptile's P1: a short non-ASCII title was undiscoverable. SQLite's `LOWER()` and GLOB classes are ASCII-only, so "он" never matched a stored "Он" and the source simply never appeared. ASCII tokens keep the word-boundary GLOB; a non-ASCII token falls back to a substring test against both the folded and the as-typed form, which the normalized confirmation afterwards makes safe. A probe now retries the ranged GET for 400 and 403, not just 405/501 — those are what a WAF returns for an unexpected HEAD on a URL it serves happily over GET, and calling that source dead also ranked it below worse ones. Three races, all the same shape as ones fixed earlier in this branch: - a pinned play awaiting its resume lookup did not notice a source picked across it, and finished last, replacing the user's choice; - two overlapping switches both saw the same external session, both awaited its close, and both launched — two detached players again; - the primary button showed the ROUTE copy's Resume while the pinned copy's row was still loading, so a click started somewhere else entirely. Also puts the races spec on the shared host harness, which is what keeps it inside the file-size rule now that it carries two more cases. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): close the player we launched, not the one we now own Three follow-ups, two of them to last round's own fixes. The external-session close was defeated in exactly the case it was written for: `switchToSource` marks the DESTINATION active before handing playback over, so by the time the service ran, the process still playing no longer looked like ours and was left running beside its replacement. The service now remembers the ids it launched with, independently of what is active. The ASCII/Unicode branch was decided from the NORMALIZED token, which folds diacritics — "Ça" arrived as "ca", looked like plain ASCII, and took the GLOB path while the stored title still read "Ça". Decided from the raw token now. Backup restore upserted archived pins but never removed the playlist's existing ones, so a present-but-empty collection left stale preferences alive — unlike the playback positions cleared beside it. An absent collection (an older archive) still means "no opinion" and is left alone. Four files crossed the size cap on the way; the split ones now share `title-sources.spec-data.ts` and `playlist-backup.xtream-fixtures.ts`, and the external-session ownership moved to its own module. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): absent is not empty, and every start claims the generation Four more from review, three of them defects in last round's fixes. The restore normalizer materialized `sourcePins: []` for archives that never had the field, so "absent means no opinion" became "this archive says there are no pins" and a merge cleared the user's. Absent now stays absent. My test for that behaviour had passed for the wrong reason — it stubbed an empty pin list, so the clear was skipped whether or not the guard worked. `startGeneration` was claimed only by the switch path, so a plain Play, Resume or Restart could be overtaken by a switch still awaiting its close. Every start claims it now. Raw and normalized tokens were paired by position, which breaks when normalization drops a whole word: "FR: Ça" normalizes to "ca" and got handed the raw token "FR:", sending it down the ASCII branch it cannot match from. They are paired by normalized form instead. And the ambiguous yearless alias (`title:dune:`) is no longer written or retired beside a precise key — it may hold another remake's pre-enrichment pin. It stays available when it is the only key there is, since refusing to pin at all would be worse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a failed close must not leave the page claiming a dead source When `closeSession()` rejected, `startResolvedPlayback` rejected with it and never launched — while `switchToSource` had already marked the destination active and reported the switch as successful. The page then named a source that nothing was playing. The close failure is logged and the replacement starts anyway. A close that rejects usually means the session was already gone, and a possibly-lingering process is the lesser of the two evils: the alternative is a UI that lies about what is on screen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(portals): split the external-playback handoff out of the service Both the service and its spec crossed the 400-line cap with the close-failure handling, so the handoff — deciding which process is ours, closing it, and surviving a close that rejects — now lives in `vod-details-external-session.ts` with its own spec file. Two tests had to start awaiting: replacing a running external player is a round-trip, and the handoff now yields once even when there is nothing to close, so the new playback is mounted a microtask later than before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * style(portals): format the extracted external-session module Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): fold diacritics in the title index Cross-playlist matching compares normalized titles ("Amélie" -> "amelie") against an index built from the raw title, and the trigram tokenizer does not fold diacritics by default. Every accented title was therefore invisible to the FTS path: two identical `Amélie` entries produced no candidates at all. That is the broadest of the Unicode gaps review found, and it predates the short-title work. The tokenizer is fixed at CREATE time, so existing databases recreate and rebuild the index once behind a migration marker. `remove_diacritics` needs SQLite 3.45+, so support is probed on a temp table first: an older runtime keeps its working index untouched and the migration is not recorded as done, leaving a later version free to upgrade it. Case folding for non-ASCII remains impossible in stock SQLite — "ОН" cannot find "Он" by any available predicate — and is documented as the known limit rather than patched around again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): clear a playlist's pins by playlist, not by key list Restoring over a playlist reused the keyed clear, which caps its input at MAX_KEYS_PER_LOOKUP to bound an IN clause. A playlist with more than eight pinned movies therefore kept the surplus while the call still reported success, and the restore then wrote the archive's pins on top — leaving the union of two states, which is neither the one the user asked for. Clearing is now a dedicated delete-by-playlist operation with no key list to truncate, and it refuses a blank playlist id rather than deleting everything. A failure fails the entry instead of being swallowed: `listForPlaylist` returns `[]` on error and `clear` returns `false`, so ignoring the result made a failed read indistinguishable from "there was nothing to clear". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): keep a pin readable under every identity of its film Two defects in the pin/position subsystem, both reported in review. A pin was stored under the movie's most-trusted key alone and its other keys retired. But a movie's identity GROWS: the film keyed `tmdb:438631` today was `title:dune:2021` before enrichment, and reopening it cold asks for the poorer key first. The preference was therefore ignored until enrichment landed — and permanently when enrichment is off or never answers. The decision is now written under every key in `write` (never the yearless form, which every remake shares), one upsert per key plus the leftover retirement in the same transaction. `setVodSourcePin` also reports failure for a pin with no usable key instead of claiming a write it never made. The primary button asked whether the pinned copy's position had loaded by testing presence rather than identity, so re-pinning left it wearing the previous copy's timecode until the new lookup returned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(portals): record the key-addressing limit a pin write cannot close Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): fold non-ASCII case in the scan, and read years as tags I was wrong about SQLite twice over, and both errors cost matches. GLOB character classes are NOT ASCII-only. `patternCompare` reads them as UTF-8 code points, so `'Он' GLOB '*[Оо][Нн]*'` is true — only `LOWER()` is ASCII-only. The scan tier now folds the case in JavaScript, where Unicode case mapping is real, and hands SQLite one class per character. A short Cyrillic or Greek title stored in a different case is found instead of being silently absent from the Sources chip. The builder returns `null`, leaving the substring tests as the whole answer, for a token holding a GLOB metacharacter (GLOB has no escape character) or a case mapping that changes length. The FTS tier is untouched and still cannot fold — that needs a stored normalized-title column. The movie's own year came from `extractYear`, which reads a year from anywhere in the title. That is right where a year is a search hint, wrong where it is an identity: `2001: A Space Odyssey` was treated as a 2001 film, so every genuine 1968 copy failed the year gate and the movie had no alternatives at all — and its pin key moved the moment enrichment supplied the real year. `releaseTagYear` accepts only bracketed and trailing forms; the repo's own TRAILING_YEAR_PATTERN already documented this exact hazard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): cover a letter spelled two ways in lower case Greek Σ lowercases to σ, but a word-final sigma is written ς and is equally a lowercase of it, so a class built only from the character in hand knew one spelling of two. Each class now also carries the uppercase form's own lowercase, which reaches the other one. One-way on purpose: σ → Σ → σ never arrives at ς. Left so because ς is only correct at the end of a word, which is exactly where the request's last character sits — the pair that occurs in real titles is covered, and closing the other direction needs a fold table. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let an exact title keep a number that is part of its name Both match tiers weighed the same year, taken from a trailing four-digit tail or a bracketed tag. On the exact tier that rejects the very copy it was meant to confirm: reaching it means both titles are the SAME string, so the trailing digits belong to both, and comparing them against a release year out of metadata makes "Blade Runner 2049" disagree with its own stated 2017 — the genuine alternative disappears at the moment enrichment lands, which is when the user has most reason to expect it. The exact tier now reads the bracketed form only. Brackets are never part of a name, so "Dune (1984)" is still rejected against 2021. The base tier is unchanged: it has just stripped a trailing year, and that year is the only thing separating "Dune 1984" from "Dune 2021". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(database): verify the title index folds, rather than trust the marker `createTables` declares content_title_fts with the plain trigram tokenizer, and the diacritics migration declares it again with folding. Two sources of truth for one tokenizer: if the table ever went missing after the marker was written, `CREATE TABLE IF NOT EXISTS` would restore the unfolded form and the migration would skip it on the marker alone. The upgrade now reads the live table's own DDL from sqlite_master and rebuilds unless it really folds. A degraded index is invisible from the outside — discovery just stops finding "Pokémon" for "pokemon" — so the record has to be checked against the thing it describes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): give the route's own row the facts the page already has Two provenance defects found in review. The current-source row is never resolved — nothing needs to fetch a URL for the stream already playing — so it carried no provider metadata at all, while every alternative got its facts from the resolve preceding playback. `audioDiffersFactually` requires a fact on BOTH sides, so the "dub may differ" warning was structurally unreachable on the commonest switch there is: route to alternative. It could only ever fire between two alternatives that had both been resolved. The row now carries what `get_vod_info` already told the page, via a `providerVodMetadataOf` mapper shared with the resolver so the two cannot describe one movie differently. Quality bucketed every width from 900 to 1199 as 576p, so a 960x540 stream — an ordinary 540p encode — was published as "576p" with `api` provenance: a measurement its own pixels contradict, from the one field that is supposed to mean the provider said so. That range holds two standard formats, so it is matched now rather than bucketed, exactly as the sub-HD sizes already were. A width matching no known format yields no tag and a check chip, which is the honest answer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): let the height veto a width-derived quality, and refresh route facts Both of these are gaps I saw and chose not to close last round; a reviewer was right that neither survives its own reasoning. The shape check only ran below 1200, so the HD ranges kept publishing wrong-but-confident labels: 1440x1080 is anamorphic 1080 and 1600x900 is 900p, and both were "720p" with `api` provenance — the provenance that means the provider said so. Ranges are fine up there, the standard widths really are far apart, but only once a known height can veto the answer. Same rule the matched formats already used: a shorter frame is a letterboxed master, a taller one is a different shape and gets no tag. And the route row picked up provider facts only when discovery reran. On a sparse panel `get_vod_info` can answer with no year and no TMDB id, so the movie key is unchanged, nothing reruns, and the row keeps stating nothing — leaving `audioDiffersFactually` one-sided and the dub warning unreachable on exactly the switch it exists for. It now takes those facts on without rediscovering, merged onto the existing row so a probe result already sitting there survives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a codec is not a dub, and two waits needed a switch guard Three findings from review. The "dub may differ" warning compared audio CODECS. AAC and AC3 routinely carry the same dub, and two AC3 tracks can carry different ones, so it fired on every identical-language re-encode and stayed silent on the dub changes it exists for — wrong in both directions, which is worse than absent, because a warning people learn to ignore is not a warning. Worse, the previous commit made it reach the common route-to-alternative switch for the first time, so the false claim was about to get louder. It now reads a new `audioLanguage`, taken from the track's language tag and never from the codec. `audio` stays as a display fact. Few panels tag a language, so the warning is usually silent — the same answer the rest of this feature gives when it does not know. `failover()` validated only the session across its wait for a discovery in flight. The session moves when the FILM does, so a source the user picked — or the route stream they restarted — during that wait was then treated as the thing that failed and switched away from. It claims and rechecks a switch generation, as the pinned path already did. And the scan's ASCII branch could not find "Ça" from a folded "ca", while the non-ASCII branch found "Ca" from "Ça" — so whether two playlists could see each other depended on which one was open. Each ASCII letter now carries its accented forms, derived by decomposition rather than tabulated, so it cannot drift from the normalizer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(portals): pin what the declared audio shape can and cannot say The array shape the mock server and many panels send carries a codec and no language, so the dub warning is silent for every source arriving that way. Asserted rather than assumed, alongside the ffprobe shapes that do carry one — otherwise a later reader sees an unused field and wires the codec back into the warning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): a failed pin read must not export as "no pins" Three findings, all in code from this session. Backup called the lenient `listForPlaylist`, which turns a failed read into `[]`. Since `e0ebbeaf` made restore treat `sourcePins` as authoritative — clearing the playlist's pins before applying it — an export whose read failed produced a file that looks complete and wipes every pin on restore. Losing them is bad; losing them through the one feature meant to protect them is worse. Backup now uses a strict listing that throws, so the export fails instead. The diacritic map stopped at U+024F, which is tidy and leaves Vietnamese out: `ố` is U+1ED1, the normalizer folds it to `o`, and the scan filtered those rows out before confirmation. Latin Extended Additional is included now; the filter decides what belongs, so the range only has to be wide. And two panels spelling one language differently (`eng` vs `en`, or `en-US`) raised a dub warning between identical tracks. Tags are canonicalized before comparison — 639-2 collapses to 639-1, both German forms meet at `de`, regions drop, and `und` becomes nothing. Anything that survives longer than three characters is not a language code, so the comparison is declined rather than guessed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(portals): stop two backup paths from deleting pins they never read Two data-loss paths, both P1, both mine. A web export wrote `sourcePins: []`. Pins are Electron-only, so out there we cannot read them — which is not the same as knowing there are none, and restore treats the collection as authoritative. A backup made in the browser was therefore an instruction to delete every pin the moment it was imported on the desktop. There are three answers here, not two: pins exist, there are none, and "could not look". The last omits the field, exactly as an archive written before pins existed does. The same rule now covers Electron with the bridge method missing. I had written a test asserting the unreachable-store case resolves to an empty list "because a backup made there is complete". That reasoning was wrong: empty was true of what the runtime could see, never of the playlist. Restore also cleared the playlist's pins and then wrote the archive's one by one. A write failing partway left the previous pins already gone and only a prefix applied — a state belonging to neither, reported as a failure the user could not undo. `DB_REPLACE_VOD_SOURCE_PINS` does the clear and every write in one transaction, so the playlist ends up as the archive describes it or exactly as it was. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-07-29 21:53:42 +02:00
4grayandClaude Fable 5	6bdd6fd8a8	fix(playlists): serialize per-playlist collection writes to prevent lost updates (#1255) ... * fix(playlists): serialize per-playlist collection writes to prevent lost updates All per-playlist mutations (portal favorites, recently viewed, playlist meta/favorites updates) used an uncoordinated read -> patch -> replace-whole-row pattern, so two overlapping mutations on the same playlist were last-write-wins and silently dropped each other's changes (flagged by Greptile on PR #1253). Chain every read-modify-write through a per-playlist promise queue (Map<playlistId, Promise>) inside defer(), covering both the SQLite upsert and IndexedDB update paths while keeping the Observable-based public API, laziness, and emitted values unchanged. A failed mutation does not wedge the queue, and different playlists are not serialized against each other. Regression coverage: overlapping favorite+recently-viewed adds, two rapid favorite adds, IndexedDB-path overlap (all three fail on the old code), plus queue-continues-after-error and cross-playlist independence guards. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playlists): close serialization gaps flagged by review bots Greptile P1 (writers bypassing the queue): route updateManyPlaylists and updatePlaylistPositions through the same per-playlist write queue. Auto-refresh batch writes now re-read the stored row inside the queue and preserve user-owned fields (favorites, recently viewed, position) instead of writing a pre-refresh snapshot over them; position updates re-read and patch inside the queue on both storage paths. Codex P1 (callers precompute stale snapshots): add an atomic PlaylistsService.transformPlaylistFavorites(playlistId, transform) that applies the favorites transform to the freshly-read row inside the queue, and convert every read-then-set call site to it: UnifiedFavoritesDataService M3U add/remove/clear/reorder and Stalker reorder/clear, GlobalFavoritesService M3U removal, DashboardDataService M3U removal. Reorders now keep concurrently added favorites (appended after the dragged order) instead of dropping them. New coverage: overlapping favorites transforms, auto-refresh batch write vs queued favorite add, position update vs queued favorite add, and a public addFavorite race through UnifiedFavoritesDataService; existing specs updated to the transform-based contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playlists): share the canonical refresh merge with the auto-refresh batch The batch path previously spread the stale refresh snapshot over the freshly read row and pinned only favorites/recently-viewed/position, so a queued metadata mutation (hiddenGroupTitles, curated EPG sources) finishing before the refresh write could be reverted. Extract updatePlaylist's merge into mergeRefreshedPlaylist() and use it for both the single-playlist update flow and updateManyPlaylists: refresh-owned data (parsed content, count, EPG detection) comes from the payload, user-owned state comes from the current row, and manual/disabled EPG configuration is resolved through resolvePlaylistEpgSourceState instead of being overwritten. Regression test: queued hiddenGroupTitles meta update overlapping an auto-refresh batch write keeps both the metadata change and the refreshed content, including preserved manualEpgUrls. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playlists): let the current row decide autoRefresh during batch refresh The batch path force-set autoRefresh: true after the merge, so disabling auto-refresh while a refresh was in flight was reverted by the completing write. Drop the override — mergeRefreshedPlaylist already prefers the current row's autoRefresh over the snapshot — and add a count fallback to the snapshot value for rows without a stored copy. Regression test: disabling auto-refresh concurrently with the batch write keeps autoRefresh false while still applying the refreshed content. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-25 19:24:42 +02:00
4grayandClaude Fable 5	c707af1334	feat(epg): manual EPG mapping for Stalker portals (#1173) ... * feat(epg): manual EPG mapping for Stalker portals Extends the manual EPG-to-channel mapping (PR #1165) to Stalker: - shared key helper buildStalkerEpgMappingKey — playlist-scoped stalker:{playlistId}:{channelId} keys, mirroring the Xtream scheme - ITV sidebar: right-click context menu with "Map EPG channel"; after the dialog closes with a change, the bulk EPG cache is rebuilt so the panel and row previews reflect the new mapping immediately - withStalkerEpg().applyMappedItvEpg(): batch-resolves mappings for rendered channels (one getEpgMappingsBatch IPC per new id set) and overlays uploaded-XMLTV programs onto bulkItvEpgByChannel; overrides survive ensureBulkItvEpg reloads - stream-resolver: mapping check in loadStalkerEpgItems (detail) and batched prefetch in loadStalkerEpgBatch (previews); mappingCandidateKeys/prefetchEpgMappings generalized beyond Xtream - global favorites: stalker branch for the Map-EPG menu entry (item id extracted from the stalker::{playlistId}::{id} uid) - docs: manual-mapping section in docs/architecture/stalker-epg.md and a CLAUDE.md EPG bullet covering the whole mapping feature - tests: applyMappedItvEpg suite, stalker preview mapping in the stream-resolver spec, key-builder specs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(epg): harden Stalker mapping edges found in adversarial review - stream-resolver: stalker items resolve only the playlist-scoped mapping key — bare tvgId/name candidates (tvgId mirrors the raw provider id) could only produce false matches against unrelated M3U mappings, and previews would disagree with the detail path - applyMappedItvEpg: staleness guard after every await so an in-flight call cannot write portal A's mapped EPG into portal B's state after a playlist switch (the store is a root singleton) - applyMappedItvEpg: ids are marked checked only after a successful lookup — a transient IPC failure no longer suppresses the mapping for the rest of the session - live layout: post-dialog refresh re-applies overrides for the unfiltered channel list, so an active search cannot drop the playing channel's mapping - global favorites: new epgMappingChanged output emitted when the dialog actually changed a mapping; unified live tab reloads its EPG previews in response Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 18:29:23 +02:00
3 people	ec6fc403a3	feat: manual EPG-to-channel mapping with mapping fallback (#1165) ... * feat(epg): manual EPG-to-channel mapping with mapping fallback in all EPG paths * fix: epg mapping in live tv list * fix(epg): harden manual EPG mapping — upgrade safety, perf, playlist-scoped keys Follow-up fixes on top of the manual EPG-to-channel mapping feature: - epg-database: dedupe existing epg_programs rows before creating the unique (channel_id, start, title) index — a plain CREATE UNIQUE INDEX crashed the EPG worker on upgrade when historical duplicates exist; replace INSERT OR REPLACE with ON CONFLICT DO UPDATE so the epg_programs_fts delete trigger is not bypassed (REPLACE skips delete triggers unless recursive_triggers is on), with a plain-INSERT fallback when the index cannot be created - db: add idx_content_epg_channel — the mapping fallback scanned the whole content table on every single-channel EPG lookup - keys: scope Xtream mapping keys per playlist via shared buildXtreamEpgMappingKey (xtream:{playlistId}:{id}) — bare stream ids collide across portals; the backend fallback now joins categories to resolve the playlist id - pwa: hide "Map EPG channel" entries behind the supportsEpgMapping capability — the menu item was a dead end in the PWA - parser: parse the XMLTV offset sign from the string — Math.sign(0) dropped the minutes of ±00:xx offsets - cleanup: typed window.electron access instead of ad-hoc casts, drop unused resolveChannelId and dialog data field, shared EpgMappingDialogComponent.open() for all seven call sites - dialog UX: minimum-characters search hint, save/remove snackbars, current mapping shows the EPG channel display name, takeUntilDestroyed on the search stream - i18n: fill the new keys in all 17 locales - tests: cover mapping CRUD/search escaping, the dedup-index guard, offset parsing and playlist-scoped keys; update stale stream-resolver specs for the new 50-item limit and 10s timeout Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(epg): escape backslashes in EPG channel search LIKE pattern CodeQL js/incomplete-sanitization: a lone trailing backslash in the search term paired with the closing wildcard under the ESCAPE clause and corrupted the pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * perf(epg): batch mapping lookups in the viewport preview queue Expose the existing getEpgMappingsBatch operation over a new EPG_MAPPING_GET_BATCH IPC channel and use it in resolveManualMappings — the per-entry lookup issued one IPC round-trip per visible channel on every scroll event. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * perf(epg): batch mapping prefetch in the collection preview loader Resolve all candidate mapping keys for an Xtream preview batch with a single getEpgMappingsBatch IPC call instead of per-channel lookups. Also fix a worker early-exit: a channel without tvgId/name returned out of the shared-iterator loop and silently killed one of the three concurrent preview workers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: 4gray <serega05@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 09:00:14 +02:00
StefanandClaude	2f8aee72df	feat(xtream): add catch-up playback to favorites and recent tabs (#1166) ... Enables Xtream catch-up/timeshift from the Favorites and Recent surfaces (per-playlist and global), not just Live TV, and adds start-over replay of the currently-airing programme. Carries tv_archive/tv_archive_duration through the favorites and recently-viewed DB projections and maps them onto UnifiedCollectionItem; tv_archive_duration is interpreted as days, matching live-stream-layout.controlledArchiveDays. Closes #1138. Co-authored-by: Claude <noreply@anthropic.com>	2026-07-19 06:38:19 +02:00
4grayandClaude Fable 5	54265755ee	fix(favorites): persist custom drag-and-drop order for Xtream favorites (#1143) ... * fix(favorites): persist custom drag-and-drop order for Xtream favorites Prepared-statement writes dispatched via drizzle's `.execute()` on the better-sqlite3 driver return a promise and defer the write to a microtask. Inside a synchronous `db.transaction(() => ...)` callback (which cannot await), the transaction commits before that promise settles, so the write is a silent no-op — no error, no rows changed. This bit `reorderGlobalFavorites`: the custom favorites order never persisted for the per-playlist ("This playlist") Xtream scope, which relies solely on the `favorites.position` column. The global ("All playlists") scope masked the bug because it also persists an order to the `appState` `global-favorites-channel-order-v1` key and re-applies it on read. `removeRecentItemsBatch` had the same latent bug — batch "clear recent items" silently did nothing. Switch both writers to synchronous `.run()`. Add regression coverage that asserts `.run()` (not `.execute()`) is used and would fail on the old behavior, and document the gotcha in the DB worker architecture doc. Verified over CDP against a live Electron instance: reorder writes positions 0..N, and the order survives navigation and a full reload. Fixes #1137 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(favorites): scope reorder position writes by playlist The global favorites reorder wrote the new position filtering only by content_id, so two Xtream playlists holding a favorite with the same content_id would clobber each other's persisted order (greptile P1). Thread playlist_id through the whole reorder path — the renderer builder (UnifiedCollectionItem already carries playlistId), the IPC contract (ElectronBridgeFavoriteReorderUpdate + inline payload types), the worker op — and scope the prepared UPDATE by (contentId, playlistId), matching the favorites composite unique index. Tests: favorites.operations.spec asserts the playlistId placeholder and per-row playlistId payload; preload contract fixture updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(favorites): include playlist_id in workspace global favorites reorder payload The workspace global-favorites reorder path still sent updates with only content_id and position. Since the backend UPDATE is now scoped by (contentId, playlistId), that payload binds an undefined playlist id and matches no rows — the DB write silently no-ops (flagged by Greptile P1). Also scope the prepared-statement example in the sqlite-db-worker gotcha doc by (contentId, playlistId) so it no longer documents the cross-playlist rewrite this PR fixes (flagged by Codex P3). Regression spec asserts the reorder payload carries playlist_id per item (fails on the old payload shape) and that the appState uid order is still persisted for non-Xtream items. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 13:24:58 +02:00
4gray	697eab6e73	refactor(epg): route renderer calls through runtime bridge ... Add typed EPG runtime bridge, split EPG runtime capabilities, migrate renderer EPG callers away from direct window.electron access, and address Greptile review feedback.	2026-05-24 13:45:51 +03:00
4gray	959f6061f0	fix(runtime): address greptile capability feedback	2026-05-22 14:37:06 +03:00
4gray	ed8680116c	fix(runtime): address consolidated review feedback	2026-05-22 14:02:56 +03:00
4gray	790dbb7062	refactor(portal): gate activity storage by runtime capability	2026-05-22 13:34:16 +03:00
4gray	c571c57c5b	refactor(runtime): centralize platform capabilities	2026-05-22 11:00:34 +03:00
4gray	36bce47764	merge: resolve master conflicts for pwa hardening ... - merge origin/master into PR #964 and keep embedded MPV test on the isolated playback sub-entrypoint - centralize EPG capability through DataService.supportsEpg and update PWA web-e2e expectations - split BrowserAccessError copy between Electron and PWA diagnostics	2026-05-22 10:20:03 +03:00
4gray	4ab8915483	chore(web): enable strict TypeScript mode	2026-05-22 02:58:12 +03:00
4gray	55efc24608	fix(pwa): harden self-hosted runtime boundaries	2026-05-22 02:09:57 +03:00
4gray	87dfaec03d	fix(pwa): filter stalker from xtream collections	2026-05-21 20:33:02 +03:00
4gray	9097ff5bc1	fix(pwa): align xtream recent clearing	2026-05-21 19:45:07 +03:00
4gray	ec098f98b1	fix(pwa): hydrate xtream user collections	2026-05-21 19:35:36 +03:00
4gray	1d4d793aac	fix(pwa): restore xtream user collections	2026-05-21 19:23:25 +03:00
4gray	20e7322353	refactor(portal): split collection data access (#953)	2026-05-19 00:01:34 +02:00