4grayandClaude Fable 5 87058c2f6d fix(stalker): keep session headers on same-host redirects ...

Since 0.22 requestWithValidatedRedirects stripped Cookie/Authorization
whenever a redirect changed the *origin*, so a portal answering with an
http->https upgrade or a port move lost the MAC cookie and Bearer token
mid-session. Real Stalker/Ministra servers then reply with a plain-text
"Authorization failed." body: categories fail to load, create_link never
resolves, and no player receives a stream URL (#1158 regression window).

Scope credential stripping to the host instead: same-host scheme/port
redirects keep headers, basic auth, params, and request bodies; a
redirect to a different host still drops all of them, preserving the
original hardening intent (no credential leaks to third-party hosts).

Also adds the Stalker API compatibility roadmap produced by the
2026-08-01 protocol audit (.plans/, force-added like earlier plans).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-01 12:00:46 +02:00

..

app

fix(stalker): keep session headers on same-host redirects

2026-08-01 12:00:46 +02:00

assets

chore: back to electron + nx

2025-10-07 18:02:13 +02:00

environments

chore: back to electron + nx

2025-10-07 18:02:13 +02:00

main.ts

feat(portals): find the same movie in your other playlists (#1286)

2026-07-29 21:53:42 +02:00