* fix(hls): keep provider account across client IP changes
Wrap live HLS media playlists in a single-variant master whose variant
URI is a sealed owner token, so playlist refreshes from changing client
IPs keep their owner, lease and provider affinity. Expired sessions are
recreated from the token with the same access and admission checks.
- Classify HLS resources by playlist tag, not by .m3u8 extension
- Answer non-HLS 200 bodies as failed manifests (entry: unavailable,
refresh: 502)
- Pin child manifests and media URIs to the resolving provider account
- Add reverse_proxy.stream.hls_wrap_media_playlist (default true)
- Split AppState into app_state/ containers; move HTTP clients to core
* fix(hls): keep provider account across client IP changes
Wrap live HLS media playlists in a single-variant master whose variant
URI is a sealed owner token, so playlist refreshes from changing client
IPs keep their owner, lease and provider affinity. Expired sessions are
recreated from the token with the same access and admission checks.
- Classify HLS resources by playlist tag, not by .m3u8 extension
- Answer non-HLS 200 bodies as failed manifests (entry: unavailable,
refresh: 502)
- Pin child manifests and media URIs to the resolving provider account
- Add reverse_proxy.stream.hls_wrap_media_playlist (default true)
- Split AppState into app_state/ containers; move HTTP clients to core
* fix(hls): keep provider account across client IP changes
Wrap live HLS media playlists in a single-variant master whose variant
URI is a sealed owner token, so playlist refreshes from changing client
IPs keep their owner, lease and provider affinity. Expired sessions are
recreated from the token with the same access and admission checks.
- Classify HLS resources by playlist tag, not by .m3u8 extension
- Answer non-HLS 200 bodies as failed manifests (entry: unavailable,
refresh: 502)
- Pin child manifests and media URIs to the resolving provider account
- Add reverse_proxy.stream.hls_wrap_media_playlist (default true)
- Split AppState into app_state/ containers; move HTTP clients to core
* fix(hls): keep provider account across client IP changes
Wrap live HLS media playlists in a single-variant master whose variant
URI is a sealed owner token, so playlist refreshes from changing client
IPs keep their owner, lease and provider affinity. Expired sessions are
recreated from the token with the same access and admission checks.
- Classify HLS resources by playlist tag, not by .m3u8 extension
- Answer non-HLS 200 bodies as failed manifests (entry: unavailable,
refresh: 502)
- Pin child manifests and media URIs to the resolving provider account
- Add reverse_proxy.stream.hls_wrap_media_playlist (default true)
- Split AppState into app_state/ containers; move HTTP clients to core
* fix(hls): keep provider account across client IP changes
Wrap live HLS media playlists in a single-variant master whose variant
URI is a sealed owner token, so playlist refreshes from changing client
IPs keep their owner, lease and provider affinity. Expired sessions are
recreated from the token with the same access and admission checks.
- Classify HLS resources by playlist tag, not by .m3u8 extension
- Answer non-HLS 200 bodies as failed manifests (entry: unavailable,
refresh: 502)
- Pin child manifests and media URIs to the resolving provider account
- Add reverse_proxy.stream.hls_wrap_media_playlist (default true)
- Split AppState into app_state/ containers; move HTTP clients to core
---------
Co-authored-by: euzu <euzu@proton.me>
* fix(hls): reuse stable provider lease owners across playback retries
Keep public HLS tokens unique while sharing provider leases by
client/user/channel fingerprint. Preserve request ID and binding
generation guards and scope socket cleanup to the original session.
Add regression tests for repeated retries, stale cleanup, reused
sockets and M3U alias fallback with an A=2/B=4 provider pool.
* fix(hls): reuse stable provider lease owners across playback retries
- Keep public HLS tokens unique while sharing provider leases by
client/user/channel fingerprint. Preserve request ID and binding
generation guards and scope socket cleanup to the original session.
- Add regression tests for repeated retries, stale cleanup, reused
sockets and M3U alias fallback with an A=2/B=4 provider pool.
fix: proxy external Xtream VOD sources in M3U reverse mode
- Resolve stored VOD URLs using the existing input identity.
- Use canonical movie URLs for alias accounts with the original stream ID.
- Keep redirects internal and stop forwarding upstream Referer headers.
- Add regression tests for CDN URLs, aliases, ranges, and URL leakage
* fix(hls): reuse stable provider lease owners across playback retries
- Keep public HLS tokens unique while sharing provider leases by
client/user/channel fingerprint. Preserve request ID and binding
generation guards and scope socket cleanup to the original session.
- Add regression tests for repeated retries, stale cleanup, reused
sockets and M3U alias fallback with an A=2/B=4 provider pool.
fix: proxy external Xtream VOD sources in M3U reverse mode
- Resolve stored VOD URLs using the existing input identity.
- Use canonical movie URLs for alias accounts with the original stream ID.
- Keep redirects internal and stop forwarding upstream Referer headers.
- Add regression tests for CDN URLs, aliases, ranges, and URL leakage
* **Bug Fixes**
* Playback retries can use another available provider when playback has not started, helping requests proceed if the initially selected provider is unavailable.
* Once playback has started, retries continue using the same eligible provider to preserve playback continuity.
* Provider selection follows the same rules for regular playback and forced reopens, reducing unnecessary provider pinning before media begins.
* Series episode URLs can resolve to the correct account-specific playback address.
* fixing resource url problem
* fix(resources): classify resource destinations per hop and keep the proxy in the fetch path
A resource URL is classified (public / non-public / local) before it reaches a client, and every
redirect hop is classified and fetched again: non-public hops connect directly, public hops go
through the configured proxy, local hops are refused. Adds the public no-redirect resource client,
a process-wide destination memo, and regression tests for the redirect and Web UI paths.
* fix(resources): classify resource destinations per hop and keep the proxy in the fetch path
A resource URL is classified (public / non-public / local) before it reaches a client, and every
redirect hop is classified and fetched again: non-public hops connect directly, public hops go
through the configured proxy, local hops are refused. Adds the public no-redirect resource client,
a process-wide destination memo, and regression tests for the redirect and Web UI paths.
---------
Co-authored-by: euzu <euzu@proton.me>
* **Bug Fixes**
* Improved live-stream session handling during instant grace periods, including when a session has not yet been created.
* Corrected connection-limit and eviction tracking so active streams remain eligible for eviction even when their session record is unavailable.
* Improved reliability when switching between live channels under connection limits.
* **Improvements**
* Updated staged M3U overlays for Xtream providers: staged groups determine selected categories and channels, while unmatched categories remain available. Provider categories with no usable staged channels are retained.
* **Documentation**
* Clarified how staged Xtream and M3U playlists affect provider categories and channels.
* **New Features**
* Added a Resource Policy editor for each input, supporting trusted hostnames and private network ranges.
* Resource URLs now retain their source input and use authenticated links where supported.
* Resource caching is scoped to the policy authorizing access.
* **Bug Fixes**
* Invalid or unsupported resource values are safely discarded.
* Redirects and destination addresses are rechecked against the applicable policy.
* **Breaking Changes**
* Private DNS destinations require approved hosts and networks; private IP literals require an approved network.
* Input and alias names must be non-empty and globally unique.
- **New Features**
- Added assertions for verifying which provider account handled the latest request.
- Enabled provider-affine playback to fall back to another available provider when the pinned provider is unavailable.
- **Bug Fixes**
- Improved provider fallback handling, origin request tracking, and session updates.
- Preserved session headers when fallback stream setup fails and refreshed them after successful fallback.
- **Tests**
- Added coverage for provider-pool failover, account reuse, limits, rejection handling, and eviction behavior.
* **New Features**
* Added an opt-in runtime liveness watchdog with diagnostics, health status, and optional automatic restart.
* Added configurable stream cleanup capacity and eviction re-entry protection.
* Expanded configuration and UI access for users with playlist or user permissions, with safer data sanitization.
* Added testkit scenarios and reporting for playback, admission, provider limits, sharing, and VOD behavior.
* Added support for experimental-branch Docker builds.
* **Bug Fixes**
* Improved provider prioritization, shared playback capacity, cleanup, reconnect handling, and concurrent client behavior.
* Fixed playlist parsing for declared media types.
* Release links now use the configured destination.
New Features
Added an option to append a stable, numeric stream index to upstream User-Agent headers.
Stream indexes remain consistent throughout a playback session, including manifests, segments, reconnects, seeks, and provider failover.
Added a configuration checkbox for enabling the feature.
Documentation
Documented the new configuration option, including session behavior and restart handling.
Added English, Arabic, and Russian translations for the setting.
Co-authored-by: euzu <euzu@proton.me>
New Features
Programme icons are now captured when importing XMLTV electronic programme guides.
Programme icons are preserved when combining programme data from multiple sources.
Exported XMLTV guides now include programme icon information when available.
Icon URLs are rewritten consistently when URL rewriting is enabled.
Bug Fixes
Public resource requests now avoid following redirects and validate destinations before fetching.
Resource caching behavior is now correctly applied according to the request type.
Compatibility
Existing guides and legacy programme data remain supported when no icon is provided.
New Features
Added target-specific bouquet filtering with whitelist and blacklist modes for Live, VOD, and Series groups.
Added an in-context bouquet editor with search, selection controls, status indicators, reset, and streaming previews.
Targets are managed by name, with saved selections available through the Source Editor.
Improved stream alias resolution and provider failover behavior.
Bug Fixes
Existing playlists are preserved when refreshes produce no usable items.
Empty playlists are no longer published.
Configuration changes now recover more safely from persistence failures.
Documentation
Updated feature and configuration documentation and added translations.
* Fix M3U alias credential rewriting on provider fallback
Rewrite opaque authentication query parameters when stream allocation
switches from the primary M3U provider to an alias.
Support unambiguous cross-key mappings such as token to api_key while
preserving unrelated query parameters and rejecting ambiguous mappings.
Add regression coverage for URL rewriting and provider allocation.
* Fix M3U alias credential rewriting on provider fallback
Rewrite opaque authentication query parameters when stream allocation
switches from the primary M3U provider to an alias.
Support unambiguous cross-key mappings such as token to api_key while
preserving unrelated query parameters and rejecting ambiguous mappings.
Add regression coverage for URL rewriting and provider allocation.
