[Skip to content](https://github.com/khalilbenaz/ultra-tv#start-of-content)
You signed in with another tab or window. [Reload](https://github.com/khalilbenaz/ultra-tv) to refresh your session.You signed out in another tab or window. [Reload](https://github.com/khalilbenaz/ultra-tv) to refresh your session.You switched accounts on another tab or window. [Reload](https://github.com/khalilbenaz/ultra-tv) to refresh your session.Dismiss alert
{{ message }}
[khalilbenaz](https://github.com/khalilbenaz)/ **[ultra-tv](https://github.com/khalilbenaz/ultra-tv)** Public
- [Notifications](https://github.com/login?return_to=%2Fkhalilbenaz%2Fultra-tv) You must be signed in to change notification settings
- [Fork\\
4](https://github.com/login?return_to=%2Fkhalilbenaz%2Fultra-tv)
- [Star\\
12](https://github.com/login?return_to=%2Fkhalilbenaz%2Fultra-tv)
main
[**1** Branch](https://github.com/khalilbenaz/ultra-tv/branches) [**37** Tags](https://github.com/khalilbenaz/ultra-tv/tags)
[Go to Branches page](https://github.com/khalilbenaz/ultra-tv/branches)[Go to Tags page](https://github.com/khalilbenaz/ultra-tv/tags)
Go to file
Code
Open more actions menu
## Folders and files
| Name | Name | Last commit message | Last commit date |
| --- | --- | --- | --- |
| ## Latest commit
Khalil Benazzouz
and
[claude](https://github.com/khalilbenaz/ultra-tv/commits?author=claude)
[resignRelease: opt out of configuration cache](https://github.com/khalilbenaz/ultra-tv/commit/1da9ab55ca59edea7c177773398d79138f1478b6)
Open commit detailssuccess
last monthJun 3, 2026
[1da9ab5](https://github.com/khalilbenaz/ultra-tv/commit/1da9ab55ca59edea7c177773398d79138f1478b6) · last monthJun 3, 2026
## History
[95 Commits](https://github.com/khalilbenaz/ultra-tv/commits/main/)
Open commit details
[View commit history for this file.](https://github.com/khalilbenaz/ultra-tv/commits/main/) 95 Commits |
| [.github/workflows](https://github.com/khalilbenaz/ultra-tv/tree/main/.github/workflows "This path skips through empty directories") | [.github/workflows](https://github.com/khalilbenaz/ultra-tv/tree/main/.github/workflows "This path skips through empty directories") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [android-app](https://github.com/khalilbenaz/ultra-tv/tree/main/android-app "android-app") | [android-app](https://github.com/khalilbenaz/ultra-tv/tree/main/android-app "android-app") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [android-native](https://github.com/khalilbenaz/ultra-tv/tree/main/android-native "android-native") | [android-native](https://github.com/khalilbenaz/ultra-tv/tree/main/android-native "android-native") | [resignRelease: opt out of configuration cache](https://github.com/khalilbenaz/ultra-tv/commit/1da9ab55ca59edea7c177773398d79138f1478b6 "resignRelease: opt out of configuration cache Co-Authored-By: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [cloudflare-config](https://github.com/khalilbenaz/ultra-tv/tree/main/cloudflare-config "cloudflare-config") | [cloudflare-config](https://github.com/khalilbenaz/ultra-tv/tree/main/cloudflare-config "cloudflare-config") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [docs](https://github.com/khalilbenaz/ultra-tv/tree/main/docs "docs") | [docs](https://github.com/khalilbenaz/ultra-tv/tree/main/docs "docs") | [v1.0.0 — UI redesign 2026](https://github.com/khalilbenaz/ultra-tv/commit/91025fd211a3a8b70742541cd1745fc972057536 "v1.0.0 — UI redesign 2026 Editorial AMOLED redesign of every screen + variant C launcher icon. - Design tokens: accent #FF3A2F, Instrument Serif + Geist + Geist Mono - New shared components: ChannelLogo (hue-gradient), ContinueWatchingTile (16:9 + progress), NowPlayingMini, UltraIcons (28 stroke icons), HeroBanner (serif 84sp + accent eyebrow + CTA ring) - Chrome: SidebarNav collapsible 92↔220 with accent pill, TopBarNav with search pill + clock/weather/bandwidth - Live TV: Tivimate 3-pane (categories | channels | preview window with giant logo, LIVE chip, now/next cards, watch CTA) - Guide TV: 12h timeline with hour ruler, channel column with logo, programme cards with EN COURS chip, NOW accent line - Search: 2-pane layout — on-screen keyboard 4×10 + recents | filter chips + results grid (films/series/channels) - Home: editorial hero + NowPlaying mini column + Continue 16:9 + rails - Movies/Series: hero + rails with eyebrows, detail with serif 72sp + meta accent - Settings: editorial header + section cards Surface1 + border - Onboarding: full-screen 3-step wizard with stepper + Cloud/Manual cards - Player: stats card mono with sain indicator - Launcher icon: variant C (red gradient + broadcast waves + play) - Removed Multi-View screen - README: new \"🎨 UI 2026 redesign\" section with home screenshot") | 2 months agoMay 21, 2026 |
| [electron](https://github.com/khalilbenaz/ultra-tv/tree/main/electron "electron") | [electron](https://github.com/khalilbenaz/ultra-tv/tree/main/electron "electron") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [web](https://github.com/khalilbenaz/ultra-tv/tree/main/web "web") | [web](https://github.com/khalilbenaz/ultra-tv/tree/main/web "web") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [.gitignore](https://github.com/khalilbenaz/ultra-tv/blob/main/.gitignore ".gitignore") | [.gitignore](https://github.com/khalilbenaz/ultra-tv/blob/main/.gitignore ".gitignore") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [CONTRIBUTING.md](https://github.com/khalilbenaz/ultra-tv/blob/main/CONTRIBUTING.md "CONTRIBUTING.md") | [CONTRIBUTING.md](https://github.com/khalilbenaz/ultra-tv/blob/main/CONTRIBUTING.md "CONTRIBUTING.md") | [Ultra TV — modern IPTV player for Web, Desktop and Android TV / Googl…](https://github.com/khalilbenaz/ultra-tv/commit/f9d2f05ea6a378e5296916a3788a9480180e0e82 "Ultra TV — modern IPTV player for Web, Desktop and Android TV / Google TV Multi-platform IPTV client: - Web: React + TypeScript + Vite + IndexedDB (Dexie) + hls.js + shaka-player + mpegts.js - Desktop: Electron shell with native codecs (HEVC, AC3, MKV) — macOS, Windows, Linux - Android / Android TV / Google TV: Capacitor wrapper with custom ExternalPlayer plugin that hands streams off to VLC / MX Player / Just Player / Next Player / ExoPlayer for codecs the WebView can't decode Supports Xtream Codes, M3U / M3U8 and Stalker Portal providers. Live TV with inline EPG (current/next program + progress), Movies and Series with rich detail pages (Xtream get_vod_info / get_series_info), category whitelist per content type (saves bandwidth on huge providers), drag-drop favorites, separate Watchlist, sort/filter (alpha/year/rating + genre + year range), Random pick, Home with Continue Watching / Top Rated / Recently Added / Live shelves, Cmd+K command palette, numeric TV-remote channel keys. Player: HLS via hls.js with custom proxy loader (rewrites every segment URI), DASH via shaka-player, MPEG-TS via mpegts.js (lazy CDN), Picture-in-Picture, fullscreen, playback speed, audio/subtitle track selection, external .srt/.vtt upload, stats overlay (Shift+D), automatic codec/container fallback chain (.mp4 → .mkv → .ts → .mov…). Multi-language UI (English / French / Arabic, RTL native), dark + light themes, collapsible sidebar, mobile-responsive layout, PWA installable with offline shell. DVR via MediaRecorder + Origin Private File System. EPG reminders via the Notifications API. Catch-up playback for live channels that advertise it. Chromecast Web Sender + AirPlay handoff. Includes four interchangeable CORS / User-Agent proxy implementations to choose from (Val Town paste-and-go, Vercel Edge Function, Cloudflare Worker, Deno Deploy) — pick whichever suits your hosting.") | 2 months agoMay 11, 2026 |
| [LICENSE](https://github.com/khalilbenaz/ultra-tv/blob/main/LICENSE "LICENSE") | [LICENSE](https://github.com/khalilbenaz/ultra-tv/blob/main/LICENSE "LICENSE") | [Ultra TV — modern IPTV player for Web, Desktop and Android TV / Googl…](https://github.com/khalilbenaz/ultra-tv/commit/f9d2f05ea6a378e5296916a3788a9480180e0e82 "Ultra TV — modern IPTV player for Web, Desktop and Android TV / Google TV Multi-platform IPTV client: - Web: React + TypeScript + Vite + IndexedDB (Dexie) + hls.js + shaka-player + mpegts.js - Desktop: Electron shell with native codecs (HEVC, AC3, MKV) — macOS, Windows, Linux - Android / Android TV / Google TV: Capacitor wrapper with custom ExternalPlayer plugin that hands streams off to VLC / MX Player / Just Player / Next Player / ExoPlayer for codecs the WebView can't decode Supports Xtream Codes, M3U / M3U8 and Stalker Portal providers. Live TV with inline EPG (current/next program + progress), Movies and Series with rich detail pages (Xtream get_vod_info / get_series_info), category whitelist per content type (saves bandwidth on huge providers), drag-drop favorites, separate Watchlist, sort/filter (alpha/year/rating + genre + year range), Random pick, Home with Continue Watching / Top Rated / Recently Added / Live shelves, Cmd+K command palette, numeric TV-remote channel keys. Player: HLS via hls.js with custom proxy loader (rewrites every segment URI), DASH via shaka-player, MPEG-TS via mpegts.js (lazy CDN), Picture-in-Picture, fullscreen, playback speed, audio/subtitle track selection, external .srt/.vtt upload, stats overlay (Shift+D), automatic codec/container fallback chain (.mp4 → .mkv → .ts → .mov…). Multi-language UI (English / French / Arabic, RTL native), dark + light themes, collapsible sidebar, mobile-responsive layout, PWA installable with offline shell. DVR via MediaRecorder + Origin Private File System. EPG reminders via the Notifications API. Catch-up playback for live channels that advertise it. Chromecast Web Sender + AirPlay handoff. Includes four interchangeable CORS / User-Agent proxy implementations to choose from (Val Town paste-and-go, Vercel Edge Function, Cloudflare Worker, Deno Deploy) — pick whichever suits your hosting.") | 2 months agoMay 11, 2026 |
| [README.md](https://github.com/khalilbenaz/ultra-tv/blob/main/README.md "README.md") | [README.md](https://github.com/khalilbenaz/ultra-tv/blob/main/README.md "README.md") | [Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt…](https://github.com/khalilbenaz/ultra-tv/commit/5985aa0709178a80aad4f1804efd93d8a89d7946 "Audit fixes: security hardening, Room migrations, CI/CD, codecs, debt cleanup (#1) * Audit fixes: worker security hardening, Room migrations, player/recording bugs, web + electron robustness cloudflare-config/worker.js: - opt-in protectReads per MAC: GET /api/config/:mac requires ?password= when enabled (dashboard toggle, session+CSRF) - fail-closed session secret (500 if SESSION_SECRET/ADMIN_PASSWORD missing) - constant-time compares for session/CSRF/password/token checks - exponential login lockout backoff, JSON.parse lockout guard - CSRF on raw-JSON POST /api/config/:mac - Referrer-Policy + nosniff headers; CRASH_TOKEN documented android-native: - Room: exportSchema=true, schemaLocation, destructive fallback limited to v1-9 (no more DB wipe on future bumps) - fix VOD resume race (prepareResume now suspend, seekTo gets real value) - RecordingWorker: cancelled no longer overwritten by done; retryable vs terminal failures (\"error\" status, surfaced in UI) - replace runBlocking in PlayerScreen composition with produceState (ANR) - HlsRecorder: dedupe by media-sequence index (sliding playlist gaps + unbounded memory) - ReminderReceiver: goAsync + scoped job instead of GlobalScope - UpdateChecker: verify .sha256 sibling asset when published; drop dead versionCodeNormalised web: - fix series whitelist bug (dead vodCats overwrite) — extracted filterCategories helpers + tests - top-level ErrorBoundary with TV-friendly fallback wired to diag buffer - proxy worker default-deny (ALLOWED_HOSTS mandatory) - EPG gzip magic-byte sniff + tests (vitest 9/9, tsc clean) electron: - validate URL scheme before shell.openExternal (http/https only) - did-fail-load / render-process-gone / unresponsive fallback page - scope header rewriting to http(s), document webSecurity tradeoff - dev script sets SV_DEV via cross-env Co-Authored-By: Claude Opus 4.8 (1M context) * Phase 2: PBKDF2, CI/CD, single-source versioning, castlabs Electron, web credential hygiene, debt cleanup cloudflare-config/worker.js: - PBKDF2-SHA256 (100k iters, versioned pbkdf2$$ format) replaces single-pass SHA-256 - backward compat: legacy hashes verified then transparently re-hashed on login - min password length 4 -> 8 (signup, change, UI hints, README) CI/CD + versioning: - VERSION file as single source; build.gradle.kts derives versionName + versionCode (10029) - .github/workflows/ci.yml: web (tsc+vitest), android (compile+unit tests), workers (node --check) - .github/workflows/release.yml: tag==VERSION gate, ULTRA_* secrets with debug fallback, publishes UltraTV-debug.apk + .sha256 electron: - switch to castlabs fork pinned via GitHub tag v33.4.11+wvcus (HEVC/AC3/EAC3/Widevine); npm registry alias doesn't work (404) and semver ignores +wvcus metadata - electron/README.md (codecs, EVS signing notes, icon generation); build/ buildResources un-ignored web: - stop persisting Xtream credentials in stored stream URLs; URLs rebuilt at play time from provider record (backup exports no longer leak credentials); 9 new URL-builder tests (vitest 18/18, tsc clean) - remove dead proxy code (proxiedStreamUrl, getProxy, LEGACY_DEFAULTS) android-native: - StalkerClient: session token cached per provider (5 min TTL, invalidated on auth failure) — no more handshake on every zap - RemoteLog URL/token moved to BuildConfig fields (gradle prop/env overridable) - Search result opens the channel via the same player route as Live - remove unused Retrofit deps; drop redundant usesCleartextTraffic manifest flag android-app: marked DEPRECATED (README), dead Firebase wiring + boilerplate tests removed Co-Authored-By: Claude Opus 4.8 (1M context) * CI: drop flaky setup-android action, use preinstalled SDK + chmod gradlew Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Khalil Benazzouz Co-authored-by: Claude Opus 4.8 (1M context) ") | last monthJun 3, 2026 |
| [SECURITY.md](https://github.com/khalilbenaz/ultra-tv/blob/main/SECURITY.md "SECURITY.md") | [SECURITY.md](https://github.com/khalilbenaz/ultra-tv/blob/main/SECURITY.md "SECURITY.md") | [v1.0.20 — release-signing infra, CSRF, JUnit suite](https://github.com/khalilbenaz/ultra-tv/commit/6325f3290436250e98f47e3eff37b656aa3f9c0a "v1.0.20 — release-signing infra, CSRF, JUnit suite Build / signing - New \"release\" signingConfig reads ULTRA_KEYSTORE / _PASSWORD / ULTRA_KEY_ALIAS / _PASSWORD env vars and enables v1/v2/v3/v4 signature schemes. Falls back to the debug keystore when env vars aren't set, so CI / dev checkouts still produce an installable APK. - SECURITY.md documents the full rotation procedure with apksigner rotate + lineage so existing installs keep auto-updating across the keystore swap (APK Signature Scheme v3, Android 9+). Worker — CSRF - Stateless csrf token derived from the session cookie (hmac(sessionSecret, sess + \".csrf\").slice(0,32)). All mutating endpoints under /api/provider/, /api/password/, /api/config/ now require it: the request's form body must carry the token in a hidden \"csrf\" field. Mismatch → 403. SameSite=Lax already blocked the obvious cross-site POST; this closes the lax-mode subdomain and timing edge cases. - Dashboard HTML embeds the token in every