v1.2.5 - Startup Flash Fix, 12h/24h Clock & High Performance Mode

Patch release resolving startup white flash (FOUC), adding a 12h/24h clock toggle, and introducing a High Performance mode for resource-constrained TVs. Closes #10. Also includes compatibility fixes for older BusyBox timeout (#9) and listing installed apps on newer webOS via SSAP (#12).

What's Changed

• Eliminated Startup White Flash / FOUC:
  • Added "bgColor": "#000000" to appinfo.json so webOS paints a pure black window canvas on launch.
  • Set dark background color inline on html and body with early theme restoration before initial paint.
  • Deferred background transitions until after startup, eliminating the slow fade from white.
• Clock Format Toggle (12-Hour / 24-Hour):
  • Added setting in Customize modal to switch between 24-Hour (20:30) and 12-Hour (8:30 PM) format, applied to both the main clock and OLED screensaver.
• High Performance Mode (60 FPS Boost):
  • Added High Performance setting that disables GPU-heavy CSS backdrop-filter and ambient-glow filters, ensuring smooth 60 FPS navigation on mid-range and older TV chipsets (e.g., LG NANO81 series).
• BusyBox Compatibility:
  • Automated installer (scripts/install.py) now supports BusyBox's older timeout -t syntax on legacy webOS releases (#9).
• App Discovery via SSAP:
  • Automatically falls back to TV's local SSAP remote socket when listLaunchPoints is restricted on newer webOS releases (#12).

Install

Download org.webos.freemytv_1.2.5_all.ipk below, or run python scripts/install.py from a clone of this repository.

v1.2.4 - webOS 5.x Install Fix

Patch release - fixes installation on webOS 5.x. Closes #8.

Fixed

• "-5: ipk verified failed" on webOS 5.x. Reported on an LG 55NANO81SNA (webOS 5.6.2) via webOS Dev Manager, both from the Homebrew store listing and the repo's own prebuilt ipk.

  Root cause: ares-package (the official packaging tool, current @webosose/ares-cli lineage) bakes 1970-01-01 (epoch-zero) modification timestamps into every file entry inside control.tar.gz and data.tar.gz. webOS 5.x's on-device pkgverifier shells out to tar to extract those archives, and GNU tar emits an "implausibly old time stamp" warning on epoch-zero entries that pkgverifier treats as a fatal error - even though older webOS versions installed the exact same package without issue. This is a known, previously-documented issue affecting other homebrew apps built with the same CLI.

  scripts/build.py now rewrites every tar entry's timestamp to the actual build time after packaging, regardless of whether ares-package or the script's own pure-Python fallback packager produced the file.

Install

Download org.webos.freemytv_1.2.4_all.ipk below, or run python scripts/install.py from a clone of this repo. If you built your own ipk from an older checkout, rebuild with python scripts/build.py to pick up the fix.

v1.2.3 - XSS and SSH Key Security Fixes

Security patch release. Fixes items 1 and 2 of #6, reported and fixed by @lewalmeida in #7. Thank you!

Fixed

• HTML injection (XSS) from third-party API data (high). renderPicks() built each trending card with innerHTML, concatenating the title/badge/service text straight from TMDB and TVMaze (TVMaze is community-edited, no API key required) without escaping. A crafted title on a show scoring ≥ 8.4 could run script in the app on every TV that displayed it. On a rooted TV this is worse, since the app already calls luna://org.webosbrew.hbchannel.service/exec as a launch fallback. Also fixed: pick.poster was concatenated unvalidated into background-image: url('...'), letting it break out of the CSS string, and renderAppSelectorGrid() had the same innerHTML pattern for installed-app titles (lower risk, requires a malicious installed app). docs/index.html had the same code and got the same fix.
  • All three now build DOM nodes with textContent instead of innerHTML.
  • Poster URLs are only used if they match a strict https:// pattern with no quotes, parens, backslashes, or whitespace - real TMDB/TVMaze URLs still work.
• Decrypted SSH private key written world-readable (medium). scripts/install.py wrote ~/.ssh/webos_tv_rsa and ~/.ssh/webos_tv_rsa_decrypted with a plain open(..., "wb"), which under the common umask 022 leaves them mode 0644 - readable by any local user, and rejected outright by OpenSSH ("UNPROTECTED PRIVATE KEY FILE") on some platforms. Both files are now created mode 0600.

Not changed in this release

The issue also noted some lower-severity items for future consideration: disabled host-key verification (StrictHostKeyChecking=no), auto-installing to the first SSDP-discovered TV without confirmation, the install passphrase being visible via argv/ps, and README clarity around Key Server and ACR/telemetry claims. None of these were part of the fix in #7.

Install

Download org.webos.freemytv_1.2.3_all.ipk below, or run python scripts/install.py from a clone of this repo.

v1.2.2 - webOS 3.x Compatibility & Installer Fix

Patch release - compatibility and installer reliability fixes. Closes #4.

Fixed

• webOS 3.x / Chromium 38 (2014) compatibility. A report on an LG 55UJ634V (webOS 3.9) showed a completely blank app shelf. The root cause: async/await syntax (ES2017) is a parse error on that engine, which aborts the entire inline script - not just the weather/trending functions that used it. A full sweep of the app turned up a wider set of unsupported ES6+ features:
  • async function/await → rewritten as .then() promise chains
  • const/let → var throughout
  • String.prototype.padStart, Array.prototype.find/findIndex, Array.from, Object.assign → small ES5-safe helpers
  • Both network functions now guard against a missing fetch global (the Fetch API postdates Chromium 38 entirely), so a legacy engine degrades to the offline/curated fallback instead of throwing and skipping the rest of boot
  • Added flexbox fallbacks ahead of all 5 display: grid layouts, so engines without CSS Grid still get a usable layout
• scripts/install.py PTY crash on some TVs. A TV whose sshd rejects forced PTY allocation (ssh -tt → "PTY allocation request failed on channel 0") would silently get empty command output and the script reported failure even when the install may have gone through. The script now retries once without forcing a PTY when it detects that rejection.

The icon-artwork rendering bug also reported in #4 was already fixed by #2/#3 (bundled brand logos + real iconUrl discovery) - no change needed there.

Not addressed: persistent Home-screen/autostart is a feature request tracked on the roadmap (requires root), not a bug. These compatibility fixes are based on documented Chromium 38 engine limitations, not a device-confirmed trace - I don't have webOS 3.x hardware to verify against directly.

Install

Download org.webos.freemytv_1.2.2_all.ipk below, or run python scripts/install.py from a clone of this repo.

v1.2.1 - Installer Reliability Fixes

Patch release - installer reliability fixes, no new app features.

Fixed

• scripts/install.py now actually works end-to-end, verified live on real hardware (webOS 10.3.1). It was silently reporting success while installing nothing. Three real bugs:
  • luna-send-pub -u isn't a valid flag on this firmware and errored out immediately.
  • luna-send-pub prints nothing at all - not even to stderr - without a controlling TTY; a plain ssh user@host cmd needs -tt or every call "succeeds" with empty output.
  • subprocess.run(cmd_string, shell=True) runs through cmd.exe on Windows regardless of which shell launched Python, which mangled the double quotes embedded in the JSON payloads sent to the TV. Switched to list-form argv throughout.
  • The script now actually checks the response for "state":"installed" / "returnValue":true instead of unconditionally printing success.
• Same invalid -u flag fixed in the app's own Luna launch fallback (launchApp()'s hbchannel exec path).
• Rebuilt dist/ from current source - the v1.2.0 release's .ipk had been built just before the launch-fallback fix landed, so it didn't actually match that tag's source.

See README.md and v1.2.0's release notes for the full feature set (Movies/Shows tabs, Weather & Sun drawer, OLED idle screensaver).

Install

Download org.webos.freemytv_1.2.1_all.ipk below, or run python scripts/install.py from a clone of this repo (now the recommended path - it's confirmed working, unlike ares-install which has a permission bug on some firmwares).

v1.2.0 - Movies/Shows Tabs, Weather Drawer, OLED Screensaver

Highlights

• Movies / Shows trending tabs - the trending row is now two tabs instead of one mixed list. TMDB-ranked per tab when you set an API key; TVMaze's live feed for Shows and curated picks for Movies when you don't.
• Weather & Sun drawer - clicking the weather widget now opens a slide-in panel with an hourly forecast and sunrise/sunset times (Open-Meteo), instead of just refreshing in place.
• OLED-safe idle screensaver - a pure-black floating clock appears after 3 minutes idle and gently shifts position to avoid burn-in. Dismissed by any key or remote movement.
• Smoother, cheaper focus animations - replaced hand-tuned index arithmetic for D-Pad Up/Down with a geometric nearest-row algorithm, cut the ambient-glow re-blur cost that ran on every keypress, and trimmed backdrop-filter blur radii for weaker TV GPUs.
• Better default app shelf - swapped Plex and Globoplay (niche personal-media/regional apps) for Prime Video and Disney+.
• Fixed version drift - appinfo.json had been stuck at 1.0.0 since the v1.1 feature set shipped; build/install scripts now read the version from appinfo.json instead of hardcoding it.

See README.md (now available in English and Portuguese) and ROADMAP.md for details.

Install

Download org.webos.freemytv_1.2.0_all.ipk below and install it via webOS Dev Manager, or run python scripts/install.py from a clone of this repo.