v1.4.0 — Buffering fixes, security hardening & code review

Summary

21 commits since v1.3.0. The focus was eliminating persistent stream buffering, hardening security, and resolving 33 code review findings.

Buffering fixes (the big one)

Root cause: The remux path (-c:v copy, no video re-encode) was capped at 1× playback speed by ffmpeg's -re flag, leaving zero buffer margin. The browser could never build a buffer ahead, so any transient dip (probe, audio re-encode, CDN latency) immediately stalled the video. Stremio doesn't have this problem because it hands the RD URL directly to the player, which downloads at network speed.

Fixes applied:

• Remove -re from remux/copy path — ffmpeg now reads at full speed, the Tempfile buffer decouples it from HTTP backpressure, and -reconnect handles upstream drops
• Enable direct play for H.264 MP4 with B-frames — direct_playable? was using browser_safe_video? which rejects B-frames (needed for MSE, not for native <video>). Most x264 releases have B-frames, so direct play was almost always blocked
• Allow HEVC remux on macOS/iOS/Android — canPlayType returns "" for HEVC even on Chrome 107+ where <video> plays it via VideoToolbox. Added platformSupportsHevc() to check the platform directly
• Allow direct play when selected audio = default track — loadMediaTracks auto-sets selectedAudioStream to the preferred track, which blocked direct play for all multi-audio files even when the preferred track was the default
• Stop reconnect cycle when browser buffer is full — the progress watchdog's download stall detector was firing every ~15s for remux direct play because the browser stops reading when its internal buffer is full (normal for 4K HEVC). Now skips reconnect when bufferedAhead > 5s
• Wait for first frame before playback (HEVC) — HEVC via VideoToolbox has higher decoder startup latency than H.264. Without waiting, audio started before the first video frame was ready, causing a brief freeze
• Disk-based Tempfile buffer — decouples ffmpeg stdout from HTTP backpressure so the reader thread keeps draining ffmpeg's pipe even when the browser pauses reading
• Abort stale progress requests — prevents connection pool exhaustion when seeking rapidly
• Pre-emptive reconnect — detects download stalls before the buffer runs dry and reconnects while the video is still playing from buffer

Security & code quality

• 33 code review findings resolved — security, correctness, performance, and test coverage
• Rack::Attack rate limiting — protects against abuse on API endpoints
• Content param validation — shared concern for validating imdb_id, type, season, episode
• Stream URL validation — validates and sanitises stream URLs before use
• CSRF token fix — stall telemetry POST body was not being sent
• Comet 200 trailer rejection — Comet proxy returning HTTP 200 with trailer data instead of the real stream URL was not handled

Other changes

• Recommendation refresh job — background job with spec coverage
• HLS session improvements — record model, spec coverage
• Torrentio service refactor — cleaner stream provider interface
• Comprehensive test suite — 363 examples, 87.69% line coverage

Files changed

54 files changed, 2453 insertions(+), 284 deletions(-)

Full changelog: v1.3.0...v1.4.0