Installation Guide

Get Your License Key

Before installing, you need a valid license key:

• Go to Sign Up and create an account
• Login to your Dashboard
• Purchase a license
• Copy your License Key

Run the Installer

Download the latest xOTT Panel installer:

Make the installer executable and run it:

Wait for Installation

The automated installer will set up:

• Node.js runtime environment
• PostgreSQL database
• FFmpeg and media tools
• Python dependencies
• Systemd service

Access the Panel

Open your browser and navigate to:

Login with Default Credentials

Use the default admin credentials:

• Username: admin
• Password: admin

Verify License Status

Go to Settings → License and verify your license is active

Create or Verify a Backup

Before major updates, open Management → Database and create a backup. The Database page also supports restoring from server-side backups or an uploaded backup file.

Run the Installer

Download the latest installer and run it on the existing server:

Verify After Update

After the service restarts, verify login, services, active streams, outputs, viewers, XUI mappings, and database health from the Management pages.

Stop and Disable Services

Stop the running services to ensure files can be safely removed:

Remove Application Files

Delete the application directory and service configurations:

Remove Database

Drop the PostgreSQL database and user (optional):

Service Not Starting

Check the service status:

View Logs

Check real-time application logs using journalctl:

v1.4.36 — Zattoo Stop Fix May 2026

• Fix — Zattoo streams with channel IDs containing underscores now stop correctly from Streams, Library, and Events views.
• Fix — Stream stop API now accepts the exact active stream key to avoid reconstructing incorrect channel IDs.

v1.4.35 — Zattoo Login & DRM Fix May 2026

• Fix — Zattoo now supports optional logged-in accounts correctly while keeping anonymous access available.
• Fix — Services page now displays real Zattoo accounts below anonymous access instead of hiding them.
• Fix — Service login now rejects failed script responses instead of showing a false success message.
• Fix — Zattoo DRM channels now return standard PSSH/license data and CDM keys for encrypted DASH playback.

v1.4.33 — Event Slot Reassignment Fix May 2026

• Fix — Event slots now rebuild from the current provider schedule on refresh instead of preserving stale same-day auto-slot mappings.
• Fix — DAZN Italy event slots now assign early visible events consistently from the first available auto slots while keeping team-rule slots reserved.

v1.4.32 — Event Slot Rules Fix May 2026

• Fix — Dynamic event slot rules now clear stale assignments when a team, competition, category, or keyword rule is changed.
• Fix — Auto event slots now preserve provider event order and avoid duplicate event assignment across rule and auto slots.
• Improvement — DAZN event metadata now exposes team fields when available, improving team-based stable slot matching.

v1.4.31 — Event Slot Assignment Fix May 2026

• Fix — Service event slots now apply to all non-ended live/upcoming events returned by the provider schedule, not only same-day events.
• Fix — Events page bypasses stale browser event cache when stable service slots are enabled, ensuring slot numbers and stable slot URLs appear immediately.

v1.4.27 — DAZN Event Hotfix May 2026

• Fix — DAZN event filtering now preserves valid regions where live/upcoming event tiles are AssetId-based and do not include Sport or Competition metadata.
• Fix — DAZN Events still excludes explicit linear, catch-up, replay, highlight, and VOD tiles without hiding valid live/upcoming events.

v1.4.26 — DAZN Event Cleanup May 2026

• Fix — DAZN Events now filters out linear channel tiles that DAZN returns inside mixed discovery rails.
• Fix — DAZN catch-up, replay, highlight, and VOD tiles no longer appear in the Events page as live events.
• Improvement — DAZN event extraction now falls back to alternate event sources when the primary rail contains only non-event content.

v1.4.25 — DRM Runtime Install Fix May 2026

• Fix — Fresh installs now include the bundled mp4decrypt DRM runtime directly in the release package.
• Fix — Installer now validates the DRM runtime after deployment so protected streams do not fail later with a missing binary.
• Improvement — DRM setup no longer depends on a best-effort external Bento4 download during customer installation.

v1.4.24 — Dynamic Event Outputs May 2026

• New — Service event outputs now support universal dynamic slots for teams, competitions, categories, keywords, and regex rules.
• Improvement — Fixed event slots can now keep stable URLs like DAZN Roma, Serie A, UFC, or Premier League while automatically mapping matching live events.
• Improvement — Existing automatic daily event-slot assignment remains available for slots left in Auto mode.

v1.4.23 — Live HLS Burst Smoothing May 2026

• Fix — Live HLS streams now use stable media-sequence tracking so source URL/session changes do not cause duplicate segment bursts.
• Improvement — Live stream processing now skips stale backlog near the live edge instead of publishing many old segments at once.
• Improvement — Samsung TV Plus and other live HLS channels should deliver smoother playback when upstream playlists briefly re-window or refresh sessions.

v1.4.22 — Multi-Proxy Pools May 2026

• New — Proxy assignments now support multiple proxies per service, account, and stream for pool-based stream startup.
• Improvement — Streams now choose proxies using health-aware least-connection selection, with fallback to healthier proxies after proxy-related failures.
• Fix — Script execution, token refresh, VOD, metadata probes, and stream recovery now use the same centralized proxy resolution logic.

v1.4.21 — XUI Event Slot Integration May 2026

• Improvement — XUI event exports now use stable service event slot URLs when available, keeping XUI sources stable across event rotation.
• Fix — XUI event export now sends real event metadata and protected HLS URLs instead of placeholder event data.
• Fix — XUI sync, scheduler, connection testing, and activity logs are now aligned with the database schema and multi-connection usage.

v1.4.20 — Viewer Expiration Controls May 2026

• New — Viewer accounts now support optional expiration dates for protected M3U and HLS access.
• Improvement — Expired viewers can be extended or cleared from the Users page without recreating accounts or rotating tokens.
• Improvement — Navigation now uses Content and Management groups, with Monitoring moved under Management.

v1.4.19 — Admin Session Login Fix May 2026

• Fix — Admin login no longer fails when generated JWT sessions exceed the old database session-token length.
• Fix — Database session storage now writes token hashes consistently for active-session lookup and cleanup.
• Improvement — Older installs migrate user session columns safely during startup.

v1.4.18 — Viewer Controls and Runtime Library Cleanup May 2026

• Fix — Starting streams or events no longer automatically saves them into the Library; explicit Library saves remain persistent.
• New — Viewer accounts now support an allowed-connections limit for protected playback links.
• Improvement — Users page redesigned with clearer viewer output controls and assignment explanations.
• Improvement — Application navigation is grouped into cleaner Content, Operations, and Admin menus.

v1.4.17 — Multi-User Management May 2026

• New — Added multi-user management with Admin, Operator, and Viewer roles.
• New — Admins can assign users to specific services, accounts, streams, and proxies from the Users page.
• Improvement — Stream, event, VOD, library, and dashboard views now respect each user's assigned resources.
• Improvement — System-level sections are reserved for admins while operators keep access to day-to-day stream workflows.

v1.4.16 — Streamstable Provider API Load Reduction May 2026

• Improvement — Streamstable now reuses the loaded channel catalog across page navigation instead of refreshing provider APIs on each visit.
• Fix — Manual Refresh remains the only Streamstable action that clears channel caches and forces a full provider channel reload.
• Improvement — Runtime stream status and metrics continue updating through lightweight local polling without stressing service channel APIs.

v1.4.15 — Database Management & Paramount Linear Fixes May 2026

• Fix — Paramount linear channels now refresh playback sessions correctly after stop/start cycles.
• Improvement — Database Management now supports safer backup upload and restore with pre-restore safety backups.
• Improvement — Added xOTT-specific database integrity checks and repair actions for streams, outputs, sessions, and proxy assignments.
• Fix — Database health checks now use real PostgreSQL max connection limits and safer cleanup validation.

v1.4.14 — On-Demand Idle & Recovery Fixes May 2026

• Fix — Stream on Demand now properly tracks active playback across all public HLS URL formats.
• Fix — Idle on-demand streams are now stopped automatically even if they were already running before viewer tracking began.
• Fix — Stream recovery now excludes on-demand streams so they do not auto-start after an app restart.

v1.4.13 — Service Defaults & Library Menu May 2026

• Improvement — Service Outputs now includes service-level auto-restart defaults, refresh-on-restart, and Stream on Demand defaults.
• Improvement — Library table rows now support right-click action menus consistent with Streamstable.
• Fix — Service-level stream defaults now propagate auto-restart and on-demand settings through the normal stream start path.

v1.4.12 — On-Demand Public Playback Fix May 2026

• Fix — Stream On Demand public HLS URLs now resolve playlist and segment requests reliably after viewer-triggered startup.
• Fix — Public stream keys are matched case-insensitively to prevent channel ID casing from breaking playback.
• Improvement — PublicKeyResolver misses during on-demand fallback are logged at debug level to avoid noisy warning spam.

v1.4.11 — On-Demand Auth Fix May 2026

• Fix — Stream On Demand now authenticates its internal startup request, allowing viewer-triggered streams to pass through the normal manifest route.
• Fix — Events Outputs now shows event M3U links only, keeping linear output management on Services and Library.
• Improvement — Library rows show the Stream On Demand indicator for saved on-demand streams.

v1.4.10 — On-Demand Startup Fix May 2026

• Fix — Stream On Demand now starts through the normal service manifest route, preventing null manifest startup failures.
• Fix — Events Outputs is available on the All Services view and lists output links for all services.
• Improvement — Library rows now show the Stream On Demand indicator for saved on-demand streams.

v1.4.9 — On-Demand & Event Outputs May 2026

• Fix — Library stream settings now honor Stream On Demand mode without starting the stream immediately.
• Fix — Stable public HLS URLs can now wake inactive saved on-demand streams by resolving them from the database.
• Improvement — Events now include an Outputs button for the selected service with stable event and same-service linear M3U links.

v1.4.8 — Proxy Assignments & Stable Outputs May 2026

• Fix — Proxy assignment dialogs now correctly pre-select existing service, account, and stream assignments regardless of service-name casing.
• Fix — Proxy account assignment saving now preserves account names that contain underscores.
• Fix — Stream On Demand settings now persist and reload correctly from stream settings.
• Improvement — Library Outputs now expose protected stable global and per-service linear M3U links for saved streams.
• Change — Streamstable legacy snapshot export was removed so M3U output management stays centralized in Library and Services outputs.

v1.4.7 — Paramount Event Playback Fix May 2026

• Fix — Paramount+ event streams now pass the required playback authorization headers to token-gated HLS key and segment requests.
• Fix — Paramount+ HLS event manifests no longer attempt DASH PSSH extraction, avoiding misleading startup errors.

v1.4.6 — Proxy Management & Paramount Events May 2026

• Fix — Proxy assignment dialogs now correctly pre-select services, accounts, and streams already assigned to the selected proxy.
• Fix — Proxy testing now verifies outbound HTTPS through the configured proxy URL, so bad credentials or expired proxies report failure instead of false success.
• Improvement — Paramount+ now supports live/upcoming events and shows device pairing as the supported authentication method.

v1.4.5 — Events Auto-Start Refresh Fix May 2026

• Fix — Events auto-refresh and auto-start now bypass stale event cache so upcoming events become live and start automatically without manual refresh.

v1.4.4 — Service Defaults & Active Track Metadata May 2026

• Improvement — Service Outputs now include global per-service stream defaults for video quality, audio tracks, and subtitle tracks.
• Improvement — Per-service stream defaults now apply to both linear streams and event streams unless overridden per stream.
• Fix — Active streams and events now show selected tracks and available track metadata correctly while running in worker engine mode.

v1.4.3 — Stream Recovery & Peacock Fixes May 2026

• Fix — App update mode now protects the active stream recovery snapshot before stopping the running service, preventing older installs from clearing streams during an update.
• Fix — Stream recovery can now fall back to the protected pre-update snapshot when the primary recovery file is empty.
• Fix — Recovered event streams now keep their event type during restart instead of being requested as linear channel manifests.
• Fix — Peacock token refresh now retries only after an auth failure and avoids crashing event/channel requests when the refresh endpoint rejects a stale token.

v1.4.2 — Streamstable Visibility & Recovery Fixes May 2026

• Fix — Streamstable no longer misclassifies saved linear channels with long provider IDs as event streams.
• Fix — Saved stream metadata now preserves explicit channel/event type when loading stopped or offline streams.
• Fix — App update and graceful restart now preserve the stream recovery snapshot instead of overwriting it while active streams are being stopped.
• Improvement — Stopped saved linear streams remain visible in Streamstable through the saved/orphan stream path after service refresh.

v1.4.1 — Stream Recovery & HLS Decryption Fixes May 2026

• Fix — HLS segment decryption now respects per-segment clear/encrypted state, preventing clear live segments from being incorrectly sent through DRM decryption.
• Fix — AES-128 HLS decryption now derives IVs from the segment sequence when the manifest omits an explicit IV.
• Fix — Stream recovery and restart paths now preserve saved channel names instead of replacing them with raw provider IDs.
• Fix — Failed recovery attempts no longer silently discard recovery state; failed streams remain available for later retry.
• Fix — Service Outputs stream defaults now match the main stream settings modal for FFmpeg timestamp and corruption-handling defaults.
• Improvement — Service output defaults now load missing FFmpeg options from safe defaults instead of turning them off implicitly.

v1.4.0 — Streaming Performance & Service Output Architecture May 2026

• Major — Streaming engine performance architecture upgraded with worker-process isolation and TS passthrough defaults. Multi-stream workloads now run outside the main API process while preserving DRM, HLS, and stream recovery behaviour.
• Feature — Added per-service output configuration on the Services page, including stable event slots, event M3U output, linear M3U output, slot prefix/count, and service-level stream default options.
• Feature — Protected per-service event and linear output URLs with service-specific access tokens, including tokenized event-slot playlist links and URL regeneration from the Services page.
• Improvement — Reworked the Service Outputs modal so service stream defaults use normal form controls for HLS, request, engine, retry, live-edge, headers, and FFmpeg options instead of raw JSON inputs.
• Feature — Added stable event slot assignment and daily slot reuse. Live/upcoming events can now map to fixed slot URLs and stable per-service event playlists.
• Feature — Added separate per-service linear playlist output at /outputs/{service}/linear.m3u, keeping linear channels separate from event slots.
• Fix — Events page service selection now preserves the selected service context instead of requiring the same service to be selected again inside a dropdown.
• Fix — Event streams are filtered out of linear stream tables and M3U exports, and ended event streams no longer pollute linear playlists.
• Fix — Event exports now prefer stable SlotUrl, SlotName, and SlotNumber values when service event slots are enabled.
• Fix — Streamstable and Library M3U exports now skip event streams and export xOTT playlist URLs only, avoiding direct provider manifest URLs in customer playlists.
• Fix — Event stream starts and restarts now carry itemType=event and service defaults correctly for services that require event type context.
• Fix — Event lifecycle handling no longer loops indefinitely when live events end. Transient CDN live/offline flips are tolerated, but legitimate event-end transitions now stop cleanly.
• Fix — Events Settings modal probing and Apply & Restart now persist custom track choices for inactive and active event streams.
• Fix — Batch stop now normalizes stream keys and treats already-stopped streams as successful, eliminating phantom stop failures.
• Improvement — Installer update mode now runs idempotent migrations for service event config and slot tables while preserving existing credentials and configuration.

v1.3.66 — Event Lifecycle & Streaming Engine Fixes May 2026

• Fix — Streaming engine no longer loops indefinitely after a live event ends. The isLive=true override that protects against transient CDN flips was unbounded; events that legitimately ended kept playing the last segments forever. Now capped at 3 consecutive isLive=false responses, after which the manifest is trusted and the stream exits cleanly.
• Fix — Track probing for inactive event streams now works in the Events page Settings modal. The probe endpoint was hardcoding itemType='channel' for streams not in the database, causing manifest fetch to fail with "No tracks found in manifest". Modal now passes itemType in the probe request and the server honors it.
• Fix — Custom video / audio track selections now persist for active event streams after Apply & Restart. The handler was skipping the database save step before restart, so the restart endpoint loaded stale defaults. Now mirrors the Streams Table flow (save → restart).
• Fix — Event stream restart now passes type=event in manifest args. Without this, services like Peacock that require both id and type rejected restart requests with "Item ID and type required".
• Fix — Batch stop on the Streams table no longer reports phantom failures. The endpoint was using a raw service_user_channel concat that didn't match the lowercased / sanitized active-streams map keys. Now uses normalizeKey() and treats already-stopped streams as success.
• Fix — Events page Auto Refresh switch now persists across page reloads via localStorage.
• Fix — Events page Auto Start now correctly fires for upcoming events that flip to live. Previously required Auto Refresh to also be on; polling now activates whenever Auto Refresh OR Auto Start is enabled.

v1.3.65 — Events Table Fixes & UI Polish May 2026

• Fix — Stopping an active event stream now correctly removes it from the Active tab. Stopped streams were lingering with frozen metrics because the correlation query included streams with isActive=false.
• Fix — Stop and Batch Stop were sending the raw service event ID instead of the sanitized database channel ID. For services with special characters in event IDs the stop request targeted the wrong stream and silently failed.
• Fix — Stream proxy can now be configured for event streams via the Settings modal. Previously the proxy field was disabled.
• Fix — Server-side channel cache is now invalidated on manual Refresh in the Events page, matching Streams Table behaviour.
• Fix — SportEurope geo-blocked and auth-failed errors now surface the correct error message instead of a generic INTERNAL_ERROR.
• Improvement — Active Events table now has search, pagination, unified column names, action button styles, and status chip consistent with Streams Table.

v1.3.64 — DRM Binary, DB Migration & Proxy Fix May 2026

• Fix — mp4decrypt (Bento4) now deployed directly from the release tarball on every update. Previously only installed on fresh installs via external download — servers where the download failed had no DRM binary, causing STREAM_START_FAILED on all DRM-protected services (Peacock, etc.).
• Fix — Update installer now runs schema migrations in update mode. Missing columns (on_demand_timeout and others) were causing constant query errors on updated servers.
• Fix — Proxy lookup queries now use proper indexes (service_id, account_id, stream_id, LOWER(name)). Previously caused 5-second full table scans on every stream start and login, resulting in proxies not being injected.

v1.3.62 — Peacock Territory Fix May 2026

• Fix — Peacock: geo-detection call to init.sky.com removed entirely; territory hardcoded to US. Peacock is a US-only service — dynamic detection was unreliable through datacenter proxies and caused login failures on non-US servers.

v1.3.61 — Peacock Login Hotfix May 2026

• Fix — Peacock: country code detection was running before the proxy was configured, causing non-US servers to get the wrong territory and fail login with 400 Bad Request on auth/tokens. Country code is now resolved after proxy setup.

v1.3.60 — New Services, On-Demand Streams & Bug Fixes May 2026

• New — Stream On-Demand: streams can now be configured to start automatically when a viewer first requests the playlist and stop after a configurable inactivity timeout. Fully opt-in per stream, zero impact on existing streams.
• New — BBC iPlayer script: 9 live channels plus full VOD support (categories, series, episodes, manifests) via BBC mediaselector API.
• New — Joyn script: 10 German live channels (ARD, ZDF, SAT.1, ProSieben, etc.) with DASH/Widevine DRM.
• New — Zattoo script: 307 live channels with email/password auth and automatic token refresh.
• New — CoupangPlay script: Korean streaming service with cookie-based auth, 24/7 live channels, dedicated sports events page, and auto token refresh — users only need to export cookies once every ~6 months.
• Fix — Batch settings: outputFormat and refreshManifestOnRestart now saved correctly; quality settings properly nested so batch saves no longer silently drop video/audio/subtitle quality preferences.
• Fix — SamsungTVPlus: region parameter now wires end-to-end; all supported regions (at/ca/ch/de/es/fr/gb/in/it/kr/us) now work correctly.
• Fix — Peacock: Retry() now tries allowed_methods with fallback to legacy method_whitelist, eliminating TypeError crash on startup for customers with newer urllib3.
• Fix — Peacock: event manifest 400 Bad Request caused by PCKSLE content IDs being incorrectly re-colonised during parsing. Sports event playback now works correctly.
• Fix — Peacock: capabilities payload used wrong keys (v/a) for codecs; API requires vcodec/acodec. Channel manifests now resolve correctly.
• Fix — All service scripts were writing to a spurious netflix_debug.log file in the data directory. Hardcoded debug path removed from the shared logging library.

v1.3.59 — Account Deletion Hotfix May 2026

• Fix — Account deletion no longer removes token files belonging to a different account that shares the same email in a different case (e.g. deleting user@example.com no longer deleted the token file for USER@EXAMPLE.COM). Token file cleanup now uses the exact database-stored username.
• Fix — Account lookup for deletion is now exact-case so deleting one account cannot accidentally target another account with the same email in different capitalisation.

v1.3.58 — NowTV Restart Fix & Account Deletion May 2026

• Fix — NowTV streams failed to restart after first play with SCRIPT_ERROR: the server was passing the username in lowercase to scripts, but token files are keyed by the original account case (e.g. BANGLORE2021@HOTMAIL.COM). The server now resolves the exact account username from the database before spawning scripts.
• Fix — Deleting an account from the Services page now stops all active streams for that account and removes them from the database via cascade. Previously only token files were deleted, leaving orphaned HLS processes and stream records.
• Fix — Script auth failures (Not logged in, session expired) now surface as AUTH_ERROR instead of the misleading SCRIPT_ERROR.
• Fix — When a script exits silently (code 1, empty stderr), the stdout JSON error is now logged and surfaced to the client instead of being discarded.

v1.3.57 — NowTV Stability & Code Quality May 2026

• Fix — NowTV SCRIPT_ERROR on stream restart: token file race condition when starting multiple channels simultaneously caused JSON corruption. Token writes are now atomic (write-to-tmp then rename), and load errors are handled gracefully.
• Fix — NowTV license signature was malformed when the license URL had no query string (/path? instead of /path). This could cause intermittent DRM failures.
• Fix — NowTV token refresh action now persists the refreshed token to disk (was refreshing in memory but not saving).
• Fix — Manifest script output parser now tolerates debug lines before the final JSON object, consistent with the CDM executor path.
• Fix — Service scripts now execute with correct working directory set to the scripts folder.

v1.3.56 — NowTV Token Auto-Refresh May 2026

• Fix — NowTV streams can now be started multiple times without re-login. User tokens (short TTL ~1 hour) are cached on disk and silently refreshed using the long-lived sky cookie. If a token expires mid-session, the manifest step retries once automatically. Users only need to re-login if the sky cookie itself expires.

v1.3.55 — DASH DRM Decryption Fix May 2026

• Fix — CMAF/DASH streams (e.g. NowTV) were playing garbled video because the parallel segment download path checked segment.encrypted instead of segment.streamInfo.encrypted. Individual DASH segment objects inherit encryption state from their parent stream, not directly. Segments are now correctly decrypted via mp4decrypt before muxing.

v1.3.54 — NowTV CDM Key Format Fix April 2026

• Fix — NowTV CDM action now outputs decryption keys in the correct kid:key per-line format that the streaming engine expects. Previously the script output JSON which the server could not parse, resulting in "no valid keys" error when starting streams.

v1.3.53 — NowTV Signing Path Fix April 2026

• Fix — NowTV internal signing API now correctly loads the signing module from the real filesystem path (/opt/xott/scripts/lib/nowtv_sign.js) instead of the pkg virtual snapshot path. Previously the endpoint returned "Signer not available" inside the compiled binary.

v1.3.52 — NowTV Signing Fix April 2026

• Fix — NowTV streams now work on servers without a standalone node binary. The xott server exposes an internal HMAC signing API that the NowTV script calls using the server's own embedded Node.js runtime, eliminating the external dependency entirely.

v1.3.51 — NowTV Stream Fix April 2026

• Fix — NowTV streams: probe and stream start now work. Manifest output was using non-standard field names; corrected to ManifestUrl, LicenseAcquisitionUrl, Pssh, requires_cdm. Channel logos and display names also corrected.

v1.3.50 — NowTV Channels Fix April 2026

• Fix — NowTV channels: fixed 502 error where channels failed to load after login. Territory prefix in token filename was causing username mismatch. Token files now use the standard naming format; territory is stored inside the token and restored automatically.

v1.3.49 — NowTV Multi-Region Support April 2026

• NowTV — Added support for NOW Italy (nowtv.it) and WOW TV Germany (wowtv.de). Territory is auto-detected from the proxy IP, or can be overridden with territory=IT / territory=DE. All three regions share the same signing module and backend stack.
• Fix — NowTV login button now appears correctly on the Services page.

v1.3.48 — NowTV Widevine CDM Support April 2026

• NowTV — Added Widevine CDM decryption support: PSSH extraction from DASH MPD manifests, HMAC-signed license requests via WASM signing helper, and full key retrieval pipeline for live channel playback.

v1.3.47 — Playback Time Display Fix April 2026

• Fix — Playback Time: Fixed timer showing wrong values (e.g. 3+ hours immediately after server restart). For MPEG-TS streams, FFmpeg preserves native broadcast timestamps which can be hours into the broadcast day. The display now uses accumulated segment durations relative to session start — timer always starts at 00:00 and increments correctly.

v1.3.46 — Playback Time Fix April 2026

• Fix — Playback Time: Fixed playback timer freezing on stitched streams (Pluto TV, etc.). The PTS-span method froze lastPts after a PTS reset at a clip boundary. Switched to accumulated ffmpeg segment durations which increment correctly through discontinuities.

v1.3.45 — FPS Calculation Fix April 2026

• Fix — FPS Display: Replaced cumulative PTS-based FPS with per-segment EWMA. The previous method froze lastFramePts after a PTS reset at a discontinuity while the frame count kept growing, causing FPS to inflate to 100+ over time on stitched streams (Pluto TV, etc.).

v1.3.44 — Stitched HLS Stability Fixes April 2026

• Fix — Stitched HLS: Fixed stale encryption flag causing "No decryption key found" crash when a stitched stream (Pluto TV, etc.) transitions from an encrypted clip to an unencrypted one — primary cause of recurring restarts.
• Fix — Stitched HLS: Fixed fMP4 init segment being cleared when the playlist sliding window scrolls past the #EXT-X-MAP tag, causing "moov atom not found" crashes at clip transitions.
• Fix — FPS Display: Fixed inflated FPS values (showing thousands) caused by PTS resets at discontinuity points in stitched streams.

v1.3.43 — fMP4 Format Detection Fix April 2026

• Fix — fMP4 Format Detection: Fixed a bug where fMP4 segments starting with moov/moof boxes were misidentified as MPEG-TS, causing FFmpeg to crash with "Invalid data found when processing input". Resolves stream restarts on Pluto TV and other stitched HLS linear channels.
• Fix — AES-128 HLS: Fixed incorrect zero IV for segments without explicit IV tag (per HLS spec, IV must be the media sequence number).
• Fix — HLS Streams: Resolved fMP4 init segment loss on manifest refresh causing stream restarts.
• Fix — Script Runner: Resolved SSL certificate verification failure on VPS installs.

v1.3.42 — AES-128 HLS Decryption Fix April 2026

• Fix — AES-128 HLS: Fixed incorrect zero IV for segments without explicit IV tag. Per HLS spec the IV must be the media sequence number — resolves stream crashes on Pluto TV and any AES-128 channel with implicit IVs.
• Fix — HLS Streams: Resolved fMP4 init segment loss on manifest refresh causing stream restarts.
• Fix — Script Runner: Resolved SSL certificate verification failure on VPS installs.

v1.3.39 — Stability & Delivery Improvements April 2026

• New — Improved service script delivery system.
• Fix — Resolved API connectivity issue on fresh installations.
• Fix — In-App Updater: Fixed update process leaving the UI broken after refresh.

v1.3.38 — In-App Updater Fix April 2026

• Fix — In-App Updater: Fixed a critical bug where triggering an update from the header would wipe the frontend (client/build) and leave the UI returning a JSON error on refresh. The updater script now correctly changes into the extracted tarball directory before running the installer.

v1.3.37 — Services Page Improvements April 2026

• Fix — Services Auth Buttons: The Pair Device button is now only shown for services that actually support device pairing, removing the redundant button from password/cookie-only services.
• New — Bulk Script Import: The Services page now accepts .zip and .tar.gz archives to mass-import multiple service scripts at once, with a results dialog showing imported/failed counts.
• New — Instant DB Sync on Import: Scripts imported via the UI are immediately registered in the database — no server restart required.
• New — Services Page Notices: Two dismissible info banners added — one about script compatibility and one reminding users to configure a proxy for geo-locked services before authenticating.

v1.3.36 — DirecTV Stream Stability Fixes April 2026

• Fix — DirecTV SSAI: Disabled DAI (dynamic ad insertion) in manifest requests, eliminating backward PTS jumps on local affiliate channels (e.g. ABC) caused by the sponsored CDN stitcher.
• Fix — DRM Key Rotation: Preserved original DRM error codes so the fail-fast handler fires correctly on daily key rotation, reducing stream outage from ~40s to near-zero.
• Fix — PTS Discontinuity Threshold: Backward PTS jumps under 90s are now tolerated as ad-insertion artifacts, halving unnecessary EXT-X-DISCONTINUITY insertions per ad break.

v1.3.35 — YouTube Cookies Support April 2026

• New — YouTube Cookies: Added a dedicated YouTube tab in Settings to paste and manage your cookies.txt file, enabling yt-dlp to access age-restricted and members-only YouTube streams.

v1.3.34 — In-App Updater & YouTube Proxy Fixes April 2026

• Fix — In-App Updater: Completely rearchitected the update mechanism. The updater now works correctly — a root-owned systemd unit handles the actual installation instead of attempting to run it inside the sandboxed app process.
• Fix — YouTube Proxy Assignment: Resolved an issue where assigning a proxy to a YouTube manual stream via the stream settings modal failed silently, causing the stream to start without the proxy.
• Fix — YouTube Stream Start with Proxy: The server now correctly looks up the assigned proxy when resolving a YouTube live stream URL at startup, so bot detection is bypassed properly when a proxy is configured.
• Fix — Stream Proxy Display: The currently assigned proxy URL now loads correctly in the stream settings modal instead of always appearing blank.

v1.3.33 — DGO Fixes & Stream Stability April 2026

• Fix — DGO Token Refresh: Corrected a request header issue that caused 404 errors when refreshing DGO streaming tokens from the service card.
• Fix — DGO Long-Running Streams: DGO streams now automatically re-fetch a fresh manifest on each restart, preventing stream failures after 24–48 hours caused by expired CDN tokens.
• Fix — Stream Monitoring: Resolved an issue where the monitoring loop could become blocked during stream restarts, causing all monitoring ticks to be skipped.
• Improvement — Stream Restart Backoff: Stream restarts now use exponential backoff (up to 30 minutes) with a hard cap on consecutive failures to prevent runaway crash loops on permanently broken streams.

v1.3.32 — Bug Fixes & YouTube Compatibility April 2026

• Fix — Startup Stability: Streams stuck at running in the database after an unclean shutdown are now reset to stopped on service start, preventing crash-loop chains.
• Performance — Non-Blocking Init: Service account status checks now run in the background so the panel is immediately responsive after restart.
• Fix — YouTube Compatibility: The --js-runtimes yt-dlp flag is now version-aware and is only used when the installed yt-dlp version supports it (Python 3.8 / Ubuntu 20 servers no longer fail with "no such option").
• Fix — YouTube Logs: YouTube resolution activity is now written to the structured log files.

v1.3.31 — Performance & Stability Patch April 2026

• Optimization — Database Stability: Fixed major CPU-heavy race conditions and hangs in the proxy management system.
• Stability — Intelligent Initialization: Implemented non-blocking, promise-based locking for background database tasks to prevent server crashes during peak load.
• Fix — Service Monitoring: Corrected inefficient monitoring loops and system calls to reduce global CPU usage by 90% on high-load servers.
• Performance — Enforced Lookups: Guaranteed 3-second timeout on all database-backed proxy resolutions to maintain UI responsiveness.

v1.3.30 — YouTube Live Streams April 2026

• YouTube Live Streams — Paste any YouTube channel /live URL (e.g. https://youtube.com/@CNN/live) into the Add Stream dialog and it auto-resolves to an HLS manifest via yt-dlp. Stream name, channel, and thumbnail metadata are auto-filled. No DRM keys needed.
• Auto token refresh — YouTube HLS tokens expire every ~6 hours. A background timer re-resolves the manifest URL every 4 hours to keep streams alive indefinitely without manual intervention.
• yt-dlp dependency — yt-dlp is now included in requirements.txt and installed automatically during setup/update.
• YouTube resolve API — New POST /api/youtube/resolve endpoint validates YouTube URLs and returns HLS manifest + metadata via yt-dlp.

v1.3.29 — Installer Fixes April 2026

• Fix — PostgreSQL extensions (uuid-ossp, pg_trgm) now created as superuser before schema is applied — previously caused missing tables and Server Error on login on fresh installs
• Fix — Installer now creates the data/config directory so settings can be written on first boot
• Fix — JWT_SECRET and SESSION_SECRET now generated with 256-bit entropy on fresh install instead of being left blank

v1.3.28 — Critical Hotfix April 2026

• Hotfix — Reverted H264 SPS/PPS BSF filter introduced in v1.3.27 that caused constant ffmpeg restarts on DirecTV and other services with non-standard H264 extradata
• Fix — Stream restart no longer deletes the HLS output directory, preventing downstream consumers (xAccel, headends) from getting 404s during CDN token reconnects
• Fix — Installer now detects Python version mismatch after OS upgrades (e.g. Ubuntu 20→22) and rebuilds the venv automatically

v1.3.27 — HLS Output Stability Fixes April 2026

• Fix — HLS output now injects H264 SPS/PPS context before every keyframe, eliminating "Packet corrupt (dts=NOPTS)" drops in downstream encoders (xAccel, headend systems) that connect mid-stream
• Fix — HLS playlist minimum buffer increased from 10 to 20 segments (~120s), reducing stream interruptions to downstream consumers during upstream CDN token refreshes
• Fix — License validation result is now cached in-memory for 60 seconds, eliminating per-request writes to the database that caused background write pressure and excessive log noise

v1.3.26 — Performance Optimizations April 2026

• Performance — Proxy lookups are now cached (30s TTL), eliminating repeated slow database queries on every stream start and recovery — dramatically reduces DB load when starting many streams simultaneously
• Performance — Monitoring loop now batches all stream PID checks into a single system call instead of spawning one process per stream

v1.3.24 — Stream Library Fixes & Live Sync April 2026

• Bulk delete fix — The confirmation dialog in the Stream Library no longer shows "undefined streams" when deleting multiple streams at once.
• Channel name protection — Channel names stored in the library are now protected from being overwritten by generic placeholder names (e.g. "Channel ...") during refresh or re-import.
• Live API sync — The Refresh button on the Streams page now syncs your library against the live service APIs: changed channel names are updated automatically and dead channels that no longer exist are removed.
• Hotfix — Resolved a startup crash introduced in v1.3.20.

v1.3.19 — DGO Multi-Stream Auth Fix April 2026

• DGO concurrent stream fix — Channels like WIN Fútbol+ and DSPORT+ would fail with AUTH_ERROR when another DGO channel was already streaming. The DGO script now correctly falls back to the assetToken authentication path using the SM DGO token when the authorizer session limit is reached, allowing multiple DGO channels to run simultaneously.

v1.3.18 — Primary Audio Fix for Inactive Streams April 2026

• Primary audio for inactive streams — A "Primary Audio" dropdown now appears below the audio track selector when 2 or more tracks are chosen on an inactive stream, allowing you to set the default language before the stream starts. Previously this option was only available while a stream was actively running.

v1.3.17 — Primary Audio Track Selection April 2026

• Primary audio track — When multiple audio tracks are manually selected in stream settings, click ★ next to any track to mark it as primary. The primary track is placed first in the muxed output and flagged as default so downstream players always start on the correct language (e.g. Spanish over English).

v1.3.16 — Batch Start Throttling April 2026

• Batch concurrency throttled — Stream batch start concurrency reduced from 8 to 4 simultaneous starts, with a 500ms pause between groups. Prevents DB connection pool exhaustion and event loop saturation during recovery of large installations (80+ streams).

v1.3.15 — Crash Fix & Stream Start Optimisation April 2026

• Critical crash fix — A database connection pool timeout in the proxy lookup path was an unhandled promise rejection that killed the Node.js process. The lookup now fails gracefully (stream continues without proxy), and a global unhandled rejection handler ensures no future transient DB error can crash the server.
• Service & account ID caching — Service and account IDs were re-fetched from the database on every single stream start. These are now cached in memory after the first lookup, eliminating 2 redundant DB queries per stream restart on large installations.

v1.3.14 — Batch Start Performance Fix April 2026

• Batch stream start optimisation — When starting multiple streams at once, settings were fetched from the database individually for each stream. All stream settings are now pre-loaded in a single bulk query before the batch begins, eliminating connection pool exhaustion and DB timeout errors on large installations (80+ streams).
• Installer safe-mode default — The installer now auto-detects an existing installation and defaults to Update mode, preventing accidental data loss when the installer is run non-interactively or the prompt times out.

v1.3.13 — Critical DB Load Fix (High Stream Count) April 2026

• Settings read caching — Application settings were re-fetched from the database on every authenticated request, every stream restart, and every license check. Settings are now cached in memory for 10 seconds, eliminating thousands of redundant DB round-trips per minute on busy servers (80+ streams).
• Streams table poll interval — The dashboard streams table was polling the database every 2 seconds with a heavy 109-row JOIN query. Default interval raised to 10 seconds, reducing that query load by 5×.

v1.3.12 — Performance & Stability Fix April 2026

• Server CPU spike fix — Unconditional database query logging was firing on every single query, saturating the Node.js event loop under heavy stream load (80+ streams). In production, only slow queries (>500ms) are now logged.
• JWT caching fix — The JWT secret was being re-fetched from the database on every authenticated request. It is now cached in memory for 5 minutes, significantly reducing database load on busy servers.

v1.3.11 — In-App Auto-Update April 2026

• In-app update notifications — When a new version is available, a notification badge appears in the header. Click it to see the changelog and update with one click — the server downloads the installer, applies it, and the page reloads automatically when the server is back up.
• DGO — track probe now works — Probing tracks from the stream settings modal was failing with a geo-block error. Fixed.

v1.3.10 — DGO Probe Fix April 2026

• DGO — track probe now works correctly — Probing tracks from the stream settings modal was failing with a geo-block error because the manifest fetch used no proxy. The probe endpoint now always resolves the service/account proxy for the manifest fetch regardless of stream proxy settings.

v1.3.9 — DGO Streaming & UI Fixes April 2026

• DGO — channels now load after adding account — Multiple token acceptance fixes: the login handler now recognizes all DGO token formats including bare payloads, cookie arrays, JSON objects, and any token with standard DGO fields. A final fallback ensures no valid token is rejected.
• DGO — streams now start correctly — The DRM license request now uses the configured proxy (required for geo-restricted Latin American content). Additionally, the DASH manifest fetch now always uses the account/service proxy regardless of the "Stream Proxy Fallback" toggle — segments still respect that toggle.
• Service login instructions now visible — Step-by-step login instructions defined in service scripts (e.g. DGO's 3-option cookie/token guide) now appear in the Add Account and Update Credentials dialogs.

v1.3.8 — DGO Update Credentials Fix April 2026

• DGO — "Update Credentials" now works correctly — Updating an existing DGO account's token via the Update Credentials button was silently failing because the token JSON normalizer fix was only applied to the Add Account flow. The Update Credentials endpoint now also passes token objects (id_token, refresh_token, etc.) through unchanged without corrupting them into cookie strings.

v1.3.7 — DGO Login & Channel Fix April 2026

• DGO — channels now load after cookie login — After adding a DGO account via token/cookie, the channel list was always empty. The script now correctly reads the channel list from the SM DGO token stored during cookie login instead of only looking at the Toolbox OIDC token (which is only available after device pairing).
• DGO — all token paste formats now accepted — The login now correctly handles: raw JWT, JSON object with id_token + refresh_token, browser localStorage display format (sessionToken:"eyJ..."), cookie arrays, and bare base64 payload tokens. Previously several of these formats were silently rejected.
• DGO — token JSON no longer corrupted before reaching the script — A server-side cookie normalizer was converting JSON token objects (e.g. {"id_token":"...","refresh_token":"..."}) into a cookie string before passing to the script, destroying the structure. It now passes token objects through unchanged.

v1.3.6 — Bulk Stop Fix April 2026

• Bulk stop now works correctly — Stopping 50+ channels via the batch operation now actually stops the streams. Previously the stop was reported as successful immediately without waiting for streams to actually terminate, causing channels to appear stopped in the UI while still running. The fix properly awaits each stop and processes them in parallel batches of 8.

v1.3.5 — Performance Fix: Server CPU & Zombie Process Elimination April 2026

• Eliminated zombie processes during stream monitoring — The system metrics check previously spawned a top -bn1 shell command for every active stream on every monitoring cycle. With 50+ streams, this created dozens of simultaneous subprocesses causing high CPU usage and zombie process accumulation. Metrics are now read directly from /proc/stat and /proc/meminfo (instant file reads, no subprocess) and cached for 5 seconds with promise coalescing — all concurrent calls share a single read.
• Database dead tuple cleanup — Performed VACUUM ANALYZE on all core tables to remove dead tuple bloat that was slowing down queries. The system_config table had 46 dead tuples versus 4 live rows, causing significantly slower reads at startup and during license verification.

v1.3.4 — Dashboard Fixes April 2026

• Dashboard — fast first load — The dashboard no longer takes up to a minute to load on first visit or after a server restart. Channel counts are now fetched in parallel batches of 6 instead of one-by-one, and the backend summary endpoint runs library, proxy, and VOD counts concurrently instead of sequentially.
• Dashboard — auto-refresh removed — The dashboard no longer visually reloads every time the user switches tabs or after 30 seconds. Tab-switch now only updates the active stream count silently. A full silent refresh of all counters happens in the background every ~2 minutes without any visible flash or spinner.
• Dashboard — events counter now populates automatically — The Events and Active Events counters no longer stay at 0 after a server restart. The dashboard now warms the events cache in the background on first load and updates the counters automatically without requiring a manual refresh.

v1.3.3 — Performance & UX Improvements April 2026

• Bulk channel start — major speed improvement — Starting 50+ channels is now significantly faster. Database queries per stream were reduced from ~7 to ~1 by adding a 30-second in-memory cache for proxy lookups (service, account, and stream-level). Duplicate settings loads are also eliminated by passing pre-loaded settings directly to the stream engine.
• Bulk start concurrency raised from 3 to 8 — Streams are now started 8 at a time (up from 3), cutting wall-clock time for large batches by more than half. Applies to both batch start and batch restart.
• Streams table — service filter fixed — The "Service" dropdown in the Streams table now correctly lists all services when the channel cache is warm. Previously the filter showed only "All Services" and "My Streams" on page load because service names were not extracted from the cache.
• DGO & Netflix — guided cookie setup — The Add Account and Update Credentials dialogs for cookie-based services (DGO, Netflix) now display a clear step-by-step instruction panel explaining exactly where to find the token or cookies in the browser. DGO shows three options: raw JWT, JSON with auto-refresh, or cookie export. Netflix shows the EditThisCookie flow. Field labels and placeholders are service-specific.
• Server page — network interface error fixed — The Server page no longer shows "Failed to fetch server information" on hardened systems. The systemd service unit now grants AF_NETLINK access, which libuv requires internally when enumerating network interfaces.

v1.3.2 — DGO & Streams Fixes April 2026

• DGO — All channels now listed — Fixed a 50-channel hard limit that silently cut off the remaining channels when an account had more than 50 (e.g. 123 total). Channels are now fetched in batches so the full list is always returned.
• DGO — Auto token refresh — The SM DGO session token is now automatically refreshed before it expires (30-minute threshold). Provide a {"id_token":"eyJ...","refresh_token":"eyJ..."} JSON object at login to enable unattended renewal for up to 90 days.
• Streams — Deleted account channels removed — Channels belonging to a deleted account are now immediately removed from the Streams table instead of persisting until the 2-hour cache expired.

v1.3.1 — Max Service & Events Fixes April 2026

• Max — Device pairing fixed — Pairing no longer gets stuck at "Step 3: Wait for automatic activation". The pair context is now saved to a separate file that the server's cleanup routine cannot delete, eliminating the race condition that caused workers to find no pairing context.
• Max — VOD playback fixed — Resolved a 400 Bad Request from the Max playback API caused by unsupported capabilities.video and capabilities.audio fields. The payload now only includes manifests and contentProtection as required by the API schema.
• Max — Live events implemented — The Events page now lists live and upcoming sports events from the Max sports/live CMS routes, including correct Sport and League labels.
• Max — Event live/upcoming status corrected — Events with videoType=LIVE that have not yet started are now correctly marked as Upcoming rather than Live, based on their broadcast start time.
• Max — Improved playback error messages — The script now parses Max API error codes from the response body, distinguishing geo-block errors from subscription/entitlement errors instead of showing a generic GEO_BLOCKED message.
• Max — Live event manifest resolution — Fixed incorrect edit ID resolution for live events; the script now falls back to the direct video endpoint when the show endpoint returns no result, ensuring live content IDs are correctly resolved before the playback request.

v1.3.0 — DGO Service & Proxy Engine Improvements April 2026

• DGO (DirecTV GO) — Full Widevine DRM support — Streams now play end-to-end using the SM DGO authorizer flow, which returns pre-tokenized Akamai CDN manifest URLs and an IP-locked DRM authorization JWT. Widevine keys are extracted automatically via the CDM action.
• DGO — Cookie/token login — DGO now uses a cookie-based login (like Netflix). Paste the SM DGO JWT from your browser's Network tab or an EditThisCookie export directly into the login dialog — no pairing code required for streaming accounts.
• DGO — Device code pairing fixed — The device code and token polling endpoints now correctly use Basic auth, resolving the INVALID_APIKEY error that broke pairing.
• DGO — Token auto-refresh — If a SM DGO refresh_token is stored, the script automatically renews the session token before it expires without user intervention.
• Proxy engine — Account proxy now passed to all scripts — spawnPythonScript (used for CDM, manifest, channels, and all other script actions) now resolves the account-level proxy in addition to the service-level proxy. Previously, CDM license requests did not receive the account proxy, causing DRM failures when "Use proxy for streams" was disabled.

v1.2.0 — Bug Fixes & DRM Support April 2026

• DRM streams — Bento4 (mp4decrypt) is now automatically installed; services like DirecTV with encrypted streams now work out of the box.
• Python environment — Scripts now correctly use the virtual environment Python so all required packages (curl_cffi, pycurl, etc.) are available.
• Stream access — Fixed a false-positive in the integrity check that incorrectly blocked all stream operations after license activation.
• Installer — Fixed admin password not being applied at install time; the password shown at the end now matches what you log in with.
• Installer — Resolved dependency installation failure on Ubuntu 22 caused by libcurl package conflicts; nodejs/npm no longer required.
• Installer — Fixed WebAssembly crash on startup caused by the 2 GB virtual memory limit in the systemd service.
• Email delivery — License keys are now automatically emailed to customers after successful payment.
• Stream naming — Fixed a bug where streams that fail to start would get renamed to "Unknown Channel" in the database and UI; the original channel name is now preserved across retries and restarts.

v1.1.68 — Performance & Stability Update April 2026

• Streams page — Channels now load from a local cache (2-hour TTL) so navigating back to the Streams page is instant; cache is refreshed on manual refresh.
• Batch operations — Stop/Restart now run in the background; the panel responds immediately and operations continue safely even if you refresh or close the page.
• Events auto-start — Fixed duplicate stream launches; auto-start now only triggers for events that newly become live, not on every status poll.
• Parallel batch processing — Batch stop/restart use concurrent processing (up to 3 streams at a time) instead of sequential queuing, reducing completion time significantly for large batches.
• Events page — Fixed missing UI imports that caused rendering issues in the events skeleton loader.
• Installer — Rewritten to be clean and silent; now displays the panel URL and admin credentials at the end of installation.

v1.1.0 — xUI Integration & VOD February 2026

• xUI panel integration — import streams and accounts directly from xUI.
• VOD page with on-demand stream management.
• HLS player built into the panel for live preview.
• Database management page for direct SQL inspection.
• Horizontal navigation layout option.
• Dark/light theme toggle with system preference detection.

v1.0.0 — Initial Release January 2026

• Multi-service IPTV stream management (ESPN, Hulu, Fubo, Sling, Peacock, Pluto, and more).
• HLS re-streaming with FFmpeg and proxy support.
• Live events tracking with schedule-based stream control.
• Proxy management dashboard.
• Stream monitoring and health checks.
• Structured logging with real-time log viewer.