v0.33.284-master.4 — Android: next song plays with the screen locked, plus lock-screen controls

PRIMER.md

@@ -824,6 +824,7 @@ Automatic, from the show's location; there is no setting. `lib/units.js` reverse
 | 0.33.284-master.1 | **Show directory admin page.** Why: the maintainer needed a way to remove shows from the app's directory and to diagnose shows that don't appear. In `tools/install-counter` (the directory server, not the ShowPilot app): new `/admin` page (`admin/index.html`), off unless the counter runs with `ADMIN_KEY`; the page sends the key as a Bearer header to `/api/admin/*` (timing-safe compare; 20 wrong keys in 15 min locks the admin API, counted globally since the counter never looks at IPs). `directory.js`: new `shows_blocked` table (blocked check-ins get 403 with a message the owner sees as "Not listed: …" in Settings → ShowPilot App) and `shows_rejects` (latest refused check-in per install with reason and repeat count; cleared on the next good check-in, purged after 30 days); `shows.verify_error` records a failed re-verification the grace period let through. Admin API: overview (every show with live / online / not checking in / dropped status), live Check (show-info + listing ID, viewer page, `/api/now-playing-audio` at the listed pin; re-verifies on success), Remove (comes back on next check-in if still listed), Block / Unblock, Dismiss. The page also runs the public `/nearby` and `/directory` endpoints for any point ("What a phone sees here"). `fetchShowInfo` generalized to `fetchFromShow` (same private-address refusal). Deploy: copy the folder to the counter host and restart with `ADMIN_KEY`. Checked: `node --check` on both files and the page script; ran the counter against a fake show (accepted, mismatched-ID and private-address check-ins, block → 403, show-info down) and screenshotted the page at desktop and phone width. Main only (directory server isn't in Lite). |
 | 0.33.284-master.2 | **Directory admin: username/password sign-in, clearer layout, unblock no longer loses the show.** Why: the maintainer found unblocking removed the show (block deleted its listing row, so it only came back on its next check-in), the page ran together, and a shared key isn't a login. `admin-auth.js`: users in `admin_users` (scrypt hashes), added on the server with `node admin-user.js add <name>` (hidden prompt; `list`, `remove`); no sign-up page; `/admin` is off until a user exists. Sign-in sets an HttpOnly Secure SameSite=Strict cookie (14 days; sessions stored hashed); changes also need `X-Requested-With: ShowPilotAdmin`; 5 wrong passwords per username / 30 overall per 15 min lock sign-in; changing a password signs that user out everywhere. `ADMIN_KEY` is retired. `directory.js`: block keeps the listing row and the public endpoints and counts skip blocked shows, so unblock restores the show at once. `admin/index.html` rebuilt: sign-in screen, sticky top bar with user menu (auto-refresh, change password, sign out), stat tiles, each show its own card with a status stripe and pill, now-playing / address / web address lines, a labelled facts panel, check results as a list; refused and blocked shows as cards too. Checked: `node --check` on all four files and the page script; ran the counter locally: user add (terminal and piped), wrong and right password, missing header 403, block hides from `/nearby`, blocked check-in 403, unblock returns it immediately, sign-out; screenshots light/dark/phone. Main only (directory server). |
 | 0.33.284-master.3 | **MultiSync remote warning only while the show runs.** The Dashboard's show-player strip went amber with "<remote> (MultiSync remote) not seen recently" even with the show idle, and often for a remote that was fine: when the player doesn't ask remotes directly, ShowPilot goes by FPP's MultiSync `lastSeen`, which FPP refreshes only now and then, and counted a remote missing after 2 minutes. `lib/fpp-monitor.js`: lastSeen-only remotes now count as online for 10 minutes (`LASTSEEN_ONLINE_S = 600`), and the missing-remote warning (both "not seen recently" and "isn't answering") is raised only while the show is playing, paused or testing. Remote temperature warnings are unchanged. Main only (the FPP Monitor isn't in Lite). Checked: `node --check`; health() with an idle/playing show and a remote last seen 5 or 20 minutes ago, or asked with no answer (before: warned in every case; now: only playing + 20 min, and playing + no answer); FPP Monitor scenario tests updated (offline remote while idle = ok, while playing = warn) and 12/12 FPP scenarios pass. |
+| 0.33.284-master.4 | **Phone audio: next song starts with the screen locked (Android), plus lock-screen controls.** Contributed in PR #76 by dev8edss. (1) Keep awake: Chrome on Android throttles a hidden tab once it stops making sound, and the -80 dBFS keep-alive DC level is under Chrome's ~-72 dBFS audible threshold, so the 1 s poll and song-change timers stalled between songs until the screen came back on. While the player is open and not paused the existing `ConstantSourceNode` is ramped to -60 dBFS (`setKeepAwake()`), back to -80 dBFS on Pause and 10 min after the show stops (`scheduleKeepAwakeStop()`). Android only by default; `?keepawake=0/1`. A second `startup()` on the same context now stops the earlier keep-alive source instead of stacking it. (2) Media Session: a looping silent 8 kHz WAV `<audio>` anchor (made in the page, carries no music, so sync is unchanged) lets the browser show a media notification with title, artist, cover, show name and progress; Play/Pause only, seek/skip disabled. Pause between songs sets the paused state directly. On by default where Media Session exists except iPhone/iPad; skipped inside the ShowPilot app; `?mediasession=0/1`. Player cache-buster 155. Checked: `node --check`; review confirmed every referenced player variable/function exists on main, no network calls or external URLs. Keep-awake tested by the contributor on a live Android server; Media Session not yet tested on a real phone. Credit: dev8edss. Main only (audio). |
 
 **Plugin version history (this session):**
 | Version | Change |

lib/viewer-renderer.js

@@ -1383,7 +1383,7 @@ ${visitorMessages.BOX_CSS}${showButtons.CSS}</style>
   <script>window.__SHOWPILOT__ = ${JSON.stringify(bootstrap)};</script>
   <script src="/socket.io/socket.io.js"></script>
   ${cfg.debug_mic_measure === 1 ? '<script src="/sp-mic.js?v=4"></script>' : ''}
-  <script src="/rf-compat.js?v=154"></script>
+  <script src="/rf-compat.js?v=155"></script>
   `;
   if (html.includes('</body>')) {
     html = html.replace('</body>', injection + '</body>');

package.json

@@ -1,6 +1,6 @@
 {
   "name": "showpilot",
-  "version": "0.33.284-master.3",
+  "version": "0.33.284-master.4",
   "description": "Self-hosted light show viewer control server. Falcon Player (FPP) plugin compatible. Replaces Remote Falcon for self-hosters.",
   "main": "server.js",
   "scripts": {

public/admin/index.html

@@ -2112,7 +2112,7 @@ <h1>ShowPilot <span class="login-brand-sub">Admin</span></h1>
           <rect class="lp" x="8"   y="-3"  width="5" height="5" rx="1"/>
         </svg>
         <span class="app-brand-text">ShowPilot</span>
-        <span class="app-version">v0.33.284-master.3</span>
+        <span class="app-version">v0.33.284-master.4</span>
       </span>
       <span id="modePill" class="mode-pill off">OFF</span>
       <span class="header-spacer"></span>