@torrent-tv/proxy 2.89.19 → 2.89.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.89.19",
+  "version": "2.89.20",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {

package/services/encode/output/cut-grid.js

@@ -105,3 +105,38 @@ export function computeCutGrid({ useKeyframeGrid, durationSeconds, segDur, keyfr
   // all, and an even one serves better than a table with a single entry.
   return boundaries.length >= 2 ? { boundaries, sourceTimes } : uniform();
 }
+
+/**
+ * Whether an output is cut at times we hand the muxer, rather than at a
+ * duration the muxer chooses for itself.
+ *
+ * One answer for the command a run is given and for the serving of what it
+ * made, because both follow from it: given times mean the `segment` muxer,
+ * which writes each piece self-contained under a working name and says when it
+ * has closed it; without them the `hls` muxer names its pieces itself and
+ * writes one init file beside them.
+ *
+ * Every grid is handed over, the even one included. The `hls` muxer finishes
+ * the piece it has open whenever it ends — on our SIGTERM, and when its input
+ * stops — and gives that piece its served name, so a piece shorter than its
+ * span became servable with nothing to say so. Field 2026-09-27, on the
+ * `segment` muxer before its own guard existed: a run stopped while it wrote
+ * #111 left 0.37 s of a 4.2 s piece, the browser appended it, counted the
+ * fragment as loaded and went on to the next one, and the picture stood at
+ * 463.3 s while the player fetched 515.7 s and beyond.
+ *
+ * What is left without times is an output with no grid at all, which has no
+ * duration to cut.
+ *
+ * @param {{ segmentFormat?: { explicitTimesMuxerArgs?: () => string[] | null } | null,
+ *   timeline?: { published?: number[], boundaries?: number[] } | null }} output
+ * @returns {boolean}
+ */
+export function cutsAtGivenTimes(output) {
+  if (!output?.segmentFormat?.explicitTimesMuxerArgs?.()) {
+    return false;
+  }
+  const published = output.timeline?.published;
+  const grid = Array.isArray(published) && published.length > 0 ? published : output.timeline?.boundaries;
+  return Array.isArray(grid) && grid.length >= 2;
+}

package/services/encode/output/index.js

@@ -1,5 +1,6 @@
 export { OutputSpec, VideoOutput, AudioOutput, CutGrid, isOutputName } from "./OutputSpec.js";
 export { PLAYLIST_FILE_NAME } from "./playlists.js";
+export { cutsAtGivenTimes } from "./cut-grid.js";
 
 // FFmpeg may close a segment this far before its requested cut. Both the
 // command and coverage validation use this existing muxer configuration.

package/services/encode/run-command.js

@@ -17,7 +17,7 @@
 
 import { PLAYLIST_FILE_NAME } from "./output/playlists.js";
 import { AUDIO_TRANSCODE_KBPS } from "./args.js";
-import { SEGMENT_CUT_TIME_DELTA_SECONDS } from "./output/index.js";
+import { cutsAtGivenTimes, SEGMENT_CUT_TIME_DELTA_SECONDS } from "./output/index.js";
 
 /**
  * What ffmpeg's own CLI subtracts from an input seek, and therefore what has to
@@ -364,15 +364,26 @@ export function buildRunCommand({
   // the first requested cut. It is never published over another run's output.
   const inputIndex = !transcodeVideo && !audioOnly && explicitTimes && safeIndex > 0
     ? safeIndex - 1 : safeIndex;
-  // A COPY is cut by this list whatever grid it ended up on. Even when no
-  // keyframe index could be read and the boundaries are a plain grid, saying
-  // them outright is what keeps the playlist and the muxer agreeing — ffmpeg
-  // moves each cut forward to the first real keyframe, and serving reads back
-  // where the piece truly begins. Requiring a keyframe grid here dropped a
-  // copy with no index onto the `hls` muxer, which takes no cut list and
-  // writes no self-contained pieces, so nothing could read a true start and
-  // segments were stamped with times the file does not have — the 4.17 s
-  // speech-against-subtitles drift, back again.
+  // EVERY OUTPUT WITH A GRID is cut by this list, whatever the grid is and
+  // whether the picture is copied or re-encoded (`cutsAtGivenTimes`).
+  //
+  // A copy needs it even when no keyframe index could be read and the
+  // boundaries are a plain grid: saying them outright is what keeps the
+  // playlist and the muxer agreeing — ffmpeg moves each cut forward to the
+  // first real keyframe, and serving reads back where the piece truly begins.
+  // Requiring a keyframe grid here dropped a copy with no index onto the `hls`
+  // muxer, which takes no cut list and writes no self-contained pieces, so
+  // nothing could read a true start and segments were stamped with times the
+  // file does not have — the 4.17 s speech-against-subtitles drift, back again.
+  //
+  // A re-encode on the even grid needs it for the proof of a closed piece. The
+  // `hls` muxer finishes the piece it has open whenever it ends, on our SIGTERM
+  // and when its input stops, and renames it to the served name itself, so a
+  // stopped run left a piece shorter than its span where any request could
+  // take it. Measured 2026-10-05 with ffmpeg 8.1.2 on the addon host, a
+  // 4 s piece stopped 3 s in stayed as `segment-00001.mp4` with 3.04 s in it.
+  // Through the `segment` muxer the piece is published only on the encoder's
+  // word and only after its media is shown to reach its cut.
   //
   // Cut on the grid the PLAYER WAS GIVEN, not on the corrected one. A player
   // places a fragment by the playlist it holds, and that text was written
@@ -387,7 +398,7 @@ export function buildRunCommand({
   // created later inherits the corrected table and PUBLISHES it, so its own
   // playlist and its own cuts agree from the start. What they may not do is
   // move the cuts of a session whose playlist is already being read.
-  const gridCutTimes = explicitTimes && (!transcodeVideo || timeline.cutGrid === "keyframe")
+  const gridCutTimes = cutsAtGivenTimes({ segmentFormat, timeline })
     ? segmentCutTimesFrom(publishedGridFor(timeline), inputIndex)
     : null;
   // Cut times are stated on the grid, for both branches.
@@ -721,9 +732,10 @@ export function buildRunCommand({
       // into the same directory — and the name arrives on the channel above the
       // instant ffmpeg closes it, which is what turns it into the served one.
       //
-      // The other branch needs none of this: the HLS muxer writes through a
-      // temporary name of its own (`+temp_file`), so its files appear under
-      // their final name whole.
+      // The other branch cannot do this: the HLS muxer writes through a
+      // temporary name of its own (`+temp_file`) and renames each file itself,
+      // including the one it was writing when it ended. It is left for the runs
+      // that have no cut list at all.
       //
       // TAGGED WITH THE STRETCH IT WAS GIVEN, which names the run without any
       // counter to keep: intervals never overlap, so two live runs of one output

package/services/server/OutputLifecycle.js

@@ -8,7 +8,7 @@
  */
 
 import { logger } from "../../utils/logger.js";
-import { isOutputName } from "../encode/output/index.js";
+import { isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
 import { IDLE_KEEP_MS } from "../storage/keep.js";
 /**
  * How long produced segments are kept after the last request for them.
@@ -273,7 +273,12 @@ export class OutputLifecycle {
   adoptSegmentsLeftBehind() {
     // Which container the segments are in is stated by the key itself; a key
     // that cannot say is a directory that goes (`encode/output-key-format.js`).
-    return this.#host.segmentStore.adoptWhatSurvived((key) => this.#host.segmentFormatOfKey(key));
+    // The `hls` muxer writes its own list, under the playlist's name, beside the
+    // pieces it named itself; none of those pieces is proven whole.
+    return this.#host.segmentStore.adoptWhatSurvived(
+      (key) => this.#host.segmentFormatOfKey(key),
+      { selfNamedListFileName: PLAYLIST_FILE_NAME }
+    );
   }
 
   /**

package/services/server/SegmentServing.js

@@ -13,7 +13,7 @@ import { access, readFile, stat, unlink } from "node:fs/promises";
 import { Readable } from "node:stream";
 import path from "node:path";
 import { logger } from "../../utils/logger.js";
-import { isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
+import { cutsAtGivenTimes, isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
 // The index of variants. Served from the same route as the media playlist, so
 // it needs no path of its own.
 export const MASTER_PLAYLIST_FILE_NAME = "master.m3u8";
@@ -50,25 +50,6 @@ function isSafeFileName(fileName, segmentFormat) {
     segmentFormat.isSegmentFileName(fileName)
   );
 }
-/**
- * Whether this output is cut at times we hand the muxer, rather than at a
- * duration it chooses for itself.
- *
- * A property of the output and not of a run: the cut grid and the branch decide
- * it, so every run of one output answers alike. It decides how a segment is
- * judged finished — see getFileStream.
- *
- * @param {object} session
- * @returns {boolean}
- */
-function cutsAtGivenTimes(session) {
-  const explicit = session?.segmentFormat?.explicitTimesMuxerArgs?.() ?? null;
-  if (!explicit) {
-    return false;
-  }
-  return !session.spec.transcodesVideo || session.timeline?.cutGrid === "keyframe";
-}
-
 export class SegmentServing {
   /** Serving state keyed by the output object it belongs to. */
   #states = new WeakMap();
@@ -275,14 +256,12 @@ export class SegmentServing {
       return this.#holdForProduction(session, fileName, isPlaylist, options);
     }
     try {
-      // Existing is not the same as finished. The `hls` muxer wrote each
-      // segment to a temporary name and renamed it once complete, so a file
-      // appearing WAS a finished segment. The `segment` muxer has no such
-      // option: the file appears when writing begins. Serving it then hands the
-      // player a truncated segment, which it rejects and then simply stops —
-      // observed as playback dying a few seconds in with the encoder still
-      // running happily ahead. A segment is finished once the NEXT one has been
-      // started, or once the run producing it has ended.
+      // Existing is not the same as finished. The `hls` muxer writes each
+      // segment to a temporary name and renames it when it ends the segment —
+      // at its cut, but also on SIGTERM and when its input stops, so a file
+      // appearing there proves only that the muxer let go of it. Every output
+      // with a grid is therefore cut by the `segment` muxer, whose file appears
+      // when writing begins and is served only once it is published below.
       if (!isPlaylist && cutsAtGivenTimes(session)) {
         // WHAT PROVES A PIECE IS WHOLE is the encoder's own word for it: it
         // names each file on a channel of its own the moment it closes it, and

package/services/storage/segment-store/SegmentStore.js

@@ -403,6 +403,74 @@ export class SegmentStore {
     return removed;
   }
 
+  /**
+   * Remove the pieces a muxer that names its own pieces left in a directory,
+   * and the list it named them in.
+   *
+   * Asked only of what a previous life of the process left. The `hls` muxer
+   * renames the piece it has open when it ends, so a stopped run leaves a
+   * piece shorter than its span under the served name — the shape of field
+   * 2026-09-27, where #111 held 0.37 s of 4.2 s, the browser appended it and
+   * never asked for that stretch again. The list cannot say which piece is the
+   * short one, so every piece it names goes and is made again.
+   *
+   * @param {string} key
+   * @param {string} dir
+   * @param {{ isSegmentFileName?: (name: string) => boolean, initFileName?: string | null }} format
+   * @param {string | null} listFileName
+   * @returns {number} How many pieces were removed.
+   */
+  #sweepSelfNamed(key, dir, format, listFileName) {
+    if (!listFileName) {
+      return 0;
+    }
+    const listPath = path.join(dir, listFileName);
+    let text;
+    try {
+      text = readFileSync(listPath, "utf8");
+    } catch {
+      return 0;
+    }
+    let removed = 0;
+    for (const line of text.split(/\r?\n/)) {
+      const name = line.trim();
+      if (name.length === 0 || name.startsWith("#") || !format?.isSegmentFileName?.(name)) {
+        continue;
+      }
+      const piecePath = path.join(dir, name);
+      if (!existsSync(piecePath)) {
+        continue;
+      }
+      try {
+        rmSync(piecePath, { force: true });
+        removed += 1;
+      } catch {
+        // Then it stays, and is served as it was before this sweep existed.
+      }
+    }
+    // The list goes with the pieces it named, and so does the init file the
+    // same muxer wrote beside them: nothing else writes one into this
+    // directory, and a piece cut by the list carries its own header.
+    for (const leftover of [listFileName, format?.initFileName]) {
+      if (!leftover) {
+        continue;
+      }
+      try {
+        rmSync(path.join(dir, leftover), { force: true });
+      } catch {
+        // It names or describes pieces that are gone; reading it again removes nothing.
+      }
+    }
+    if (removed > 0) {
+      this.#held.delete(key);
+      this.#logger.info(
+        `segment-store removed ${removed} piece(s) of ${path.basename(dir)} that the hls muxer ` +
+        "named itself: nothing proves they reach their cut"
+      );
+    }
+    return removed;
+  }
+
   /**
    * The encoder has closed a piece: give it the name it is served under.
    *
@@ -564,10 +632,11 @@ export class SegmentStore {
    * muxer writes under a working name and reports the closure on a channel of
    * its own (`publish`); the `hls` muxer writes through a temporary name of its
    * own (`+temp_file`) and reports nothing, so the file simply appears under the
-   * name it is served as. That branch is taken by every re-encoded output on the
-   * even grid — the ordinary quality step — and for those `waitFor` could only
-   * end on its deadline: the segment was on disk and the request that wanted it
-   * went on waiting, up to a full minute, and was then answered 503.
+   * name it is served as. That branch was then taken by every re-encoded output
+   * on the even grid — the ordinary quality step — and for those `waitFor` could
+   * only end on its deadline: the segment was on disk and the request that
+   * wanted it went on waiting, up to a full minute, and was then answered 503.
+   * It is now taken only by a run given no cut list.
    *
    * So the store watches what it owns. The rename into place moves the
    * directory's modification time, the kernel says so, and both branches reach
@@ -1243,9 +1312,12 @@ export class SegmentStore {
    * @param {(key: string) => object | null} formatFor - How to read the file
    *   names of an output, given its key. Null when this proxy cannot serve that
    *   output at all, and then the directory goes.
+   * @param {{ selfNamedListFileName?: string | null }} [writers] - The list a
+   *   muxer that names its own pieces writes beside them. Every piece in it was
+   *   given its served name by that muxer and not by a closure we were told of.
    * @returns {{ adopted: number, dropped: number, unprovenRemoved: number }}
    */
-  adoptWhatSurvived(formatFor) {
+  adoptWhatSurvived(formatFor, { selfNamedListFileName = null } = {}) {
     const swept = this.sweep();
     let adopted = 0;
     let dropped = 0;
@@ -1266,15 +1338,21 @@ export class SegmentStore {
         continue;
       }
       this.#formats.set(entry.key, format);
-      // EVERY SEGMENT FOUND IS COMPLETE, because a piece is given its served
-      // name only once the encoder has said it is closed. So there is nothing to
-      // prove here and nothing to un-prove: what the directory holds under
-      // served names is what a killed process finished.
+      // A SEGMENT GIVEN ITS SERVED NAME BY US IS COMPLETE, because we give it
+      // only once the encoder has said it is closed and its media reaches its
+      // cut. So there is nothing to prove here and nothing to un-prove: what
+      // the directory holds under those names is what a killed process
+      // finished.
       //
       // What it may also hold is pieces it was in the middle of, under their
       // working names, and those are swept — the file a run was writing when the
       // kernel took the process is exactly this.
       unprovenRemoved += this.#sweepUnfinished(entry.key, entry.dir, format);
+      // And pieces the `hls` muxer renamed itself. It renames the piece it has
+      // open whenever it ends, on SIGTERM and when its input stops, so nothing
+      // says any of them reaches its cut; an earlier version cut every
+      // re-encode on the even grid that way. The muxer's own list names them.
+      unprovenRemoved += this.#sweepSelfNamed(entry.key, entry.dir, format, selfNamedListFileName);
       adopted += 1;
       this.#logger.info(
         `segment-store adopted ${path.basename(entry.dir)}: ${this.provenNumbers(entry.key).length} ` +