2.0.0-beta2

Pre-release – :latest stays on the last stable version.

Install: download funscript-player-v2.0.0-beta2.zip below → unzip funscript-player-v2.0.0-beta2.zip && cd funscript-player → cp .env.example .env → edit .env → docker compose up -d (README)
Update: set PLAYER_VERSION=2.0.0-beta2 in .env, then docker compose pull && docker compose up -d (back to stable: PLAYER_VERSION=latest) – your .env and data stay.

---

Before you update

• Login page instead of the browser dialog. You log in on the player's own page; “stay logged in” keeps you
  logged in for 30 days. Everyone logs in once after the update. Scripts with curl -u keep working.
• The download is now called funscript-player-vX.Y.Z.zip and unpacks into the folder funscript-player – you can
  keep using your old folder.

New

• ⚙️ → Security & privacy: log out, log out all devices, number of logged-in devices and failed logins (also
  in docker logs, with time and address)
• ⚙️ → VR & HereSphere: log out all HereSphere devices without a new password
• The Handy connection key and Application ID are stored encrypted in the data volume (optional own key:
  DATA_SECRET in .env)
• Simple setup without ZIP and .env: see QUICKSTART.md – login, Stash and devices are set up in the player
• Other strokers via Intiface (e.g. Keon, OSR) get the same script intensity as the Handy (untested on real hardware)
• 📺 Stream to your TV (Chromecast via Chrome, AirPlay via Safari) – the devices keep following the video.
  In Chrome the player uses Google's Cast library (loaded from www.gstatic.com): picking another video plays it on
  the TV right away, without connecting again. While the TV plays, the phone shows “Playing on the TV” with a
  TV delay setting (devices ahead of the picture → +); the devices follow the TV's position, also when the app
  is in the background
• Stash itself under /stash: open Stash's own interface through the player (switch in ⚙️ → Library,
  STASH_UI=off locks it)
• Control yourself: stroke quick picks Full / Top only, short / Middle / Bottom only, short, and your
  patterns right at the video (switch Direct | Patterns) – a pattern repeats until you tap it again or use
  another control there
• Touch area in Position mode: the tempo and stroke sliders are hidden, the Handy follows the finger faster, new
  switch Smooth (the Handy glides after the finger)
• 8 more ready-made patterns (heartbeat, tease, swell, flutter at the top/bottom, deep and slow …) – added to
  your pattern list once
• Satisfyer: ⏏ Disconnect all and ⟳ Reconnect per device; a device you disconnect is no longer reconnected
  automatically on the next start. While a Satisfyer reconnects after a drop, the status at the top says so
• Known: AV1 videos stay black on Chromecasts without AV1 support – a converted stream for the TV is planned
• HereSphere: videos with the Stash tag passthrough (or “passthrough”/“alpha” in the file name) open with
  passthrough (alpha mask) – untested, please report

Changed

• 🔥 Finale: the Handy runs slower (stroke 20–70 %, detached speed 20 %) – your own finale settings stay
• Fullscreen: the switch “whole app in fullscreen” now also works in the installed app – switch it off if the back
  gesture makes the screen jump; after the update you may need to add the app to the home screen once more
• The filter bar disappears when all Stash filters are switched off in ⚙️ → Library
• Swiping in fullscreen: by default the left side does nothing, the right side controls both devices
• Device bars move more smoothly
• Demo mode: the address /demo now simply switches on the demo switch in ⚙️ → Security & privacy – one mode, switched off there

Fixed

• Stash under /stash: videos and previews did not load
• Warm-up: no more short stop of the Handy when you pause the video
• 📺 button sometimes missing; no more error message when you close the device picker
• Direct control and patterns did nothing on the Satisfyer after the touch area had held a value (“hold on release”)
• Satisfyer stopped after switching away from the app and back while the pattern was still shown as running
• Streaming to the TV: the player no longer jumps, and the TV no longer stops or skips because of the phone
  (buffering or the app in the background)

---

Docker image ghcr.io/scripthost/funscript-player:2.0.0-beta2 (amd64 + arm64)

SHA-256 of the ZIP: f0e1771b86354961f05005aa7b86fab9185c9f31be442910da797a37edf8fc89 – the image comes with an SBOM and a build provenance attestation.

2.0.0-beta1

The big redesign. A beta: please report anything odd.

Before you update

• A login is now required. If your player ran without AUTH_USER/AUTH_PASS, it now opens a setup page where you
  choose user name and password. Or set AUTH_USER + AUTH_PASS in .env, or LOGIN=off if a reverse proxy with
  its own login protects it. The example password change-me does not count.
• HereSphere is off by default on new installs (existing installs keep their setting) – switch it on in ⚙️ → VR & HereSphere.
  HereSphere addresses changed: reload the library in HereSphere once.
• New, much shorter docker-compose.yml and .env.example: required values on top, everything else optional.
  Video folders are now one line, MEDIA=/path (every subfolder becomes a source), instead of MEDIA_FILME … –
  take the new docker-compose.yml and compare your .env.
• Behind a reverse proxy with its own login: only /heresphere needs an exception now – remove exceptions for
  /stash and /media.
• Stash 0.32+ answers “HTTP 403” when Stash has no login and the player's Docker network counts as public. The player
  shows the exact public_whitelist line for Stash's config.yml in ⚙️ → Library and in docker logs.

New look

• New dark “graphite” design with a thumb bar at the bottom (Library, Player, Devices, Settings); on a PC the navigation
  sits at the top, settings use two columns
• Settings in clear pages (Devices, Security & privacy, Script, Library, Picture, VR & HereSphere, System) with a back button
• The script shows as a “mountain” in the player bar: height and colour by tempo (blue calm … red/purple intense),
  Stash markers on top
• New app icon; quieter play/pause and finale buttons

Player and devices

• Several scripts per video (clip.soft.funscript …) for folders and Stash, switchable while playing
• Intensity presets Auto · Original · Soft · Intense – Intense keeps the rhythm and only uses a longer stroke
• 🌱 Warm-up: short, gentle strokes at the bottom and a soft vibration – also while the video is paused
• ⏺ Record your own script along the video, name your recordings; patterns and recordings as cards
• “✕ Close video”; the player area becomes “Control” without a video
• Picture-in-picture only via ⧉ (no more black mini window when leaving fullscreen); leaving it returns to the full player
• Device checks every time you come back to the app; no Handy warning while another device (e.g. Satisfyer) plays
• Demo mode: blurred videos, previews and names, no sound, virtual Handy and Satisfyer

Login, Stash and HereSphere

• Set up, change or remove the login in ⚙️ → Security & privacy (also with LOGIN=off). Order: .env > ⚙️ > LOGIN=off.
  Forgotten? LOGIN_RESET=1 in .env, restart, remove the line again
• Stash address and API key can be changed in ⚙️ → Library (overrides STASH_URL/STASH_API_KEY); connection status
  with “Test connection”; the player reconnects on its own every 30 s
• “Show 2D videos only” now works without a “2D” tag: it hides Stash scenes with a VR tag and folder videos with a VR
  marker in the file name
• HereSphere: just enter the normal address – the player redirects HereSphere to /heresphere (switchable); its own
  password (log in once); the library opens faster (lists load in parallel and are kept for up to 10 minutes)

Security and Docker

• Brake against password guessing (10 attempts per minute), login password stored as scrypt hash
• PLAYER_BIND to publish the port only locally (e.g. behind a proxy); UPDATE_CHECK=off
• Intel graphics check in docker logs and ⚙️ → System; the container stops immediately on docker stop
• The Docker image now also runs on ARM64 (Apple silicon, Raspberry Pi …) – the HQ stream uses the CPU there

---

Pre-release – :latest stays on the last stable version. To try it: PLAYER_VERSION=2.0.0-beta1 in .env, then docker compose pull && docker compose up -d. Back: PLAYER_VERSION=latest.

---

Docker: docker compose pull && docker compose up -d · Image ghcr.io/scripthost/funscript-player:2.0.0-beta1 (amd64 + arm64)

SHA-256 of the ZIP: 2d95dfdb24676c1c8b9bc42d2502f680c00c7c0baede8c733b9c2efd2a897988 – the image comes with an SBOM and a build provenance attestation.

1.19.11

• Own fullscreen is back – with STOP, finale, sound and fit/fill (“stretched”); swiping shows its value in the middle of
  the picture. The browser’s video fullscreen (since 1.19.3) only had the browser controls. Picture-in-picture via ⧉
• Quieter start: connecting the Handy automatically runs silently (status at the top only) and keeps retrying; one calm
  hint only after the last attempt. Satisfyer reconnects silently too. Coming back to the app retries the Handy
• Video start: the thumbnail (or black with a spinner) shows until the first real frame is on screen
• Fix: recording along the video with only a Satisfyer recorded nothing (touch mode “position” is Handy-only now)
• Devices window: one “Connect” button instead of two; shows whether Handy API v2 or v3 is in use
• Clearer texts for “keep the Handy in time” and for calibrating the offset (tap when the video reaches the lowest point)
• Swipe defaults from 1.19.8 (left volume, right both) are switched once to left Handy stroke, right Satisfyer strength

---

Docker: docker compose pull && docker compose up -d · Image ghcr.io/scripthost/funscript-player:1.19.11

SHA-256 of the ZIP: dc7951c00a509c0bd0eb5fc7693f4e9700cc4abce8c11797fe9cbdbcd82debbd – the image comes with an SBOM and a build provenance attestation.

1.19.10

Security fixes – all low risk:

• /api/version now requires the login like everything else (only /healthz stays open for the Docker healthcheck)
• Logs: line breaks and control characters are stripped from everything written to docker logs, so log lines can't be faked
• Stash filters and own-script keys: names like __proto__ are rejected
• HereSphere: passwords from before 1.19.5 (SHA-256) are no longer accepted – if HereSphere asks again, set the password
  once more under ⚙️ → VR
• Stash IDs in requests are always encoded

---

Docker: docker compose pull && docker compose up -d · Image ghcr.io/scripthost/funscript-player:1.19.10

1.19.9

• Fix – picture-in-picture: leaving the app from the player page put the video into an invisible picture-in-picture
  (grey “playing as picture in picture”, sound kept running). Picture-in-picture is requested from fullscreen only again,
  and a stuck one is ended when you come back
• Health check: “connected” is verified on return (after more than 20 s in the background) and every minute – the
  Handy via the cloud, Satisfyers via Bluetooth – and reconnects automatically
• Device drops mid-video → video pauses with a hint (⚙️ → Emergency stop, on by default)
• Satisfyer battery per device in the device list, warning once below 15 %
• Soft stop: on pause, seeking or the end of the video the Satisfyer fades out within ~0.5 s (Esc / Stop everything
  stay immediate)
• Offset collapsed at the video (“Offset +40 ms ›”, tap to change) – no more accidental −/+
• Swipe defaults: left Handy stroke, right Satisfyer strength (volume only on request)
• Moved to settings: Satisfyer “Control” (follow / manual) and the Application ID (device window links there)
• Removed: “🎵 Follow sound” and about 160 unused translations and leftovers of earlier features
• Quality checks on GitHub: a translation test (every German UI text has an English one), the browser self-test in
  headless Chrome before every release, and ESLint

---

Docker: docker compose pull && docker compose up -d · Image ghcr.io/scripthost/funscript-player:1.19.9