* docs: add Home Assistant 0.4.0 hardening roadmap
* fix: protect media credentials and resume state
* feat: authenticate RelayTV API operations
* fix: make targeting and media state reliable
* test: add Home Assistant integration CI
* fix: validate API credentials during setup
* release: prepare HACS 0.4.0
* fix: align pytest dependency pin
* fix: close URL sanitizer gaps and correct player state reporting
Sync the sensitive-query-key list with the RelayTV server (adds auth,
exp, jwt, X-Emby-Token, X-Jellyfin-Token), filter query credentials
from relative URLs instead of returning them verbatim, and preserve
brackets around IPv6 literal hosts.
Also report volume on RelayTV's 0-100 scale unconditionally (a raw 1
is 1%, not full volume) and give the coordinator its own
position_updated_at stamp — the base DataUpdateCoordinator has no
last_update_success_time, so media_position_updated_at silently fell
back to now() on every read and the seek bar never extrapolated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Resolve all targeted RelayTV config entries for service calls so overlay, play, snapshot, resume, and other targeted actions execute across multiple selected Home Assistant entities or devices instead of only the first target.
Convert relative snapshot image_url responses to absolute URLs using configured RelayTV base_url and refresh API helper notes for /playback/play fallback semantics.
markandClaude Fable 5