iOS 27 remote now playing - #5690
Draft
gbyo wants to merge 9 commits into
Draft
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Multiple unresolved critical security, duplicate-command, and memory-safety issues block approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
Sources/RemoteMediaCore/RemoteMediaSnapshotMapper.swift:91
Boolalso bridges toNSNumberin this integer path, sosupported_features: truebecomes the pause capability on-device while the server mapper rejects it. Reject booleans before converting numeric feature flags.
- Files reviewed: 100/104 changed files
- Comments generated: 11
- Review effort level: Balanced
Comment on lines
+40
to
+44
| public static func isFetchable(_ url: URL) -> Bool { | ||
| guard url.scheme?.lowercased() == "https" else { return false } | ||
| guard url.user == nil, url.password == nil else { return false } | ||
| guard let host = url.host, !host.isEmpty else { return false } | ||
| return true |
Author
There was a problem hiding this comment.
I don’t think rejecting all private/LAN addresses would be the best solution since local entity picture URLs can be used legitimately in some setups (if you're self-hosting music). I'm going to change it to still allow LAN hosted artwork and just prevent redirects from bypassing the checks
| // Belt and braces: `ephemeral` already holds nothing, and this says so at the request too. | ||
| request.httpShouldHandleCookies = false | ||
|
|
||
| guard let (data, response) = try? await session.data(for: request) else { |
Comment on lines
+213
to
+214
| case is URLError: | ||
| return true |
Comment on lines
+64
to
+67
| public static func send( | ||
| server: Server, | ||
| baseURL: URL, | ||
| method: Method = .get, |
Comment on lines
+85
to
+89
| Current.settingsStore.remoteMediaSelection = selection | ||
| // Each Follow is its own relationship. Re-following the same player reuses the session | ||
| // identifier, so this is what lets the server retire the token the last one registered and | ||
| // know which of the two came later. | ||
| Current.settingsStore.startRemoteMediaFollowLifetime(following: selection) |
Comment on lines
+24
to
+26
| /// One client and a cached context, refreshed when the host delivers new attributes so route | ||
| /// changes are picked up without making every command build the app's networking stack. | ||
| private let client = RemoteMediaWebhookClient() |
Comment on lines
+83
to
+85
| // The host app is authoritative when it is running, but a reconciliation already in flight | ||
| // is answering a command the user just pressed, so it is not thrown away here. | ||
| apply(attributes.snapshot) |
Comment on lines
+323
to
+327
| } catch { | ||
| RemoteMediaLog.logger.error( | ||
| "command \(command.rawValue, privacy: .public) failed: \(error.localizedDescription, privacy: .public)" | ||
| ) | ||
| throw error |
Comment on lines
+79
to
+81
| switch value { | ||
| case let number as NSNumber: candidate = number.doubleValue | ||
| case let text as String: candidate = Double(text) |
Comment on lines
+128
to
+130
| } catch { | ||
| lastError = error | ||
| guard Self.shouldTryNextCandidate(after: error) else { throw error } |
gbyo
force-pushed
the
ios27-remote-now-playing
branch
from
September 8, 2026 12:26
606e61c to
772be0c
Compare
gbyo
force-pushed
the
ios27-remote-now-playing
branch
from
September 8, 2026 12:31
772be0c to
176a9c7
Compare
Validate a followed entity id against the character set Home Assistant slugifies to, so it cannot escape the quoted literal it sits in inside the render_template query. Fall through to the next webhook route on statuses that prove a service call never arrived, which is what a deleted cloudhook returns. Clamp seek and volume through the command so the settle condition waits for the value that was sent. Block up artwork bytes before appending them, parse a space-separated timestamp with no fractional seconds, and drop some dead code. Co-authored-by: Claude <noreply@anthropic.com>
bgoncal
requested changes
Sep 8, 2026
bgoncal
left a comment
bgoncal
left a comment
Member
There was a problem hiding this comment.
Please split this PR into smaller iterations, it's already over 8k lines added + 110 file changes.
Also coordinate with your core PR to have it ready first, core PRs can change quite a lot during review so I would advise keeping it simple around here until it's not done there.
Also, there is currently a PR open in core that implements entity state subscription reported via silent push notifications, that one could help you a lot in here
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI Policy
Select exactly one option that describes AI usage in this contribution:
Summary
Adds Remote Now Playing support on iOS 27.
A media_player can be followed from its Add to... menu, which makes it appear in the native iOS Now Playing interface on the Lock Screen and in Control Center. Only one media player can be followed at a time. The current player can be stopped either from its add to menu or from the companion app settings
The session continues receiving metadata, progress, artwork, and playback state updates while the app is not open.
Screenshots
Follow / stop following
Lock Screen / Control Center
Link to pull request in Documentation repository
Documentation: home-assistant/companion.home-assistant#1420
Any other notes
It might be in the best interest to split this PR, it's huge.
Documentation needs to be updated with generic screenshots
Needs Bump GitHub runners to Xcode 27 #5665
Work in other repos:
Core: Add Remote Now Playing session support core#181613
APNS: Now playing direct apns mobile-apps-fcm-push#363
Discussion: Native Media Player Notification for Mobile Apps feature-requests#1338
Tested on a physical iPhone running iOS 27, including metadata and artwork updates with the Companion app force-closed and playback controls from the native Now Playing UI.
The RemoteMedia-focused test suites pass 56/56. SwiftFormat, SwiftLint, and RuboCop also pass.