Reduce log noise by demoting ALSA device enumeration from info to debug.
Add a 5th backoff retry at 800ms for both hw and plughw paths as a
safety net for any EBUSY cases that slip through the lifecycle fix.
cc
In the Play and PlayStreaming handlers, the old engine's writer thread
still holds an Arc<AlsaDirectStream> when the stream_opt is dropped and
a new snd_pcm_open() is attempted. This causes EBUSY on track switches
with sample rate changes. Reorder to: stop engine -> drop stream -> open
new stream, matching the Stop handler's correct lifecycle.
cc
- Device enumeration (48 CPAL devices): info → debug
- Playlist fetch completion: info → debug
- Playlist command invocation: info → debug
- zbus socket_reader/tracing: filtered to warn level
These remain visible with RUST_LOG=debug or verbose log capture.
cc
Add per-app secret from org.freedesktop.portal.Secret as entropy
in the AES-256-GCM key derivation. DE-agnostic (works with GNOME,
KDE, etc.) and Flatpak-safe (portals auto-accessible in sandbox).
Falls back to machine_id + salt when portal is unavailable (headless,
old DEs, non-Linux). Cached for session lifetime via OnceLock.
Users will need to re-login once on upgrade (key derivation changed).
cc
Token was stored as plaintext in the system keyring, visible via
secret-tool. Now AES-256-GCM encrypted before storing — keyring
entry shows ciphertext, not the raw token.
Handles migration from both plaintext keyring entries and encrypted
files from previous versions.
cc
OAuth token was saved to BOTH keyring and encrypted file, making the
keyring pointless. Now:
- Save: keyring first. Only writes file if keyring unavailable.
- Load: keyring first. If found in file, migrates to keyring and
deletes the file.
- Result: when keyring works, no token file exists on disk.
cc
Move the CMAF app seed from a hardcoded constant in qbz-cmaf to a
parameter passed by callers. The seed now lives in qbz-qobuz::auth
where other app-level constants are defined. This resolves CodeQL
alerts for hard-coded cryptographic values.
Also truncate session_id in logs to avoid cleartext logging of
sensitive session identifiers.
cc
Logout was not clearing OAuth tokens or credentials from keyring
and encrypted files. Users had to manually delete files to fully
sign out. Now clears both keyring and file storage.
cc
Cargo.toml was left at 1.2.2 because the version bump sed command
only matched JSON format ("version": "1.2.2") not TOML format
(version = "1.2.2"). This caused CARGO_PKG_VERSION to report 1.2.2
at runtime, triggering the update-available modal on every launch.
cc
Keyring save/load failures were logged at debug level, making them
invisible in normal logs. Users on KDE Plasma 6 reported the keyring
feature not working (#276) but couldn't see why.
Promoted keyring failures to warn level with actionable messages
(e.g., KDE users need org.freedesktop.secrets enabled in KWallet).
cc
Loop used 1..n_segments (exclusive) but n_segments is the count of
audio segments, not the last index. Segments are numbered 1 through
n_segments, so the loop must be 1..=n_segments (inclusive).
This caused the last ~9 seconds of every CMAF-streamed track to be
missing. Confirmed with diagnostic logging: table_total_samples
exceeded actual decoded frames by exactly one segment's worth.
cc
Template had a different src_compile (npm run build + cargo build)
than the overlay's working ebuild (npx tauri build --no-bundle).
Now they match exactly, preventing the release workflow from
breaking the overlay.
cc
Logout left audio playing through the ALSA/PipeWire backend while
tearing down the session. Now explicitly stops playback and clears
MPRIS state as the first step of logout.
cc
OAuth token save/load/clear now use the system keyring (GNOME Keyring,
KDE Wallet) as primary storage, with the existing AES-256-GCM
encrypted file as automatic fallback.
On first load from file, the token is migrated to the keyring
automatically for future use.
The previous commit enabled the keyring backend but only wired it
for email+password credentials (no longer used). This wires it
for the OAuth token which is the active auth method.
cc
Enable async-secret-service + crypto-rust features on the keyring
crate, activating GNOME Keyring and KDE Wallet support. The keyring
integration code was already written but the crate was compiled
without any platform backend, so it silently failed every time.
OAuth tokens will now be stored in the system keyring when available,
with encrypted file as automatic fallback.
Added org.freedesktop.secrets to Flatpak finish-args for sandbox
keyring access.
Fixes#215
cc
pause, resume, stop, seek, and volume commands required
RequiresClientInit which fails when offline (no internet = no bundle
extraction = client not initialized). These commands only use the
local Player/CoreBridge, not the Qobuz API client.
Changed to RequiresUserSession which passes in offline mode since
the offline session activates from cached user data.
Fixes#173
cc
Fixes 3 dev server vulnerabilities:
- Path traversal in optimized deps .map handling
- Arbitrary file read via WebSocket
- server.fs.deny bypass with queries
Closes#274
cc
New encrypted CMAF streaming via Akamai CDN, replacing legacy nginx
direct downloads that were failing with "1 byte EOF" for many tracks.
Key changes:
- qbz-cmaf crate: HKDF key derivation, AES-CBC/CTR decryption, CMAF parsing
- qbz-qobuz: session/start + file/url endpoints
- Streaming playback: init segment fetch (~500ms) then background segment download
- CMAF-first with legacy fallback on all download paths
- Quality matching: request track's actual quality, not always UltraHiRes
cc
playTrack() was always sending the user's max quality setting (Hi-Res+)
regardless of what the track actually offers. A 44.1kHz/24bit track
would trigger 3 API fallback calls (UltraHiRes -> HiRes -> Lossless)
and the cache was discarded as "lower quality" for re-download.
New effectiveQuality() picks the minimum of user max and track metadata
(bit_depth + sampling_rate), so a 24bit/96kHz track requests Hi-Res
directly (1 API call) and cache matches perfectly.
cc
Frontend sends "24bit/44.1kHz" format from track metadata, but
parse_quality fell through to default UltraHiRes for unknown formats.
This caused unnecessary API quality fallback cascades (3 calls per
track) and cache mismatches where cached 24bit/44.1kHz data was
discarded for re-download that returns the same quality.
Now parses "XXbit/YYYkHz" format and maps to the correct Quality
level, requesting exactly what the track offers.
cc
A track mastered at 44.1kHz/24bit IS the maximum quality available.
Re-downloading won't produce a higher sample rate. Only check bit
depth for UltraHiRes/HiRes quality matching — if cache has 24-bit,
use it regardless of sample rate.
Previously, requesting UltraHiRes with a 44.1kHz/24bit cache would
discard the cache and re-download, getting the exact same data.
cc
Add CMAF fallback to streaming probe failure, standard download,
and individual prefetch paths. Legacy nginx CDN path kept as
automatic fallback for each. Cast/DLNA/offline-cache paths marked
with TODO (require CoreBridge parameter plumbing).
cc
Prefetch was still using the legacy nginx CDN path, causing "1 byte
EOF" failures on tracks that only work via the new Akamai CDN. Now
tries CMAF full download first, falls back to legacy on failure.
cc
Replace full-download CMAF with streaming: fetch init segment, start
playback, then download+decrypt audio segments in background. Player
begins playing after ~500ms instead of waiting for full download.
cc
Download tracks via Qobuz Akamai CDN with encrypted CMAF segments.
Derives session key (HKDF), unwraps content key (AES-CBC), decrypts
frames (AES-CTR), reassembles into standard FLAC. Falls back to legacy
track/getFileUrl if CMAF fails.
- Add qbz-cmaf dependency to src-tauri
- Make ensure_cmaf_session public on QobuzClient
- Add ensure_cmaf_session and get_file_url passthroughs to CoreBridge
- Add download_audio_cmaf and try_cmaf_download helpers
- Wire CMAF as primary download path in v2_play_track with legacy fallback
cc
Auto-advance from a previous track could arrive after the user
switched to a new album/playlist, advancing the new queue's index
and skipping a track (observed: Sorceress track skipped).
Added queue epoch counter that increments on setQueue/clearQueue.
nextTrackGuarded() captures epoch before the invoke and discards
the result if the queue changed while in-flight. Applied to all
auto-advance paths (track-end, gapless transition) but not to
manual skip (user-initiated).
cc
download_audio() was sending bare GET requests without User-Agent,
while all other CDN request paths (probe, streaming) sent Mozilla/5.0.
CDNs commonly reject or truncate responses from requests without
User-Agent, explaining the "1 byte then EOF" failures on tracks
that work fine in the web player.
Also removed the 120s total timeout that contradicted the comment
saying "no total timeout" — Hi-Res+ files can be 200MB+ and need
more than 120s on slower connections.
cc
When skipping tracks quickly, the previous PCM handle may not be
fully released by the kernel before the new track tries to open
the same ALSA device (snd_pcm_open fails with EBUSY).
Previous behavior: single retry after 200ms PipeWire suspend, then
immediate failure. This didn't cover our own PCM race condition.
New behavior: 4 retries with progressive backoff (50/100/200/400ms)
for both hw and plughw paths. PipeWire suspend still attempted once
upfront. Total worst-case wait: 750ms (vs 200ms before), but the
early retries at 50-100ms cover the common fast-skip case.
cc
StreamFetcher used a persistent reqwest::Client for the entire app
session. When a CDN connection broke mid-transfer, the HTTP/2 pool
kept reusing the dead connection, causing all subsequent downloads to
fail after 1 byte ("end of file before message length reached").
Changes:
- StreamFetcher now creates a fresh client per download attempt,
matching the pattern used by download_audio() which never had
this issue
- Added retry logic with exponential backoff (3 retries, 1s/3s/5s)
— offline cache previously had zero retries for multi-hundred-MB
downloads
- Clean up partial .tmp files on failure before retrying
- Extracted try_download() for clean retry loop
Root cause: issue #268 / reported in #270 testing
cc
Remove dead alsa dependency from src-tauri/Cargo.toml (code lives in
qbz-audio since V2 migration) and bump qbz-audio to alsa 0.10.
Eliminates duplicate alsa versions in Cargo.lock.
Breaking changes in 0.10 (Format/ChmapPosition reorder) do not affect
QBZ — we use catch-all matches and never rely on PartialOrd.
Closes#260
cc
Artwork bumped from min(45vh, 360px) to min(52vh, 460px), matching
coverflow center cover. Padding reduced to 52px/88px consistent with
other panels. Responsive breakpoints updated accordingly.
cc
The side covers partially overlapping the center is correct coverflow
behavior — they just need to render BEHIND the center cover. Center
has z-index: 10, sides have 4/3. Restored original-style offsets
(200px/340px) with 45deg rotation for the classic coverflow look.
cc
Remove transform-style: preserve-3d and translateZ which caused center
cover to render as ghost/transparent. Remove duplicate perspective on
parent panel. Add dark backdrop to quality badge in all immersive views
for legibility on light backgrounds.
cc
Three changes to prevent overlap:
1. translateX increased from 280px to 400px for adjacent covers
2. rotateY reduced from 45deg to 30deg (less inward swing)
3. Added translateZ(-120px) to push side items behind the Z-plane
The 3D perspective projection with rotateY causes the near edge of
side covers to swing toward center. Reducing rotation and adding
Z-depth separation fixes the visual overlap.
cc
Center cover bumped from 360px to 460px. Side covers pushed out to
280px/460px offsets (from 180/300) to prevent overlapping the center.
Removed broken slideLeft/slideRight keyframe animations that
referenced unset --translate-x variable and conflicted with the CSS
transitions already on each item. Transitions alone handle all
position changes smoothly on click/skip.
cc
Bump artwork vh constraint from 60vh to 72vh — the previous value was
the bottleneck on laptop screens (461px on 768px viewport). Now yields
~553px. Reduce vertical padding from 164px to 140px total. Compact
track info margins below artwork.
cc
Change from center-center floating layout to stretch-fill approach.
Artwork section now gets fixed 42% width proportion and fills column
height. Artwork max-width overridden to 100% of column (no viewport
caps). Columns stretch to fill available height, eliminating dead
space above/below. Track info made more compact. Panel section
removes max-width cap for lyrics to breathe.
cc
Remove fixed px caps on artwork — now scales purely with viewport
(42vw/60vh). Switch lyrics font from condensed Oswald to Montserrat
for better legibility. Hide scrollbar in immersive lyrics (scrolling
still works). Add padding to artwork column for breathing room.
cc
Artwork scales with viewport (min of 500px/38vw/58vh) instead of fixed
380px cap. Lyrics use responsive clamp() sizing (up to 34px inactive,
42px active) with better line-height. Reduced padding/gaps throughout
split mode for less dead space. Tighter mask gradient on lyrics panel.
cc
The cargo eclass requires pre-generated offline crate sources which
the CI workflow never set up. Revert to the working approach: inherit
xdg only, RESTRICT network-sandbox, direct npm ci + cargo build.
cc
Off by default. Toggle in Audio settings controls whether QBZ
silently downgrades quality when the requested tier is unavailable.
i18n keys added to all 5 locales.
cc
Off by default. When disabled, if the requested quality is unavailable
the download/stream fails instead of silently downgrading. Persisted
to audio_settings DB. Applied to offline cache downloads.
cc
When a track is cached at lower quality than requested (e.g. CD quality
cached during a Qobuz outage, but user wants Hi-Res), the cache hit is
now detected via FLAC header inspection (sample_rate + bit_depth).
If quality is insufficient, QBZ attempts a fresh download at the
requested quality. If the download fails (network error), the cached
lower-quality version is played instead of failing entirely.
cc
Bootstrap no longer attempts email/password login — only OAuth token
restore. v2_manual_login and v2_auto_login now return immediately with
deprecation errors. Users with old saved credentials will see the
login screen instead of hitting Qobuz's deprecated endpoint.
cc
Secondary link-style option below the main OAuth button. Opens the
user's default browser (Firefox, Chrome, etc.) instead of the Tauri
WebView. Useful for password managers and saved sessions.
i18n keys added to all 5 locales.
cc
Refactor: shared finalize_oauth_login() handles code exchange, CoreBridge
injection, session activation, and token persistence. Frontend-agnostic,
reusable by GUI, TUI, and headless clients.
New command: v2_start_system_browser_oauth spawns a local axum listener,
opens the user's default browser for Qobuz OAuth, and captures the
redirect code automatically.
cc
Qobuz no longer accepts basic auth. Remove email/password fields,
manual login handler, and "Remember me" checkbox from LoginView.
OAuth browser login is now the sole authentication method.
cc
setCurrentTrack during session restore was missing albumId and artistId,
causing Go to Album / Go to Artist clicks to silently fail until a new
track was played. Also restore isLocal, source, and parental_warning for
full parity with the normal playback path.
Closes#252
cc
handleBulkMakeOffline was calling v2_cache_favorite_track which only
saves metadata to the favorites cache. Replaced with
cacheTracksForOfflineBatch which triggers the real offline download.
cc
vicrodh