[github-actions]

🤖 I have created a release beep boop

0.2.1 (2026-10-23)

Features

• add artwork cards and redesign settings (#1183) (d7d16c2)
• content badges for live and last played media (#1186) (e123fe2)
• linux: add native tray with WebUI menu and bounded lifecycle (513a34a)
• linux: stage native desktop packages with declared tray dependencies (7edcdb5)
• publish usage badges and refresh the docs (#1185) (726dc57)

Fixes

• accept Spotify loopback callback only once (dcd79cc)
• add Plex GDM and gateway identity discovery (3ff647d)
• allow bounded status card cache buster (fc52a06)
• analytics: send one Discord ping per process start when calls overlap (1126e31)
• apply privacy to Settings sample card preview (46857d4)
• atomically order hosted device ingests (2dae312)
• avoid port reuse flake in the unix entry simultaneous-launch test (2af931e)
• bind local card artwork to selected server (c67c5e7)
• bound the artwork upload reply and cancel it on failure (0bbc99e), closes #1118
• cancel rejected MusicBrainz search response bodies (075f2ad)
• cancel rejected provider sign-in response bodies (a766b8b)
• cancel rejected update-check bodies (f6b8d09)
• cancel setup discovery probe bodies on early exit (9d626e2)
• cancel the Discord analytics ping reply body (b08503b)
• cancel the health check body on a non-200 response (c166d85)
• cancel the sibling response when one update fetch fails (a064c78)
• cancel unread bodies when an update download is rejected (ed8b066)
• cancel unread final artwork responses (1718c22)
• cap concurrent pending Spotify sign-in starts (6dab490)
• cap hosted sign-in response bodies (0d58ab5)
• cap the Spotify profile response body and cancel rejected bodies (e904def)
• cap the Spotify token response body (ea811f7)
• card: pick auto text direction from the displayed title (cef0e17)
• classify revoked media server tokens as authentication failures (723ed56)
• clear hosted playback on privacy save during outage (5b9d572)
• clear stale Spotify consent link on sign-in failure (5ea5954)
• confine provider credential redirects to original origin (345edce)
• copy and merge card layout settings (311f41c)
• count release assets named like Object.prototype members (ba2f84e), closes #1122
• destroy the discord client when login fails (30977b5)
• discard late sign-in start after Cancel (8f52243)
• discard provider redirect reply bodies (72fe2ab), closes #1126
• discard Spotify sign-in completion after expiry (52d53bb)
• don't leave the Spotify error body unread on a non-OK now-playing reply (193b88c)
• don't let a stalled cancel hang desktop instance detection (ee820d7)
• don't wait on body cancel when the health check response is oversized (6629ec1)
• don't write last-played history after the device token is revoked (f5e1e70)
• drive the injected test clock through both Discord client timers (#731) (cf15ab0)
• drop artwork with an overlong Emby/Jellyfin item ID (933c728), closes #1124
• expire abandoned hosted sign-in guard (e0629c1)
• expire artwork cache by elapsed time (#721) (513c1af)
• expire Discord artwork by elapsed time (#723) (3693e51)
• expire local last-good card by elapsed time (7844ffe)
• expire YouTube tabs by elapsed time (bcc0465)
• explain server sign-in save failures in Settings (0260a5b)
• guard server sign-in and restore credentials on failed saves (057f648)
• hosted: require the exact application/json media type on ingest (be97948)
• identify current repository in MusicBrainz User-Agent (ede2712)
• ignore late hosted sign-in token replies from a replaced flow (6ebd4eb), closes #1121
• invalidate cancelled provider sign-in polls (ef5cb56)
• invalidate last-good card after appearance save (9b21318)
• invalidate pending Spotify sign-in on disconnect (70f10e3)
• invalidate private card cache after privacy changes (76bfa90)
• keep a clickable auth link in WebUI provider flows (287c095)
• keep a Discord RPC close final over a pending login (6345bd4), closes #1127
• keep authenticated artwork redirects on original origin (f3f7090)
• keep committing sign-in flows through expiry (1412f5d)
• keep hosted heartbeat alive after client clock rollback (819a4ab)
• keep same-ID items from different servers distinct in the presence key (7067633)
• keep sign-in flow claimed throughout finish (61bd08e)
• keep sign-in visible while commit finishes (23a65a2)
• keep status snapshot ordered by provider poll start (9101ee8)
• keep the hosted recovery key when registration save fails (fdaa202)
• linux: bound secret-tool credential response buffering (fa22410)
• linux: constrain native packaging scripts and tests to Linux (641763a)
• linux: disable RPM debug extraction for prebuilt Node bundles (f25d9da)
• linux: filter first-run browser subprocess environment (14c265c)
• linux: report non-application autostart entries as broken (baf8a99)
• linux: route tray pages to Settings until first-run setup completes (e9f7999)
• linux: settle credential timeout before terminating helper (2a5d190)
• macos: bound security credential response buffering (8690e01)
• macos: settle Keychain timeout before terminating helper (39d9e97)
• make sign-in cancellation honest during credential commit (bd0ec6a)
• make the LAN discovery timeout cover bind and send (1bb3302)
• measure Discord stuck and grace by elapsed time (#727) (dc42e39)
• newest overlapping Spotify sign-in supersedes older pending flows (#703) (b8649b2)
• node --check only checked the first file, check every file (e3d070a)
• normalize private subnet targets before probing (c8055b1)
• offer auth links in legacy setup page (ec3fe04)
• omit hidden subtitles from card metadata and uploads (4b2f4da)
• omit progress track when timing is hidden (17ad73e)
• order the settings sections to match the navigation (#1188) (f4b085b)
• populate the mediaType template token from the presence kind (2345212), closes #1119
• prepare audited v0.2.1 release (6535af2)
• preserve migration temp-file ownership and permissions (6f97cac)
• prevent older hosted pushes from retrying above newer state (7801e7d)
• prioritize failed sources over hosted startup (ac10770)
• queue recovery saves without losing later writes (93d7fb0)
• rank combined playback by activity order (d4b83f9)
• rank distinct same-title media items by stable ID (d44b0ed)
• rank multi-server playback by activity order (0bb954e)
• rank YouTube tabs by playback activity order (21c140f)
• re-check credential liveness before saving a rotated refresh token (#725) (3ff3ccb)
• reap every spawned child in the unix entry tests (f2f6286)
• recover hosted upload sequence after clock rollback (beb495d)
• recover server sign-ins after settings restart and show connected discovery rows (#1189) (efc9a7a)
• reflect per-server auth failures in tray and diagnostics (1e6203d)
• reject corrupt stored credentials in the hosted service (c27ab8c)
• reject hosted ingest committed after device revocation (2c668ce)
• reject malformed card output before it replaces the last-good card (a9d1b65)
• reject oversized Discord IPC activity without leaking waiter (a94006a)
• release bounded response reader locks (6eada3d)
• release rejected artwork redirect bodies (45096b4)
• release the Settings subnet discovery probe body on failure (9d0cec4)
• release the unread body on rejected Plex, Jellyfin, Emby and Navidrome replies (ff24077)
• release the unread body on the Plex owner check reply (b66c9a6)
• remove saved sign-in when disconnecting a server (fdd7c70)
• replace prior hosted device on same-PC sign-in (e8e0755)
• report bounded discovery probe failure reasons (abcccbc)
• reset stuck detection for distinct same-title media (8e26ced)
• restore focus after cancelling server sign-in (83cee39)
• restore Spotify credential when config save fails (6f6b404)
• retain hosted revoke key and expose pending disconnect (abe2377)
• retry Discord clear after publish limiter (7a2203d)
• retry failed Plex owner checks (7729906)
• retry first-run activation after another sign-in (91c9fe2)
• retry unchanged Discord activity after publish failure (d6cff56)
• run optional setup before committing server config (89d9319)
• serialize same-account Spotify credential writes (#703) (be5fdd1)
• serialize setup-store writes (1b8dcb1)
• setup: accept a 4096-byte draft on load (7d68d1d)
• setup: settle LAN discovery when cancelled during bind (1757815)
• share first hosted registration across callers (0cb6d0e)
• show failed server in Settings notice (65d65dd)
• show localhost Plex probe failures in quick scan (85d0e28)
• show per-server sign-in failures in multi-server status (627a8b2)
• skip artwork fetch when card hides image (d039fcb)
• space MusicBrainz requests by elapsed clock (#734) (4a0cc23)
• stop the auto-updater installing twice in one process (3c90684)
• stop the discord client updating state after close (e7b7541)
• stop the sibling body read when one update body fails (9cb1f74)
• stream first-run discovery probe bodies with a running byte cap (#745) (0ccf48b)
• surface failed first-run activation with recovery (192e8b6)
• surface hosted upload failures in app health (b670eca)
• time Discord publish throttle and reconnect backoff by elapsed clock (#731) (5794b1d)
• time hosted device flow by elapsed clock (#729) (692f110)
• time hosted sign-in restart guard by elapsed clock (#741) (18859b1)
• time status-only refresh interval by elapsed clock (#736) (d670e3a)
• track setup test rate window by elapsed clock (#739) (e79d193)
• tray: close the app on a stop request after the tray fails (031a0b7)
• tray: keep one quit waiter across Settings restarts (1b2d99f)
• tray: log tray outcomes with statuses the logger accepts (73b4110)
• treat only a refused shutdown request as the app being absent (23a8eb5), closes #1123
• use elapsed time for hosted stale playback guards (14b4cd9)
• use elapsed time for hosted upload backoff (e9cf458)
• use elapsed time for provider reconnect backoff (e81bc10)
• validate persisted analytics v1 shapes (4a54dc0)
• wait for cancel before switching server sign-in (a3e90a6)
• windows: bound Credential Manager response buffering (88c8da3)
• windows: handle closed credential helper stdin without crashing (c87383e)
• windows: settle credential timeout before terminating helper (38fd4f3)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

APPROVE the release metadata diff at 374746c02ddfbb246de09ff18a43fd4f40f628c2, checked with main 316c2712a995441ecf5ece710f8e5cad1bc34ea6 merged locally.

Only release manifest, changelog and package/lock version fields differ from main. The four version fields agree at 0.2.1, and no dependency versions change. The current-main merge is clean; full local suite passes 1285 tests with 22 skipped and no failures, and npm run check passes. The head check-runs endpoint returned no checks, so this is local test evidence, not a green-CI claim.

This is a metadata/code review, not a decision to publish now. Later fixes can still update the release notes before publication. No merge, tag or release performed.

[github-actions]

🤖 Created releases:

• v0.2.1

🌻