Musonic Web 1.1.0

Podcasts, and Musonic Web becomes an app. Search shows and the episodes where someone speaks, follow them, and pick up an episode where you left it on any device. Musonic Web can now be installed from the browser, with its own window and icon.

Added

• Install Musonic Web as an app (computer or phone): its own window and icon, from the browser's install button.
• Podcasts (with Musonic Server): search shows and the episodes where someone speaks, open a show before following it, follow it and find it in the Library. Episodes resume where you stopped (on every device), play faster (up to 2×), jump back 15 s or forward 30 s; their transcript shows like lyrics when the show publishes one. A found episode opens its show and plays.

Security

• Cover and audio addresses (which carry the sign-in) are never sent to other sites as the page they come from.
• On a Musonic Server, the browser keeps a device key instead of a token made from your password. The password is used once at sign-in; the key, named after the browser, is listed in the server's console and can be revoked there. Other Subsonic servers keep the token as before.

Changed

• Play, Previous, Next and Add to queue use the same icons as the mobile app (shared icon set).
• Edit a playlist in place — “Edit” turns the page into its edit mode: the name and description become fields, each song gets a handle to drag it to a new place (or the up and down arrow keys) and a “−” to remove it; “Done” saves everything at once, Escape or “Cancel” drops the changes. It replaces the name and description dialog.
• Log out revokes the browser's key on a Musonic Server.

Fixed

• A refused account goes back to the sign-in form with the reason (key revoked, account suspended, password changed) instead of showing errors and an empty library.

Added

• Import a Spotify or Deezer playlist (Library → Import, on a Musonic Server): paste the playlist's address, check its name, cover and songs, and Musonic makes it again with songs from your library and the online catalog. The import runs on the server (you can close the window) with its progress shown live, then a report lists the songs not found and the uncertain ones (a close version used instead). A Spotify playlist is read up to its first 100 songs; for the rest, put them in a second Spotify playlist and paste its address in the report: its songs are added to the same playlist. The report can look for the missing songs again. The report stays available from the playlist's page.

Fixed

• Plays are now counted. The web client never told the server what you listened to, so "Recently played", "Most played" and the top songs stayed empty. A track counts once you have really listened to half of it (or 4 minutes, tracks under 30 s never count): skipping to the end does not count. The track also shows as "now playing" while it plays, and the home picks up the new plays on your next visit.
• Liking an online track, or adding it to a playlist, now works: the track is first imported into your library (a message tells you while it downloads), then liked or added under its library id. Before, the server could not find it and nothing happened.

---

Podcasts need Musonic Server 1.1.0. Self-hosting: Musonic-Web.zip in this release, as before.

Musonic Server 1.1.0

Podcasts. Musonic Server reads podcasts from their RSS feeds, finds shows in the iTunes directory and in Podcast Index (including the episodes where a person speaks, host or guest), and keeps each account's place in every episode. Every Subsonic client gets the standard podcast routes; Musonic's apps get search, show pages and transcripts as synced lyrics.

Added

• Podcasts (first part, ADR-023). Shows are read from their RSS feed (iTunes and
  Podcasting 2.0 tags: duration, chapters, transcripts) and found in the iTunes directory
  (searchPodcasts?query=&country=, kept a day, no key needed). The standard Subsonic routes
  work for every client: getPodcasts, getNewestPodcasts, getPodcastEpisode,
  createPodcastChannel, deletePodcastChannel, refreshPodcasts. Episodes play through
  stream (relayed from the host, seeking included: the host never sees the listener) and
  their pictures through getCoverArt. Each account follows its own shows and keeps its place
  in each episode (savePodcastPosition, listened to the end past 95 %). Followed feeds are
  read every hour; an unchanged feed costs one short answer. musonicServer extension
  version 4.
• Feeds, audio and pictures of podcasts are only fetched from public addresses: a feed cannot
  make the server read its own network.
• Podcasts: Podcast Index (free key set in the console, Imports page): shows the iTunes
  directory misses or lists without their feed, and episodes by person (host or guest) in
  searchPodcasts. getPodcastShow?url= opens a show before following it. Transcripts
  (podcast:transcript, VTT or SRT) are served as synced lyrics by getLyricsBySongId.

Security

• Every answer carries browser protections: the console and Musonic Web cannot be shown
  inside another site (X-Frame-Options, frame-ancestors), and addresses carrying a token
  are never sent to other sites (Referrer-Policy: no-referrer).
• Dependencies: tokio 1.54.1 (1.54.0 was withdrawn: timer race), zip 9 (advisories
  RUSTSEC-2026-0367/0368/0369 on extract(), which Musonic does not call). The CI runs
  cargo audit.

---

Updating

Migration 0009 adds the podcast tables at the first start (instant) and keeps a copy of the database before it (musonic.db.before-schema-9). Nothing else to do.

Podcast Index (optional): create a free key at podcastindex.org, then paste the key and its secret in the console, Imports page. Without it, shows are still found through the iTunes directory; episodes by person need it.

Musonic Server 1.0.3

Security

• /health now only answers {"status":"ok"} (or "degraded" with a 503 when the database
  does not answer), for Docker and uptime monitors. Its detail (version, schema, last scan,
  providers, alerts, imports) told anyone which providers a server had: it moves to
  GET /v1/admin/health, for administrators.

Changed

• Short ids (11 characters instead of 36): songs, albums, artists, folders and playlists.
  Lists of thousands of items repeat them and random ids do not compress: the list of artists
  is 42 % lighter, 500 albums 24 %, a search about 20 %. Migration 0008 converts the
  database at the first start (about a second for 2 000 songs) and keeps a copy of it before
  (musonic.db.before-schema-8, also done before any later migration). Ids kept from a
  Navidrome import (22 characters) are shortened too.
• Old ids keep working: a short id is computed from the old one (the first 64 bits of its
  UUID, or the first 11 characters of a Navidrome id), so the server converts any old id a
  client sends. Musonic's apps convert what they saved by themselves (musonicServer
  extension version 3). Other Subsonic apps (Symfonium, Substreamer…) see new ids and refresh
  their copy of the library; their downloads and playlists keep working.
• Accounts, API keys, invitations and reset links keep their long ids.

Musonic Mobile 2.3.0

Podcasts, on the phone and in the car. Search shows and the episodes where someone speaks, follow them, and pick up an episode where you left it, on any device. In Android Auto, your shows are in Library → Podcasts, with −15 s, +30 s and the speed on the playback screen.

Added

• Podcasts (needs Musonic Server 1.1.0) — search shows and the episodes where a person speaks (in All and in a Podcasts tab), a show page with Follow, a Podcasts tab in the Library.
• Episodes resume where you stopped, on any device; speed (0.75× to 2×) and −15 s / +30 s jumps in the player; transcripts shown as lyrics.
• Podcasts in Android Auto — Library → Podcasts: the shows you follow, then their episodes (date, time left); an episode resumes where you stopped. On the car's playback screen, an episode gets −15 s, +30 s and its speed (the number on the button) instead of shuffle, repeat and like; no queue nor lyrics.

Changed

• The search loses its « My library » filter: the Library has its own search.
• Previous and Next are a triangle and a bar, the same icons as Musonic Web and the console.

Fixed

• An episode whose feed gives no duration showed a progress bar stuck at 0:01 in the full player: the player's own duration is used.

---

Podcasts need Musonic Server 1.1.0; everything else works as before with other servers.

Musonic Mobile 2.2.0

Android Auto, Musonic's own screens. The car no longer shows a generic list: Musonic draws its own Home (resume what was playing, recently played, your playlists), marks the track playing, puts the queue and live lyrics on the playback screen, and adds search, typed when parked or said to the car's assistant.

Added

• Android Auto: a Home in sections — Resume (the track playing, one tap to go on), Recently played, then your playlists.
• Android Auto: the track playing stands out in playlists and albums (level bars in place of its cover).
• Android Auto: queue and lyrics on the playback screen — see what comes next; the lyrics button shows the line sung live in place of the artist, on the car's own playback screen.
• Android Auto: search — a search button on the Home (typed when parked), and « Play … on Musonic » said to the car's assistant.

---

Using it in the car

Update the app on the phone, then plug it in or connect wirelessly as usual: Musonic opens on its new Home. Voice: say « Play an artist or a title on Musonic » to the car's assistant. Typing in the search is only allowed when parked (the car's rule).

Musonic Mobile 2.1.0

Your password leaves the phone, and Musonic gets lighter. On a Musonic Server the phone now signs in with its own device key, the app drops from 95 MB to 30 MB, long lists and the background use far less battery, and Android Auto gains albums, artists and downloads. A sleep timer arrives in the player.

Security

• Your password no longer stays on the phone. On a Musonic Server, signing in now gives this phone its own device key: the password is used once and forgotten, and the key alone goes with each request (no more username and password in the addresses of songs and covers). The key is listed in the server's console, where it can be revoked. Accounts already saved switch over by themselves at the next launch. The password they kept is then wiped from the app's storage, not just replaced. On other Subsonic servers the app keeps a sign-in token instead of the password.

Added

• Sleep timer — from the player menu: any length (hours, minutes, seconds), quick presets, or the end of the current track. Playback stops when it runs out.
• Android Auto: albums, artists and downloads — browse them from the car screen too, and Musonic starts in Android Auto even when the app was closed.
• New player (test) — in Settings, advanced mode: Android's own player, which lets the phone's audio chip decode the music. With the screen off, the app uses about three times less processor. Off by default while it is being tested.

Changed

• Log out really logs out: it revokes this phone's key and removes the account from the phone; you sign in again with your password.
• Much smaller app — the Android download goes from 95 MB to 30 MB (64-bit phones only, unused code and resources removed).
• My Music opens at once — the library is kept on the phone and only downloaded again when it changed on the server; the Library tile shows the real number of songs. On a Musonic Server the Home loads in two requests instead of about twenty.
• Smoother long lists — album, playlist, artist pages and My Music recycle their rows: far fewer dropped frames while scrolling, less memory.
• Lighter in the background — the app no longer redraws or polls the playback position when nothing is on screen: much less battery used with the screen off.
• The mini player is there from the start — it shows the last track as soon as the app opens; Back closes the queue first.
• Black launch screen instead of a grey flash.
• Short ids of Musonic Server 1.0.3 — the app converts what it saved (downloads, their covers, the queue, likes, recent plays, search history, pinned items) once, by itself, when the server starts using them. Nothing is downloaded again.

Removed

• The optional “Musonic API” setting — Musonic Server now does what it did (online tracks start fast on their own); its address and key are cleared from the phone.

Fixed

• A server on your home network works in plain HTTP (for example http://192.168.1.20:4533, a .local name or Tailscale): the released app used to refuse every http:// address. Addresses on the internet still need HTTPS.
• Plays are counted on the time really listened — half the track (or 4 minutes); skipping to the end no longer counts, the same rule as Musonic Web.
• Artist pictures — artists without a picture of their own now show one of their albums instead of an empty image.
• A refused account no longer leaves the app stuck offline: when its key was revoked, the account suspended or the password changed, the app goes back to the sign-in screen, filled in, and says why.
• The log out question names the account and the server (it showed the server address twice).

---

With Musonic Server 1.0.3, ids become short and the app converts what it saved by itself, once. The device key needs a Musonic Server; other Subsonic servers keep working with a sign-in token.

Musonic Server 1.0.2

Added

• Routes for Musonic's own clients, announced by version 2 of the musonicServer OpenSubsonic
  extension (ADR-021): getMusonicLibrary (every song of the library in one kept answer with
  an ETag, only the fields the clients use), getMusonicHome (the first wave of the home
  screen in one answer) and getMusonicHomeMore (its second wave: similar artists' albums,
  similar songs, genre mixes, chained on the server). About 20 requests in 3 waves become 2.

Fixed

• search3 / search2: the offsets (songOffset, albumOffset, artistOffset) were capped at
  500 like the counts, so a client listing the whole library by pages of 500 got songs 500–999
  again and again and never the ones past the 1000th.

Musonic Server 1.0.0

Added

• Project structure, PolyForm Noncommercial 1.0.0 license.
• SQLite database (schema v1) with built-in migrations: canonical tracks with local files and
  online sources, albums, artists with roles, genres, folders, accounts, per-device API keys,
  sessions, per-user likes / ratings / play counts, scrobbles, playlists, saved play queue,
  lyrics cache, accent-insensitive full-text search.
• Audio provider interface with conformance checks and an in-memory example provider.
• Shared segment cache for provider streams, track matching, tag writing (from Musonic API).
• /health endpoint, with the state of the last scan.
• Library scanner: reads tags (several artists, composers, genres, dates, ISRC, MusicBrainz
  ids, embedded pictures and lyrics) and audio properties; rescans only the folders that
  changed (folder hash); keeps the track, its likes and playlists when a file moves, is
  duplicated or disappears; attaches an imported file to the track first seen online (ISRC,
  else title + artists + length); picks album covers (cover.*, folder.*, front.*, then
  embedded) and sidecar lyrics (.lrc, .txt). Tracks without an album go to
  "[Unknown Album]". Misnamed files (AAC in a .mp3) are still read.
• Library watching: changes in the music folder are scanned a few seconds later; scheduled
  scan every hour (MUSONIC_SCAN_INTERVAL_MINUTES).
• musonic-server scan [--full]: scans once and prints what it did.
• Accounts: administrators and users, passwords hashed with argon2id, one revocable API key
  per device (only its hash is stored), sign-in sessions (30 days, sliding), a new password
  ends the other sessions, the last administrator cannot be deleted. Failed sign-ins are
  limited per address and account.
• Subsonic API (/rest): sign-in by password (p, also enc:), legacy token (t + s, on by
  default, the password then kept encrypted with AES-256-GCM under a key outside the
  database: MUSONIC_SECRET_KEY or secret.key) and OpenSubsonic API keys; XML, JSON and
  JSONP answers; form posts; ping, getLicense, getOpenSubsonicExtensions, tokenInfo,
  getUser, getUsers, createUser, deleteUser, changePassword, getMusicFolders.
• Native API (/v1): first administrator (/v1/setup), sign-in / sign-out, profile, password,
  device keys, accounts.
• CORS open to any origin (no cookies), for browser clients.
• musonic-server user add <name> [--admin].
• Subsonic browsing: getArtists, getIndexes, getArtist, getAlbum, getSong,
  getMusicDirectory, getGenres, getAlbumList2 / getAlbumList (random, newest, highest,
  frequent, recent, alphabetical, starred, by genre, by year), getRandomSongs,
  getSongsByGenre, getStarred2 / getStarred, getTopSongs (most played here),
  getSimilarSongs2 (same artists and genres), getArtistInfo2 (similar artists by genre),
  getAlbumInfo2, getScanStatus, startScan, getNowPlaying, getPlaylists,
  getPlaylist, getInternetRadioStations (none); OpenSubsonic fields (several artists,
  album artists, genres, release date, ISRC, sampling rate, bit depth).
• Search (search3, search2): every word as a prefix, accents ignored; an empty query lists
  everything.
• Playback: stream sends the file with HTTP ranges (seeking), or transcodes with ffmpeg when
  a lower bit rate or another format is asked (MP3, Opus, AAC, Vorbis; the file as is when
  ffmpeg is missing); download.
• Covers (getCoverArt): the album's image file or embedded picture, resized on request
  (JPEG) and cached on disk.
• Lyrics: getLyricsBySongId (synced lines from .lrc files) and getLyrics.
• Likes and ratings: star / unstar (songs, albums, artists, several at once; liking again
  keeps the first date), setRating.
• Plays: scrobble counts a play for the song, its album and its artists (with the client's
  date when given), feeding the "frequent" / "recent" lists and top songs; submission=false
  shows the song in getNowPlaying until it would have ended.
• Playlists: createPlaylist (new, or every song replaced, which is how clients reorder),
  updatePlaylist (name, comment, public, songs added and removed), deletePlaylist; only
  the owner may change them. Positions sent by clients count the songs they see: a song whose
  file is gone stays in place, untouched, and comes back with its file. Song counts and
  durations count the songs shown.
• Saved play queue: savePlayQueue / getPlayQueue and the OpenSubsonic …ByIndex variants
  (indexBasedQueue extension), to resume on another device.
• Online catalog, from Deezer's public API (no account, metadata only; online, on by
  default): search3 / search2 add online songs, albums and artists after the library's
  (first page, nothing shown twice); getSong, getAlbum, getArtist and getCoverArt open
  online items (dz-track-…, dz-album-…, dz-artist-… ids). Answers are cached and requests
  kept under the API's limit.
• Online songs liked, rated, played, queued or added to a playlist are stored as library tracks
  without a file, under a library id (or linked to the library track of the same recording:
  ISRC, else title, artists and length). Their album and artist pages open, with their covers.
  They show in likes, playlists and the queue, not in the library lists until their file is
  imported; the imported file then joins the same track, which keeps its likes and playlists.
• Songs without a file play from audio providers, tried in order, through the shared segment
  cache (seeking works, several listeners share one stream, idle streams are freed). Included:
  a relay to another Subsonic server (an OctoFiesta, a Navidrome: found by ISRC, else title,
  artists and length) and, last, the 30-second online preview.
• Imports: an online song liked, part of a liked album or added to a playlist is downloaded in
  the background from a provider whose files may be imported (never a preview), tagged, filed
  in <music folder>/Musonic/Album Artist/Album/NN - Title.ext and scanned: it joins the same
  track, which keeps its likes and playlists. Failed imports are tried again (5 min, 30 min,
  2 h, 12 h), then given up until asked again. Settings: import, import_dir,
  import_quality. /health counts them.
• Online albums and artists can be liked whole (albumId / artistId with dz-… ids): a
  liked album's songs are imported; liked albums and artists known only online show in the
  likes.
• musonic-server import-navidrome <copy of navidrome.db>: playlists, likes, ratings, play
  counts and plays of the accounts that exist here (same user name), tracks matched by their
  file (then ignoring case and accents); tracks and playlists keep their Navidrome ids
  (--new-ids otherwise), albums and artists get ids from their tags. Safe to run again
  (--replace-playlists to import playlists again). Tested on a real library: 15 playlists,
  432 entries, 2 858 plays, in about a second.
• Daily database backup (consistent copy while running) in data_dir/backups, 14 days kept
  (backup_days).
• Dockerfile (with ffmpeg) and compose.example.yml.
• Clients can tell Musonic Server from another Subsonic server: OpenSubsonic extension
  musonicServer and GET /v1/info (version, native API version, features), both without
  signing in.
• Real-time events: GET /v1/events (WebSocket, token in Authorization: Bearer or
  ?token=, device id in ?device=) pushes to every device of an account what changed, from
  any client: likes, ratings, playlists, plays, the saved queue, finished or given-up imports.
  A keep-alive ping every 30 seconds; a device that falls behind is told to reload (resync).
  The device that made a change is named in by when it says who it is (X-Musonic-Device
  header or device parameter).
• online: true on songs, albums and artists that have no file in the library (online
  catalog, songs liked but not imported yet), for an "Online" badge in clients.
• Console dashboard and event bar: GET /v1/admin/status (administrators) gives live CPU,
  memory and network rates, disk space (server and music, imports apart), the library's
  figures, database / backups / caches sizes, who is listening, imports, recent activity,
  alerts (expired provider credentials, given-up imports, disk almost full, no backup for two
  days, newer server released) and the latest releases of the server and of Musonic Web,
  looked up on GitHub every 6 hours (update_check).
  Alerts are sent as their kind and figures, for clients to word them in their language.
• Invitations keep the name of the account they created, also once it is deleted.
• A suspended account signing in with its own credentials is told so (Subsonic error 50,
  native API 403), instead of "wrong password".
• Administration console, served at the server's address (admin_dir, see apps/admin).
• Account management (administrators): accounts listed with their devices and imports; role
  (always at least one active administrator), suspension (no sign-in at all, nothing
  deleted), sign out everywhere, revoke one device key. Invitation links: the person
  creates their account, choosing name and password; password reset links: they choose a
  new password (optionally signing their devices out). Links are random, stored hashed, used
  once, valid from a minute to a year; the administrator never sees a password.
• Rights and quotas of users who are not administrators, all allowed and unlimited by
  default: importing online songs, the online catalog, downloads, public playlists; imports
  per day and per month, total size of their imports, highest streaming bit rate.
• Console « Imports » (/v1/admin/imports, /v1/admin/providers): the import queue with its
  counts, retry one or every failed import, remove one; audio providers with their state; a
  provider's credential (the Deezer ARL) changed from the console, checked by the provider
  ...

Musonic Web 1.0.0

The first complete release of Musonic in the browser, made for desktop. Use it online at https://doodzprog.github.io/Musonic/app/ or host it yourself with Musonic-Web.zip.

Added

• Sign-in to Navidrome or any Subsonic-compatible server with token authentication: the password is never sent in clear. Remember me keeps you signed in on your own computer, after a clear warning about the token stored in the browser.
• Home like the mobile app: quick access, recently played, favourite artists, “More like…”, “Because you liked…”, Magic Mixes, rediscover, new in your library, random.
• Library: playlists with Liked Songs and My Music, albums, artists, and Play by genre.
• Search in your library with Songs / Albums / Artists filters and endless results, plus Browse: recently added, most played, random and one tile per decade.
• Magic Mixes: eight mixes a day from your favourite genres, each with its own page like a playlist.
• Playback engine shared with the mobile app: shuffle off / on / Magic, repeat all / one, autoplay, previous restarts after 3 s; Space and Ctrl + arrows; media keys and the desktop media controls.
• Queue panel in zones (now playing, added by you, next up, autoplay): play from any entry, remove, reorder by drag and drop.
• Synced lyrics: from the server, else from LRCLIB; the line being sung is highlighted and a click jumps to it.
• Full-screen player: blurred cover background, large cover, lyrics beside it, like, controls and volume, and the browser’s full screen.
• Floating mini player: a Picture-in-Picture window (Brave, Chrome, Edge) that stays on top of everything, even when the tab is hidden or the browser minimized. Its layout follows its size, from one thin line to a large view with like and the next track.
• Track rows: a heart for liked songs and a “+” / “✓” showing at a glance whether the song is in one of your playlists. Right click or “⋯” for play next, add to queue, add to a playlist, like, go to the album or the artist.
• Add to a playlist box with the covers and track counts; it also removes the song from a playlist.
• Playlists: create, edit the name and description (synced with every client), delete. The sidebar lists the most recently played first, with a play button on hover.
• Resizable side panels: drag the edge, double-click to reset.
• English and French: the browser language by default, your choice remembered and shared with the Musonic website. Settings in the profile menu, at the top right.
• Self-hosting: Musonic-Web.zip in every web-v release, with a short guide.

Musonic Mobile 2.0.1

Android Auto (beta) and a security fix. Musonic now shows up in Android Auto, the server credentials no longer reach other apps, and two small player touches.

Security

• Credentials no longer reach other apps — the cover of the playing track was published to the system media session (notification, lock screen) as a server address carrying the account username and password. Apps allowed to read the playing media (notification access, smartwatch companions, Android Auto) could read it. The player now only gets an address internal to Musonic, which reads the cover itself. Changing your Navidrome password after updating is advised.

Added

• Android Auto (beta) — Musonic appears in Android Auto. Browse Library → Playlists with their covers and start a playlist from any track; play / pause, previous / next and seeking work, and the playback screen gets Shuffle (off, on, Magic), Repeat and Like buttons, kept in sync with the phone. Downloaded playlists and tracks show the downloaded badge. Buttons pressed in the car do not vibrate the phone. Not there yet: albums, artists, downloads and Home in the car, voice search, and starting Musonic from the car while it is fully closed.
• Swipe the full player's cover — left for the next track, right for the previous one, like the mini player. Dragging the player down to close it still works.

Fixed

• Mini player tint — on very colourful covers, the blurred cover behind the mini player stopped in a hard vertical line next to the play button; it now fades out smoothly.

---

Turning on Musonic in Android Auto

Android Auto only lists apps installed from the Play Store. Musonic is installed from GitHub, so it stays hidden until you allow it once:

1. On the phone, open the Android Auto settings and tap Version ten times, then accept developer mode.
2. Menu ⋮ → Developer settings → Unknown sources: turn it on.
3. Open Musonic once on the phone, then connect to the car.

GrapheneOS: also open Settings → Apps → Sandboxed Google Play → Android Auto and grant the permissions it asks for, otherwise Android Auto stops as soon as the car connects.

---

Download: Musonic.apk below (Android 7+). iPhone: Musonic.ipa, to sideload with AltStore or Sideloadly (no CarPlay yet).