Meld Desktop 0.3.0

Update recommended for everyone on 0.2.0. 0.2.0 users get this update inside the app (Settings → About, or the daily check); you can also run the setup EXE over 0.2.0. Your library, downloads and settings are kept.

Fixed

• "The native audio element could not read the resolved stream URL." In 0.2.0 every song that had already been cached or downloaded failed to play (most of Liked Songs). The asset-protocol scope pointed at the wrong folder (%APPDATA%\com.romany-osama.meld-desktop\… instead of %APPDATA%\Meld Desktop\…). The scope now points at the real data folder, those folders are also granted when the app starts, and a CI test checks that the two always match.
• Search missing songs. YouTube Music changed its search page: the top result is now a card and the other results arrive as individual sections. 0.2.0 dropped the top result and could miss others; both layouts are now read in page order.
• If a stream or cached file fails, Meld no longer stops at an error. It drops the bad cached copy or marks that YouTube source as failed for five minutes, resolves again and continues from the same position (up to two retries), then shows a clear message.
• Streams close to expiry are refreshed a minute early, so resuming after a long pause doesn't hit a dead link.

Added

• More YouTube fallbacks, like Meld for Android. When the direct-link clients (Android VR, visionOS, iOS) are refused, Meld now uses clients whose audio links are protected by YouTube's player signature and n parameter: YouTube Music web (with your account when signed in), TV and embedded players. The signature and n values are computed the same way YouTube's own web player does, using yt-dlp's EJS solver in a sandboxed QuickJS interpreter (no network, file or system access; memory and time limits). The player script is prepared in the background after start-up and cached on disk, so this fallback is fast. No DRM, ads or PoTokens are involved.
• Uploaded songs use your signed-in YouTube Music session first.
• Every stream request carries a playback nonce, and stream URLs are accepted only from HTTPS *.googlevideo.com hosts.
• Player menu → Copy playback report: a redacted list of the sources tried and why each failed (no links, cookies or e-mail addresses), for bug reports.
• Clearer errors: a failed song now lists each source tried with its reason (bot check, sign-in, age or region restriction, unavailable…).

Changed

• Signing out also clears the resolver's memory of failed sources.
• Release metadata (SBOM, third-party notices) now includes the vendored yt-dlp EJS solver, meriyah and astring.

Known limitations

• Releases are still not Authenticode-signed (Windows SmartScreen may warn); verify downloads with SHA256SUMS.txt.
• YouTube can still refuse every source for a song, for example with a bot check on some networks. Signing in usually helps.

---

Downloads: Meld-Desktop-0.3.0-x64-setup.exe (installer, recommended) or Meld-Desktop-0.3.0-x64-portable.zip (portable; needs the Microsoft Edge WebView2 Runtime, which Windows 10/11 normally include).

The installer and executable are not Authenticode-signed yet, so Windows SmartScreen may show "Windows protected your PC" — choose More info → Run anyway. Verify downloads against SHA256SUMS.txt; updates are verified with the Meld Desktop update signing key before they are installed.

Meld Desktop 0.2.0

0.2.0 merges the two diverged lines of development: everything users had in 0.1.8 (persistent session, offline Home, taskbar thumbnail buttons, lyrics provider picker, artist follow, podcast refresh, local recap, profile refresh, overlay layering) plus the security and reliability hardening that only existed on main. Everyone on 0.1.8 should update. 0.1.8 cannot update itself: run the 0.2.0 setup EXE over it (your library, downloads and settings are kept), or extract the portable ZIP over the old folder. From 0.2.0 on, updates are offered inside the app.

Security

• Session secrets (Google cookie, Spotify access token, sp_dc, sp_key) are encrypted at rest with AES-256-GCM; the key lives in Windows Credential Manager. Existing 0.1.8 databases are migrated on first start and the database is vacuumed so no plaintext remains.
• A real Content Security Policy replaces csp: null; the asset protocol is limited to Meld's own folders, and local files are granted individually.
• Signing out also clears the WebView's sign-in data.
• Unused commands that let the WebView write an arbitrary Google cookie are no longer exposed.
• A second launch focuses the running window instead of starting another instance.

Fixed

• Interrupted downloads are kept as resumable instead of stuck in "downloading"; network requests have timeouts and stalled downloads stop after 30 seconds without data.
• Expired stream URLs are re-resolved instead of failing or skipping; a newer play request always wins over an older one, and replaying the same song restarts it.
• Settings shows Audio quality once.
• Accessibility: keyboard focus outlines, aria-pressed/aria-current, minimum 12 px text and WCAG AA muted-text contrast.

Added

• Updates: Settings → About shows the version and can check for, download and install signed updates (your library is backed up first). Meld Desktop also checks quietly once a day and tells you when an update is available. The portable version gets a link to the download page.
• Each release now ships SHA256SUMS.txt, a CycloneDX SBOM, THIRD-PARTY-NOTICES.txt and build provenance attestations.

Changed

• Restoring a backup streams the library to disk and rejects oversized archives instead of reading them into memory.
• The portable ZIP now includes the taskbar button icons (missing from 0.1.8's ZIP), a README-portable.txt and the licence files.
• Version 0.2.0 everywhere (installer, About, Rust crate) from one source.
• Release binaries are no longer committed to the repository; they are published only as GitHub Release assets.
• Packaging: NSIS setup and portable ZIP only (no MSI).

---

Downloads: Meld-Desktop-0.2.0-x64-setup.exe (installer, recommended) or Meld-Desktop-0.2.0-x64-portable.zip (portable; needs the Microsoft Edge WebView2 Runtime, which Windows 10/11 normally include).

The installer and executable are not Authenticode-signed yet, so Windows SmartScreen may show "Windows protected your PC" — choose More info → Run anyway. Verify downloads against SHA256SUMS.txt; updates are verified with the Meld Desktop update signing key before they are installed.

Meld Desktop v0.1.8

UI layering fixes: Details and child overlays now remain above the player, while the integrated lyrics panel stays inside the player. Player controls retain the responsive single-row layout and long titles stay constrained with hover access. MSI is intentionally omitted; this release contains Portable ZIP and NSIS setup EXE.

Meld Desktop v0.1.7

Meld Desktop v0.1.7

What changed

• Combined the full-player Share, Like, More, Previous, Play, Next, Shuffle, Repeat, and Queue controls into one responsive row.
• Limited the full-player song title to one line with an ellipsis; the complete title remains available through the hover tooltip.
• Made the lyrics viewport use the available right-hand player-column space instead of a fixed content height, with balanced internal spacing for synchronized-line centering.
• Preserved the existing lyrics Provider selector and Back/Forward controls.
• Retained the Google profile refresh introduced in v0.1.5: one authenticated startup check using the existing session, with local fallback when offline.
• Left Spotify behavior unchanged.
• Published the portable ZIP and NSIS setup EXE only. MSI is intentionally not included in this release.

Files

• MeldDesktop-0.1.7-portable.zip — portable Windows package with taskbar thumbnail resources.
• Meld.Desktop_0.1.7_x64-setup.exe — NSIS Windows installer.
• SHA256SUMS.txt — SHA-256 checksums for both Windows packages.
• MeldDesktop-0.1.7-source.zip — source archive from tag v0.1.7.

User data, downloads, library data, and session state are stored separately from the application binaries and should be preserved when replacing the portable package or installing over an existing NSIS installation.

Meld Desktop v0.1.6

Meld Desktop v0.1.6

This release contains the two requested application fixes.

Player title layout

Long song titles in the full player are now constrained to a maximum of two lines with a responsive ellipsis, so they cannot escape the player card or overlap the lyrics area. Hovering the title shows the complete original name through the normal Windows/browser tooltip. Artist metadata remains constrained to the available width.

Google profile refresh

When a saved Google / YouTube Music session exists, Meld Desktop performs one authenticated profile check during startup using the existing session. If the account name, channel handle, email, or avatar changed, the updated values are stored locally and shown without requiring logout and login. If the request fails or the app is offline, the last locally saved profile remains available and startup continues normally. The check does not create a new login session, does not loop, and does not run when merely opening Settings.

Spotify integration and its like/playlist behavior were not changed. Offline Home cache, Downloads, Library, cached lyrics, artwork, playback persistence, and the verified Windows icon/taskbar resources remain included from earlier releases.

Windows packages

The release includes the portable ZIP, NSIS setup EXE, MSI installer, checksums, and GitHub's source archives. The MSI is included for user testing as requested; the separate MSI installation investigation is intentionally not treated as a blocker for this release.

Meld Desktop v0.1.4

Meld Desktop v0.1.4

This release packages the continuous playback session, offline Home fallback, and verified Windows distribution artifacts.

Highlights

• Restores the current queue, playlist context, selected track, playback position, and play/pause state across restarts without persisting expired stream URLs.
• Refreshes Home after Google / YouTube Music account connect or disconnect and displays the connected account avatar.
• Saves the last successful Home response in local SQLite and returns it when the network is unavailable.
• Keeps Downloads, Library, local playlists, downloaded artwork, cached lyrics, and local playback available offline.
• Rebuilds Windows portable, NSIS setup, and MSI artifacts with the Meld Desktop application icon embedded in the executable.
• Includes the six taskbar thumbnail toolbar resources beside the portable executable.

Offline scope

Offline playback applies to downloaded or locally cached tracks and saved lyrics/artwork. Search, radio, recommendations, online account synchronization, and fetching new lyrics still require an internet connection. The app does not add advertisements or implement upstream ad bypassing.

Assets

• meld-desktop-0.1.4-portable.zip — complete portable folder; keep the adjacent icons/taskbar directory after extraction.
• Meld Desktop_0.1.4_x64-setup.exe — NSIS installer.
• Meld Desktop_0.1.4_x64_en-US.msi — MSI installer.
• meld-desktop-0.1.4-source.zip — source archive for this tagged commit.
• SHA256SUMS.txt — SHA-256 checksums for all release archives and installers.

The release is published from the feat/source-parity-next branch. The main branch is not changed by this release operation.

Validation

Check	Result
TypeScript and Vite production build	Passed on Windows
Tauri Windows build	Passed
EXE associated-icon extraction	Passed; Meld logo embedded
Portable taskbar resources	Passed; six resources present
NSIS setup generation	Passed
MSI generation	Passed
Desktop-only source tree check	Passed; no Kotlin, Java, Gradle, or Android manifest files tracked

Meld Desktop v0.1.3 — Lyrics provider picker

What's changed

Meld Desktop now lets you choose the lyrics provider directly from both the Lyrics window and the Full Player.

The new Provider box includes Automatic provider order, BetterLyrics, Paxsenix, LrcLib, KuGou, LyricsPlus, Musixmatch, YouTube Subtitle, and YouTube. Automatic keeps the configured order and normal cache behavior. Choosing a provider manually requests that provider specifically, replaces the cached lyrics with its result, and shows a clear provider-specific error when that source has no match. Choosing Automatic again refreshes the configured provider order instead of staying on the manually selected cached result.

The existing provider enable/disable switches, ordering controls, synchronized lyrics, line seeking, offline lyrics cache, and dark blue-black Meld layout remain unchanged.

About missing lyrics

Some songs do not have lyrics published by any of the available sources. When every provider returns no match, Meld Desktop reports that result rather than showing unrelated or guessed lyrics. This is a limitation of source availability, not a missing application feature.

Validation

Check	Result
TypeScript no-emit and Vite production build	Passed
Cargo check and Rust tests	Passed; 23/23 tests
Linux production gates	Passed
Windows release Cargo check/test and Tauri build	Passed
Windows portable startup smoke	Passed; 12 seconds, zero TCP listeners, clean close

Portable download

Extract the complete ZIP folder. Keep the icons/taskbar folder next to the executable so the native Windows taskbar thumbnail controls can load their icons. This package is portable and does not install a Windows service or localhost playback server.

Scope and safety

Meld Desktop does not add advertisements, invent lyrics, or implement protected-stream handling, DRM circumvention, ad bypass, or browser playback. The project remains an independent Windows desktop adaptation and is not an official Meld release.

Meld Desktop v0.1.2 — Safe parity gap batch

Meld Desktop Changelog

0.1.2 — Safe parity gap batch

Added

• Added native artist Follow/Following behavior in artist details. Artist bookmarks are persisted locally, and authenticated YouTube Music subscription/unsubscription requests are sent when a valid channel ID is available.
• Updated the Artists library query so followed artists remain visible even when they do not yet have locally saved songs.
• Added Refresh saved to the Podcasts library. Saved podcast details are re-fetched through the existing authenticated YouTube Music browse contract and their metadata/detail JSON is persisted locally.
• Added Refresh to podcast detail surfaces.
• Added a clearly labeled device-only Local listening recap in Stats, calculated from real Meld Desktop playback history with plays, minutes, unique songs, top song, and top artist.
• Retained the previous batch features: native Windows taskbar thumbnail Previous/Play-Pause/Next controls and mouse-wheel volume adjustment over the mini and full player volume controls.

Validation

• TypeScript no-emit check: passed.
• Vite production build: passed.
• Cargo check: passed.
• Rust tests: 23/23 passed.
• Linux Tauri no-bundle build: passed.
• Windows npm, release Cargo check/test, and Tauri no-bundle build: passed.
• Windows portable startup smoke: passed for 12 seconds with zero TCP listeners and clean close.

Portable installation

Extract meld-desktop-0.1.0-gap-batch-portable.zip as a complete folder. Keep meld-desktop-0.1.0-gap-batch.exe beside icons/taskbar/*.ico; the thumbnail toolbar requires those resource files. The package is a no-bundle portable candidate and is not an installer.

Why some source gaps are not included

Last.fm requires a user-authorized Last.fm session and real API signing. Discord Rich Presence requires a registered Discord application/client ID and native IPC or SDK lifecycle. Listen Together requires a synchronization/signaling service. Qobuz requires an authorized catalog/playback contract. Google Cast requires a receiver/session/content contract. A Tauri updater requires project-owned signing keys and an HTTPS update endpoint. ShazamKit recognition is an Apple framework, while Android Auto, Android notifications, Android audio focus, and Android offload have no 1:1 Windows runtime.

Equalizer/DSP, crossfade, skip silence, and loudness normalization are not exposed as inert switches; each requires a tested Windows audio graph that preserves direct playback, local files, seeking, queue transitions, and error recovery. Remote Wrapped and source-identical recognition remain separate contracts, so the included recap is explicitly local.

Protected or transformed YouTube stream handling—including PoToken/BotGuard extraction, signatureCipher/n-transform resolution, SABR playback, DRM/Widevine, ad bypass, ripping, browser playback, and localhost playback—is intentionally outside this Windows port. The app does not insert advertisements or promise behavior controlled by the upstream service.

Meld Desktop v0.1.1 — UI Fixes

Meld Desktop v0.1.1 UI Fixes

This release contains targeted UI corrections on top of the source-parity desktop build. It preserves the existing Meld-inspired blue-black identity and player/library behavior while correcting two reported interaction problems.

Included fixes

• Search history is now shown only while the search input is focused.
• Search history closes when the user clicks outside the search box or submits a search.
• Search history has an independent maximum height and scroll behavior.
• The Full Player close button is explicitly positioned at the panel's top-right.
• Close controls for playlist, detail, queue, and other scrollable surfaces retain their intended behavior.
• Existing playback, offline audio/artwork/lyrics, queue, library, and settings contracts are unchanged.

Validation

• TypeScript check passed.
• Cargo check passed.
• Rust tests passed: 23/23.
• Linux production build passed.
• Windows production build and Tauri no-bundle passed.
• Windows startup smoke passed for 12 seconds with 0 TCP listeners for the app process.

Scope and parity statement

This is a Windows desktop adaptation of Meld/Metrolist, not a literal 1:1 Android implementation. It continues to use the native Windows WebView2 HTML audio path rather than Android Media3/ExoPlayer. Contract-gated integrations, Android-only features, advanced DSP/audio architecture, and protected-stream transformations remain outside the implemented scope. The application contains no ad SDK or app-inserted offline ads, but upstream service behavior cannot be guaranteed.

Source commit: 3c6f68516f08efa4a129bdbfd6681ecff8d8be64

Portable artifact: meld-desktop-0.1.0-search-history-x-fixed.exe

SHA-256: 7DB4AAD684DA5FC92E867823375BD59E73721B93807FE1C713CB4AFEA4A5A87A

Meld Desktop v0.1.0 Source Parity

Meld Desktop current source-parity build

This release packages the audited Desktop source at commit b891ec29 on the feat/source-parity-next branch. It includes the current native Tauri Windows portable executable and the source-backed UI, playback, queue, offline, lyrics, Library, Spotify, podcast, history, stats, settings, and Discover work completed in the audit.

Included and validated

• Native Tauri/WebView2 Windows executable; no Electron, Java runtime, localhost playback server, or app-injected ad SDK.
• Home and typed YouTube Music search flows, artist/album/playlist/podcast navigation, queue continuation, source-aware autoplay/recommendations, shuffle, Repeat One/All, and optional auto-skip.
• Offline native downloads with temporary-file recovery, Range resume, cancellation, local audio/artwork/lyrics, and separate Downloaded/Cache/Local surfaces.
• Source-aligned AudioQuality values (auto, high, low) for direct original formats, including quality-aware player cache and persisted player volume.
• Library, Liked Songs, local playlists, Spotify folder/playlist flows, podcasts, history/playtime, stats, backup/restore, and Home shortcuts for Explore, Charts, Moods & Genres, and New Releases.
• Static and release gates passed: TypeScript, Cargo check/test with 23 Rust tests, Windows release build, Tauri no-bundle build, and 12-second startup smoke with zero TCP listeners for the application.

Important limitations

This is not a claim of literal 1:1 Android parity. The current Desktop build still differs from Media3/ExoPlayer and does not implement protected or transformed stream mechanisms (signatureCipher, cipher, SABR-only, DRM, PoToken/n-transform/ad bypass). Windows Auto quality currently falls back to High because native metered-network detection is not wired.

Listen Together, Cast, Last.fm, Discord RPC, Qobuz, updater signing, Recognition/Shazam, full Wrapped, Android Auto, Android-only focus/notification/alarm integrations, and advanced DSP such as equalizer/crossfade/normalization/skip-silence remain unavailable or contract/platform gated. Spotify's internal GraphQL operations may change upstream. Manual Windows validation is still required before treating this as a final production release.

The application contains no app-inserted advertisements and no ad SDK. Upstream service behavior is outside the application's control, and no guarantee is made about upstream ads or policy changes.