v0.3.2

Hardware-validated fixes for the native daemon, found by the first live smoke test on a third-party Cast receiver (Philips TPM191E):

Fixed

• media-load no longer hangs forever on receivers that never ack the app-transport CONNECT — the CONNECT is now fire-and-forget, like every production sender. Verified live: load → PLAYING → pause → play → stop.
• A load retry after such a hang could crash the daemon (use-after-free in the client teardown chain); explicit teardown is now silent and deferred resets only target the dying client. A timed-out load also drops its half-open session.

Added

• The daemon logs the receiver's idleReason when playback aborts, distinguishing dead/unreachable content from protocol bugs.

The extension is unchanged since 0.3.1 (in AMO listed review). AUR package updated to 0.3.2. Full details in CHANGELOG.md.

v0.3.0

Hardening + modern best practices release. Highlights from the changelog:

Added

• SECURITY.md (security model + private vulnerability reporting), CONTRIBUTING.md, PR template
• Format configs (.prettierrc, .editorconfig, Chromium .clang-format) enforced in CI
• Dependabot; all workflow actions pinned by commit SHA
• Input validation at trust boundaries (daemon: poster URL / device IP; extension: castability shape)

Fixed

• Daemon: async replies addressed by stable connection ids (no fd-reuse misdelivery); mirror stop thread tracked and joined; socket path overflow guard; Lounge ids URL-encoded
• Extension: reply-timer cleanup, session persistence across MV3 suspension, takeover confirm expiry
• web-ext 10 + patched shell-quote: npm audit clean

Changed

• daemon.cc request handling split into per-action handlers
• CI: native-sanity job, id-sync/format checks, regen-patch --verify-only
• Shared nm-host wrapper template (install + PKGBUILD)

Full details in CHANGELOG.md. The signed .xpi will be attached by the release workflow once the AMO signing secrets are configured.