v0.4.0 — Apple in the browser, notch island, one-command install

What's Changed

• Fix 12 contract and safety findings from final review by @sriinnu in #5
• Rewrite web app with React + Vite + onboarding wizard by @sriinnu in #6
• Fix final review blockers by @sriinnu in #7
• Bump to v0.2.0 by @sriinnu in #8
• Clean README, mark internal packages private, fix publish by @sriinnu in #9
• Bump harmond to v0.2.1 by @sriinnu in #10
• Merge CLI + daemon into single @sriinnu/harmon package by @sriinnu in #11
• Publish v0.3.0 by @sriinnu in #12
• Update docs for single-package install by @sriinnu in #13
• ci: add npm publish workflow with provenance by @sriinnu in #14
• Production hardening: MCP assistant path, provider API drift, security, engine races by @sriinnu in #15
• Getting-started walkthrough + CLI build-ordering fix by @sriinnu in #16
• fix: actually load .env — no entry point ever read it by @sriinnu in #17
• Menubar cockpit, browser-as-Spotify-device, Keychain secrets, guided onboarding by @sriinnu in #18
• Menubar app installs to /Applications as a real bundle by @sriinnu in #19
• Apple MusicKit browser player, notch island, and player UX overhaul by @sriinnu in #20
• Release pipeline: daemon-served web app, notarized builds, CI, Homebrew by @sriinnu in #21
• Pre-public hardening: dependency fixes, SKILL sync, docs prune, release blockers by @sriinnu in #22
• docs: README rate limits reflect current middleware by @sriinnu in #25
• fix: CI verify:pack — use git grep, rg is absent on runners by @sriinnu in #26

Full Changelog: v0.2.0...v0.4.0

v0.2.0 — Hardened architecture, multi-provider auth, smart play

Harmon v0.2.0

Major hardening, features, and distribution pipeline.

Install

npm install -g @sriinnu/harmon
harmon init

Or with Docker:

cp .env.example .env && docker compose up -d

What's new since v0.1.0

Architecture

• Daemon decomposed: 2620 → 982 LOC across 14 focused modules
• DaemonContext interface pattern for route isolation
• 393 tests (up from 326)

Auth (all providers now seamless)

• YouTube: full OAuth + PKCE with auto-refresh
• Apple: JWT auto-regeneration from ES256 key material
• harmon init interactive setup wizard

Features

• Smart play: harmon smart-play "song name" — searches all connected providers, plays best match
• Song recognition: harmon listen — AudD or Chromaprint (open-source, free)
• YouTube mini player: http://localhost:17373/player/youtube
• 20+ MCP tools for AI assistant integration

Security

• Crypto key rotation with SHA-256 fingerprint detection
• Loopback-only token embedding in player pages
• Fetch timeout on external API calls
• Concurrent session start mutex

Distribution

• Standalone CLI bundle (79KB, no monorepo needed)
• Docker multi-stage build + docker-compose.yml
• npm publish pipeline (all 11 packages)
• CI/CD: GitHub Actions for test + publish

v0.1.0

First production release of Harmon.

Highlights:

• harden production startup, auth, provider, storage, and daemon contracts
• align CLI, daemon, protocol, provider, and docs surfaces with implemented behavior
• add CI, stronger validation, provider/status honesty, and release hygiene
• cut the workspace and packages to 0.1.0 with runtime version sourcing from package metadata

Verification:

• pnpm lint
• pnpm exec vitest run
• pnpm build
• built entrypoint smoke check for CLI, daemon, and harmon-flow version helpers