v1.33.0

Your indexer and download client credentials were being sent back to the browser.

Every settings page load returned the stored keys and passwords in full, masked
on screen but plainly readable in the network tab, in page state, and to
anything else with a view of an admin's session. Both APIs are write only from
this release on. The rest of the release is the backlog: the oldest requests in
the tracker, several of them open since June, plus the box sets that fill a
default install and the fix match that quietly rewrote people's folder layouts.

Added

• Hardcover can be promoted to the primary metadata provider (#2040). metadata.primary_provider now accepts hardcover alongside openlibrary (still the default) and dnb. Selecting it lets Hardcover's curated catalogue define what an author's book list is, instead of only enriching OpenLibrary's, which for English language libraries means far fewer translated editions, omnibus bundles, alternate title duplicates and non book entries landing in the wanted list. It requires a Hardcover API token: the selector stays disabled until one is saved, the setting is rejected without one, and a token removed out of band makes Bindery fall back to OpenLibrary with a startup warning instead of failing every lookup. Changing it is safe for an existing library, because the catalogue provider is chosen per author from the ID they are already linked to, so authors added under OpenLibrary keep syncing from OpenLibrary and are not duplicated. The new primary applies to authors added afterwards.
• Indexers now show when they have stopped working (#1935). An indexer answering every search with "Account suspended" looked completely normal in Settings: enabled, no badge, no warning, nothing sent anywhere. The only trace was the search details panel on a book page, and only if you happened to run an interactive search and expand it, so an expired subscription or a revoked API key could sit there for weeks quietly dropping that indexer out of every automatic grab. Bindery now remembers whether each indexer answered its last search and shows it on the Indexers tab, in red when the credentials were rejected and someone has to fix it, in amber when it is a rate limit that clears on its own. A hard rejection also sends a notification, once when it starts rather than once per search. The indexer is never disabled automatically: that switch stays yours.
• The book page now says where its metadata came from (#1707). A Metadata source section names the provider, shows the identifier the book is bound to with a copy button, and lists every other provider id the same book is known by. With OpenLibrary, Hardcover, Google Books and DNB all in play there was no way to tell which record you were looking at, or whether a book was worth re binding. Providers whose public page can be built from the stored id get a link out; the rest show the id on its own rather than a link that goes nowhere.
• Linked Hardcover series now link out to hardcover.app (#1708), both in the candidate list while you are picking a series and on the linked series itself. Light novel searches routinely return the novel, its manga adaptation and a spin off under near identical names, and there was no way to open any of them before choosing. Bindery records the series slug when a link is made and fills it in for series linked before this release the next time their Hardcover catalogue is checked. A series with no slug yet shows no link rather than one that 404s.
• Create a book from Manual Import's unmatched files (#1719). An unmatched file could only be pointed at a book already in the library, so a file for a book nobody had added yet dead ended on the page that found it. Unmatched rows now offer a metadata search that creates the book, and its author when new, then resolves the row against it.
• Sort the Authors list by display name (#2102). The list could only be ordered by sort name, so an author filed under a surname was hard to find by the name actually shown. First name A to Z and Z to A join the existing buttons, ordered by a new folded name_sort_key column so accented first names sort in place rather than after Z.
• Clear a queue item without touching the download client (#2167): DELETE /api/v1/queue/{id}?removeFromClient=false, and "removeFromClient": false on POST /api/v1/queue/bulk-delete. Removing a queue item has always told the client to drop the job, which for a torrent ends the seed, so a stale row left behind by an out of band import could not be cleared without losing the release. The default is unchanged, and deleteFiles=true alongside removeFromClient=false is rejected with a 400 rather than silently ignoring one of them.

Changed

• An automatic grab now records when part of the indexer pool never answered (#1936). A failing indexer returns no results, which looked exactly like an indexer that had nothing to offer. So if two of your three indexers were down, auto grab quietly picked the best of whatever the third returned and nothing anywhere said that most of the pool was never asked. If the release you wanted was on one of the other two, it simply did not get grabbed. Grabs decided this way are now stamped with how many indexers failed and why, visible in History, and logged rather than buried at debug level. What gets grabbed is deliberately unchanged: this makes the decision auditable first, so that acting on the signal can be a separate and deliberate choice.

Fixed

• Box sets no longer fill an author's catalogue on a default install (#1780). OpenLibrary files a box set as an ordinary work, so "The Lord of the Rings 3 Books Box Set" arrived looking exactly like a book, monitored and Wanted, and went looking for releases. Removing them used to need either a Hardcover token or the Skip part books switch in the metadata profile, and neither is on out of the box. Titles that unambiguously name a bundle (box set, boxed set, "(Boxed)", collection set, "3 Books Set", "Carton of 10 Signed Copies") are now dropped from every author catalogue on ingestion, including the Audible supplement, whatever your providers and settings are. The judgement calls stay with Skip part books: a bare trailing "Omnibus", slash separated titles like "Title A / Title B", and "Books 1-3" are still only filtered when you turn it on, because each of those has real single books it would wrongly catch. "Trilogy" is filtered by neither, since plenty of real books are subtitled "Book One of the X Trilogy". A bundle already in your library keeps its row and its files; the catalogue simply stops offering it back.
• The quality profile editor now offers every format release parsing recognises (#1700). It listed only 8 of the 17 formats the search pipeline can label, so once v1.28.2 made the allow list authoritative (#1693), AZW, DJVU, CBR, CBZ, FB2, LIT, RTF, TXT and OGG could never be allowed for an author with a configured profile. All nine are now available as "+ Add" chips in the editor, and new profiles still start from the familiar PDF, MOBI, EPUB, AZW3 seed. A drift test keeps the editor's vocabulary locked to the parser's so the two cannot diverge again.
• Hardcover list sync no longer downloads books nobody asked for (#2124, #2217). Each list now has a "Download books from this list" checkbox under Settings > Import. On, which is the default and the old behaviour, synced books are created monitored and wanted. Off, they land in your library unmonitored, so a 400 book Want to Read shelf becomes something you browse instead of a 400 book download queue. The setting is the list's existing monitorNew API field, which was persisted and settable but read by nothing. Authors created by a list also stop pulling their entire back catalogue in on their first metadata refresh, because the syncer now pins monitorNewItems to "none" alongside the monitor mode, so only the listed books are added. The install wide default for monitorNewItems proposed in #2217 is not part of this change.
• Fix match now warns that it moves and renames the file, and shows where (#2055). Reassigning a file to a different book runs the full import pipeline, so the file is relocated into the target book's folder and renamed from your naming template, and nothing said so. Clicking a candidate committed straight to it, the request returns before the move runs, and there is no undo, so people with an existing library discovered their folder layout had been rewritten only afterwards. Picking a book is now a selection rather than the commit: Bindery asks the server where the file would land, shows that exact path next to the current one, spells out that the file is moved and renamed and that the move cannot be undone from Bindery, and waits for you to confirm. When the file is already where the template would put it, it says so instead of warning about a move that will not happen. Reassigning the metadata link without relocating the file is still not possible, and that half of the issue stays open.
• Refreshing an author after relinking them to a different metadata provider created a second copy of books you already had (#1705). With a Hardcover linked series, using Find better metadata on the author, picking their OpenLibrary entry and refreshing produced two rows for the same volume, one from each provider, and the only way out cost you the series link. A book row could only ever record one provider's id, so a work arriving from a second provider looked like something new. Books now keep track of every provider id they are known by, the way authors have since v1.26, so the same volume seen through two providers resolves to the one book you already have. This stops new duplicates rather than merging existing ones, which still need removing by hand.
• Hardcover series membership no longer disappears for books OpenLibrary also lists (#2207). When a Hardcover work matched a work from your primary metadata provider, the merge kept its rating, cover, description and genres but silently dropped its series. The only books that ever gained a series were the ones Hardcover has and OpenLibrary does not, so anthologies and tie ins were linked while the actual novels were not. Books created from now on are linked into the series Hardcover puts them in, which also fills the Edit author > By series picker and lets the By series monitor mode catch new books on discovery.
• Download client Host field rejects a pasted URL instead of saving something that cannot work (#2203). Pasting a value like 192.168.1.50:8080/#/ out of a browser address bar used to save fine and test green, then fail on every poll with invalid character '<' looking for beginning of value. Bindery now says which part of the value belongs in the Port field and which belongs in URL Base, fails Test for a client already saved with one, and marks it unhealthy in the client list.
• qBittorrent errors say what came back (#2203). A response that is not JSON is now reported as an HTML page from the WebUI, along with the two settings that route a request away from the API, rather than as a JSON parser message about a stray <.
• IPv6 download client hosts work in both spellings (#2203). ::1 and [::1] now reach the same address whichever client type you use; previously each spelling worked for only half of them.
• Deluge grabs failed while the connection test passed (#2204). Deluge's Web UI and its deluged daemon are separate processes, and Bindery only logged in to the Web UI. A session that had not been attached to a daemon accepted the login and then failed every torrent operation behind it. Bindery now attaches the session to the configured daemon after logging in, and the connection test reports the problem instead of passing when no daemon is attached. With several daemon hosts configured Bindery names them and asks you to pick one in the Deluge Web UI rather than guessing.
• Editing a download client no longer wipes fields the request left out (#2213). An update now applies on top of the saved row, so a client that omits enabled, useSsl, category or priority leaves them as they were. Sending false explicitly still turns a setting off.
• Corrected the queue removal doc comment (#2167). It claimed removing an item "preserves the seed" for torrent clients. The data survives on disk, but the torrent itself was deleted from the client, so nothing was seeding it.

Security

• Indexer and Prowlarr API keys are no longer sent back to the browser (#2212). The settings pages used to receive every stored indexer and Prowlarr key in full, so the credentials were readable from the network tab, from page state, and from anything else with a view of an admin's session. Responses now return an empty apiKey plus an apiKeyConfigured flag. The edit forms start blank: leave the field alone to keep the saved key, or type a new one to replace it. API clients get the same contract, with a new clearApiKey: true body field for deliberately removing a key.
• Download client passwords and API keys are no longer sent to the browser (#2213). The download client API used to return the stored qBittorrent, Deluge, Transmission, rTorrent and NZBGet passwords, and the SABnzbd and NZBGet API keys, in full on every list and fetch, so they sat in the settings page in plain text behind a password mask that only hid them visually. Responses now blank them and report apiKeyConfigured and passwordConfigured instead. The edit form starts blank: leave the credential field alone to keep the saved one, or type a new one to replace it. Changing a client's type still drops the credential it no longer uses.
• Warn when local-only auth mode runs without a trusted proxy configured. In local-only mode Bindery serves any client whose resolved IP is private without a login. With BINDERY_TRUSTED_PROXY unset that decision is made on the connecting peer, which behind a reverse proxy or a Kubernetes ingress is the proxy's own private address, so every proxied request counts as local. Bindery now logs a warning at startup and when the auth mode is changed if it sees that combination, Settings > General > Security shows the same text inline under the authentication mode control when you select the mode, and the deployment docs state the requirement. Instances reached directly on a LAN are unchanged.