WrzDJ v2026.06.19

🎛️ WrzDJSet (Beta) is here

This is a big one. WrzDJSet — an AI-assisted set planner built directly into the DJ dashboard — ships in Beta in this release.

Instead of hand-building a setlist track by track, you gather candidate songs into a pool, let WrzDJ draft an energy-aware running order, then refine it conversationally with an AI agent before exporting to your DJ software. The full plan-a-set loop — import → build → refine → export — is shipped and usable today.

• Build a pool from a live event's requests, your Tidal/Beatport playlists, a public playlist URL, or manual search — de-duplicated on import (by ISRC, with artist + title fuzzy fallback) and tagged by source.
• Draft the order with a deterministic, energy-aware pass that scores every transition (energy, BPM, Camelot key, transitional role, mood, artist diversity), then 2-opt refines around your locked slots and saved pairings.
• Shape the energy curve with built-in or saved templates, including slow-window markers for breaks.
• Refine with the AI agent — the set is auto-critiqued (energy dips, vibe clashes, era jumps, a banger buried too early) and you reshape it by chatting. Every agent action runs through a fixed, auditable toolkit with required rationales, full undo/redo, and autosave.
• Export to Rekordbox XML, Engine DJ, Lexicon, M3U, or plaintext — or push straight to a Tidal playlist, with a preflight check for unresolved tracks.

All AI calls route through WrzDJ's provider-agnostic LLM Gateway — no hard-coded model provider, each DJ uses their configured connector (or an org default), every call audited.

Beta means the core loop is solid while deeper integrations (local-library readers, Serato/Engine DB writes, more playlist targets, real-time collaboration, set templates, AI cost guardrails) are still on the roadmap. See the WrzDJSet (Beta) section of the README for the full picture.

---

📦 What's in this release (73 commits since v2026.06.02)

🎛️ WrzDJSet — the set builder (new)

• Two-pass builder + agent core — a deterministic ordering pass, then a conversational AI refine pass (#424, #410); the pass-2 agent split into focused modules.
• Pool import — four sources with source tagging and ISRC/fuzzy dedupe (#388, #414); drag-drop and auth-gating fixes (#431, #432).
• Energy curve editor — templates, slot-coupled targets, friction views (#415); apply / set / remove curve-point tools (#466, #468, #470, #473); large-set timeline stabilized (#433).
• Agent toolkit — set_target, lock/unlock_slot, replace_slot, move_range, suggest/add/remove_pairing, summarize_set, analyze_pool_gaps, get_track_vibes, explain_transition (#442, #455–#473); in-chat critique wired to the real LLM with surfaced transition warnings (#443); every mutation undoable (#494) and audit-logged at the dispatch choke point.
• Track vibes & community consensus — LLM vibe enrichment with three-tier resolution (your overrides → community consensus → AI baseline), community vibe controls, and DJ-curated pairings (#391, #422, #425, #435).
• Timeline reordering — hand-drag and mobile touch reorder views for the set timeline (#437, #438, #448, #449).
• Exports — Tidal, Rekordbox XML, and M3U, plus Engine DJ + Lexicon (#396, #401, #421, #453).
• Playback & feedback — Bridge-backed transport playback (#426); a play-history feedback loop (#403, #454).
• Sharing & history — read-only share links + duplicate-set (#398, #413); persisted agent sidebar history with compacted LLM context, and document history (#427, #440).
• UX — mobile chat via an Agent FAB overlay (#402, #452), target-duration/overlap settings (#428), improved locked-slot UX, and theme-correct buttons (#416, #434).

🤖 AI Engine / LLM Gateway (the foundation)

• Provider-agnostic LLM Gateway + 8 connectors (#354); org-scoped house connector with clearer AI policy (#418). No model provider is hard-coded in the set builder.

🙋 Guest join & request flow

• Frictionless join no longer degrades to the NicknameGate under bot-protection enforcement (#419, #420).
• Resolved collection-code vs join-code mismatches that caused dashboard 404s, search 403s, and bridge-app self-stop (#492).
• Event owners bypass the human-verification gate on their own request submissions (#495).
• Paginated the collect leaderboard and join list, dropping the old hard caps (#411).

📝 DJ request management

• Paginated DJ request list with field + best-match sorting, true tab counts, a server-side status filter, and an accepted_at timestamp for the "date accepted" sort (the #478 stack).
• Request timestamps now show the date when they aren't from today; the accepted queue is paginated with a true total.

🖥️ Kiosk

• Recovers gracefully when a paired kiosk's event is deleted (#475).
• X-Pair-Nonce allowed through production CORS so kiosks can re-pair (#498).

🎚️ Bridge / now-playing

• Album art resolves via Tidal, not Spotify-only (#499); the bridge app shows the join code, not the collection code (#503); tracks match when equipment embeds "(ft. …)" in the title (#501); alphatheta-connect → 0.21.1 (#450).

🔒 Security, dependencies & infra

• Pinned undici ≥ 7.28.0 to clear TLS-bypass + cache-disclosure CVEs (#508); remediated Dependabot alerts with provenance-verified pins (#445); allowed 'unsafe-eval' in the production CSP for guest fingerprinting (#496); versioned nginx http tuning (#451); CI efficiency improvements + Docker build smoke test (#429, #477).

📚 Docs

• Streamlined CLAUDE.md, splitting out ARCHITECTURE.md + SECURITY.md (#423); refreshed screenshots and documentation.

---

What's Changed

Commits

• fix(deps): pin undici >=7.28.0 to clear TLS-bypass + cache-disclosure CVEs (#508)
• added new screenshots and doc updates
• added new screenshots and doc updates
• fix(nowplaying): resolve album art via Tidal, not Spotify-only (#499)
• fix(bridge-app): show the join code, not the collection code (#503)
• fix(now-playing): match tracks when equipment embeds "(ft. …)" in the title (#501)
• fix(kiosk): allow X-Pair-Nonce through production CORS so kiosks can re-pair (#498)
• fix(nginx): allow 'unsafe-eval' in production CSP for guest fingerprinting (#496)
• fix(requests): event owner bypasses human-verification gate on POST /requests (#495)
• feat(setbuilder): make agent chat mutations undoable (#494)
• fix: resolve collection-code vs join_code mismatches (dashboard 404s, search 403, bridge-app self-stop) (#492)
• feat(setbuilder): audit-log every agent tool action at the dispatch choke point
• fix(setbuilder): address CodeRabbit review on #483
• feat(setbuilder): suggest/add/remove_pairing agent tools (#442)
• feat(setbuilder): move_range agent tool — relocate a contiguous slot block (#442)
• refactor(setbuilder): split 1400-line pass2_agent.py into focused modules
• feat(dj): show date on request timestamps that aren't from today
• fix(requests): address CodeRabbit review on #479 (direction, races, error handling)
• fix(kiosk): stop the accepted queue from squishing rows when it overflows
• feat(kiosk): paginate the accepted queue with a true total
• feat(collect): paginate + sort pending-review; drop the silent 200 cap
• fix(requests): server-side status filter, true tab counts, immediate sort reload
• feat(requests): paginated DJ request list with field + best-match sorting
• test(contracts): include accepted_at in RequestOut contract key set
• feat(requests): add accepted_at timestamp for DJ "date accepted" sort
• ci: re-add Docker Build Smoke Test check, drop slow multi-arch builds from PRs (#477)
• fix(kiosk): recover gracefully when a paired kiosk's event is deleted (#475)
• feat(setbuilder): set_curve_point/remove_curve_point agent tools (#468) (#470)
• feat(setbuilder): replace_slot agent tool — atomic track swap (#472)
• feat(setbuilder): apply_curve_template agent tool (#466) (#473)

Downloads

Platform	Artifact
Windows	bridge-app-win32
macOS (Apple Silicon)	bridge-app-darwin-arm64
macOS (Intel)	bridge-app-darwin-x64
Linux	bridge-app-linux
Deploy Scripts	wrzdj-deploy-scripts.tar.gz