These surfaced once the codec libs let macOS/Windows compile and run tests:
- ipc: bind sockets under a short /tmp dir on macOS (sun_path is capped at 104 bytes; t.TempDir() under /var/folders overflows for long test names).
- plugintrust: skip the 0600 manifest-mode assertion on Windows (no Unix perm bits; Stat reports 0666).
- pluginmgr: verify the installed plugin under the temp HOME instead of os.UserHomeDir(), which ignores HOME on Windows.
- luaplugin: run the exec output test via cmd instead of PowerShell so the process exits and closes stdout promptly, letting on_exit fire.
- fileutil: skip the unsupported directory fsync on Windows (Sync returns 'Access is denied'; NTFS does not need it), via a build-tagged syncDir. Fixes atomic writes in config, plugintrust, pluginmgr, and bundled-plugin tests.
- playlist: fileURL now prepends a leading slash for drive-letter paths so it renders file:///C:/... instead of file://C:/...
- appdir: DataDir honors HOME (consistent with Dir()); identical result on Linux, and lets tests redirect the data dir on Windows.
- tests: skip the Unix-only 0400-mode and colon-in-filename cases on Windows; raise the exec test timeout for cold PowerShell startup.
* windows: fix config, IPC, path, and Lua compatibility
* spotify: share API structures and helper so tests compile on Windows
* windows: address PR comments and fix socket unavailable detection, tasklist matching, api_fs tests, and doc comment
* windows: address remaining PR reviews (table-driven tests, m3u resolve comments & tests, blockquote formatting, and site/index.html description)
* feat: implement cross-platform IPC server with Unix and Windows support
* feat: implement Unix socket IPC server and Windows process liveness check
* ipc: detect dead processes via os.ErrProcessDone
os.Process.Signal converts ESRCH to os.ErrProcessDone since Go 1.16, so
comparing against raw syscall.ESRCH never matched and a stale socket from
a crashed instance made NewServer fail instead of cleaning it up.
* windows: simplify fs allowlist normalization, exec env, and ipc error checks
- normalize write allow-dirs once in the memoized writeAllowDirs
- collapse duplicate test helpers and repeated getenv blocks
- drop redundant errors.As branch; name WSAECONNREFUSED
- revert single-entry table test to linear form
- gofmt: trailing newlines and indentation
---------
Co-authored-by: Bjarne Øverli <bjarne.oeverli@gmail.com>
Sync docs/plugins.md and site/index.html with the expanded plugin surface:
the player.seek/volume/eq/mode and queue.change events, the cliamp.queue read
+ control API, and the cliamp.store KV API. Correct the player.mode repeat
value casing to match playlist.RepeatMode.String() (Off/All/One).
Read the playlist (list/count/current) with no permission, and mutate it
(add/jump/remove/move) under the control permission. Mutations route through
prog.Send and the model Update loop so derived state (cursor, current index,
playback) stays consistent; add() reuses the resolve.Args/Remote pipeline off
the UI thread. Indices are 0-based, matching cliamp.queue.current().
queue.save() is intentionally deferred: it needs a shared M3U encoder plus
write-path allowlisting, which belong in their own change.
Plugin stores may hold credentials (API keys, tokens). Tighten the store
directory to 0o700 and the file to 0o600, and write via a temp file + rename so
a crash mid-write cannot leave a truncated store.
Persistent namespaced key/value store backed by a JSON file at
~/.local/share/cliamp/plugins/<name>/store.json. Values round-trip through the
existing Lua<->JSON conversion, so tables/numbers/strings/bools survive a
restart. Scoped per plugin (no cross-plugin reads); no permission required.
Adds appdir.DataDir() for non-config state.
Expands the plugin event surface from a single-choke-point delta emitter in
the model Update loop, plus an explicit player.seek emission on seek finish.
Events are gated on HasHook so live-state reads (volume/EQ take the speaker
lock) only run when a plugin subscribes.
Adds a regression test that loads every bundled plugin through a real Manager
to lock the backward-compatibility contract: the plugin API only grows.
- luaplugin: route invokeHook/invokeHookWithData through the callBounded helper
and extract logHookErr, removing the duplicated context-timeout dance.
- history: build the save buffer in a strings.Builder + atomic WriteFile
(matching radio favorites), dropping the bespoke errWriter and its
per-field write syscalls.
- plex: clone cached playlist/track slices on return, consistent with the
spotify/navidrome defensive copies.
* fix(playlist): synchronize Playlist for concurrent plugin/UI access
Lua plugin callbacks run on goroutines (hooks, timers, keybinds) and read
playlist state through StateProvider closures, while the Bubbletea loop
mutates the same *Playlist. The struct had no synchronization, so reads of
p.tracks/p.order/p.pos raced with Next/Prev/Add/Remove/shuffle, and
Current()'s unguarded p.tracks[idx] could panic on a stale index.
Add a sync.Mutex and guard every exported method. Reads and writes are now
serialized; no exported method calls another, so defer-unlock cannot deadlock.
Fixes the high-severity track/player getter race and the playlist-mutation
data race.
* fix(luaplugin): block SSRF in cliamp.http
doHTTP passed plugin-supplied URLs straight to the HTTP client with no
validation, letting a plugin reach loopback, RFC1918, and link-local
169.254.169.254 (cloud metadata), and follow redirects into those targets.
Add an ssrfGuard on the dialer Control hook so every connection attempt
(including redirects and DNS-rebound hosts) is checked against the resolved
IP and rejected if non-public, and reject non-http(s) schemes up front.
A per-plugin network permission gate remains a possible follow-up; it is
omitted here to avoid breaking existing plugins that legitimately use http.
* fix(pluginmgr): sandbox plugin VM during metadata extraction
extractMetadata ran DoFile on the entire plugin file with full stdlib, so
any top-level os.execute/io call ran unsandboxed the moment a user listed
installed plugins. Apply the same luaplugin.Sandbox used by the runtime
before executing the file. Exports luaplugin.Sandbox for reuse.
* fix(luaplugin): error on oversized fs.read instead of silent truncation
fs.read used os.ReadFile (whole file into memory) then sliced to 1MB,
returning a silently truncated value as success and not bounding memory for
huge files. Stream through io.LimitReader(maxSize+1) and return an explicit
error when the file exceeds the limit.
* fix(luaplugin): make write allowlist symlink-safe
isWriteAllowed validated paths lexically: the strings.Contains(abs, "..")
check was dead (filepath.Abs already cleans "..", and it false-positived on
filenames like "..bar"), and a symlink planted inside an allowed dir could
redirect a write outside it. Resolve symlinks on the deepest existing
ancestor of the target and on the allow dirs themselves before the prefix
check. Also fixes the same gap in the exec cwd check, which reuses this
function.
* fix(luaplugin): bound timer callbacks with hookTimeout
timer.after/every called CallByParam directly with no context timeout, so a
runaway callback held the plugin mutex forever, blocking every other hook,
keybind, and visualizer for that plugin. Add a shared callBounded helper that
applies hookTimeout (mirroring invokeHook) and use it from both timer paths.
* fix(luaplugin): bound visualizer render/init/destroy with hookTimeout
RenderVis runs on the UI render loop and called CallByParam with no timeout
while holding the plugin mutex; a hanging render() froze the UI with no
escape. InitVis/DestroyVis had the same gap. Route all three through
callBounded so a misbehaving visualizer times out and render falls back to
the previous frame.
* fix(luaplugin): wait for async hook goroutines before closing LStates
Emit spawned untracked goroutines that call CallByParam on a plugin LState.
Close stopped timers/execs then closed every LState without waiting, so a UI
event dispatched just before shutdown could run against an already-closed
LState (p.L.Close does not take the plugin mutex). Track Emit goroutines in a
WaitGroup, set a closing flag under mu to reject late dispatch, and Wait
before closing the LStates.
* fix(ui): guard spectrum visualizers against zero-width panel
renderFirework/renderBubbles/renderSakura compute dotCols = PanelWidth*2 and
then mod by dotCols/dotRows/len(bands); on a narrow terminal PanelWidth can be
0, so seed % uint64(dotCols) panicked and crashed the TUI. Add the same
dotRows<4 || dotCols<4 early-out the braille-grid renderers already use.
* fix(history): do not clobber history on a transient load error
Record discarded loadLocked's error and proceeded as if history were empty,
so a one-off read failure (permission/I-O glitch) made saveLocked atomically
rewrite the file with only the new entry, destroying all prior rows.
Propagate the error instead, leaving the on-disk file untouched.
* fix(history): detect write errors before committing history file
saveLocked ignored errors from writeEntry's formatted writes, so a failure
mid-write (e.g. ENOSPC) could still rename a truncated temp file over the
real history. Thread writes through an errWriter and abort the rename when a
write fails.
* fix(lyrics): stop cleanQuery from erasing titles with label words
The noise regex matched official/lyric/audio/video as bare substrings
followed by .*, so 'Videotape', 'Audioslave', and 'Video Games' were cleaned
to empty or truncated queries, breaking lyric lookups. Restrict bare-label
stripping to genuine trailing labels (dash suffix, or 'official video/audio'
and 'lyric(s) video' phrases). Add regression test cases.
* fix(jellyfin,emby): synchronize client token/userID/album cache
Client.token, userID, and albumCache were lazily read and written from
concurrent tea.Cmd goroutines (Playlists, album browse, SearchTracks all run
in their own goroutines) with no synchronization, a data race on the lazy
auth writes and the cached slice. Add a mutex guarding those fields, taken
only around field access and never across network I/O, with double-checked
auth so at most a redundant (not racy) auth can occur.
* fix(ipc): close in-flight connections on shutdown
handleConn's read loop only observed the 60s per-request read deadline, never
s.done, and Close closed only the listener. A still-connected client (e.g. a
vis-bands polling client) kept its handler goroutine alive, so Close blocked
on wg.Wait for up to 60s. Track live connections and close them in Close so
their scanner.Scan unblocks immediately; addConn shares the conn mutex with
the done check to close the accept-during-shutdown race.
* refactor(ipc): route all reply-waits through waitReply
The reply/timeout/shutdown select was open-coded in load/theme/vis/bands/
status and waitReply was used elsewhere with a generic 'timeout' message.
Parameterize waitReply with a label and timeout and use it everywhere, which
also gives the previously-generic commands specific timeout messages.
* fix(ipc): handle accept errors instead of spinning silently
acceptLoop swallowed every non-shutdown Accept error and retried at 10/s,
treating a permanently closed listener as transient. Return on net.ErrClosed
and log other errors before backing off.
* fix(ui): notify Lua plugins on jump-to-time seek
The jump enter handler called notifyPlayback (MPRIS only) plus notifier.Seeked,
skipping plugin notification. Use finishSeek, which calls notifyAll, so a jump
seek emits the playback-state event to plugins like every other completed
seek. Seek stays synchronous (immediate seek), matching the existing test.
* fix(resolve): bound startup feed sniff with a short timeout
Args runs on the startup path and called sniffFeedURL, which did a HEAD on
the 30s feed/M3U client, so one slow CDN could stall cliamp startup for up to
30s during pure URL classification. Give the sniff a dedicated 5s client.
* fix(pluginmgr): reject empty download body
An empty 200 response left download returning a non-nil empty slice, so
Install wrote a 0-byte plugin file. Treat an empty body as a download error
so the next candidate URL is tried (or the install fails cleanly).
* fix(pluginmgr): reject raw URLs with no usable filename
A raw URL ending in '/' made path.Base yield '.' or '/', producing a
degenerate plugin filename. Return a clear error instead.
* fix(config): let --low-power=false override config-enabled low power
The override only set LowPower when the flag was true, so --low-power=false
could not disable a config.toml low_power=true. Assign the flag value
directly, matching the other boolean overrides.
* fix(main): log MPRIS/NowPlaying init failure instead of dropping it
wireMediaCtl's error was silently discarded in TUI mode, so a dbus/MPRIS
setup failure left media-control silently disabled with no trace. Log it to
the app log (not stderr, which would corrupt the TUI).
* docs(plugins): remove unimplemented player getters
cliamp.player.eq_preset(), visualizer(), and theme() were documented but
never registered in the player API (calling them errors). Implementing them
would require exposing model state to plugin goroutines, which would add a
data race; remove them from the docs so the reference matches the API.
* fix(luaplugin): reject partial bands table in set_eq_preset
A bands table missing entries silently zeroed the unset bands. Require all
10 values and raise an arg error otherwise so partial input can't corrupt
the EQ curve.
* fix(luaplugin): track EmitKey goroutines and gate on shutdown
EmitKey spawned fire-and-forget goroutines per keypress that were untracked
and not gated on shutdown, so a keypress during Close could call into a
closed LState. Track them in the manager WaitGroup and skip dispatch once
closing, matching Emit.
* fix(mediactl): apply MPRIS volume changes in order
Each volume Change spawned its own goroutine to send SetVolumeMsg, so rapid
changes could be delivered out of order and an older volume win. send
(prog.Send) is goroutine-safe and non-blocking, so call it directly.
* fix(mediactl): reject stale-track MPRIS SetPosition
trackid was a fixed constant for every track, so SetPosition ignored its
trackID argument and would seek whatever track became current after the
client read its position. Assign a unique track object path per track change
and ignore SetPosition when its trackID does not match the current track.
* fix(radio): write favorites atomically
save() truncated the real favorites file with os.Create and ignored every
write error, so a partial write could lose all favorites. Build the content
in memory, write a temp file, and rename so a failed write can't corrupt the
existing file and the error surfaces to the caller.
* fix(radio): propagate save errors from ToggleFavorite
ToggleFavorite discarded the error from Add/Remove (which persist favorites),
so a failed save was silently swallowed. Return it to the caller.
* refactor(spotify): drop pointless lock around local slice append
The mutex around appending the Your Music entry only touched the
function-local 'all' slice, guarding nothing shared (the other locks in the
loop legitimately guard trackCache).
* fix(spotify): return cloned playlist list, not the cache slice
Playlists returned the cached slice directly (both on cache hit and after
building it), so a caller mutating the result corrupted the cache. Return a
clone on both paths.
* fix(spotify): return cloned cached tracks
Tracks handed out the cached track slice directly, so a caller mutating it
corrupted the per-playlist cache. Clone on both the cache-hit and freshly
built return paths. (The snapshot-based invalidation within the playlist-list
TTL is an intentional caching tradeoff and is left as-is.)
* fix(spotify): don't sleep before giving up on rate limit
On the final retry the loop slept the full backoff (up to 128s) and then
returned the rate-limited error without making another request. Break out
immediately on the last attempt.
* fix(jellyfin): guard AlbumList against negative offset
A negative offset passed the offset>=len check and then panicked at
out[offset:end]. Clamp offset to 0 first, matching the Emby client.
* docs(playlist): correct MoveQueue comment
MoveQueue swaps any two positions, not only adjacent ones.
* refactor(ui): simplify dead math.Min in flame tier mapping
math.Min(0.65, 0.55) is a constant 0.55; replace with the literal and drop
the now-unused math import.
* refactor(netease): compare app code against its own constant
resp.Code is NetEase's application-level status, not an HTTP status; it was
compared against http.StatusOK which only coincidentally shares the value
200. Introduce neteaseCodeOK and use it at all four comparison sites.
* fix(resolve): strip audio extension from derived title
humanizeBasename left a trailing extension (e.g. .mp3) in the title derived
from a URL basename. Drop a recognized audio extension first, leaving
non-media dotted suffixes untouched.
* fix(resolve): bound RSS feed read size
resolveFeed decoded the response body with no size limit. Wrap it in an
io.LimitReader (32 MB) so an oversized or malicious feed can't exhaust
memory.
* fix(navidrome): return cloned cache slices
Playlists and Tracks handed out the internal cached slices, so a caller
mutating the result corrupted the cache. Return slices.Clone on the cache-hit
and freshly built return paths.
* fix(player): include ffmpeg stderr in decode error
decodeFFmpeg wrapped the exec error but dropped ffmpeg's stderr, where the
actual failure reason is written. Surface ExitError.Stderr in the message.
* refactor(player): forward speedStreamer.Err directly
beep.Streamer already declares Err() error, so the local errorer type
assertion was redundant. Call ss.s.Err() directly, matching the eq and
volume streamers.
* fix(ui): don't drop queued seek/lyric cmds on reconnect
When the scheduled stream reconnect fired, the tick handler returned early
with only playTrack + tick, discarding the seekCmd/lyricCmd computed earlier
in the same tick. Fold them into the reconnect batch.
* fix(ui): nav list footer counts reflect committed filter
The footer only showed the filtered count while the search input bar was
open (searching); once a filter was committed with Enter it fell back to the
full count. Add navFilteredTotal and use the filtered count whenever a query
is active, across the artist, album, and track footers.
* refactor: remove dead internal/control package
internal/control duplicated the message types in internal/playback and had no
importers (only its own test); the live code uses internal/playback. Remove
it.
* fix(providers): implement Refresh for self-hosted providers
Navidrome, Plex, Jellyfin, and Emby cache playlist/track (and album) data but
none implemented playlist.Refresher, so the UI refresh key was a silent
no-op for them. Add Refresh to clear the caches (including the jellyfin/emby
client album cache) so the next fetch hits the server.
* refactor: share minimal-TOML section parser
The [[section]] parse loop was duplicated three times (radio loadStations,
radio loadFavoriteStations, local loadTOML). Extract tomlutil.ParseSections
and rewrite all three against it. Behavior is preserved, including the
single-section-type assumption of the original parsers.
* refactor: extract shared Emby/Jellyfin client into internal/embyapi
The emby and jellyfin clients were ~95% identical (~700 duplicated lines) and
had already drifted (jellyfin lacked the negative-offset guard and error
wrapping). Extract one shared Client into internal/embyapi, isolating the real
differences behind a dialect: auth header scheme (Emby Authorization vs
Jellyfin X-Emby-Authorization), ping endpoint, user-id discovery, error
prefix, and metadata key.
emby and jellyfin become thin wrappers (NewClient, IsStreamURL, type aliases)
plus their providers. Client tests are consolidated in embyapi: shared
behavior once, dialect specifics per dialect. The client now uses a per-
instance http.Client (SetHTTPClient) instead of a package global, which is
what makes it testable from the provider packages.
- luaplugin: waitExec now holds the plugin mutex while reading LState,
matching the locking exec goroutines do when calling into Lua. The
race detector caught this in TestExecCancel.
- ipc: log conn.Write failures in writeResponse instead of silently
dropping them.
- ui/model: collapse empty if/else branches in track-title rendering;
drop dead 'Add now-playing' assignment that was always overwritten.
Release / build (amd64, darwin, macos-latest) (push) Has been cancelled
Release / build (amd64, linux, ubuntu-latest) (push) Has been cancelled
Release / build (amd64, windows, windows-latest) (push) Has been cancelled
Release / build (arm64, darwin, macos-latest) (push) Has been cancelled
Release / build (arm64, linux, ubuntu-latest) (push) Has been cancelled
Release / release (push) Has been cancelled
Release / update-homebrew (push) Has been cancelled
Plugins can now call cliamp.message(text, duration_secs?) to display
transient messages in the UI status bar. Closes#175.
Delivery flows through prog.Send to the Bubbletea model thread, so
plugin timers and event handlers never touch UI state directly.
Faza Iman Imron