fix: locale format and translation updates

New Crowdin updates

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,123 @@
+name: Bug Report
+description: Report a bug or unexpected behavior
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug! Please fill out the form below.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: I have searched existing issues and this bug hasn't been reported yet
+          required: true
+        - label: I am using the latest version of SpotiFLAC (Stable Version)
+          required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is
+      placeholder: Describe the bug...
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen?
+      placeholder: Describe what you expected...
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What actually happened?
+      placeholder: Describe what actually happened...
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: App Version
+      description: Which version of SpotiFLAC are you using? (Check in Settings > About)
+      placeholder: "e.g., v2.2.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Which platform are you using?
+      options:
+        - Android
+        - iOS
+    validations:
+      required: true
+
+  - type: input
+    id: device
+    attributes:
+      label: Device & OS Version
+      description: What device and OS version are you using?
+      placeholder: "e.g., Samsung Galaxy S24, Android 14"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: download-service
+    attributes:
+      label: Download Service
+      description: Which download service were you using when the bug occurred?
+      options:
+        - Tidal
+        - Qobuz
+        - Amazon Music
+        - Deezer (search only)
+        - Not applicable
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / Screenshots
+      description: |
+        If applicable, add logs or screenshots to help explain your problem.
+        
+        **To get logs:**
+        1. Go to Settings > Options > Detailed Logging (turn ON)
+        2. Reproduce the bug
+        3. Go to Settings > Logs
+        4. Tap Share button to export logs
+      placeholder: Paste logs or drag & drop screenshots here...
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Any other context about the problem
+      placeholder: Add any other context...

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: README
+    url: https://github.com/zarzet/SpotiFLAC-Mobile#readme
+    about: Check the README for setup instructions and FAQ
+  - name: Extension Development Guide
+    url: https://zarz.moe/docs
+    about: Documentation for building SpotiFLAC extensions

.github/ISSUE_TEMPLATE/download_issue.yml

@@ -0,0 +1,111 @@
+name: Download Issue
+description: Report issues with downloading specific tracks or albums
+title: "[Download]: "
+labels: ["download-issue"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Having trouble downloading a specific track or album? Please provide details below.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: I have tried downloading with a different service (Tidal/Qobuz/Amazon)
+          required: true
+        - label: I am using the latest version of SpotiFLAC (Stable Version)
+          required: true
+
+  - type: dropdown
+    id: issue-type
+    attributes:
+      label: Issue Type
+      description: What kind of download issue are you experiencing?
+      options:
+        - Track not found on service
+        - Wrong track downloaded
+        - Download fails/errors
+        - Metadata incorrect
+        - Audio quality issue
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: spotify-url
+    attributes:
+      label: Spotify URL
+      description: The Spotify URL of the track/album you're trying to download
+      placeholder: "https://open.spotify.com/track/..."
+    validations:
+      required: true
+
+  - type: input
+    id: track-info
+    attributes:
+      label: Track Info
+      description: Artist name and track title
+      placeholder: "Artist - Track Title"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: download-service
+    attributes:
+      label: Download Service
+      description: Which service did you try to download from?
+      options:
+        - Tidal
+        - Qobuz
+        - Amazon Music
+        - All services
+    validations:
+      required: true
+
+  - type: dropdown
+    id: search-service
+    attributes:
+      label: Search Service
+      description: Which search service are you using?
+      options:
+        - Spotify
+        - Deezer
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Describe the issue in detail
+      placeholder: |
+        What happened? What did you expect?
+        If wrong track was downloaded, what track was downloaded instead?
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: App Version
+      description: Which version of SpotiFLAC are you using?
+      placeholder: "e.g., v2.2.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots / Logs
+      description: |
+        If applicable, add screenshots or logs.
+        
+        **To get logs:**
+        1. Go to Settings > Options > Detailed Logging (turn ON)
+        2. Try downloading the track again
+        3. Go to Settings > Logs
+        4. Tap Share button to export logs
+      placeholder: Drag & drop screenshots or paste logs here...

.github/ISSUE_TEMPLATE/extension_feature_request.yml

@@ -0,0 +1,117 @@
+name: Extension API Feature Request
+description: Request new API features or capabilities for extension development
+title: "[Extension API]: "
+labels: ["enhancement", "extension-api"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve the SpotiFLAC Extension API! 
+        This form is for extension developers who need new features or capabilities that don't exist yet.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: I have read the [Extension Development Guide](https://github.com/zarzet/SpotiFLAC-Mobile/blob/main/docs/EXTENSION_DEVELOPMENT.md)
+          required: true
+        - label: I have searched existing issues and this API feature hasn't been requested yet
+          required: true
+
+  - type: textarea
+    id: extension_goal
+    attributes:
+      label: What are you trying to build?
+      description: Describe the extension or feature you're developing
+      placeholder: "I'm building an extension that downloads from [service name] / provides metadata from [source]..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: current_limitation
+    attributes:
+      label: Current API Limitation
+      description: What's missing or limiting in the current extension API?
+      placeholder: |
+        The current API doesn't support:
+        - [missing feature 1]
+        - [missing feature 2]
+        
+        This prevents me from...
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed_api
+    attributes:
+      label: Proposed API / Feature
+      description: Describe the API or feature you'd like to see added
+      placeholder: |
+        I would like to have:
+        - A new function `api.newFeature()` that does X
+        - A new manifest field `newOption` that enables Y
+        - Access to Z capability...
+    validations:
+      required: true
+
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use Case Example
+      description: Provide a code example of how you would use this feature
+      placeholder: |
+        ```javascript
+        // Example usage in extension code
+        function download(request, progressCallback) {
+          const result = api.proposedFeature(params);
+          // ...
+        }
+        ```
+    validations:
+      required: false
+
+  - type: dropdown
+    id: api_category
+    attributes:
+      label: API Category
+      description: What category does this feature fall under?
+      options:
+        - HTTP/Network API
+        - File System API
+        - Storage API
+        - FFmpeg/Audio Processing
+        - Manifest Options
+        - Runtime Functions
+        - UI Integration
+        - Authentication
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: How critical is this for your extension?
+      options:
+        - Blocker - Cannot build my extension without this
+        - High - Major functionality depends on this
+        - Medium - Would significantly improve my extension
+        - Low - Nice to have
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: Current Workaround
+      description: Are you using any workaround currently? If so, describe it.
+      placeholder: "Currently I'm working around this by..."
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context, links to similar APIs, or examples from other platforms
+      placeholder: "Similar feature in other platforms: ..."

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,66 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting a feature! Please fill out the form below.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: I have searched existing issues and this feature hasn't been requested yet
+          required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / Motivation
+      description: Is your feature request related to a problem? Please describe.
+      placeholder: "A clear description of what the problem is. Ex: I'm always frustrated when..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution you'd like
+      placeholder: A clear description of what you want to happen...
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Describe any alternative solutions or features you've considered
+      placeholder: Other approaches you've thought about...
+
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      description: What category does this feature fall under?
+      options:
+        - UI/UX Improvement
+        - Download Feature
+        - New Service Integration
+        - Metadata/Tagging
+        - Performance
+        - Settings/Configuration
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context, mockups, or screenshots about the feature request
+      placeholder: Add any other context or screenshots...

.github/workflows/release.yml

@@ -3,13 +3,13 @@ name: Release
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version tag (e.g., v1.0.0)'
+        description: "Version tag (e.g., v1.0.0)"
         required: true
-        default: 'v1.0.0'
+        default: "v1.0.0"
 
 jobs:
   # Get version first (quick job)
@@ -28,7 +28,7 @@ jobs:
             VERSION="${GITHUB_REF#refs/tags/}"
           fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
-          
+
           # Check if version contains -preview, -beta, -rc, or -alpha (NOT -hotfix)
           VERSION_LOWER=$(echo "$VERSION" | tr '[:upper:]' '[:lower:]')
           if [[ "$VERSION_LOWER" == *"-preview"* ]] || [[ "$VERSION_LOWER" == *"-beta"* ]] || [[ "$VERSION_LOWER" == *"-rc"* ]] || [[ "$VERSION_LOWER" == *"-alpha"* ]]; then
@@ -43,7 +43,7 @@ jobs:
   build-android:
     runs-on: ubuntu-latest
     needs: get-version
-    
+
     steps:
       - name: Free disk space
         run: |
@@ -65,13 +65,13 @@ jobs:
       - name: Setup Java
         uses: actions/setup-java@v4
         with:
-          distribution: 'temurin'
-          java-version: '17'
+          distribution: "temurin"
+          java-version: "17"
 
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: "1.21"
           cache-dependency-path: go_backend/go.sum
 
       # Cache Gradle for faster builds
@@ -89,15 +89,16 @@ jobs:
           # Use pre-installed Android SDK on GitHub runners
           echo "ANDROID_HOME=$ANDROID_HOME"
           echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
-          
+
           # Accept licenses
           yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses || true
-          
-          # Install NDK (required for gomobile)
-          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager "ndk;25.2.9519653" "platforms;android-34" "build-tools;34.0.0"
-          
+
+          # Install NDK r27d LTS (required for 16KB page size support on Android 15+)
+          # Platform android-36 and build-tools 36.0.0 for targetSdk 36 (Android 16)
+          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager "ndk;27.3.13750724" "platforms;android-36" "build-tools;36.0.0"
+
           # Set NDK path
-          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/25.2.9519653" >> $GITHUB_ENV
+          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/27.3.13750724" >> $GITHUB_ENV
 
       - name: Install gomobile
         run: |
@@ -115,7 +116,7 @@ jobs:
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
-          channel: 'stable'
+          channel: "stable"
           cache: true
 
       - name: Get Flutter dependencies
@@ -144,7 +145,7 @@ jobs:
           keyStorePassword: ${{ secrets.KEYSTORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
         env:
-          BUILD_TOOLS_VERSION: "34.0.0"
+          BUILD_TOOLS_VERSION: "36.0.0"
 
       - name: Rename APKs
         run: |
@@ -164,8 +165,8 @@ jobs:
 
   build-ios:
     runs-on: macos-latest
-    needs: get-version  # Only depends on version, NOT android build!
-    
+    needs: get-version # Only depends on version, NOT android build!
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -173,7 +174,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: "1.21"
           cache-dependency-path: go_backend/go.sum
 
       # Cache CocoaPods
@@ -201,51 +202,51 @@ jobs:
         run: |
           ls -la ios/Frameworks/
           ls -la ios/Frameworks/Gobackend.xcframework/ || (echo "ERROR: XCFramework not found!" && exit 1)
-          
+
       - name: Add XCFramework to Xcode project
         run: |
           # Install xcodeproj gem for modifying Xcode project
           sudo gem install xcodeproj
-          
+
           # Create Ruby script to add framework
           cat > add_framework.rb << 'EOF'
           require 'xcodeproj'
-          
+
           project_path = 'ios/Runner.xcodeproj'
           project = Xcodeproj::Project.open(project_path)
-          
+
           # Get the main target
           target = project.targets.find { |t| t.name == 'Runner' }
-          
+
           # Get or create Frameworks group
           frameworks_group = project.main_group.find_subpath('Frameworks', true)
           frameworks_group ||= project.main_group.new_group('Frameworks')
-          
+
           # Add XCFramework reference
           framework_path = 'Frameworks/Gobackend.xcframework'
           framework_ref = frameworks_group.new_file(framework_path, :project)
-          
+
           # Add to frameworks build phase
           frameworks_build_phase = target.frameworks_build_phase
           frameworks_build_phase.add_file_reference(framework_ref)
-          
+
           # Add to embed frameworks build phase
           embed_phase = target.build_phases.find { |p| p.is_a?(Xcodeproj::Project::Object::PBXCopyFilesBuildPhase) && p.name == 'Embed Frameworks' }
           if embed_phase
             build_file = embed_phase.add_file_reference(framework_ref)
             build_file.settings = { 'ATTRIBUTES' => ['CodeSignOnCopy', 'RemoveHeadersOnCopy'] }
           end
-          
+
           project.save
           puts "Successfully added Gobackend.xcframework to Xcode project"
           EOF
-          
+
           ruby add_framework.rb
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
-          channel: 'stable'
+          channel: "stable"
           cache: true
 
       # Swap pubspec for iOS build (includes ffmpeg_kit_flutter)
@@ -275,7 +276,7 @@ jobs:
         run: |
           # Build Flutter iOS without codesigning
           flutter build ios --release --no-codesign --config-only
-          
+
           # Use xcodebuild with code signing disabled
           cd ios
           xcodebuild -workspace Runner.xcworkspace \
@@ -300,7 +301,7 @@ jobs:
           # Use absolute path to avoid relative path issues
           zip -r $GITHUB_WORKSPACE/build/ios/ipa/SpotiFLAC-${VERSION}-ios-unsigned.ipa Payload
           rm -rf Payload
-          
+
       - name: Verify IPA created
         run: |
           ls -la build/ios/ipa/
@@ -321,7 +322,7 @@ jobs:
     needs: [get-version, build-android, build-ios]
     permissions:
       contents: write
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -331,21 +332,23 @@ jobs:
         run: |
           VERSION=${{ needs.get-version.outputs.version }}
           VERSION_NUM=${VERSION#v}  # Remove 'v' prefix
-          
+
           echo "Looking for version: $VERSION_NUM"
-          
+
           # Extract changelog section for this version using sed
           # Find the line with version, then print until next version header or end
           CHANGELOG=$(sed -n "/^## \[$VERSION_NUM\]/,/^## \[/{ /^## \[$VERSION_NUM\]/d; /^## \[/d; p; }" CHANGELOG.md)
-          
+
           # If no changelog found, use default message
           if [ -z "$CHANGELOG" ]; then
             echo "No changelog found for version $VERSION_NUM"
             CHANGELOG="See CHANGELOG.md for details."
           else
             echo "Found changelog content"
+            # Remove trailing --- separator if present (CHANGELOG uses --- between versions)
+            CHANGELOG=$(echo "$CHANGELOG" | sed '/^---$/d')
           fi
-          
+
           # Save to file for multiline support
           echo "$CHANGELOG" > /tmp/changelog.txt
           echo "Extracted changelog:"
@@ -367,32 +370,34 @@ jobs:
         run: |
           VERSION=${{ needs.get-version.outputs.version }}
           cat > /tmp/release_body.txt << 'HEADER'
-          ## SpotiFLAC $VERSION
-          
-          Download Spotify tracks in FLAC quality from Tidal, Qobuz & Amazon Music.
-          
           ### What's New
           HEADER
-          
-          # Replace $VERSION in header
-          sed -i "s/\$VERSION/$VERSION/g" /tmp/release_body.txt
-          
+
           cat /tmp/changelog.txt >> /tmp/release_body.txt
+
+          REPO_OWNER="${{ github.repository_owner }}"
+          REPO_NAME="${{ github.event.repository.name }}"
           
           cat >> /tmp/release_body.txt << FOOTER
-          
+
           ---
-          
+
           ### Downloads
-          - **Android (arm64)**: \`SpotiFLAC-${VERSION}-arm64.apk\` (recommended)
-          - **Android (arm32)**: \`SpotiFLAC-${VERSION}-arm32.apk\` (older devices)
+
+          #### Android
+          - **arm64**: \`SpotiFLAC-${VERSION}-arm64.apk\` (recommended for modern devices)
+          - **arm32**: \`SpotiFLAC-${VERSION}-arm32.apk\` (older devices)
+
+          #### iOS
           - **iOS**: \`SpotiFLAC-${VERSION}-ios-unsigned.ipa\` (sideload required)
-          
+
           ### Installation
           **Android**: Enable "Install from unknown sources" and install the APK
           **iOS**: Use AltStore, Sideloadly, or similar tools to sideload the IPA
+
+          ![arm64](https://img.shields.io/github/downloads/${REPO_OWNER}/${REPO_NAME}/${VERSION}/SpotiFLAC-${VERSION}-arm64.apk?style=flat-square&logo=android&label=arm64&color=3DDC84) ![arm32](https://img.shields.io/github/downloads/${REPO_OWNER}/${REPO_NAME}/${VERSION}/SpotiFLAC-${VERSION}-arm32.apk?style=flat-square&logo=android&label=arm32&color=3DDC84) ![iOS](https://img.shields.io/github/downloads/${REPO_OWNER}/${REPO_NAME}/${VERSION}/SpotiFLAC-${VERSION}-ios-unsigned.ipa?style=flat-square&logo=apple&label=iOS&color=0078D6)
           FOOTER
-          
+
           echo "Release body:"
           cat /tmp/release_body.txt
 

.gitignore

@@ -6,6 +6,8 @@ Thumbs.db
 .idea/
 .vscode/
 *.iml
+.cursorignore
+.cursorrules
 
 # Kiro specs (development only)
 .kiro/
@@ -13,6 +15,9 @@ Thumbs.db
 # Reference folder (development only)
 referensi/
 
+# Documentation (development only, published separately)
+docs/
+
 # Old spotiflac_android folder (moved to root)
 spotiflac_android/
 
@@ -50,3 +55,20 @@ ios/.symlinks/
 ios/Flutter/Flutter.framework/
 ios/Flutter/Flutter.podspec
 android/app/libs/gobackend-sources.jar
+
+# Extension folder
+extension/
+
+# Agent instructions
+AGENTS.md
+
+# Temp/misc
+nul
+
+# Log files
+*.log
+hs_err_*.log
+flutter_*.log
+
+# Development tools
+tool/

CHANGELOG.md

@@ -1,5 +1,955 @@
 # Changelog
 
+## [3.1.1] - 2026-01-17
+
+### Added
+
+- **Lyrics Caching**: Lyrics are now cached for 24 hours to reduce API calls and improve performance
+  - Thread-safe cache with automatic expiration
+  - Cache key based on artist, track, and duration
+  - Log indicator shows "(cached)" when lyrics are served from cache
+
+- **Lyrics Duration Matching**: Improved lyrics accuracy with duration-based matching
+  - Compares track duration with lrclib.net results
+  - 10-second tolerance to handle version differences (radio edit, remaster, etc.)
+  - Prioritizes synced lyrics over plain text when duration matches
+  - Falls back gracefully if no duration match found
+
+- **Deezer Cover Art Upgrade**: Cover art from Deezer CDN now automatically upgraded to maximum quality
+  - Detects Deezer CDN URLs (`cdn-images.dzcdn.net`)
+  - Upgrades cover resolution to 1800x1800 (max available)
+  - Works alongside existing cover upgrade
+
+- **Live Search for Extensions**: Search-as-you-type functionality for extension search
+  - 800ms debounce delay to prevent excessive API calls
+  - Minimum 3 characters required before searching
+  - Concurrency control to prevent race conditions in extension runtime
+  - Queues pending searches if a search is already in progress
+
+- **Russian Language Support**: Added Russian (Русский) translation - 99% complete
+  - Translated via Crowdin community contributions
+  - Covers all UI elements, settings, and error messages
+
+### Fixed
+
+- **ISRC Index Race Condition**: Fixed repeated index rebuilding during parallel downloads
+  - Added per-directory build lock using `sync.Map` and `sync.Mutex`
+  - Double-check locking pattern ensures index is built only once
+  - Significantly improves performance during CSV import with many tracks
+
+- **Queue Tab Scroll Exception**: Fixed Flutter rendering exception with NestedScrollView
+  - Disabled Material 3 stretch overscroll indicator that caused `_StretchController` assertion
+  - Wrapped NestedScrollView with ScrollConfiguration to prevent `setState during build` errors
+  - Issue was especially noticeable during rapid queue updates (CSV import)
+
+- **CSV Import**: Fixed CSV export not being parsed correctly
+  - Added support for `Artist Name(s)` header (with parentheses)
+  - Added support for `Track URI` header for track IDs
+  - Added `artists` and `track_id` as alternative header names
+  - Now correctly parses "Liked Songs" and playlist exports
+
+---
+
+## [3.1.0] - 2026-01-16
+
+### Added
+
+- **Recent Access History**: Quick access to recently visited content when tapping the search bar
+  - Shows recently visited artists, albums, playlists, and downloaded tracks
+  - Merged view combining navigation history and download history
+  - Tap to quickly navigate back to previously accessed content
+  - X button to remove individual items from history
+  - "Clear All" button to clear entire history
+  - Persists across app restarts (stored in SharedPreferences)
+  - Max 20 items stored, sorted by most recent
+  - Multi-language support (Artist/Album/Song/Playlist labels localized)
+
+- **Artist Screen Redesign**
+  - Full-width header image (380px) with gradient overlay
+  - Artist name displayed at bottom of header with text shadow
+  - Monthly listeners count display (formatted with compact notation)
+  - "Popular" section showing top 5 tracks with download status indicators
+  - Dynamic download button states (queued, downloading, completed)
+  - Header image and top tracks fetched from extension metadata
+  - Image alignment set to top-center to show faces properly
+
+- **Extension Store Update Badge**: Badge indicator on Store tab icon showing number of available updates
+  - Users can see extension updates are available without opening Store tab
+  - Badge shows count of extensions with updates
+
+- **Extension Compatibility Warning**: Warning badge for extensions requiring newer app version
+  - Extensions with `minAppVersion` higher than current app show warning label
+  - Label displays "Requires vX.X.X+" to encourage users to upgrade
+  - Users can still install the extension (not blocked)
+
+- **Year in Album Folder Name** ([#50](https://github.com/zarzet/SpotiFLAC-Mobile/issues/50)): New album folder structure options with release year
+
+  - `Artist / [Year] Album`: Albums/Coldplay/[2005] X&Y/
+  - `[Year] Album Only`: Albums/[2005] X&Y/
+  - Year extracted from release date metadata
+  - Matches desktop SpotiFLAC folder structure
+
+- **Extension Album/Playlist/Artist Support**: Extensions can now return albums, playlists, and artists in search results
+
+  - Search results now properly separated into Albums, Playlists, Artists, and Songs sections
+  - Albums, playlists, and artists show chevron icon (navigate to detail) instead of download button
+  - Tap album/playlist to view track list and download
+  - Tap artist to view their albums/discography
+  - New `getAlbum()`, `getPlaylist()`, and `getArtist()` extension functions
+  - New `ExtensionAlbumScreen`, `ExtensionPlaylistScreen`, and `ExtensionArtistScreen` for fetching content from extensions
+  - YouTube Music extension updated with album/playlist/artist support
+
+- **Odesli (song.link) Integration for YouTube Music Extension**
+  - New `enrichTrack()` function to fetch ISRC and external service links
+  - Uses Odesli API to convert YouTube Music tracks to Deezer/Tidal/Qobuz
+  - Enables built-in service fallback for high-quality audio downloads
+  - Extension version updated to 1.4.0 with `api.song.link` and `odesli.io` network permissions
+- **Download Cancel**: Canceling a download now stops in-flight built-in provider downloads (Tidal/Qobuz/Amazon) and clears backend progress tracking.
+
+### Changed
+
+- **Search Bar Behavior**: Tapping search bar now immediately moves it to top position
+  - Logo and subtitle hide when search bar is focused
+  - Recent access history appears in the content area below
+  - More space for recent items, not blocked by keyboard
+
+### Fixed
+
+- Fixed search source chips still referencing removed badge props.
+- Fixed extension artist album metadata to preserve provider IDs and cover URLs for correct navigation.
+- Fixed extension playlist fetch to populate provider IDs and reject disabled extensions.
+- Fixed extension collection screens calling setState after dispose during async loads.
+- Fixed URL handler responses to include provider IDs for extension albums and artists.
+- Fixed YTMusic extension not extracting album name and duration from search results.
+  - Album name is now extracted from flexColumns/subtitle when linked to album browseId.
+  - Duration is now extracted from fixedColumns/flexColumns in addition to existing sources.
+- Fixed "Separate Singles" setting not working ([#54](https://github.com/zarzet/SpotiFLAC-Mobile/issues/54)) - singles were going to Albums folder.
+  - Root cause: `albumType` was not being extracted from Deezer API during metadata enrichment.
+  - Deezer track responses now correctly include `album_type` (single/ep/album/compilation).
+  - Track creation now preserves `albumType` and `source` fields throughout download flow.
+- Fixed PageView overscroll at edges (BouncingScrollPhysics → ClampingScrollPhysics)
+- Fixed settings item highlight on swipe (highlightColor: Colors.transparent)
+- Fixed extension duplicate load error (skip silently instead of throwing error)
+- Fixed keyboard appearing when swiping between tabs (unfocus on page change)
+- Removed "Free"/"API Key" badges from search source selector
+- Fixed cancel action briefly resuming downloads in the queue UI after ~1 second.
+- Fixed cancelled downloads being marked as failed when the backend returns after cancellation.
+- Fixed cancel triggering provider fallback (cancel now stops the download flow immediately).
+- Fixed stale ISRC cache returning deleted files after cancel.
+- Fixed search results mixing extension and built-in artists when using default provider.
+- Fixed audio files opening with non-music apps by passing audio MIME type on open.
+- Fixed album artist showing null/blank by normalizing empty metadata and using artist fallback for tags.
+- Fixed `use_build_context_synchronously` lint warnings in `home_tab.dart`
+- Fixed `unnecessary_underscores` lint warnings in error widget callbacks
+- Fixed duplicate artist entries in recent history (recording now only happens in screen's initState)
+- **Go Backend: Missing `item_type` and `album_type` fields**
+  - Added `ItemType` and `AlbumType` fields to `ExtTrackMetadata` struct
+  - Fixed `CustomSearchWithExtensionJSON` - now includes `item_type` and `album_type` in response
+  - Fixed `HandleURLWithExtensionJSON` - now includes `item_type` and `album_type` for tracks
+  - Fixed `GetAlbumWithExtensionJSON` - now includes `item_type` and `album_type` for album tracks
+  - Fixed `GetPlaylistWithExtensionJSON` - now includes `item_type` and `album_type` for playlist tracks
+- **Album/Playlist Track Thumbnails**: Tracks inside albums/playlists now use album/playlist cover as fallback when no individual cover exists
+- **YouTube Music Extension getArtist**: Fixed `getArtist()` function not being registered in extension, causing artist pages to fail with "returned null" error
+- **Recent Access UI**: Fixed recent access list disappearing when keyboard is dismissed - now stays visible until user presses Back button
+- **Extension Artist Top Tracks**: Fixed top tracks not appearing when opening artist from extension search results
+  - YT Music extension `getArtist()` now returns `top_tracks` array with up to 10 popular songs
+  - Go backend `GetArtistWithExtensionJSON` now forwards `top_tracks`, `header_image`, and `listeners` to Flutter
+  - `ExtensionArtistScreen` now parses and passes top tracks to `ArtistScreen`
+  - `ArtistScreen` with `extensionId` skips metadata fetch, uses extension data only (fixes "Rate Limited" errors)
+- **Search Bar Unfocus**: Fixed search bar not unfocusing when tapping outside - now properly dismisses keyboard and unfocus when tapping anywhere outside the search field
+- **Keyboard Appearing on Settings Navigation**: Fixed keyboard randomly appearing when returning from Settings sub-pages (e.g., Appearance) - now uses `FocusManager.instance.primaryFocus?.unfocus()` for more aggressive unfocus
+- **Recent Access Artist Navigation**: Fixed opening artist from recent access using wrong screen - now correctly uses `ExtensionArtistScreen` for extension artists (YT Music, etc.) instead of trying to fetch from API
+
+### Extensions
+
+- **YouTube Music Extension**: Updated to v1.5.0
+  - `getArtist()` now returns `top_tracks` array with popular songs
+  - Added `header_image` and `listeners` to artist response
+- **Web Extension**: Updated to v1.6.0
+
+### Localization
+
+- **Multi-Language Support**: App now supports multiple languages with community contributions via Crowdin
+  - Available languages: English, Indonesian (Bahasa Indonesia)
+  - More languages coming soon with community translations
+  - Contribute translations at [Crowdin](https://crowdin.com/project/spotiflac-mobile)
+- Added new localization strings for recent access types:
+  - `recentTypeArtist` - "Artist" / "Artis"
+  - `recentTypeAlbum` - "Album" / "Album"
+  - `recentTypeSong` - "Song" / "Lagu"
+  - `recentTypePlaylist` - "Playlist" / "Playlist"
+  - `recentPlaylistInfo` - "Playlist: {name}"
+  - `errorGeneric` - "Error: {message}"
+
+---
+
+## [3.0.0] - 2026-01-14
+
+### Extension System (Major Feature)
+
+SpotiFLAC 3.0 introduces a powerful extension system that allows third-party integrations for metadata, downloads, and more.
+
+#### Extension Store
+
+- Browse and install extensions directly from the app
+- New "Store" tab in bottom navigation
+- Browse by category: Metadata, Download, Utility, Lyrics, Integration
+- Search extensions by name, description, or tags
+- One-tap install, update, and uninstall
+- Offline cache for browsing without internet
+
+#### Web Extension
+
+- Available in Extension Store - install and enable in Settings > Extensions
+- Metadata provider using web player API
+- Download tracks from Daily Mix, Discover Weekly, and other personalized playlists
+- Useful when official API is rate-limited or unavailable
+
+#### Extension Capabilities
+
+- **Custom Search Providers**
+- **Custom URL Handlers**
+- **Custom Thumbnail Ratios**: Square (1:1), Wide (16:9), Portrait (2:3)
+- **Post-Processing Hooks**: Extensions can process downloaded files
+- **Quality Options**: Extensions can define custom quality settings
+
+#### Extension APIs
+
+- Full HTTP support: GET, POST, PUT, DELETE, PATCH
+- Persistent cookie jar per extension
+- Browser-like polyfills: `fetch()`, `atob()`/`btoa()`, `TextEncoder`/`TextDecoder`, `URL`/`URLSearchParams`
+- Storage API for persistent data
+- File API for file operations
+- HMAC-SHA1 utility for cryptographic operations
+
+#### Security
+
+- Sandboxed JavaScript runtime (goja)
+- Permission-based access control
+- Network domain whitelisting
+- Improved credential encryption with per-installation random salt
+
+### Added
+
+- **Album Folder Structure Setting**: Option to remove artist folder from album path
+
+  - `Artist / Album` (default): `Albums/Artist Name/Album Name/`
+  - `Album Only`: `Albums/Album Name/`
+
+- **Separate Singles Folder**: Organize downloads into Albums/ and Singles/ folders
+
+  - Based on `album_type` from metadata
+  - Toggle in Settings > Download > Separate Singles Folder
+
+- **Year in Album Folder Name**: New album folder structure options with release year
+
+  - `Artist / [Year] Album`: Albums/Coldplay/[2005] X&Y/
+  - `[Year] Album Only`: Albums/[2005] X&Y/
+  - Year extracted from release date metadata
+  - Matches desktop SpotiFLAC folder structure
+
+- **Parallel API Calls**: Download URL fetching now uses parallel requests
+  - Tidal: All 8 APIs requested simultaneously, first success wins
+  - Qobuz: Both APIs requested simultaneously, first success wins
+  - Significantly reduces download URL fetch time
+
+### UI/UX Improvements
+
+- **Swipeable History Filters**: History tab now supports swipe gestures between All, Albums, and Singles filters
+
+  - Swipe left/right to switch between filter tabs
+  - Filter chips sync with swipe position
+  - Smooth edge-to-edge transition: swipe past Singles to go to Store, swipe past All to go to Home
+  - Natural gesture feel - drag connects to parent navigation
+
+  - **Improved File Open Intent**: Play button in History now correctly opens music players only
+  - Added proper MIME type (`audio/flac`, `audio/mpeg`, etc.) when opening downloaded files
+  - Prevents system from showing unrelated apps in the "Open with" dialog
+
+### Fixed
+
+- **Fixed Tab Edge Overscroll**: Home and Settings tabs now stop at edges instead of bouncing into empty space
+
+- **Fixed Extension Duplicate Load Error**: Extension loading now silently skips already-loaded extensions instead of throwing error
+
+- **Fixed Settings Item Highlight on Swipe**: Settings items no longer highlight when swiping at page edge
+
+- **Fixed Keyboard Appearing on Tab Switch**: Keyboard now auto-dismisses when swiping between tabs
+
+- **Removed Search Source Badges**: Removed "Free" and "API Key" labels from provider selector in Options
+
+- **Back Gesture Freeze on Android 13+**: Fixed app freeze when using back gesture in settings
+
+  - Added `PopScope` with `canPop: true` to all settings pages
+  - Changed navigation to use `PageRouteBuilder` with proper slide transition
+
+- **Bottom Overflow in Folder Organization Dialog**: Fixed overflow in portrait and landscape mode
+
+  - Made dialog scrollable with max height constraint
+
+- **Japanese Artist Name Order**: Fixed artist mismatch for Japanese names
+
+  - "Sawano Hiroyuki" vs "Hiroyuki Sawano" now correctly matches
+
+- **Multi-Artist Matching**: Fixed artist mismatch for collaboration tracks
+
+  - "RADWIMPS feat. Toko Miura" now matches when service only shows "Toko Miura"
+
+- **Max Resolution Cover Download**: Fixed cover not upgrading to max resolution on mobile
+
+  - Mobile now correctly upgrades 300x300 → 640x640 → max resolution (~2000x2000)
+
+- **EXISTS: Prefix in File Path**: Fixed "File not found" error in metadata screen
+
+  - Duplicate detection prefix now stripped before saving to history
+
+- **Extension Search Result Parsing**: Fixed "cannot unmarshal array" error
+
+  - Go backend now handles both array and object formats from extensions
+
+- **Store Tab Unmount Crash**: Fixed "Using ref when widget is unmounted" error
+
+- **Duplicate History Entries**: Fixed duplicate entries when re-downloading same track
+
+  - Detects existing entries by track ID, Deezer ID, or ISRC
+
+- **Permission Error Message**: Fixed download showing "Song not found" when actually permission error
+
+  - Now shows proper message: "Cannot write to folder, check storage permission"
+
+- **Android 13+ Storage Permission**: Fixed storage permission not working on Android 13+
+  - Now requests both `MANAGE_EXTERNAL_STORAGE` and `READ_MEDIA_AUDIO`
+
+### Changed
+
+- **Extension Manifest**: New `file` permission required for file operations
+  ```json
+  "permissions": {
+    "network": ["api.example.com"],
+    "storage": true,
+    "file": true
+  }
+  ```
+
+### Technical
+
+- Go backend: Simplified parallel download result handling in Tidal/Qobuz
+- Go backend: Removed unused functions and fixed bit shifting warnings
+- Release workflow: Fixed duplicate `---` separator in release notes
+
+---
+
+## [3.0.0-beta.2] - 2026-01-13
+
+### Added
+
+- **Album Folder Structure Setting**: Option to remove artist folder from album path
+  - New setting in Download Settings when "Separate Singles Folder" is enabled
+  - `Artist / Album` (default): `Albums/Artist Name/Album Name/`
+  - `Album Only`: `Albums/Album Name/`
+  - Requested by user who prefers flat album organization
+
+### Fixed
+
+- **Back Gesture Freeze on OnePlus/Android 13+**: Fixed app freeze when using back gesture in settings
+
+  - Added `PopScope` with `canPop: true` to all settings pages
+  - Changed navigation to use `PageRouteBuilder` with proper slide transition
+  - Fixes predictive back gesture conflict on devices with gesture navigation
+  - Affected pages: Download, Appearance, Options, Extensions, About, Logs, Extension Detail
+
+- **Extension Search Result Parsing**: Fixed "cannot unmarshal array into Go value" error
+
+  - Go backend now handles both array and object formats from extensions
+  - Extensions returning `[{track}, {track}]` now work correctly
+  - Extensions returning `{tracks: [...], total: N}` still work as before
+
+- **Max Resolution Cover Download**: Fixed cover not upgrading to max resolution on mobile
+
+  - Added missing `spotifySize300` constant (300x300 size code)
+  - Mobile now correctly upgrades 300x300 → 640x640 → max resolution (~2000x2000)
+  - Added `_upgradeToMaxQualityCover()` helper in Flutter for M4A conversion path
+  - Go backend `cover.go` now directly replaces URL without HEAD verification
+
+- **Extension Search Provider Reset**: Fixed search provider not resetting to default when disabled
+
+  - `copyWith` in `AppSettings` couldn't set `searchProvider` to `null`
+  - Added `clearSearchProvider` boolean parameter to properly clear the value
+  - Settings menu now correctly switches back to default provider
+
+- **Extension Disabled Search Fallback**: Fixed error when extension is disabled but still called
+
+  - `_performSearch` now checks if extension is still enabled before calling custom search
+  - Automatically falls back to Deezer search if extension was disabled
+  - Clears `searchProvider` setting if extension no longer available
+
+- **Store Tab Unmount Crash**: Fixed "Using ref when widget is unmounted" error
+
+  - Added `mounted` check after async operation in `_initialize()`
+  - Prevents crash when navigating away from Store tab during initialization
+
+- **EXISTS: Prefix in File Path**: Fixed "File not found" error in metadata screen after download
+
+  - Duplicate detection was adding `EXISTS:` prefix to file paths
+  - Prefix now stripped before saving to download history
+  - Legacy history items with prefix are handled gracefully
+
+- **History Error Badge**: Fixed error badge showing on history items even when file exists
+
+  - `queue_tab.dart` now strips `EXISTS:` prefix before checking file existence
+  - File open and delete operations also use cleaned path
+
+- **Extension Artist URL Handler**: Fixed artist pages showing "0 releases" from extensions
+
+  - Extension `fetchArtist` now returns correct format: `{ type: "artist", artist: { albums } }`
+  - Go backend `HandleURLWithExtensionJSON` now includes albums in artist response
+  - Added `AlbumType` field to `ExtAlbumMetadata` struct
+
+- **Extension Artist Name in Logs**: Fixed empty artist name in extension track logs
+
+  - Now uses `firstArtist` + `otherArtists` instead of deprecated `artists.items`
+  - Logs correctly show "Fetched track: {title} by {artist}"
+
+- **Japanese Artist Name Order**: Fixed artist mismatch for Japanese names with different order
+
+  - "Sawano Hiroyuki" vs "Hiroyuki Sawano" now correctly matches
+  - Added `sameWordsUnordered` check to both Tidal and Qobuz artist matching
+  - Handles Japanese name order (family name first) vs Western name order (given name first)
+
+- **Multi-Artist Matching**: Fixed artist mismatch for collaboration tracks
+
+  - "RADWIMPS feat. Toko Miura" now matches when Qobuz/Tidal only shows "Toko Miura"
+  - Split artists by separators (`, `, `feat.`, `ft.`, `&`, `and`, `x`)
+  - Match if ANY expected artist matches ANY found artist
+
+- **Cover Download Logging**: Improved cover download logs for debugging
+  - Shows original URL, upgrade steps, and final URL
+  - Displays estimated resolution based on file size
+  - Logs now appear in Settings > Logs via GoLog
+
+---
+
+## [3.0.0-beta.1] - 2026-01-13
+
+### Security
+
+- Improved extension sandbox security
+- Improved credential encryption with per-installation random salt
+
+### Changed
+
+- **Extension Manifest**: New `file` permission required for file operations
+  ```json
+  "permissions": {
+    "network": ["api.example.com"],
+    "storage": true,
+    "file": true
+  }
+  ```
+  Extensions that need to download files must declare `"file": true` in manifest.
+
+### Fixed
+
+- Extension packages now preserve directory structure (subdirectories supported)
+- Back gesture freeze in settings pages on Android gesture navigation
+
+---
+
+## [3.0.0-alpha.4] - 2026-01-12
+
+### Added
+
+- **Extension Store**: Browse and install extensions directly from the app
+
+  - New "Store" tab in bottom navigation
+  - Browse extensions by category (Metadata, Download, Utility, Lyrics, Integration)
+  - Search extensions by name, description, or tags
+  - One-tap install and update
+  - Offline cache for browsing without internet
+  - Extensions hosted at github.com/zarzet/SpotiFLAC-Extension
+
+- **Custom URL Handler for Extensions**: Extensions can now register custom URL patterns
+
+  - Handle URLs from YouTube Music, SoundCloud, Bandcamp, etc.
+  - Manifest config: `urlHandler: { enabled: true, patterns: ["music.youtube.com"] }`
+  - Implement `handleUrl(url)` function in extension to parse and return track metadata
+  - SpotiFLAC automatically routes matching URLs to the appropriate extension
+  - Supports share intents and paste from clipboard
+
+- **Artist URL Handler Support**: Extensions can now return artist data from URL handlers
+
+  - Added `type: "artist"` handling in track_provider.dart
+  - Navigate to artist screen with albums list from extension
+
+- **HMAC-SHA1 Utility**: New `utils.hmacSHA1(key, message)` function for extensions
+  - Enables TOTP generation and other cryptographic operations
+  - Returns byte array for flexible use
+
+### Fixed
+
+- **Extension Store Refresh**: Store tab now properly refreshes after uninstalling an extension
+  - "Installed" badge correctly updates to "Install" button
+
+### Documentation
+
+- Updated `docs/EXTENSION_DEVELOPMENT.md`:
+  - Added Custom URL Handler section with examples
+  - Added `handleUrl` function documentation
+  - Added URL pattern examples for YouTube, SoundCloud, Bandcamp
+  - Added `utils.hmacSHA1` documentation with TOTP example
+
+### Extensions
+
+- **Web Extension** (example): New extension for metadata via web API
+  - Supports personalized playlists (Daily Mix, Discover Weekly, Release Radar, etc.)
+  - Search, album, playlist, track, and artist fetching
+  - Available in Extension Store (3.0.0-alpha.4)
+
+---
+
+## [3.0.0-alpha.3] - 2026-01-12
+
+### Added
+
+- **Separate Singles Folder**: Option to organize downloads into Albums/ and Singles/ folders
+  - Based on `album_type` from metadata
+  - Toggle in Settings > Download > Separate Singles Folder
+  - Singles saved to `{output}/Singles/`, albums to `{output}/Albums/`
+- **Browser-like Polyfills**: New global APIs for easier library porting
+  - `fetch()` - Browser-compatible HTTP API with `json()`, `text()`, `arrayBuffer()` methods
+  - `atob()` / `btoa()` - Global Base64 encoding/decoding
+  - `TextEncoder` / `TextDecoder` - UTF-8 text encoding classes
+  - `URL` / `URLSearchParams` - URL parsing and manipulation classes
+  - Makes porting browser libraries (like `youtubei.js`) much easier
+
+### Performance
+
+- **Parallel API Calls**: Download URL fetching now uses parallel requests
+  - Tidal: All 8 APIs requested simultaneously, first success wins
+  - Qobuz: Both APIs requested simultaneously, first success wins
+  - Significantly reduces download URL fetch time
+
+### Fixed
+
+- **Duplicate History Entries**: Fixed duplicate entries when re-downloading same track
+  - Detects existing entries by track ID, Deezer ID, or ISRC
+  - Replaces existing entry and moves to top of list
+  - Auto-deduplicates existing history on app load
+- **Extension Search Fallback**: Fixed error when extension is disabled but still called for search
+  - Now checks if extension is still enabled before calling custom search
+  - Auto-resets search provider to default if extension was disabled
+- **Permission Error Message**: Fixed download showing "Song not found" when actually a permission error
+  - Now shows proper message: "Cannot write to folder, check storage permission"
+  - Added `permission` error type detection in backend
+- **Android 13+ Storage Permission**: Fixed storage permission not working on Android 13+
+  - Android 13+ now requests both `MANAGE_EXTERNAL_STORAGE` and `READ_MEDIA_AUDIO`
+  - `MANAGE_EXTERNAL_STORAGE` opens Settings (system-level, persists across app data clear)
+  - `READ_MEDIA_AUDIO` shows dialog (app-level, resets on app data clear)
+  - Proper permission check before showing "granted" status
+
+---
+
+## [3.0.0-alpha.2] - 2026-01-12
+
+### Added
+
+- **Full HTTP Method Support**: New shortcut methods for all common HTTP verbs
+  - `http.put(url, body, headers)` - PUT requests
+  - `http.delete(url, headers)` - DELETE requests
+  - `http.patch(url, body, headers)` - PATCH requests
+  - `http.clearCookies()` - Clear all cookies for the extension
+- **Persistent Cookie Jar**: Each extension now has its own cookie jar
+  - Cookies automatically stored from `Set-Cookie` headers
+  - Cookies automatically sent with subsequent requests to same domain
+  - Useful for APIs requiring session cookies (YouTube, etc.)
+- **Multi-Value Header Support**: Response headers now return arrays for multi-value headers
+  - `Set-Cookie` and other headers with multiple values returned as arrays
+  - Single-value headers still returned as strings for convenience
+- **Generic HTTP Request Method**: New `http.request()` for full HTTP control
+  - Supports all HTTP methods (GET, POST, PUT, DELETE, PATCH, etc.)
+  - Single options object for cleaner API: `http.request(url, { method, body, headers })`
+- **Response Helper Properties**: HTTP responses now include convenience properties
+  - `response.ok` - true if status code is 2xx
+  - `response.status` - alias for `statusCode`
+
+### Fixed
+
+- **User-Agent Header Respect**: Custom `User-Agent` headers are now respected
+  - Previously, extension-provided User-Agent was overwritten
+  - Now only sets default User-Agent if extension doesn't provide one
+- **HTTP POST Body Auto-Stringify**: `http.post()` now automatically stringifies objects to JSON
+  - Previously, passing an object as body resulted in `[object Object]`
+  - Now objects and arrays are automatically JSON.stringify'd
+  - String bodies still work as before (no double-encoding)
+
+### Documentation
+
+- Updated `docs/EXTENSION_DEVELOPMENT.md`:
+  - Added complete HTTP API documentation with all methods
+  - Added Cookie Jar documentation
+  - Added `http.put()`, `http.delete()`, `http.patch()`, `http.clearCookies()` docs
+  - Added YouTube Music / Innertube API example with custom User-Agent
+  - Added common domain lists for YouTube, SoundCloud, Bandcamp
+  - Improved HTTP API documentation with response properties
+
+---
+
+## [3.0.0-alpha.1] - 2026-01-11
+
+#### Extension System
+
+- **Custom Search Providers**: Extensions can now provide custom search functionality
+  - YouTube, SoundCloud, and other platforms via extensions
+  - Custom search placeholder text per extension
+  - Configurable thumbnail aspect ratios (square, wide, portrait)
+- **Extension Upgrade System**: Upgrade extensions without losing data
+  - Preserves extension settings and cached data during upgrades
+  - Version comparison prevents downgrades
+  - Auto-detects upgrades when installing same extension
+- **Custom Thumbnail Ratios**: Extensions can specify thumbnail display format
+  - `"square"` (1:1) - Album art style (default)
+  - `"wide"` (16:9) - YouTube/video style
+  - `"portrait"` (2:3) - Poster style
+  - Custom width/height override available
+
+### Added
+
+- **Track Source Tracking**: Tracks now remember which extension provided them
+  - `Track.source` field stores extension ID
+  - `TrackState.searchExtensionId` for current search context
+  - Enables extension-specific UI customization
+- **Extension Upgrade API**: New methods for extension management
+  - `upgradeExtension(filePath)` - Upgrade existing extension
+  - `checkExtensionUpgrade(filePath)` - Check if file is an upgrade
+  - `RemoveExtensionByID` - Remove extension by ID
+- **iOS Extension Support**: Added missing iOS method handlers
+  - `upgradeExtension` - Upgrade extension from file
+  - `checkExtensionUpgrade` - Check upgrade compatibility
+- **Extension Documentation**: Comprehensive extension development guide
+  - Thumbnail ratio customization documentation
+  - Extension upgrade workflow documentation
+  - New troubleshooting entries for common issues
+
+### Changed
+
+- **Version Bump**: 2.2.7 → 3.0.0-alpha.1 (major version for extension system)
+- **Build Number**: 49 → 50
+- **Extension Manager**: Improved upgrade detection in `LoadExtensionFromFile`
+  - Auto-detects if installing same extension with higher version
+  - Calls `UpgradeExtension` automatically for seamless upgrades
+
+### Fixed
+
+- **Extension `registerExtension`**: Fixed global `extension` variable not being set
+  - Extensions can now access their own functions via `extension.functionName()`
+  - Required for `customSearch` and other provider functions
+- **Custom Search Empty Results**: Fixed error when extension returns null
+  - Now returns empty array instead of error
+  - Prevents crash when no results found
+- **Mutex Crash on Upgrade**: Fixed "Unlock of unlocked RWMutex" crash
+  - Removed `defer m.mu.Unlock()` when manual unlock is used
+  - Proper lock handling in upgrade flow
+- **Duplicate Error Messages**: Fixed extension install errors showing twice
+  - Added `clearError()` method to extension provider
+  - Improved PlatformException parsing to remove "null, null" artifacts
+- **Extension Images Field**: Fixed thumbnails not showing in search results
+  - Added `Images` field to `ExtTrackMetadata` struct
+  - Renamed `GetCoverURL` to `ResolvedCoverURL` (gomobile conflict)
+
+### Technical
+
+- **Go Backend Changes**:
+  - `go_backend/extension_manager.go`: Added `compareVersions()`, `UpgradeExtension()`, `CheckExtensionUpgradeJSON()`
+  - `go_backend/extension_providers.go`: Added `Images` field, `ResolvedCoverURL()` method
+  - `go_backend/extension_manifest.go`: Added `ThumbnailRatio`, `ThumbnailWidth`, `ThumbnailHeight` to `SearchBehaviorConfig`
+  - `go_backend/exports.go`: Added `RemoveExtensionByID`, `UpgradeExtensionFromPath`, `CheckExtensionUpgradeFromPath`
+- **Flutter Changes**:
+  - `lib/models/track.dart`: Added `source` field
+  - `lib/models/track.g.dart`: Updated for `source` field
+  - `lib/providers/track_provider.dart`: Added `searchExtensionId`, updated `_parseSearchTrack` with source parameter
+  - `lib/providers/extension_provider.dart`: Added `SearchBehavior.getThumbnailSize()`, `clearError()`
+  - `lib/screens/home_tab.dart`: Dynamic thumbnail size based on extension config
+  - `lib/screens/settings/extensions_page.dart`: Improved error handling
+  - `lib/services/platform_bridge.dart`: Added `upgradeExtension()`, `checkExtensionUpgrade()`, `removeExtension()`
+- **iOS Changes**:
+  - `ios/Runner/AppDelegate.swift`: Added `upgradeExtension`, `checkExtensionUpgrade` handlers
+- **Android Changes**:
+  - `android/app/src/main/kotlin/com/zarz/spotiflac/MainActivity.kt`: Already had upgrade methods
+
+---
+
+## [2.2.8] - 2026-01-12
+
+### Added
+
+- **Multi-Select Batch Delete**: Long-press tracks in History to enter selection mode
+  - Select multiple tracks at once
+  - "Select All" and "Delete Selected" actions
+  - Modern Material 3 bottom action bar (slides up from bottom)
+  - Works in both grid and list view modes
+- **History Filter Tabs**: Filter history by All/Albums/Singles
+  - Album = tracks where album has >1 track in history
+  - Single = tracks where album has only 1 track in history
+  - Filter chips show counts for each category
+- **Album Grouping View**: When "Albums" filter is selected, tracks are grouped by album
+  - Album cards displayed in 2-column grid with cover art and track count badge
+  - Tap album to open dedicated album detail screen
+  - Album detail shows all downloaded tracks from that album
+  - Multi-select delete support within album view
+  - Auto-navigates back when album has <2 tracks remaining
+
+### Changed
+
+- **Issue Templates**: Updated version confirmation checkbox to specify "(Stable Version)"
+
+---
+
+## [2.2.7] - 2026-01-11
+
+### Added
+
+- **CSV Import Metadata Enrichment**: Tracks imported from CSV now automatically fetch metadata from Deezer
+  - Cover art, duration, track/disc number fetched via ISRC lookup
+  - Fallback to text search (artist + track name) when ISRC not found in Deezer
+  - Progress dialog shows enrichment status during import
+  - Ensures downloaded files have proper cover art and metadata
+- **Deezer Metadata Support**: Enhanced metadata viewer for Deezer tracks
+  - "Open in Deezer" button for Deezer-sourced tracks (opens app or web)
+  - Displays "Deezer ID" instead of "Spotify ID" when applicable
+- **Smart Tag Injection**: Filename format editor intelligently handles separators
+  - Auto-detects if " - " is needed between tags
+  - Prevents double separators or missing spaces
+- **Dynamic Source Info**: Search source selector now shows helpful context
+  - "No login required" for Deezer
+  - "Requires credentials" for Spotify
+
+### Changed
+
+- **UI Modernization**: Major UI consistency updates across the app
+  - **Unified App Bars**: Home, History, and Settings now share identical behavior
+    - Lowered expanded header for easier one-handed reachability
+    - Dynamic title text scaling (20px to 34px)
+  - **Appearance Settings**: Completely redesigned appearance page
+    - New "Theme Preview" card showing visualizing current theme
+    - Modern color palette picker replacing old color dots
+    - Clean, grouped layout
+    - "AMOLED Dark" switch is now hidden when using Light Mode
+  - **App Logo**: Refined logo style on Home and About screens
+    - Inverted colors: Filled primary color circle with on-color icon
+    - Removed padding for a cleaner, bolder look
+  - **Material 3 Switches**: Added checkmark icon to active switches
+- **UI Modernization (Global)**: Complete design refresh for a cleaner, modern look
+  - **Rounded Corners**: Standardized 16px radius for all cards, buttons, and input fields
+  - **Transparent Elements**: Applied subtle transparency to input fields and containers using `surfaceContainerHighest`
+  - **Consistent Buttons**: Unified button styling across the app (pill shape, 16px radius)
+- **Options Settings Redesign**: improved layout and usability
+  - **Search Source Priority**: Moved "Search Source" section to the very top for quick access
+  - **Compact Source Selector**: Redesigned provider toggle (Deezer/Spotify) to be compact and consistent
+  - **Credentials Workflow**: Reorganized Custom Credentials settings; toggle now auto-prompts if credentials missing
+  - **Modern Credentials Dialog**: Totally redesigned input dialog for Spotify Client ID/Secret
+- **Filename Format Editor 2.0**:
+  - **Modern Sheet UI**: Replaced legacy dialog with a clean, full-width bottom sheet
+  - **Tag Chips**: Added clickable chips ({artist}, {title}) for one-tap insertion
+  - **Smart Formatting**: Automatically injects separators (" - ") when adding tags for faster editing
+
+### Fixed
+
+- **CSV Import Missing Cover Art**: Fixed tracks from CSV having no cover art in download history
+  - Cover URL now properly fetched from Deezer during enrichment
+  - Falls back to text search when ISRC lookup fails
+- **CSV Import Missing Duration**: Fixed duration showing 0:00 for CSV-imported tracks
+  - Duration now fetched from Deezer metadata during enrichment
+- **Disc Number Not Displayed**: Fixed disc number not showing in track metadata screen
+  - Changed condition from `discNumber > 0` to `discNumber > 0`
+  - Now displays disc 1 instead of hiding it
+- **Download History Using Wrong Track Data**: Fixed history using original CSV data instead of enriched data
+  - Now uses `trackToDownload` (enriched) instead of `item.track` (original)
+
+### Technical
+
+- Updated `lib/services/csv_import_service.dart`:
+  - Added `_enrichTracksMetadata()` with ISRC lookup + text search fallback
+  - Added progress callback for UI feedback
+- Updated `lib/screens/home_tab.dart`:
+  - Added progress dialog during CSV enrichment
+- Updated `lib/providers/download_queue_provider.dart`:
+  - Uses enriched track data for download history
+- Updated `lib/screens/track_metadata_screen.dart`:
+  - Show disc number when > 0 (was > 1)
+- Updated `go_backend/metadata.go`:
+  - Added `TotalSamples` to `AudioQuality` struct for duration calculation
+- Updated `go_backend/exports.go`:
+  - `ReadFileMetadata` now returns duration calculated from FLAC stream info
+- Updated `AppTheme` with new `InputDecorationTheme` and `ButtonTheme` definitions
+- Refactored `DownloadSettingsPage` to use new `_showFormatEditor` with cursor-aware capabilities
+- Optimized various dialogs to use `showModalBottomSheet` with `isScrollControlled` for better keyboard handling
+
+---
+
+## [2.2.6] - 2026-01-11
+
+### Fixed
+
+- **Release Mode Logging**: Flutter app logs now properly captured in release builds
+  - Previously only Go backend logs appeared when "Detailed Logging" was enabled
+  - Now both Flutter and Go logs are captured in release mode
+  - Bypasses Logger package which filters logs in release mode
+
+### Added
+
+- **Detailed Deezer Search Logging**: Better debugging for search issues
+  - Logs API URLs, response counts, and errors
+  - Helps diagnose geo-restriction and API issues
+  - Detects Deezer API error responses
+
+### Changed
+
+- **Home Screen Logo**: Replaced music note icon with app logo
+  - Uses `assets/images/logo.png`
+  - Rounded corners (24px radius)
+  - Fallback to music note icon if logo fails to load
+- **About Page Logo**: Removed shadow/border from logo
+  - Cleaner appearance without background container
+- **About Page Icon Alignment**: Icons now aligned with contributor avatars
+  - DoubleDouble and DAB Music icons use 40x40 area
+  - Text now properly aligned with contributor items
+
+## [2.2.5] - 2026-01-10
+
+### Added
+
+- **In-App Log Viewer with Go Backend Logs**: Complete logging system for debugging
+  - Go backend logs now captured and displayed in app
+  - Circular buffer stores up to 500 log entries
+  - Real-time polling (500ms) for Go backend logs
+  - Logs include timestamp, level, tag, and message
+  - "Go" badge indicates logs from backend
+- **Detailed Logging Toggle**: Control logging in Settings > Options > Debug
+  - Disabled by default for performance
+  - Errors are always logged regardless of setting
+  - Enable before reproducing bugs for detailed logs
+- **Log Issue Summary**: Automatic detection of common issues in logs
+  - ISP Blocking detection with affected domains
+  - Rate limiting detection
+  - Network error detection
+  - Track not found detection
+  - Shows suggestions for each issue type
+- **ISP Blocking Detection**: Detects when ISP blocks download services
+  - DNS resolution failure detection
+  - Connection reset/refused detection
+  - TLS handshake failure detection
+  - HTTP 403/451 blocking page detection
+  - Suggests VPN or DNS change (1.1.1.1 / 8.8.8.8)
+
+### Fixed
+
+- **Artist Profile Placeholder**: Shows person icon when artist has no profile image
+  - Validates image URL before loading
+  - Fallback icon on load error
+- **Latin Extended Character Detection**: Fixed wrong track downloads for Polish, Czech, French, Spanish songs
+  - Characters like Ł, ę, ć, ñ, é now correctly treated as Latin script
+  - Previously treated as "different script" causing false matches
+  - Affects both Tidal and Qobuz search
+
+### Changed
+
+- **Log Screen UI Improvements**:
+  - Copy button moved to app bar (left of menu)
+  - Removed redundant info card
+  - Cleaner interface
+- **Issue Templates Updated**: Instructions for enabling detailed logging before submitting bug reports
+
+### Technical
+
+- New file: `go_backend/logbuffer.go` with circular buffer and GoLog function
+- Updated `go_backend/httputil.go` with ISP blocking detection
+- Updated `go_backend/tidal.go` and `go_backend/qobuz.go` with `isLatinScript()` function
+- Updated `lib/utils/logger.dart` with Go log polling
+- Updated `lib/screens/settings/log_screen.dart` with issue summary
+- Added method channel handlers for logging in Android and iOS
+- New error type: `isp_blocked` for ISP blocking errors
+
+---
+
+## [2.2.0] - 2026-01-10
+
+### Fixed
+
+- **ISRC Metadata Missing:** Fixed an issue where ISRC codes were not being saved to the download history or embedded in file metadata for certain downloads. The backend now correctly propagates the ISRC found from streaming services (Tidal, Qobuz, Amazon) back to the application.
+- **Tidal Track/Disc Numbers:** Fixed missing Track Number and Disc Number in Tidal downloads. The downloader now prioritizes the actual metadata returned by Tidal over the potentially incomplete metadata from the initial search request.
+- **Concurrent Download Race Condition:** Fixed a potential race condition where temporary cover art files could overwrite each other during rapid concurrent downloads by adding randomization to temporary filenames.
+- **Qobuz Search Accuracy:** Reduced the duration tolerance for Qobuz search matches from 30s to 10s to prevent matching with incorrect versions/remixes.
+- **Metadata Enrichment Null Safety**: Fixed `type 'Null' is not a subtype of type 'String'` error
+  - Added proper null checks when parsing Go backend response
+  - Added type checking for track data before parsing
+- **Duration Calculation in Enrichment**: Fixed duration conversion bug
+  - Go backend returns `duration_ms` (milliseconds)
+  - Now properly converts to seconds for Track model
+
+### Changed
+
+- **Default Service Priority:** Updated the default download fallback order to **Tidal → Qobuz → Amazon**.
+  - Tidal is now the default download service (was Qobuz)
+  - Tidal has faster and more reliable ISRC matching
+  - Existing users need to change setting manually or clear app data
+- **Metadata Enrichment:** Improved metadata handling for Deezer tracks. If critical metadata (ISRC, Track Number) is missing from the initial search, the app now automatically fetches full details from the Deezer API before finding a source.
+
+### Added
+
+- **ISRC in History:** The Download History now reliably displays the ISRC code for downloaded tracks.
+- **Tidal Search Optimization:** Optimized Tidal search logic to immediately check for ISRC matches within search results, improving match speed and accuracy.
+  - Returns as soon as ISRC match is found in first query results
+  - Significantly faster for tracks with valid ISRC
+- **ISRC Enrichment for Search Results**: Tracks from Home search now fetch ISRC before download
+  - Search results don't include ISRC (for performance)
+  - ISRC is now fetched via metadata enrichment when download starts
+  - Ensures accurate track matching on all streaming services
+- **Deezer-to-Tidal Fallback:** Added native support for converting Deezer IDs to Tidal links via SongLink when using the fallback mechanism.
+- **Better Logging for Qobuz ISRC Search**: Added detailed logs for debugging
+  - Shows when ISRC search is attempted
+  - Shows number of results and exact ISRC matches found
+
+### Technical
+
+- Updated `go_backend/tidal.go`:
+  - Early exit optimization in `SearchTrackByMetadataWithISRC()`
+  - Deezer ID support in SongLink lookup
+- Updated `go_backend/qobuz.go`:
+  - Added logging for ISRC search flow
+  - Duration tolerance reduced from 30s to 10s
+- Updated `go_backend/exports.go`:
+  - Default service order changed to `[tidal, qobuz, amazon]`
+- Updated `lib/providers/download_queue_provider.dart`:
+  - ISRC-based enrichment condition
+  - Null-safe parsing of Go backend response
+- Updated `lib/services/platform_bridge.dart`:
+  - Null check for `getDeezerMetadata` result
+- Updated `lib/models/settings.dart`:
+  - Default service changed to `tidal`
+
+---
+
+## [2.1.7] - 2026-01-09
+
+### Added
+
+- **Special Thanks Section**: Added new "Special Thanks" section in About page to credit API creators
+  - **uimaxbai** - Creator of QQDL & HiFi API for Tidal downloads
+  - **sachinsenal0x64** - Original HiFi project creator, foundation of Tidal integration
+  - **DoubleDouble** - Amazing API for Amazon Music downloads
+  - **DAB Music** - The best Qobuz streaming API for Hi-Res downloads
+- **New Contributor**: Added Amonoman to Contributors section as the app logo creator
+
+### Fixed
+
+- **Missing PlatformBridge Import**: Fixed build errors in `home_tab.dart` and `playlist_screen.dart`
+  - Added missing `import 'package:spotiflac_android/services/platform_bridge.dart'`
+- **iOS Method Channel Crash**: Fixed "Method not implemented" crash when searching Deezer from iOS
+  - Implemented missing `searchDeezerAll` handler in `AppDelegate.swift`
+  - Ensures full compatibility with new Deezer integration features on iOS
+
+---
+
 ## [2.1.6] - 2026-01-08
 
 ### Added

README.md

@@ -1,11 +1,12 @@
 [![GitHub All Releases](https://img.shields.io/github/downloads/zarzet/SpotiFLAC-Mobile/total?style=for-the-badge)](https://github.com/zarzet/SpotiFLAC-Mobile/releases)
-[![VirusTotal](https://img.shields.io/badge/VirusTotal-Safe-brightgreen?style=for-the-badge&logo=virustotal)](https://www.virustotal.com/gui/file/ca16289599f71b8e50d3726a8c64a202ea922a1893bcf21b9eca1a050736f1f5/)
+[![VirusTotal](https://img.shields.io/badge/VirusTotal-Safe-brightgreen?style=for-the-badge&logo=virustotal)](https://www.virustotal.com/gui/file/e1c527eacb6f5ce527af214a75aab8da060c2afc629825fff24af858439e7e6b)
+[![Crowdin](https://img.shields.io/badge/HELP%20TRANSLATE%20ON-CROWDIN-%2321252b?style=for-the-badge&logo=crowdin)](https://crowdin.com/project/spotiflac-mobile)
 
 <div align="center">
 
 <img src="icon.png" width="128" />
 
-Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music — no account required.
+Download music in true lossless FLAC from Tidal, Qobuz & Amazon Music — no account required.
 
 ![Android](https://img.shields.io/badge/Android-7.0%2B-3DDC84?style=for-the-badge&logo=android&logoColor=white)
 ![iOS](https://img.shields.io/badge/iOS-14.0%2B-000000?style=for-the-badge&logo=apple&logoColor=white)
@@ -23,37 +24,60 @@ Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music — no account
   <img src="assets/images/4.jpg?v=2" width="200" />
 </p>
 
-## Metadata Source
+## Search Source
 
-SpotiFLAC supports two metadata sources for searching tracks:
+SpotiFLAC supports multiple search sources for finding music metadata:
 
-| Source | Pros | Cons |
-|--------|------|------|
-| **Deezer** (Default) | No developer account needed, rate limit per user IP | Slightly less comprehensive catalog |
-| **Spotify** | More comprehensive catalog, better search results | Requires developer API credentials to avoid rate limiting |
+| Source | Setup |
+|--------|-------|
+| **Deezer** (Default) | No setup required |
+| **Extensions** | Install additional search providers from the Store |
 
-### Using Spotify
-To use Spotify as your search source without hitting rate limits:
-1. Create a Spotify Developer account at [developer.spotify.com](https://developer.spotify.com)
-2. Create an app to get your Client ID and Client Secret
-3. Go to **Settings > Options > Spotify API > Change from Deezer to Spotify > Input Custom Credentials**
-4. Enter your Client ID and Secret
-5. Change **Search Source** to Spotify
+## Extensions
+
+Extensions allow the community to add new music sources and features without waiting for app updates. When a streaming service API changes or a new source becomes available, extensions can be updated independently.
+
+### Installing Extensions
+1. Go to **Store** tab in the app
+2. Browse and install extensions with one tap
+3. Or download a `.spotiflac-ext` file and install manually via **Settings > Extensions**
+4. Configure extension settings if needed
+5. Set provider priority in **Settings > Extensions > Provider Priority**
+
+### Developing Extensions
+Want to create your own extension? Check out the [Extension Development Guide](https://zarz.moe/docs) for complete documentation.
 
 ## Other project
 
 ### [SpotiFLAC (Desktop)](https://github.com/afkarxyz/SpotiFLAC)
-Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music for Windows, macOS & Linux
+Download music in true lossless FLAC from Tidal, Qobuz & Amazon Music for Windows, macOS & Linux
+
+## FAQ
+
+**Q: Why is my download failing with "Song not found"?**  
+A: The track may not be available on Tidal, Qobuz, or Amazon Music. Try enabling more download services in Settings > Download > Provider Priority, or install additional extensions from the Store.
+
+**Q: Why are some tracks downloading in lower quality?**  
+A: Quality depends on what's available from the streaming service. Tidal offers up to 24-bit/192kHz, Qobuz up to 24-bit/192kHz, and Amazon up to 24-bit/48kHz. The app automatically selects the best available quality.
+
+**Q: Can I download playlists?**  
+A: Yes! Just paste the playlist URL in the search bar. The app will fetch all tracks and queue them for download.
+
+**Q: Why do I need to grant storage permission?**  
+A: The app needs permission to save downloaded files to your device. On Android 13+, you may need to grant "All files access" in Settings > Apps > SpotiFLAC > Permissions.
+
+**Q: Is this app safe?**  
+A: Yes, the app is open source and you can verify the code yourself. Each release is scanned with VirusTotal (see badge at top of README).
 
 [![Ko-fi](https://img.shields.io/badge/Ko--fi-Support%20Me-FF5E5B?style=for-the-badge&logo=ko-fi&logoColor=white)](https://ko-fi.com/zarzet)
 
 ## Disclaimer
 
-> **iOS Support**: This app is primarily tested on Android. iOS support is experimental and may have bugs — the developer is too poor to afford an iPhone for proper testing. If you encounter issues on iOS, please report them!
-
 This project is for **educational and private use only**. The developer does not condone or encourage copyright infringement.
 
-**SpotiFLAC** is a third-party tool and is not affiliated with, endorsed by, or connected to Spotify, Tidal, Qobuz, Amazon Music, or any other streaming service.
+**SpotiFLAC** is a third-party tool and is not affiliated with, endorsed by, or connected to Tidal, Qobuz, Amazon Music, Deezer, or any other streaming service.
+
+The application is purely a user interface that facilitates communication between your device and existing third-party services.
 
 You are solely responsible for:
 1. Ensuring your use of this software complies with your local laws.

android/app/build.gradle.kts

@@ -46,7 +46,7 @@ android {
     defaultConfig {
         applicationId = "com.zarz.spotiflac"
         minSdk = flutter.minSdkVersion
-        targetSdk = 34
+        targetSdk = 36
         versionCode = flutter.versionCode
         versionName = flutter.versionName
         multiDexEnabled = true

android/app/src/main/kotlin/com/zarz/spotiflac/DownloadService.kt

@@ -15,6 +15,9 @@ import androidx.core.app.NotificationCompat
 /**
  * Foreground service to keep downloads running when app is in background.
  * This prevents Android from killing the download process or throttling network.
+ * 
+ * Note: Android 15+ (API 35+) has a 6-hour timeout for dataSync foreground services.
+ * The service will be stopped automatically after 6 hours of cumulative runtime in 24 hours.
  */
 class DownloadService : Service() {
     
@@ -106,6 +109,19 @@ class DownloadService : Service() {
     
     override fun onBind(intent: Intent?): IBinder? = null
     
+    /**
+     * Called when the foreground service timeout is reached (Android 15+, API 35+).
+     * dataSync services have a 6-hour limit in a 24-hour period.
+     * We must call stopSelf() within a few seconds to avoid a crash.
+     */
+    override fun onTimeout(startId: Int, fgsType: Int) {
+        // Log the timeout for debugging
+        android.util.Log.w("DownloadService", "Foreground service timeout reached (6 hours limit). Stopping service.")
+        
+        // Gracefully stop the service
+        stopForegroundService()
+    }
+    
     private fun createNotificationChannel() {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
             val channel = NotificationChannel(

android/app/src/main/kotlin/com/zarz/spotiflac/MainActivity.kt

@@ -117,6 +117,13 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        "cancelDownload" -> {
+                            val itemId = call.argument<String>("item_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.cancelDownload(itemId)
+                            }
+                            result.success(null)
+                        }
                         "setDownloadDirectory" -> {
                             val path = call.argument<String>("path") ?: ""
                             withContext(Dispatchers.IO) {
@@ -151,8 +158,9 @@ class MainActivity: FlutterActivity() {
                             val spotifyId = call.argument<String>("spotify_id") ?: ""
                             val trackName = call.argument<String>("track_name") ?: ""
                             val artistName = call.argument<String>("artist_name") ?: ""
+                            val durationMs = call.argument<Int>("duration_ms")?.toLong() ?: 0L
                             val response = withContext(Dispatchers.IO) {
-                                Gobackend.fetchLyrics(spotifyId, trackName, artistName)
+                                Gobackend.fetchLyrics(spotifyId, trackName, artistName, durationMs)
                             }
                             result.success(response)
                         }
@@ -161,8 +169,9 @@ class MainActivity: FlutterActivity() {
                             val trackName = call.argument<String>("track_name") ?: ""
                             val artistName = call.argument<String>("artist_name") ?: ""
                             val filePath = call.argument<String>("file_path") ?: ""
+                            val durationMs = call.argument<Int>("duration_ms")?.toLong() ?: 0L
                             val response = withContext(Dispatchers.IO) {
-                                Gobackend.getLyricsLRC(spotifyId, trackName, artistName, filePath)
+                                Gobackend.getLyricsLRC(spotifyId, trackName, artistName, filePath, durationMs)
                             }
                             result.success(response)
                         }
@@ -180,6 +189,13 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        "readFileMetadata" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.readFileMetadata(filePath)
+                            }
+                            result.success(response)
+                        }
                         "startDownloadService" -> {
                             val trackName = call.argument<String>("track_name") ?: ""
                             val artistName = call.argument<String>("artist_name") ?: ""
@@ -211,6 +227,12 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        "hasSpotifyCredentials" -> {
+                            val hasCredentials = withContext(Dispatchers.IO) {
+                                Gobackend.checkSpotifyCredentials()
+                            }
+                            result.success(hasCredentials)
+                        }
                         "preWarmTrackCache" -> {
                             val tracksJson = call.argument<String>("tracks") ?: "[]"
                             withContext(Dispatchers.IO) {
@@ -277,6 +299,370 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(response)
                         }
+                        // Log methods
+                        "getLogs" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getLogs()
+                            }
+                            result.success(response)
+                        }
+                        "getLogsSince" -> {
+                            val index = call.argument<Int>("index") ?: 0
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getLogsSince(index.toLong())
+                            }
+                            result.success(response)
+                        }
+                        "clearLogs" -> {
+                            withContext(Dispatchers.IO) {
+                                Gobackend.clearLogs()
+                            }
+                            result.success(null)
+                        }
+                        "getLogCount" -> {
+                            val count = withContext(Dispatchers.IO) {
+                                Gobackend.getLogCount()
+                            }
+                            result.success(count.toInt())
+                        }
+                        "setLoggingEnabled" -> {
+                            val enabled = call.argument<Boolean>("enabled") ?: false
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setLoggingEnabled(enabled)
+                            }
+                            result.success(null)
+                        }
+                        // Extension System methods
+                        "initExtensionSystem" -> {
+                            val extensionsDir = call.argument<String>("extensions_dir") ?: ""
+                            val dataDir = call.argument<String>("data_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.initExtensionSystem(extensionsDir, dataDir)
+                            }
+                            result.success(null)
+                        }
+                        "loadExtensionsFromDir" -> {
+                            val dirPath = call.argument<String>("dir_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.loadExtensionsFromDir(dirPath)
+                            }
+                            result.success(response)
+                        }
+                        "loadExtensionFromPath" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.loadExtensionFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "unloadExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.unloadExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "removeExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.removeExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "upgradeExtension" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.upgradeExtensionFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "checkExtensionUpgrade" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.checkExtensionUpgradeFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "getInstalledExtensions" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getInstalledExtensions()
+                            }
+                            result.success(response)
+                        }
+                        "setExtensionEnabled" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val enabled = call.argument<Boolean>("enabled") ?: false
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionEnabledByID(extensionId, enabled)
+                            }
+                            result.success(null)
+                        }
+                        "setProviderPriority" -> {
+                            val priorityJson = call.argument<String>("priority") ?: "[]"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setProviderPriorityJSON(priorityJson)
+                            }
+                            result.success(null)
+                        }
+                        "getProviderPriority" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getProviderPriorityJSON()
+                            }
+                            result.success(response)
+                        }
+                        "setMetadataProviderPriority" -> {
+                            val priorityJson = call.argument<String>("priority") ?: "[]"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setMetadataProviderPriorityJSON(priorityJson)
+                            }
+                            result.success(null)
+                        }
+                        "getMetadataProviderPriority" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getMetadataProviderPriorityJSON()
+                            }
+                            result.success(response)
+                        }
+                        "getExtensionSettings" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionSettingsJSON(extensionId)
+                            }
+                            result.success(response)
+                        }
+                        "setExtensionSettings" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val settingsJson = call.argument<String>("settings") ?: "{}"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionSettingsJSON(extensionId, settingsJson)
+                            }
+                            result.success(null)
+                        }
+                        "searchTracksWithExtensions" -> {
+                            val query = call.argument<String>("query") ?: ""
+                            val limit = call.argument<Int>("limit") ?: 20
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.searchTracksWithExtensionsJSON(query, limit.toLong())
+                            }
+                            result.success(response)
+                        }
+                        "downloadWithExtensions" -> {
+                            val requestJson = call.arguments as String
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.downloadWithExtensionsJSON(requestJson)
+                            }
+                            result.success(response)
+                        }
+                        "removeExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.removeExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "cleanupExtensions" -> {
+                            withContext(Dispatchers.IO) {
+                                Gobackend.cleanupExtensions()
+                            }
+                            result.success(null)
+                        }
+                        // Extension Auth API methods
+                        "getExtensionPendingAuth" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionPendingAuthJSON(extensionId)
+                            }
+                            if (response.isNullOrEmpty()) {
+                                result.success(null)
+                            } else {
+                                result.success(response)
+                            }
+                        }
+                        "setExtensionAuthCode" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val authCode = call.argument<String>("auth_code") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionAuthCodeByID(extensionId, authCode)
+                            }
+                            result.success(null)
+                        }
+                        "setExtensionTokens" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val accessToken = call.argument<String>("access_token") ?: ""
+                            val refreshToken = call.argument<String>("refresh_token") ?: ""
+                            val expiresIn = call.argument<Int>("expires_in") ?: 0
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionTokensByID(extensionId, accessToken, refreshToken, expiresIn.toLong())
+                            }
+                            result.success(null)
+                        }
+                        "clearExtensionPendingAuth" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.clearExtensionPendingAuthByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "isExtensionAuthenticated" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val isAuth = withContext(Dispatchers.IO) {
+                                Gobackend.isExtensionAuthenticatedByID(extensionId)
+                            }
+                            result.success(isAuth)
+                        }
+                        "getAllPendingAuthRequests" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAllPendingAuthRequestsJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension FFmpeg API
+                        "getPendingFFmpegCommand" -> {
+                            val commandId = call.argument<String>("command_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPendingFFmpegCommandJSON(commandId)
+                            }
+                            if (response.isNullOrEmpty()) {
+                                result.success(null)
+                            } else {
+                                result.success(response)
+                            }
+                        }
+                        "setFFmpegCommandResult" -> {
+                            val commandId = call.argument<String>("command_id") ?: ""
+                            val success = call.argument<Boolean>("success") ?: false
+                            val output = call.argument<String>("output") ?: ""
+                            val error = call.argument<String>("error") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setFFmpegCommandResultByID(commandId, success, output, error)
+                            }
+                            result.success(null)
+                        }
+                        "getAllPendingFFmpegCommands" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAllPendingFFmpegCommandsJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension Custom Search API
+                        "customSearchWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val query = call.argument<String>("query") ?: ""
+                            val optionsJson = call.argument<String>("options") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.customSearchWithExtensionJSON(extensionId, query, optionsJson)
+                            }
+                            result.success(response)
+                        }
+                        "getSearchProviders" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getSearchProvidersJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension URL Handler API
+                        "handleURLWithExtension" -> {
+                            val url = call.argument<String>("url") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.handleURLWithExtensionJSON(url)
+                            }
+                            result.success(response)
+                        }
+                        "findURLHandler" -> {
+                            val url = call.argument<String>("url") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.findURLHandlerJSON(url)
+                            }
+                            result.success(response)
+                        }
+                        "getURLHandlers" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getURLHandlersJSON()
+                            }
+                            result.success(response)
+                        }
+                        "getAlbumWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val albumId = call.argument<String>("album_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAlbumWithExtensionJSON(extensionId, albumId)
+                            }
+                            result.success(response)
+                        }
+                        "getPlaylistWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val playlistId = call.argument<String>("playlist_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPlaylistWithExtensionJSON(extensionId, playlistId)
+                            }
+                            result.success(response)
+                        }
+                        "getArtistWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val artistId = call.argument<String>("artist_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getArtistWithExtensionJSON(extensionId, artistId)
+                            }
+                            result.success(response)
+                        }
+                        // Extension Post-Processing API
+                        "runPostProcessing" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val metadataJson = call.argument<String>("metadata") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.runPostProcessingJSON(filePath, metadataJson)
+                            }
+                            result.success(response)
+                        }
+                        "getPostProcessingProviders" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPostProcessingProvidersJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension Store
+                        "initExtensionStore" -> {
+                            val cacheDir = call.argument<String>("cache_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.initExtensionStoreJSON(cacheDir)
+                            }
+                            result.success(null)
+                        }
+                        "getStoreExtensions" -> {
+                            val forceRefresh = call.argument<Boolean>("force_refresh") ?: false
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getStoreExtensionsJSON(forceRefresh)
+                            }
+                            result.success(response)
+                        }
+                        "searchStoreExtensions" -> {
+                            val query = call.argument<String>("query") ?: ""
+                            val category = call.argument<String>("category") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.searchStoreExtensionsJSON(query, category)
+                            }
+                            result.success(response)
+                        }
+                        "getStoreCategories" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getStoreCategoriesJSON()
+                            }
+                            result.success(response)
+                        }
+                        "downloadStoreExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val destDir = call.argument<String>("dest_dir") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.downloadStoreExtensionJSON(extensionId, destDir)
+                            }
+                            result.success(response)
+                        }
+                        "clearStoreCache" -> {
+                            withContext(Dispatchers.IO) {
+                                Gobackend.clearStoreCacheJSON()
+                            }
+                            result.success(null)
+                        }
                         else -> result.notImplemented()
                     }
                 } catch (e: Exception) {

crowdin.yml

@@ -0,0 +1,19 @@
+files:
+  - source: /lib/l10n/arb/app_en.arb
+    translation: /lib/l10n/arb/app_%locale%.arb
+    languages_mapping:
+      locale:
+        # Short codes for single-variant languages
+        de: de
+        es: es
+        fr: fr
+        hi: hi
+        id: id
+        ja: ja
+        ko: ko
+        nl: nl
+        pt: pt
+        ru: ru
+        # Full codes for Chinese variants
+        zh-CN: zh_CN
+        zh-TW: zh_TW

go_backend/amazon.go

@@ -2,8 +2,10 @@ package gobackend
 
 import (
 	"bufio"
+	"context"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -18,17 +20,16 @@ import (
 // AmazonDownloader handles Amazon Music downloads using DoubleDouble service (same as PC)
 type AmazonDownloader struct {
 	client           *http.Client
-	regions          []string // us, eu regions for DoubleDouble service
+	regions          []string  // us, eu regions for DoubleDouble service
 	lastAPICallTime  time.Time // Rate limiting: track last API call
 	apiCallCount     int       // Rate limiting: counter per minute
 	apiCallResetTime time.Time // Rate limiting: reset time
 }
 
 var (
-	// Global Amazon downloader instance for connection reuse
 	globalAmazonDownloader *AmazonDownloader
 	amazonDownloaderOnce   sync.Once
-	amazonRateLimitMu      sync.Mutex // Mutex for rate limiting
+	amazonRateLimitMu      sync.Mutex
 )
 
 // DoubleDoubleSubmitResponse is the response from DoubleDouble submit endpoint
@@ -52,46 +53,40 @@ type DoubleDoubleStatusResponse struct {
 func amazonArtistsMatch(expectedArtist, foundArtist string) bool {
 	normExpected := strings.ToLower(strings.TrimSpace(expectedArtist))
 	normFound := strings.ToLower(strings.TrimSpace(foundArtist))
-	
-	// Exact match
+
 	if normExpected == normFound {
 		return true
 	}
-	
-	// Check if one contains the other
+
 	if strings.Contains(normExpected, normFound) || strings.Contains(normFound, normExpected) {
 		return true
 	}
-	
-	// Check first artist (before comma or feat)
+
 	expectedFirst := strings.Split(normExpected, ",")[0]
 	expectedFirst = strings.Split(expectedFirst, " feat")[0]
 	expectedFirst = strings.Split(expectedFirst, " ft.")[0]
 	expectedFirst = strings.TrimSpace(expectedFirst)
-	
+
 	foundFirst := strings.Split(normFound, ",")[0]
 	foundFirst = strings.Split(foundFirst, " feat")[0]
 	foundFirst = strings.Split(foundFirst, " ft.")[0]
 	foundFirst = strings.TrimSpace(foundFirst)
-	
+
 	if expectedFirst == foundFirst {
 		return true
 	}
-	
-	// Check if first artist is contained in the other
+
 	if strings.Contains(expectedFirst, foundFirst) || strings.Contains(foundFirst, expectedFirst) {
 		return true
 	}
-	
-	// If scripts are different (one is ASCII, one is non-ASCII like Japanese/Chinese/Korean),
-	// assume they're the same artist with different transliteration
+
 	expectedASCII := amazonIsASCIIString(expectedArtist)
 	foundASCII := amazonIsASCIIString(foundArtist)
 	if expectedASCII != foundASCII {
-		fmt.Printf("[Amazon] Artist names in different scripts, assuming match: '%s' vs '%s'\n", expectedArtist, foundArtist)
+		GoLog("[Amazon] Artist names in different scripts, assuming match: '%s' vs '%s'\n", expectedArtist, foundArtist)
 		return true
 	}
-	
+
 	return false
 }
 
@@ -124,8 +119,7 @@ func (a *AmazonDownloader) waitForRateLimit() {
 	defer amazonRateLimitMu.Unlock()
 
 	now := time.Now()
-	
-	// Reset counter every minute
+
 	if now.Sub(a.apiCallResetTime) >= time.Minute {
 		a.apiCallCount = 0
 		a.apiCallResetTime = now
@@ -135,7 +129,7 @@ func (a *AmazonDownloader) waitForRateLimit() {
 	if a.apiCallCount >= 9 {
 		waitTime := time.Minute - now.Sub(a.apiCallResetTime)
 		if waitTime > 0 {
-			fmt.Printf("[Amazon] Rate limit reached, waiting %v...\n", waitTime.Round(time.Second))
+			GoLog("[Amazon] Rate limit reached, waiting %v...\n", waitTime.Round(time.Second))
 			time.Sleep(waitTime)
 			a.apiCallCount = 0
 			a.apiCallResetTime = time.Now()
@@ -148,12 +142,11 @@ func (a *AmazonDownloader) waitForRateLimit() {
 		minDelay := 7 * time.Second
 		if timeSinceLastCall < minDelay {
 			waitTime := minDelay - timeSinceLastCall
-			fmt.Printf("[Amazon] Rate limiting: waiting %v...\n", waitTime.Round(time.Second))
+			GoLog("[Amazon] Rate limiting: waiting %v...\n", waitTime.Round(time.Second))
 			time.Sleep(waitTime)
 		}
 	}
 
-	// Update tracking
 	a.lastAPICallTime = time.Now()
 	a.apiCallCount++
 }
@@ -170,19 +163,16 @@ func (a *AmazonDownloader) GetAvailableAPIs() []string {
 	return apis
 }
 
-
 // downloadFromDoubleDoubleService downloads a track using DoubleDouble service (same as PC)
 // This uses submit → poll → download mechanism
 // Internal function - not exported to gomobile
-func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir string) (string, string, string, error) {
+func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, _ string) (string, string, string, error) {
 	var lastError error
 
 	for _, region := range a.regions {
-		fmt.Printf("[Amazon] Trying region: %s...\n", region)
+		GoLog("[Amazon] Trying region: %s...\n", region)
 
-		// Build base URL for DoubleDouble service
-		// Decode base64 service URL (same as PC)
-		serviceBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly8=")         // https://
+		serviceBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly8=")               // https://
 		serviceDomain, _ := base64.StdEncoding.DecodeString("LmRvdWJsZWRvdWJsZS50b3A=") // .doubledouble.top
 		baseURL := fmt.Sprintf("%s%s%s", string(serviceBase), region, string(serviceDomain))
 
@@ -202,7 +192,7 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 		req.Header.Set("User-Agent", getRandomUserAgent())
 
 		fmt.Println("[Amazon] Submitting download request...")
-		
+
 		// Retry logic for 429 errors (like PC version: 3 retries with 15s wait)
 		var resp *http.Response
 		maxRetries := 3
@@ -217,7 +207,7 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 				resp.Body.Close()
 				if retry < maxRetries-1 {
 					waitTime := 15 * time.Second
-					fmt.Printf("[Amazon] Rate limited (429), waiting %v before retry %d/%d...\n", waitTime, retry+2, maxRetries)
+					GoLog("[Amazon] Rate limited (429), waiting %v before retry %d/%d...\n", waitTime, retry+2, maxRetries)
 					time.Sleep(waitTime)
 					continue
 				}
@@ -256,7 +246,7 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 		}
 
 		downloadID := submitResp.ID
-		fmt.Printf("[Amazon] Download ID: %s\n", downloadID)
+		GoLog("[Amazon] Download ID: %s\n", downloadID)
 
 		// Step 2: Poll for completion
 		statusURL := fmt.Sprintf("%s/dl/%s", baseURL, downloadID)
@@ -300,7 +290,6 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 			if status.Status == "done" {
 				fmt.Println("\n[Amazon] Download ready!")
 
-				// Build download URL
 				fileURL := status.URL
 				if strings.HasPrefix(fileURL, "./") {
 					fileURL = fmt.Sprintf("%s/%s", baseURL, fileURL[2:])
@@ -311,7 +300,7 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 				trackName := status.Current.Name
 				artist := status.Current.Artist
 
-				fmt.Printf("[Amazon] Downloading: %s - %s\n", artist, trackName)
+				GoLog("[Amazon] Downloading: %s - %s\n", artist, trackName)
 				return fileURL, trackName, artist, nil
 
 			} else if status.Status == "error" {
@@ -345,16 +334,23 @@ func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir
 	return "", "", "", fmt.Errorf("all regions failed. Last error: %v", lastError)
 }
 
-
 // DownloadFile downloads a file from URL with User-Agent and progress tracking
 func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string) error {
+	ctx := context.Background()
+
 	// Initialize item progress (required for all downloads)
 	if itemID != "" {
 		StartItemProgress(itemID)
 		defer CompleteItemProgress(itemID)
+		ctx = initDownloadCancel(itemID)
+		defer clearDownloadCancel(itemID)
 	}
 
-	req, err := http.NewRequest("GET", downloadURL, nil)
+	if isDownloadCancelled(itemID) {
+		return ErrDownloadCancelled
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadURL, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -363,6 +359,9 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 
 	resp, err := a.client.Do(req)
 	if err != nil {
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return err
 	}
 	defer resp.Body.Close()
@@ -372,7 +371,6 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 	}
 
 	expectedSize := resp.ContentLength
-	// Set total bytes if available
 	if expectedSize > 0 && itemID != "" {
 		SetItemBytesTotal(itemID, expectedSize)
 	}
@@ -382,16 +380,13 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 		return err
 	}
 
-	// Use buffered writer for better performance (256KB buffer)
 	bufWriter := bufio.NewWriterSize(out, 256*1024)
 
-	// Use item progress writer with buffered output
 	var written int64
 	if itemID != "" {
 		pw := NewItemProgressWriter(bufWriter, itemID)
 		written, err = io.Copy(pw, resp.Body)
 	} else {
-		// Fallback: direct copy without progress tracking
 		written, err = io.Copy(bufWriter, resp.Body)
 	}
 
@@ -399,9 +394,11 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 	flushErr := bufWriter.Flush()
 	closeErr := out.Close()
 
-	// Check for any errors
 	if err != nil {
 		os.Remove(outputPath)
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return fmt.Errorf("download interrupted: %w", err)
 	}
 	if flushErr != nil {
@@ -434,6 +431,7 @@ type AmazonDownloadResult struct {
 	ReleaseDate string
 	TrackNumber int
 	DiscNumber  int
+	ISRC        string
 }
 
 // downloadFromAmazon downloads a track using the request parameters
@@ -441,29 +439,24 @@ type AmazonDownloadResult struct {
 func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	downloader := NewAmazonDownloader()
 
-	// Check for existing file first
 	if existingFile, exists := checkISRCExistsInternal(req.OutputDir, req.ISRC); exists {
 		return AmazonDownloadResult{FilePath: "EXISTS:" + existingFile}, nil
 	}
 
-	// Get Amazon URL from SongLink
 	songlink := NewSongLinkClient()
 	var availability *TrackAvailability
 	var err error
-	
-	// Check if SpotifyID is actually a Deezer ID (format: "deezer:xxxxx")
+
 	if strings.HasPrefix(req.SpotifyID, "deezer:") {
-		// Extract Deezer ID and use Deezer-based lookup
 		deezerID := strings.TrimPrefix(req.SpotifyID, "deezer:")
-		fmt.Printf("[Amazon] Using Deezer ID for SongLink lookup: %s\n", deezerID)
+		GoLog("[Amazon] Using Deezer ID for SongLink lookup: %s\n", deezerID)
 		availability, err = songlink.CheckAvailabilityFromDeezer(deezerID)
 	} else if req.SpotifyID != "" {
-		// Use Spotify ID
 		availability, err = songlink.CheckTrackAvailability(req.SpotifyID, req.ISRC)
 	} else {
 		return AmazonDownloadResult{}, fmt.Errorf("no valid Spotify or Deezer ID provided for Amazon lookup")
 	}
-	
+
 	if err != nil {
 		return AmazonDownloadResult{}, fmt.Errorf("failed to check Amazon availability via SongLink: %w", err)
 	}
@@ -472,7 +465,6 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		return AmazonDownloadResult{}, fmt.Errorf("track not available on Amazon Music (SongLink returned no Amazon URL)")
 	}
 
-	// Create output directory if needed
 	if req.OutputDir != "." {
 		if err := os.MkdirAll(req.OutputDir, 0755); err != nil {
 			return AmazonDownloadResult{}, fmt.Errorf("failed to create output directory: %w", err)
@@ -487,14 +479,12 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 
 	// Verify artist matches
 	if artistName != "" && !amazonArtistsMatch(req.ArtistName, artistName) {
-		fmt.Printf("[Amazon] Artist mismatch: expected '%s', got '%s'. Rejecting.\n", req.ArtistName, artistName)
+		GoLog("[Amazon] Artist mismatch: expected '%s', got '%s'. Rejecting.\n", req.ArtistName, artistName)
 		return AmazonDownloadResult{}, fmt.Errorf("artist mismatch: expected '%s', got '%s'", req.ArtistName, artistName)
 	}
 
-	// Log match found
-	fmt.Printf("[Amazon] Match found: '%s' by '%s'\n", trackName, artistName)
+	GoLog("[Amazon] Match found: '%s' by '%s'\n", trackName, artistName)
 
-	// Build filename using Spotify metadata (more accurate)
 	filename := buildFilenameFromTemplate(req.FilenameFormat, map[string]interface{}{
 		"title":  req.TrackName,
 		"artist": req.ArtistName,
@@ -506,7 +496,6 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	filename = sanitizeFilename(filename) + ".flac"
 	outputPath := filepath.Join(req.OutputDir, filename)
 
-	// Check if file already exists
 	if fileInfo, statErr := os.Stat(outputPath); statErr == nil && fileInfo.Size() > 0 {
 		return AmazonDownloadResult{FilePath: "EXISTS:" + outputPath}, nil
 	}
@@ -523,19 +512,21 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 			req.TrackName,
 			req.ArtistName,
 			req.EmbedLyrics,
+			int64(req.DurationMS),
 		)
 	}()
 
 	// Download audio file with item ID for progress tracking
 	if err := downloader.DownloadFile(downloadURL, outputPath, req.ItemID); err != nil {
+		if errors.Is(err, ErrDownloadCancelled) {
+			return AmazonDownloadResult{}, ErrDownloadCancelled
+		}
 		return AmazonDownloadResult{}, fmt.Errorf("download failed: %w", err)
 	}
 
 	// Wait for parallel operations to complete
 	<-parallelDone
 
-	// Set progress to 100% and status to finalizing (before embedding)
-	// This makes the UI show "Finalizing..." while embedding happens
 	if req.ItemID != "" {
 		SetItemProgress(req.ItemID, 1.0, 0, 0)
 		SetItemFinalizing(req.ItemID)
@@ -543,19 +534,35 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 
 	// Log track info from DoubleDouble (for debugging)
 	if trackName != "" && artistName != "" {
-		fmt.Printf("[Amazon] DoubleDouble returned: %s - %s\n", artistName, trackName)
+		GoLog("[Amazon] DoubleDouble returned: %s - %s\n", artistName, trackName)
+	}
+
+	existingMeta, metaErr := ReadMetadata(outputPath)
+	actualTrackNum := req.TrackNumber
+	actualDiscNum := req.DiscNumber
+
+	if metaErr == nil && existingMeta != nil {
+		if existingMeta.TrackNumber > 0 && (req.TrackNumber == 0 || req.TrackNumber == 1) {
+			actualTrackNum = existingMeta.TrackNumber
+			GoLog("[Amazon] Using track number from file: %d (request had: %d)\n", actualTrackNum, req.TrackNumber)
+		}
+		if existingMeta.DiscNumber > 0 && (req.DiscNumber == 0 || req.DiscNumber == 1) {
+			actualDiscNum = existingMeta.DiscNumber
+			GoLog("[Amazon] Using disc number from file: %d (request had: %d)\n", actualDiscNum, req.DiscNumber)
+		}
 	}
 
 	// Embed metadata using Spotify data (more accurate than DoubleDouble)
+	// But preserve track/disc numbers from file if they were better
 	metadata := Metadata{
 		Title:       req.TrackName,
 		Artist:      req.ArtistName,
 		Album:       req.AlbumName,
 		AlbumArtist: req.AlbumArtist,
 		Date:        req.ReleaseDate,
-		TrackNumber: req.TrackNumber,
+		TrackNumber: actualTrackNum,
 		TotalTracks: req.TotalTracks,
-		DiscNumber:  req.DiscNumber,
+		DiscNumber:  actualDiscNum,
 		ISRC:        req.ISRC,
 	}
 
@@ -563,7 +570,7 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	var coverData []byte
 	if parallelResult != nil && parallelResult.CoverData != nil {
 		coverData = parallelResult.CoverData
-		fmt.Printf("[Amazon] Using parallel-fetched cover (%d bytes)\n", len(coverData))
+		GoLog("[Amazon] Using parallel-fetched cover (%d bytes)\n", len(coverData))
 	}
 
 	if err := EmbedMetadataWithCoverData(outputPath, metadata, coverData); err != nil {
@@ -572,9 +579,9 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 
 	// Embed lyrics from parallel fetch
 	if req.EmbedLyrics && parallelResult != nil && parallelResult.LyricsLRC != "" {
-		fmt.Printf("[Amazon] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
+		GoLog("[Amazon] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
 		if embedErr := EmbedLyrics(outputPath, parallelResult.LyricsLRC); embedErr != nil {
-			fmt.Printf("[Amazon] Warning: failed to embed lyrics: %v\n", embedErr)
+			GoLog("[Amazon] Warning: failed to embed lyrics: %v\n", embedErr)
 		} else {
 			fmt.Println("[Amazon] Lyrics embedded successfully")
 		}
@@ -583,36 +590,45 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	}
 
 	fmt.Println("[Amazon] ✓ Downloaded successfully from Amazon Music")
-	
-	// Read actual quality from the downloaded FLAC file
-	// Amazon API doesn't provide quality info, but we can read it from the file itself
+
 	quality, err := GetAudioQuality(outputPath)
 	if err != nil {
-		fmt.Printf("[Amazon] Warning: couldn't read quality from file: %v\n", err)
-		// Add to ISRC index for fast duplicate checking
-		AddToISRCIndex(req.OutputDir, req.ISRC, outputPath)
-		// Return 0 to indicate unknown quality
-		return AmazonDownloadResult{
-			FilePath:   outputPath,
-			BitDepth:   0,
-			SampleRate: 0,
-		}, nil
+		GoLog("[Amazon] Warning: couldn't read quality from file: %v\n", err)
+	} else {
+		GoLog("[Amazon] Actual quality: %d-bit/%dHz\n", quality.BitDepth, quality.SampleRate)
+	}
+
+	finalMeta, metaReadErr := ReadMetadata(outputPath)
+	if metaReadErr == nil && finalMeta != nil {
+		GoLog("[Amazon] Final metadata from file - Track: %d, Disc: %d, Date: %s\n",
+			finalMeta.TrackNumber, finalMeta.DiscNumber, finalMeta.Date)
+		actualTrackNum = finalMeta.TrackNumber
+		actualDiscNum = finalMeta.DiscNumber
+		if finalMeta.Date != "" {
+			req.ReleaseDate = finalMeta.Date
+		}
 	}
-	
-	fmt.Printf("[Amazon] Actual quality: %d-bit/%dHz\n", quality.BitDepth, quality.SampleRate)
 
 	// Add to ISRC index for fast duplicate checking
 	AddToISRCIndex(req.OutputDir, req.ISRC, outputPath)
 
+	bitDepth := 0
+	sampleRate := 0
+	if err == nil {
+		bitDepth = quality.BitDepth
+		sampleRate = quality.SampleRate
+	}
+
 	return AmazonDownloadResult{
 		FilePath:    outputPath,
-		BitDepth:    quality.BitDepth,
-		SampleRate:  quality.SampleRate,
+		BitDepth:    bitDepth,
+		SampleRate:  sampleRate,
 		Title:       req.TrackName,
 		Artist:      req.ArtistName,
 		Album:       req.AlbumName,
 		ReleaseDate: req.ReleaseDate,
-		TrackNumber: req.TrackNumber,
-		DiscNumber:  req.DiscNumber,
+		TrackNumber: actualTrackNum,
+		DiscNumber:  actualDiscNum,
+		ISRC:        req.ISRC,
 	}, nil
 }

go_backend/cancel.go

@@ -0,0 +1,78 @@
+package gobackend
+
+import (
+	"context"
+	"errors"
+	"sync"
+)
+
+// ErrDownloadCancelled is returned when a download is cancelled by the user.
+var ErrDownloadCancelled = errors.New("download cancelled")
+
+type cancelEntry struct {
+	cancel   context.CancelFunc
+	canceled bool
+}
+
+var (
+	cancelMu  sync.Mutex
+	cancelMap = make(map[string]*cancelEntry)
+)
+
+func initDownloadCancel(itemID string) context.Context {
+	if itemID == "" {
+		return context.Background()
+	}
+
+	cancelMu.Lock()
+	defer cancelMu.Unlock()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancelMap[itemID] = &cancelEntry{
+		cancel:   cancel,
+		canceled: false,
+	}
+	return ctx
+}
+
+func cancelDownload(itemID string) {
+	if itemID == "" {
+		return
+	}
+
+	cancelMu.Lock()
+	entry, ok := cancelMap[itemID]
+	if ok {
+		entry.canceled = true
+		if entry.cancel != nil {
+			entry.cancel()
+		}
+	} else {
+		cancelMap[itemID] = &cancelEntry{canceled: true}
+	}
+	cancelMu.Unlock()
+
+	RemoveItemProgress(itemID)
+}
+
+func isDownloadCancelled(itemID string) bool {
+	if itemID == "" {
+		return false
+	}
+
+	cancelMu.Lock()
+	entry, ok := cancelMap[itemID]
+	canceled := ok && entry.canceled
+	cancelMu.Unlock()
+	return canceled
+}
+
+func clearDownloadCancel(itemID string) {
+	if itemID == "" {
+		return
+	}
+
+	cancelMu.Lock()
+	delete(cancelMap, itemID)
+	cancelMu.Unlock()
+}

go_backend/cover.go

@@ -4,15 +4,29 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"regexp"
 	"strings"
 )
 
 // Spotify image size codes (same as PC version)
 const (
-	spotifySize640 = "ab67616d0000b273" // 640x640
+	spotifySize300 = "ab67616d00001e02" // 300x300 (small)
+	spotifySize640 = "ab67616d0000b273" // 640x640 (medium)
 	spotifySizeMax = "ab67616d000082c1" // Max resolution (~2000x2000)
 )
 
+// Deezer CDN supports these sizes: 56, 250, 500, 1000, 1400, 1800
+var deezerSizeRegex = regexp.MustCompile(`/(\d+)x(\d+)-\d+-\d+-\d+-\d+\.jpg$`)
+
+// convertSmallToMedium upgrades 300x300 cover URL to 640x640
+// Same logic as PC version for consistency
+func convertSmallToMedium(imageURL string) string {
+	if strings.Contains(imageURL, spotifySize300) {
+		return strings.Replace(imageURL, spotifySize300, spotifySize640, 1)
+	}
+	return imageURL
+}
+
 // downloadCoverToMemory downloads cover art and returns as bytes (no file creation)
 // This avoids file permission issues on Android
 func downloadCoverToMemory(coverURL string, maxQuality bool) ([]byte, error) {
@@ -20,20 +34,28 @@ func downloadCoverToMemory(coverURL string, maxQuality bool) ([]byte, error) {
 		return nil, fmt.Errorf("no cover URL provided")
 	}
 
-	fmt.Printf("[Cover] Downloading cover from: %s\n", coverURL)
+	GoLog("[Cover] Original URL: %s", coverURL)
+
+	downloadURL := convertSmallToMedium(coverURL)
+	if downloadURL != coverURL {
+		GoLog("[Cover] Upgraded 300x300 → 640x640")
+	}
 
-	// Upgrade to max quality if requested
-	downloadURL := coverURL
 	if maxQuality {
-		downloadURL = upgradeToMaxQuality(coverURL)
-		if downloadURL != coverURL {
-			fmt.Printf("[Cover] Upgraded to max quality URL: %s\n", downloadURL)
+		maxURL := upgradeToMaxQuality(downloadURL)
+		if maxURL != downloadURL {
+			downloadURL = maxURL
+			// Log already printed by upgradeToMaxQuality for Deezer
+			if strings.Contains(coverURL, "scdn.co") || strings.Contains(coverURL, "spotifycdn") {
+				GoLog("[Cover] Spotify: upgraded to max resolution (~2000x2000)")
+			}
 		}
 	}
 
+	GoLog("[Cover] Final URL: %s", downloadURL)
+
 	client := NewHTTPClientWithTimeout(DefaultTimeout)
 
-	// Create request with User-Agent (required by Spotify CDN)
 	req, err := http.NewRequest("GET", downloadURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
@@ -54,48 +76,64 @@ func downloadCoverToMemory(coverURL string, maxQuality bool) ([]byte, error) {
 		return nil, fmt.Errorf("failed to read cover data: %w", err)
 	}
 
-	fmt.Printf("[Cover] Downloaded %d bytes\n", len(data))
+	sizeKB := len(data) / 1024
+	var resolution string
+	if sizeKB > 200 {
+		resolution = "~2000x2000 (hi-res)"
+	} else if sizeKB > 50 {
+		resolution = "~640x640"
+	} else {
+		resolution = "~300x300"
+	}
+	GoLog("[Cover] Downloaded %d KB (%s)", sizeKB, resolution)
+
 	return data, nil
 }
 
-// upgradeToMaxQuality upgrades Spotify cover URL to maximum quality
-// Uses same logic as PC version - replaces 640x640 size code with max resolution
+// upgradeToMaxQuality upgrades cover URL to maximum quality
+// Supports both Spotify and Deezer CDNs
 func upgradeToMaxQuality(coverURL string) string {
-	// Spotify image URLs can be upgraded by changing the size parameter
-	// Format: https://i.scdn.co/image/ab67616d0000b273...
-	// ab67616d0000b273 = 640x640
-	// ab67616d000082c1 = Max resolution (~2000x2000)
-
+	// Spotify CDN upgrade
 	if strings.Contains(coverURL, spotifySize640) {
-		// Try max resolution first
-		maxURL := strings.Replace(coverURL, spotifySize640, spotifySizeMax, 1)
+		return strings.Replace(coverURL, spotifySize640, spotifySizeMax, 1)
+	}
 
-		// Verify max resolution URL is available
-		client := NewHTTPClientWithTimeout(DefaultTimeout)
-		req, err := http.NewRequest("HEAD", maxURL, nil)
-		if err == nil {
-			resp, err := DoRequestWithUserAgent(client, req)
-			if err == nil {
-				resp.Body.Close()
-				if resp.StatusCode == http.StatusOK {
-					return maxURL
-				}
-			}
-		}
+	// Deezer CDN upgrade
+	if strings.Contains(coverURL, "cdn-images.dzcdn.net") {
+		return upgradeDeezerCover(coverURL)
 	}
 
 	return coverURL
 }
 
+// upgradeDeezerCover upgrades Deezer cover URL to maximum quality (1800x1800)
+// Deezer CDN format: https://cdn-images.dzcdn.net/images/cover/{hash}/{size}x{size}-000000-80-0-0.jpg
+// Available sizes: 56, 250, 500, 1000, 1400, 1800
+func upgradeDeezerCover(coverURL string) string {
+	if !strings.Contains(coverURL, "cdn-images.dzcdn.net") {
+		return coverURL
+	}
+
+	// Replace any size pattern with 1800x1800
+	upgraded := deezerSizeRegex.ReplaceAllString(coverURL, "/1800x1800-000000-80-0-0.jpg")
+	if upgraded != coverURL {
+		GoLog("[Cover] Deezer: upgraded to 1800x1800")
+	}
+	return upgraded
+}
+
 // GetCoverFromSpotify gets cover URL from Spotify metadata
 func GetCoverFromSpotify(imageURL string, maxQuality bool) string {
 	if imageURL == "" {
 		return ""
 	}
 
+	// Always upgrade small to medium first
+	result := convertSmallToMedium(imageURL)
+
 	if maxQuality {
-		return upgradeToMaxQuality(imageURL)
+		result = upgradeToMaxQuality(result)
 	}
 
-	return imageURL
+	return result
 }

go_backend/deezer.go

@@ -19,11 +19,10 @@ const (
 	deezerAlbumURL    = deezerBaseURL + "/album/%s"
 	deezerArtistURL   = deezerBaseURL + "/artist/%s"
 	deezerPlaylistURL = deezerBaseURL + "/playlist/%s"
-	
+
 	deezerCacheTTL = 10 * time.Minute
-	
-	// Parallel ISRC fetching settings
-	deezerMaxParallelISRC = 10 // Max concurrent ISRC fetches
+
+	deezerMaxParallelISRC = 10
 )
 
 // DeezerClient handles Deezer API interactions (no auth required)
@@ -36,7 +35,6 @@ type DeezerClient struct {
 	cacheMu     sync.RWMutex
 }
 
-// Singleton instance
 var (
 	deezerClient     *DeezerClient
 	deezerClientOnce sync.Once
@@ -58,27 +56,27 @@ func GetDeezerClient() *DeezerClient {
 
 // Deezer API response types
 type deezerTrack struct {
-	ID             int64  `json:"id"`
-	Title          string `json:"title"`
-	Duration       int    `json:"duration"` // in seconds
-	TrackPosition  int    `json:"track_position"`
-	DiskNumber     int    `json:"disk_number"`
-	ISRC           string `json:"isrc"`
-	Link           string `json:"link"`
-	ReleaseDate    string `json:"release_date"` // Sometimes at track level
-	Artist         deezerArtist `json:"artist"`
-	Album          deezerAlbumSimple `json:"album"`
-	Contributors   []deezerArtist `json:"contributors"`
+	ID            int64             `json:"id"`
+	Title         string            `json:"title"`
+	Duration      int               `json:"duration"` // in seconds
+	TrackPosition int               `json:"track_position"`
+	DiskNumber    int               `json:"disk_number"`
+	ISRC          string            `json:"isrc"`
+	Link          string            `json:"link"`
+	ReleaseDate   string            `json:"release_date"` // Sometimes at track level
+	Artist        deezerArtist      `json:"artist"`
+	Album         deezerAlbumSimple `json:"album"`
+	Contributors  []deezerArtist    `json:"contributors"`
 }
 
 type deezerArtist struct {
-	ID        int64  `json:"id"`
-	Name      string `json:"name"`
-	Picture   string `json:"picture"`
+	ID            int64  `json:"id"`
+	Name          string `json:"name"`
+	Picture       string `json:"picture"`
 	PictureMedium string `json:"picture_medium"`
 	PictureBig    string `json:"picture_big"`
 	PictureXL     string `json:"picture_xl"`
-	NbFan     int    `json:"nb_fan"`
+	NbFan         int    `json:"nb_fan"`
 }
 
 type deezerAlbumSimple struct {
@@ -89,10 +87,9 @@ type deezerAlbumSimple struct {
 	CoverBig    string `json:"cover_big"`
 	CoverXL     string `json:"cover_xl"`
 	ReleaseDate string `json:"release_date"` // Sometimes at album level
+	RecordType  string `json:"record_type"`  // album, single, ep, compile
 }
-// ... (skip other structs as they are fine/unchanged) ...
 
-// ... (in convertTrack) ...
 func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 	artistName := track.Artist.Name
 	if len(track.Contributors) > 0 {
@@ -113,8 +110,7 @@ func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 	if albumImage == "" {
 		albumImage = track.Album.Cover
 	}
-	
-	// Try to find release date
+
 	releaseDate := track.ReleaseDate
 	if releaseDate == "" {
 		releaseDate = track.Album.ReleaseDate
@@ -137,17 +133,18 @@ func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 }
 
 type deezerAlbumFull struct {
-	ID          int64  `json:"id"`
-	Title       string `json:"title"`
-	Cover       string `json:"cover"`
-	CoverMedium string `json:"cover_medium"`
-	CoverBig    string `json:"cover_big"`
-	CoverXL     string `json:"cover_xl"`
-	ReleaseDate string `json:"release_date"`
-	NbTracks    int    `json:"nb_tracks"`
-	Artist      deezerArtist `json:"artist"`
+	ID           int64          `json:"id"`
+	Title        string         `json:"title"`
+	Cover        string         `json:"cover"`
+	CoverMedium  string         `json:"cover_medium"`
+	CoverBig     string         `json:"cover_big"`
+	CoverXL      string         `json:"cover_xl"`
+	ReleaseDate  string         `json:"release_date"`
+	NbTracks     int            `json:"nb_tracks"`
+	RecordType   string         `json:"record_type"` // album, single, ep, compile
+	Artist       deezerArtist   `json:"artist"`
 	Contributors []deezerArtist `json:"contributors"`
-	Tracks      struct {
+	Tracks       struct {
 		Data []deezerTrack `json:"data"`
 	} `json:"tracks"`
 }
@@ -164,17 +161,17 @@ type deezerArtistFull struct {
 }
 
 type deezerPlaylistFull struct {
-	ID          int64  `json:"id"`
-	Title       string `json:"title"`
-	Picture     string `json:"picture"`
+	ID            int64  `json:"id"`
+	Title         string `json:"title"`
+	Picture       string `json:"picture"`
 	PictureMedium string `json:"picture_medium"`
 	PictureBig    string `json:"picture_big"`
 	PictureXL     string `json:"picture_xl"`
-	NbTracks    int    `json:"nb_tracks"`
-	Creator     struct {
+	NbTracks      int    `json:"nb_tracks"`
+	Creator       struct {
 		Name string `json:"name"`
 	} `json:"creator"`
-	Tracks      struct {
+	Tracks struct {
 		Data []deezerTrack `json:"data"`
 	} `json:"tracks"`
 }
@@ -182,11 +179,14 @@ type deezerPlaylistFull struct {
 // SearchAll searches for tracks and artists on Deezer
 // NOTE: ISRC is NOT fetched during search for performance - use GetTrackISRC when needed for download
 func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit, artistLimit int) (*SearchAllResult, error) {
+	GoLog("[Deezer] SearchAll: query=%q, trackLimit=%d, artistLimit=%d\n", query, trackLimit, artistLimit)
+
 	cacheKey := fmt.Sprintf("deezer:all:%s:%d:%d", query, trackLimit, artistLimit)
-	
+
 	c.cacheMu.RLock()
 	if entry, ok := c.searchCache[cacheKey]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
+		GoLog("[Deezer] SearchAll: returning cached result\n")
 		return entry.data.(*SearchAllResult), nil
 	}
 	c.cacheMu.RUnlock()
@@ -198,13 +198,28 @@ func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit,
 
 	// Search tracks - NO ISRC fetch for performance
 	trackURL := fmt.Sprintf("%s/track?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), trackLimit)
+	GoLog("[Deezer] Fetching tracks from: %s\n", trackURL)
+
 	var trackResp struct {
-		Data []deezerTrack `json:"data"`
+		Data  []deezerTrack `json:"data"`
+		Error *struct {
+			Type    string `json:"type"`
+			Message string `json:"message"`
+			Code    int    `json:"code"`
+		} `json:"error"`
 	}
 	if err := c.getJSON(ctx, trackURL, &trackResp); err != nil {
+		GoLog("[Deezer] Track search failed: %v\n", err)
 		return nil, fmt.Errorf("deezer track search failed: %w", err)
 	}
 
+	if trackResp.Error != nil {
+		GoLog("[Deezer] API error: type=%s, code=%d, message=%s\n", trackResp.Error.Type, trackResp.Error.Code, trackResp.Error.Message)
+		return nil, fmt.Errorf("deezer API error: %s (code %d)", trackResp.Error.Message, trackResp.Error.Code)
+	}
+
+	GoLog("[Deezer] Got %d tracks from API\n", len(trackResp.Data))
+
 	for _, track := range trackResp.Data {
 		// Convert directly without fetching ISRC - much faster
 		result.Tracks = append(result.Tracks, c.convertTrack(track))
@@ -212,21 +227,37 @@ func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit,
 
 	// Search artists
 	artistURL := fmt.Sprintf("%s/artist?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), artistLimit)
+	GoLog("[Deezer] Fetching artists from: %s\n", artistURL)
+
 	var artistResp struct {
-		Data []deezerArtist `json:"data"`
+		Data  []deezerArtist `json:"data"`
+		Error *struct {
+			Type    string `json:"type"`
+			Message string `json:"message"`
+			Code    int    `json:"code"`
+		} `json:"error"`
 	}
 	if err := c.getJSON(ctx, artistURL, &artistResp); err == nil {
-		for _, artist := range artistResp.Data {
-			result.Artists = append(result.Artists, SearchArtistResult{
-				ID:         fmt.Sprintf("deezer:%d", artist.ID),
-				Name:       artist.Name,
-				Images:     c.getBestArtistImage(artist),
-				Followers:  artist.NbFan,
-				Popularity: 0,
-			})
+		if artistResp.Error != nil {
+			GoLog("[Deezer] Artist API error: type=%s, code=%d, message=%s\n", artistResp.Error.Type, artistResp.Error.Code, artistResp.Error.Message)
+		} else {
+			GoLog("[Deezer] Got %d artists from API\n", len(artistResp.Data))
+			for _, artist := range artistResp.Data {
+				result.Artists = append(result.Artists, SearchArtistResult{
+					ID:         fmt.Sprintf("deezer:%d", artist.ID),
+					Name:       artist.Name,
+					Images:     c.getBestArtistImage(artist),
+					Followers:  artist.NbFan,
+					Popularity: 0,
+				})
+			}
 		}
+	} else {
+		GoLog("[Deezer] Artist search failed: %v\n", err)
 	}
 
+	GoLog("[Deezer] SearchAll complete: %d tracks, %d artists\n", len(result.Tracks), len(result.Artists))
+
 	// Cache result
 	c.cacheMu.Lock()
 	c.searchCache[cacheKey] = &cacheEntry{
@@ -241,7 +272,7 @@ func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit,
 // GetTrack fetches a single track by Deezer ID
 func (c *DeezerClient) GetTrack(ctx context.Context, trackID string) (*TrackResponse, error) {
 	trackURL := fmt.Sprintf(deezerTrackURL, trackID)
-	
+
 	var track deezerTrack
 	if err := c.getJSON(ctx, trackURL, &track); err != nil {
 		return nil, err
@@ -263,7 +294,7 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 	c.cacheMu.RUnlock()
 
 	albumURL := fmt.Sprintf(deezerAlbumURL, albumID)
-	
+
 	var album deezerAlbumFull
 	if err := c.getJSON(ctx, albumURL, &album); err != nil {
 		return nil, err
@@ -291,6 +322,12 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 	isrcMap := c.fetchISRCsParallel(ctx, album.Tracks.Data)
 
 	tracks := make([]AlbumTrackMetadata, 0, len(album.Tracks.Data))
+	// Normalize record_type (Deezer uses "compile" instead of "compilation")
+	albumType := album.RecordType
+	if albumType == "compile" {
+		albumType = "compilation"
+	}
+
 	for _, track := range album.Tracks.Data {
 		trackIDStr := fmt.Sprintf("%d", track.ID)
 		isrc := isrcMap[trackIDStr]
@@ -310,6 +347,7 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 			ExternalURL: track.Link,
 			ISRC:        isrc,
 			AlbumID:     fmt.Sprintf("deezer:%d", album.ID),
+			AlbumType:   albumType,
 		})
 	}
 
@@ -375,7 +413,7 @@ func (c *DeezerClient) GetArtist(ctx context.Context, artistID string) (*ArtistR
 			if albumType == "compile" {
 				albumType = "compilation"
 			}
-			
+
 			coverURL := album.CoverXL
 			if coverURL == "" {
 				coverURL = album.CoverBig
@@ -418,7 +456,7 @@ func (c *DeezerClient) GetArtist(ctx context.Context, artistID string) (*ArtistR
 // ISRC is fetched in parallel for better performance
 func (c *DeezerClient) GetPlaylist(ctx context.Context, playlistID string) (*PlaylistResponsePayload, error) {
 	playlistURL := fmt.Sprintf(deezerPlaylistURL, playlistID)
-	
+
 	var playlist deezerPlaylistFull
 	if err := c.getJSON(ctx, playlistURL, &playlist); err != nil {
 		return nil, err
@@ -482,7 +520,7 @@ func (c *DeezerClient) SearchByISRC(ctx context.Context, isrc string) (*TrackMet
 	// Use direct ISRC endpoint (API 2.0)
 	// https://api.deezer.com/2.0/track/isrc:{ISRC}
 	directURL := fmt.Sprintf("%s/track/isrc:%s", deezerBaseURL, isrc)
-	
+
 	var track deezerTrack
 	if err := c.getJSON(ctx, directURL, &track); err != nil {
 		// Fallback to search if direct endpoint fails
@@ -500,7 +538,6 @@ func (c *DeezerClient) SearchByISRC(ctx context.Context, isrc string) (*TrackMet
 		return &result, nil
 	}
 
-	// Check if we got a valid response (ID > 0)
 	if track.ID == 0 {
 		return nil, fmt.Errorf("no track found for ISRC: %s", isrc)
 	}
@@ -522,8 +559,7 @@ func (c *DeezerClient) fetchFullTrack(ctx context.Context, trackID string) (*dee
 func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTrack) map[string]string {
 	result := make(map[string]string)
 	var resultMu sync.Mutex
-	
-	// First, check cache for existing ISRCs
+
 	var tracksToFetch []deezerTrack
 	c.cacheMu.RLock()
 	for _, track := range tracks {
@@ -535,20 +571,20 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 		}
 	}
 	c.cacheMu.RUnlock()
-	
+
 	if len(tracksToFetch) == 0 {
 		return result
 	}
-	
+
 	// Use semaphore to limit concurrent requests
 	sem := make(chan struct{}, deezerMaxParallelISRC)
 	var wg sync.WaitGroup
-	
+
 	for _, track := range tracksToFetch {
 		wg.Add(1)
 		go func(t deezerTrack) {
 			defer wg.Done()
-			
+
 			// Acquire semaphore
 			select {
 			case sem <- struct{}{}:
@@ -556,24 +592,24 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 			case <-ctx.Done():
 				return
 			}
-			
+
 			trackIDStr := fmt.Sprintf("%d", t.ID)
 			fullTrack, err := c.fetchFullTrack(ctx, trackIDStr)
 			if err != nil || fullTrack == nil {
 				return
 			}
-			
+
 			// Store in result and cache
 			resultMu.Lock()
 			result[trackIDStr] = fullTrack.ISRC
 			resultMu.Unlock()
-			
+
 			c.cacheMu.Lock()
 			c.isrcCache[trackIDStr] = fullTrack.ISRC
 			c.cacheMu.Unlock()
 		}(track)
 	}
-	
+
 	wg.Wait()
 	return result
 }
@@ -581,30 +617,27 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 // GetTrackISRC fetches ISRC for a single track (with caching)
 // Use this when you need ISRC for download
 func (c *DeezerClient) GetTrackISRC(ctx context.Context, trackID string) (string, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if isrc, ok := c.isrcCache[trackID]; ok {
 		c.cacheMu.RUnlock()
 		return isrc, nil
 	}
 	c.cacheMu.RUnlock()
-	
+
 	// Fetch from API
 	fullTrack, err := c.fetchFullTrack(ctx, trackID)
 	if err != nil {
 		return "", err
 	}
-	
+
 	// Cache the result
 	c.cacheMu.Lock()
 	c.isrcCache[trackID] = fullTrack.ISRC
 	c.cacheMu.Unlock()
-	
+
 	return fullTrack.ISRC, nil
 }
 
-
-
 func (c *DeezerClient) getBestArtistImage(artist deezerArtist) string {
 	if artist.PictureXL != "" {
 		return artist.PictureXL
@@ -687,7 +720,7 @@ func parseDeezerURL(input string) (string, string, error) {
 	}
 
 	parts := strings.Split(strings.Trim(parsed.Path, "/"), "/")
-	
+
 	// Skip language prefix if present (e.g., /en/, /fr/)
 	if len(parts) > 0 && len(parts[0]) == 2 {
 		parts = parts[1:]

go_backend/duplicate.go

@@ -18,30 +18,45 @@ type ISRCIndex struct {
 	mu        sync.RWMutex
 }
 
-// Global ISRC index cache (per output directory)
 var (
 	isrcIndexCache   = make(map[string]*ISRCIndex)
 	isrcIndexCacheMu sync.RWMutex
-	isrcIndexTTL     = 5 * time.Minute // Cache TTL - rebuild after 5 minutes
+	isrcBuildingMu   sync.Map // Per-directory build lock to prevent concurrent builds
+	isrcIndexTTL     = 5 * time.Minute
 )
 
 // GetISRCIndex returns or builds an ISRC index for the given directory
+// Uses per-directory mutex to prevent concurrent builds (race condition fix)
 func GetISRCIndex(outputDir string) *ISRCIndex {
+	// Fast path: check cache first
 	isrcIndexCacheMu.RLock()
 	idx, exists := isrcIndexCache[outputDir]
 	isrcIndexCacheMu.RUnlock()
 
-	// Return cached index if still valid
 	if exists && time.Since(idx.buildTime) < isrcIndexTTL {
 		return idx
 	}
 
-	// Build new index
+	// Slow path: need to build index
+	// Use per-directory mutex to prevent multiple goroutines from building simultaneously
+	buildLock, _ := isrcBuildingMu.LoadOrStore(outputDir, &sync.Mutex{})
+	mu := buildLock.(*sync.Mutex)
+	mu.Lock()
+	defer mu.Unlock()
+
+	// Double-check cache after acquiring lock (another goroutine may have built it)
+	isrcIndexCacheMu.RLock()
+	idx, exists = isrcIndexCache[outputDir]
+	isrcIndexCacheMu.RUnlock()
+
+	if exists && time.Since(idx.buildTime) < isrcIndexTTL {
+		return idx
+	}
+
 	return buildISRCIndex(outputDir)
 }
 
 // buildISRCIndex scans a directory and builds a map of ISRC -> file path
-// Same implementation as PC version for consistency
 func buildISRCIndex(outputDir string) *ISRCIndex {
 	idx := &ISRCIndex{
 		index:     make(map[string]string),
@@ -56,7 +71,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	startTime := time.Now()
 	fileCount := 0
 
-	// Walk directory - only check .flac files
 	filepath.Walk(outputDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil || info.IsDir() {
 			return nil
@@ -67,13 +81,11 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 			return nil
 		}
 
-		// Read ISRC from file
 		metadata, err := ReadMetadata(path)
 		if err != nil || metadata.ISRC == "" {
 			return nil
 		}
 
-		// Store in index (uppercase for case-insensitive matching)
 		idx.index[strings.ToUpper(metadata.ISRC)] = path
 		fileCount++
 		return nil
@@ -82,7 +94,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	fmt.Printf("[ISRCIndex] Built index for %s: %d files in %v\n", 
 		outputDir, fileCount, time.Since(startTime).Round(time.Millisecond))
 
-	// Cache the index
 	isrcIndexCacheMu.Lock()
 	isrcIndexCache[outputDir] = idx
 	isrcIndexCacheMu.Unlock()
@@ -90,7 +101,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	return idx
 }
 
-// lookup checks if an ISRC exists in the index (internal, returns bool)
 func (idx *ISRCIndex) lookup(isrc string) (string, bool) {
 	if isrc == "" {
 		return "", false
@@ -103,6 +113,18 @@ func (idx *ISRCIndex) lookup(isrc string) (string, bool) {
 	return path, exists
 }
 
+// remove deletes an ISRC entry from the index (internal use)
+func (idx *ISRCIndex) remove(isrc string) {
+	if isrc == "" {
+		return
+	}
+
+	idx.mu.Lock()
+	defer idx.mu.Unlock()
+
+	delete(idx.index, strings.ToUpper(isrc))
+}
+
 // Lookup checks if an ISRC exists in the index (gomobile compatible)
 // Returns filepath if found, empty string if not found
 func (idx *ISRCIndex) Lookup(isrc string) (string, error) {
@@ -138,7 +160,18 @@ func checkISRCExistsInternal(outputDir, isrc string) (string, bool) {
 
 	// Use index for fast lookup
 	idx := GetISRCIndex(outputDir)
-	return idx.lookup(isrc)
+	filePath, exists := idx.lookup(isrc)
+	if !exists {
+		return "", false
+	}
+
+	if !CheckFileExists(filePath) {
+		// Stale index entry; remove it and return not found.
+		idx.remove(isrc)
+		return "", false
+	}
+
+	return filePath, true
 }
 
 // CheckISRCExists is the exported version for gomobile (returns string, error)
@@ -170,7 +203,6 @@ type FileExistenceResult struct {
 // It builds an ISRC index from the output directory once, then checks all tracks against it
 // Same implementation as PC version for consistency
 func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error) {
-	// Parse input JSON
 	var tracks []struct {
 		ISRC       string `json:"isrc"`
 		TrackName  string `json:"track_name"`
@@ -182,10 +214,8 @@ func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error
 
 	results := make([]FileExistenceResult, len(tracks))
 
-	// Build ISRC index from output directory (scan once)
 	isrcIdx := GetISRCIndex(outputDir)
 
-	// Check each track against the index (parallel)
 	var wg sync.WaitGroup
 	for i, track := range tracks {
 		wg.Add(1)
@@ -216,7 +246,6 @@ func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error
 
 	wg.Wait()
 
-	// Return results as JSON
 	resultJSON, err := json.Marshal(results)
 	if err != nil {
 		return "", fmt.Errorf("failed to marshal results: %w", err)

go_backend/extension_manager.go

@@ -0,0 +1,961 @@
+// Package gobackend provides extension management functionality
+package gobackend
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/dop251/goja"
+)
+
+// compareVersions compares two semantic version strings
+// Returns: -1 if v1 < v2, 0 if v1 == v2, 1 if v1 > v2
+func compareVersions(v1, v2 string) int {
+	parts1 := strings.Split(strings.TrimPrefix(v1, "v"), ".")
+	parts2 := strings.Split(strings.TrimPrefix(v2, "v"), ".")
+
+	maxLen := len(parts1)
+	if len(parts2) > maxLen {
+		maxLen = len(parts2)
+	}
+
+	for i := 0; i < maxLen; i++ {
+		var n1, n2 int
+		if i < len(parts1) {
+			n1, _ = strconv.Atoi(parts1[i])
+		}
+		if i < len(parts2) {
+			n2, _ = strconv.Atoi(parts2[i])
+		}
+
+		if n1 < n2 {
+			return -1
+		}
+		if n1 > n2 {
+			return 1
+		}
+	}
+
+	return 0
+}
+
+// LoadedExtension represents an extension that has been loaded into memory
+type LoadedExtension struct {
+	ID        string             `json:"id"`
+	Manifest  *ExtensionManifest `json:"manifest"`
+	VM        *goja.Runtime      `json:"-"`
+	Enabled   bool               `json:"enabled"`
+	Error     string             `json:"error,omitempty"`
+	DataDir   string             `json:"data_dir"`
+	SourceDir string             `json:"source_dir"`
+	IconPath  string             `json:"icon_path"`
+}
+
+// ExtensionManager manages all loaded extensions
+type ExtensionManager struct {
+	mu            sync.RWMutex
+	extensions    map[string]*LoadedExtension
+	extensionsDir string // Base directory for extensions
+	dataDir       string // Base directory for extension data
+}
+
+var (
+	globalExtManager     *ExtensionManager
+	globalExtManagerOnce sync.Once
+)
+
+// GetExtensionManager returns the global extension manager instance
+func GetExtensionManager() *ExtensionManager {
+	globalExtManagerOnce.Do(func() {
+		globalExtManager = &ExtensionManager{
+			extensions: make(map[string]*LoadedExtension),
+		}
+	})
+	return globalExtManager
+}
+
+// SetDirectories sets the extensions and data directories
+func (m *ExtensionManager) SetDirectories(extensionsDir, dataDir string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.extensionsDir = extensionsDir
+	m.dataDir = dataDir
+
+	if err := os.MkdirAll(extensionsDir, 0755); err != nil {
+		return fmt.Errorf("failed to create extensions directory: %w", err)
+	}
+	if err := os.MkdirAll(dataDir, 0755); err != nil {
+		return fmt.Errorf("failed to create data directory: %w", err)
+	}
+
+	return nil
+}
+
+// LoadExtensionFromFile loads an extension from a .spotiflac-ext file
+func (m *ExtensionManager) LoadExtensionFromFile(filePath string) (*LoadedExtension, error) {
+	// Validate file extension
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format. Please select a .spotiflac-ext file")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file. The file may be corrupted or not a valid extension package")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	var hasIndexJS bool
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json: %w", err)
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+			}
+		}
+		if name == "index.js" {
+			hasIndexJS = true
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("Invalid extension package: manifest.json not found")
+	}
+
+	if !hasIndexJS {
+		return nil, fmt.Errorf("Invalid extension package: index.js not found")
+	}
+
+	manifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[manifest.Name]
+	var existingVersion string
+	var existingDisplayName string
+	if exists {
+		existingVersion = existing.Manifest.Version
+		existingDisplayName = existing.Manifest.DisplayName
+	}
+	m.mu.RUnlock()
+
+	if exists {
+		versionCompare := compareVersions(manifest.Version, existingVersion)
+		if versionCompare > 0 {
+			// This is an upgrade - call UpgradeExtension
+			return m.UpgradeExtension(filePath)
+		} else if versionCompare == 0 {
+			return nil, fmt.Errorf("Extension '%s' v%s is already installed", existingDisplayName, existingVersion)
+		} else {
+			return nil, fmt.Errorf("Cannot downgrade '%s' from v%s to v%s", existingDisplayName, existingVersion, manifest.Version)
+		}
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if _, exists := m.extensions[manifest.Name]; exists {
+		return nil, fmt.Errorf("Extension '%s' was installed by another process", manifest.DisplayName)
+	}
+
+	extDir := filepath.Join(m.extensionsDir, manifest.Name)
+	if err := os.MkdirAll(extDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension directory: %w", err)
+	}
+
+	// Extract all files (preserving directory structure)
+	for _, file := range zipReader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+
+		// Preserve relative path within the zip (support subdirectories)
+		// Clean the path to prevent path traversal attacks
+		relPath := filepath.Clean(file.Name)
+		if strings.HasPrefix(relPath, "..") || filepath.IsAbs(relPath) {
+			GoLog("[Extension] Skipping unsafe path in archive: %s\n", file.Name)
+			continue
+		}
+		destPath := filepath.Join(extDir, relPath)
+
+		destDir := filepath.Dir(destPath)
+		if err := os.MkdirAll(destDir, 0755); err != nil {
+			return nil, fmt.Errorf("failed to create directory %s: %w", destDir, err)
+		}
+
+		destFile, err := os.Create(destPath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create file %s: %w", destPath, err)
+		}
+
+		srcFile, err := file.Open()
+		if err != nil {
+			destFile.Close()
+			return nil, fmt.Errorf("failed to open file in archive: %w", err)
+		}
+
+		_, err = io.Copy(destFile, srcFile)
+		srcFile.Close()
+		destFile.Close()
+		if err != nil {
+			return nil, fmt.Errorf("failed to extract file: %w", err)
+		}
+	}
+
+	extDataDir := filepath.Join(m.dataDir, manifest.Name)
+	if err := os.MkdirAll(extDataDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension data directory: %w", err)
+	}
+
+	ext := &LoadedExtension{
+		ID:        manifest.Name,
+		Manifest:  manifest,
+		Enabled:   false, // New extensions start disabled
+		DataDir:   extDataDir,
+		SourceDir: extDir,
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", manifest.Name, err)
+	}
+
+	m.extensions[manifest.Name] = ext
+	GoLog("[Extension] Loaded extension: %s v%s\n", manifest.DisplayName, manifest.Version)
+
+	return ext, nil
+}
+
+// initializeVM creates and initializes the Goja VM for an extension
+func (m *ExtensionManager) initializeVM(ext *LoadedExtension) error {
+	vm := goja.New()
+	ext.VM = vm
+
+	indexPath := filepath.Join(ext.SourceDir, "index.js")
+	jsCode, err := os.ReadFile(indexPath)
+	if err != nil {
+		return fmt.Errorf("failed to read index.js: %w", err)
+	}
+
+	runtime := NewExtensionRuntime(ext)
+	runtime.RegisterAPIs(vm)
+	runtime.RegisterGoBackendAPIs(vm)
+
+	console := vm.NewObject()
+	console.Set("log", func(call goja.FunctionCall) goja.Value {
+		args := make([]interface{}, len(call.Arguments))
+		for i, arg := range call.Arguments {
+			args[i] = arg.Export()
+		}
+		GoLog("[Extension:%s] %v\n", ext.ID, args)
+		return goja.Undefined()
+	})
+	vm.Set("console", console)
+
+	var registeredExtension goja.Value
+	vm.Set("registerExtension", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) > 0 {
+			registeredExtension = call.Arguments[0]
+			vm.Set("extension", call.Arguments[0])
+		}
+		return goja.Undefined()
+	})
+
+	// Run the extension code
+	_, err = vm.RunString(string(jsCode))
+	if err != nil {
+		return fmt.Errorf("failed to execute extension code: %w", err)
+	}
+
+	// Verify extension was registered
+	if registeredExtension == nil || goja.IsUndefined(registeredExtension) {
+		return fmt.Errorf("extension did not call registerExtension()")
+	}
+
+	return nil
+}
+
+// UnloadExtension unloads an extension by ID
+func (m *ExtensionManager) UnloadExtension(extensionID string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	// Call cleanup if VM is initialized
+	if ext.VM != nil {
+		// Try to call cleanup function
+		cleanup, err := ext.VM.RunString("typeof extension !== 'undefined' && typeof extension.cleanup === 'function' ? extension.cleanup() : null")
+		if err != nil {
+			GoLog("[Extension] Error calling cleanup for %s: %v\n", extensionID, err)
+		} else if cleanup != nil && !goja.IsUndefined(cleanup) && !goja.IsNull(cleanup) {
+			GoLog("[Extension] Cleanup called for %s\n", extensionID)
+		}
+	}
+
+	// Remove from registry
+	delete(m.extensions, extensionID)
+	GoLog("[Extension] Unloaded extension: %s\n", extensionID)
+
+	return nil
+}
+
+// GetExtension returns a loaded extension by ID
+// Returns error if extension not found (gomobile compatible)
+func (m *ExtensionManager) GetExtension(extensionID string) (*LoadedExtension, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return nil, fmt.Errorf("Extension not found")
+	}
+	return ext, nil
+}
+
+// GetAllExtensions returns all loaded extensions
+func (m *ExtensionManager) GetAllExtensions() []*LoadedExtension {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	result := make([]*LoadedExtension, 0, len(m.extensions))
+	for _, ext := range m.extensions {
+		result = append(result, ext)
+	}
+	return result
+}
+
+// SetExtensionEnabled enables or disables an extension
+func (m *ExtensionManager) SetExtensionEnabled(extensionID string, enabled bool) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	ext.Enabled = enabled
+	GoLog("[Extension] %s %s\n", extensionID, map[bool]string{true: "enabled", false: "disabled"}[enabled])
+
+	// Persist enabled state to settings store
+	store := GetExtensionSettingsStore()
+	if err := store.Set(extensionID, "_enabled", enabled); err != nil {
+		GoLog("[Extension] Failed to persist enabled state for %s: %v\n", extensionID, err)
+	}
+
+	return nil
+}
+
+// LoadExtensionsFromDirectory scans a directory and loads all valid extensions
+func (m *ExtensionManager) LoadExtensionsFromDirectory(dirPath string) ([]string, []error) {
+	var loaded []string
+	var errors []error
+
+	entries, err := os.ReadDir(dirPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return loaded, errors
+		}
+		return nil, []error{fmt.Errorf("failed to read extensions directory: %w", err)}
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			manifestPath := filepath.Join(dirPath, entry.Name(), "manifest.json")
+			if _, err := os.Stat(manifestPath); err == nil {
+				ext, err := m.loadExtensionFromDirectory(filepath.Join(dirPath, entry.Name()))
+				if err != nil {
+					GoLog("[Extension] Failed to load %s: %v\n", entry.Name(), err)
+					errors = append(errors, fmt.Errorf("%s: %w", entry.Name(), err))
+				} else {
+					loaded = append(loaded, ext.ID)
+				}
+			}
+		} else if strings.HasSuffix(strings.ToLower(entry.Name()), ".spotiflac-ext") {
+			ext, err := m.LoadExtensionFromFile(filepath.Join(dirPath, entry.Name()))
+			if err != nil {
+				GoLog("[Extension] Failed to load %s: %v\n", entry.Name(), err)
+				errors = append(errors, fmt.Errorf("%s: %w", entry.Name(), err))
+			} else {
+				loaded = append(loaded, ext.ID)
+			}
+		}
+	}
+
+	return loaded, errors
+}
+
+// loadExtensionFromDirectory loads an extension from an already extracted directory
+func (m *ExtensionManager) loadExtensionFromDirectory(dirPath string) (*LoadedExtension, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	manifestPath := filepath.Join(dirPath, "manifest.json")
+	manifestData, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+	}
+
+	// Parse and validate manifest
+	manifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	indexPath := filepath.Join(dirPath, "index.js")
+	if _, err := os.Stat(indexPath); os.IsNotExist(err) {
+		return nil, fmt.Errorf("Extension is missing index.js file")
+	}
+
+	if existing, exists := m.extensions[manifest.Name]; exists {
+		GoLog("[Extension] Extension '%s' already loaded, skipping\n", manifest.DisplayName)
+		return existing, nil
+	}
+
+	extDataDir := filepath.Join(m.dataDir, manifest.Name)
+	if err := os.MkdirAll(extDataDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension data directory: %w", err)
+	}
+
+	ext := &LoadedExtension{
+		ID:        manifest.Name,
+		Manifest:  manifest,
+		Enabled:   false, // Will be restored from settings store
+		DataDir:   extDataDir,
+		SourceDir: dirPath,
+	}
+
+	// Restore enabled state from settings store
+	store := GetExtensionSettingsStore()
+	if enabledVal, err := store.Get(manifest.Name, "_enabled"); err == nil {
+		if enabled, ok := enabledVal.(bool); ok {
+			ext.Enabled = enabled
+			GoLog("[Extension] Restored enabled state for %s: %v\n", manifest.Name, enabled)
+		}
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", manifest.Name, err)
+	}
+
+	m.extensions[manifest.Name] = ext
+	GoLog("[Extension] Loaded extension: %s v%s\n", manifest.DisplayName, manifest.Version)
+
+	return ext, nil
+}
+
+// RemoveExtension completely removes an extension (unload + delete files)
+func (m *ExtensionManager) RemoveExtension(extensionID string) error {
+	ext, err := m.GetExtension(extensionID)
+	if err != nil {
+		return err
+	}
+
+	// Unload first
+	if err := m.UnloadExtension(extensionID); err != nil {
+		return err
+	}
+
+	// Remove source directory
+	if ext.SourceDir != "" {
+		if err := os.RemoveAll(ext.SourceDir); err != nil {
+			GoLog("[Extension] Warning: failed to remove source dir: %v\n", err)
+		}
+	}
+
+	// Optionally remove data directory (keep for now to preserve settings)
+	// if ext.DataDir != "" {
+	//     os.RemoveAll(ext.DataDir)
+	// }
+
+	return nil
+}
+
+// UpgradeExtension upgrades an existing extension from a new package file
+// Only allows upgrades (new version > current version), not downgrades
+func (m *ExtensionManager) UpgradeExtension(filePath string) (*LoadedExtension, error) {
+	// Validate file extension
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format. Please select a .spotiflac-ext file")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file. The file may be corrupted or not a valid extension package")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	var hasIndexJS bool
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json: %w", err)
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+			}
+		}
+		if name == "index.js" {
+			hasIndexJS = true
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("Invalid extension package: manifest.json not found")
+	}
+
+	if !hasIndexJS {
+		return nil, fmt.Errorf("Invalid extension package: index.js not found")
+	}
+
+	newManifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[newManifest.Name]
+	m.mu.RUnlock()
+
+	if !exists {
+		return nil, fmt.Errorf("Extension '%s' is not installed. Use install instead of upgrade.", newManifest.DisplayName)
+	}
+
+	// Compare versions - only allow upgrade, not downgrade
+	versionCompare := compareVersions(newManifest.Version, existing.Manifest.Version)
+	if versionCompare < 0 {
+		return nil, fmt.Errorf("Cannot downgrade extension. Current version: %s, New version: %s", existing.Manifest.Version, newManifest.Version)
+	}
+	if versionCompare == 0 {
+		return nil, fmt.Errorf("Extension is already at version %s", existing.Manifest.Version)
+	}
+
+	GoLog("[Extension] Upgrading %s from v%s to v%s\n", newManifest.DisplayName, existing.Manifest.Version, newManifest.Version)
+
+	// Save data directory path and enabled state (we want to preserve them)
+	extDataDir := existing.DataDir
+	extDir := existing.SourceDir
+	wasEnabled := existing.Enabled
+
+	// Cleanup and unload existing extension
+	m.CleanupExtension(existing.ID)
+	m.UnloadExtension(existing.ID)
+
+	// Remove old source files but keep data directory
+	if extDir != "" {
+		if err := os.RemoveAll(extDir); err != nil {
+			GoLog("[Extension] Warning: failed to remove old source dir: %v\n", err)
+		}
+	}
+
+	if err := os.MkdirAll(extDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension directory: %w", err)
+	}
+
+	for _, file := range zipReader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+
+		relPath := filepath.Clean(file.Name)
+		if strings.HasPrefix(relPath, "..") || filepath.IsAbs(relPath) {
+			GoLog("[Extension] Skipping unsafe path in archive: %s\n", file.Name)
+			continue
+		}
+		destPath := filepath.Join(extDir, relPath)
+
+		destDir := filepath.Dir(destPath)
+		if err := os.MkdirAll(destDir, 0755); err != nil {
+			return nil, fmt.Errorf("failed to create directory %s: %w", destDir, err)
+		}
+
+		destFile, err := os.Create(destPath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create file %s: %w", destPath, err)
+		}
+
+		srcFile, err := file.Open()
+		if err != nil {
+			destFile.Close()
+			return nil, fmt.Errorf("failed to open file in archive: %w", err)
+		}
+
+		_, err = io.Copy(destFile, srcFile)
+		srcFile.Close()
+		destFile.Close()
+		if err != nil {
+			return nil, fmt.Errorf("failed to extract file: %w", err)
+		}
+	}
+
+	ext := &LoadedExtension{
+		ID:        newManifest.Name,
+		Manifest:  newManifest,
+		Enabled:   wasEnabled, // Preserve enabled state from before upgrade
+		DataDir:   extDataDir,
+		SourceDir: extDir,
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", newManifest.Name, err)
+	}
+
+	m.mu.Lock()
+	m.extensions[newManifest.Name] = ext
+	m.mu.Unlock()
+
+	GoLog("[Extension] Upgraded extension: %s to v%s\n", newManifest.DisplayName, newManifest.Version)
+
+	return ext, nil
+}
+
+// ExtensionUpgradeInfo holds information about extension upgrade check
+type ExtensionUpgradeInfo struct {
+	ExtensionID    string `json:"extension_id"`
+	CurrentVersion string `json:"current_version"`
+	NewVersion     string `json:"new_version"`
+	CanUpgrade     bool   `json:"can_upgrade"`
+	IsInstalled    bool   `json:"is_installed"`
+}
+
+// checkExtensionUpgradeInternal checks if a package file is an upgrade for an existing extension
+// Internal function that returns struct
+func (m *ExtensionManager) checkExtensionUpgradeInternal(filePath string) (*ExtensionUpgradeInfo, error) {
+	// Validate file extension
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json")
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json")
+			}
+			break
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("manifest.json not found")
+	}
+
+	newManifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[newManifest.Name]
+	m.mu.RUnlock()
+
+	info := &ExtensionUpgradeInfo{
+		ExtensionID: newManifest.Name,
+		NewVersion:  newManifest.Version,
+		IsInstalled: exists,
+	}
+
+	if !exists {
+		// Not installed - this is a new install, not upgrade
+		info.CurrentVersion = ""
+		info.CanUpgrade = false
+	} else {
+		info.CurrentVersion = existing.Manifest.Version
+		info.CanUpgrade = compareVersions(newManifest.Version, existing.Manifest.Version) > 0
+	}
+
+	return info, nil
+}
+
+// CheckExtensionUpgradeJSON checks if a package file is an upgrade and returns JSON
+func (m *ExtensionManager) CheckExtensionUpgradeJSON(filePath string) (string, error) {
+	info, err := m.checkExtensionUpgradeInternal(filePath)
+	if err != nil {
+		return "", err
+	}
+
+	jsonBytes, err := json.Marshal(info)
+	if err != nil {
+		return "", err
+	}
+
+	return string(jsonBytes), nil
+}
+
+// GetInstalledExtensionsJSON returns all extensions as JSON for Flutter
+func (m *ExtensionManager) GetInstalledExtensionsJSON() (string, error) {
+	extensions := m.GetAllExtensions()
+
+	type ExtensionInfo struct {
+		ID                     string                `json:"id"`
+		Name                   string                `json:"name"`
+		DisplayName            string                `json:"display_name"`
+		Version                string                `json:"version"`
+		Author                 string                `json:"author"`
+		Description            string                `json:"description"`
+		Homepage               string                `json:"homepage,omitempty"`
+		IconPath               string                `json:"icon_path,omitempty"`
+		Types                  []ExtensionType       `json:"types"`
+		Enabled                bool                  `json:"enabled"`
+		Status                 string                `json:"status"`
+		Error                  string                `json:"error_message,omitempty"`
+		Settings               []ExtensionSetting    `json:"settings,omitempty"`
+		QualityOptions         []QualityOption       `json:"quality_options,omitempty"`
+		Permissions            []string              `json:"permissions"`
+		HasMetadataProvider    bool                  `json:"has_metadata_provider"`
+		HasDownloadProvider    bool                  `json:"has_download_provider"`
+		SkipMetadataEnrichment bool                  `json:"skip_metadata_enrichment"`
+		SearchBehavior         *SearchBehaviorConfig `json:"search_behavior,omitempty"`
+		TrackMatching          *TrackMatchingConfig  `json:"track_matching,omitempty"`
+		PostProcessing         *PostProcessingConfig `json:"post_processing,omitempty"`
+	}
+
+	infos := make([]ExtensionInfo, len(extensions))
+	for i, ext := range extensions {
+		permissions := []string{}
+		for _, domain := range ext.Manifest.Permissions.Network {
+			permissions = append(permissions, "network:"+domain)
+		}
+		if ext.Manifest.Permissions.Storage {
+			permissions = append(permissions, "storage:enabled")
+		}
+
+		// Determine status
+		status := "loaded"
+		if ext.Error != "" {
+			status = "error"
+		} else if !ext.Enabled {
+			status = "disabled"
+		}
+
+		iconPath := ""
+		if ext.Manifest.Icon != "" && ext.SourceDir != "" {
+			possibleIcon := filepath.Join(ext.SourceDir, ext.Manifest.Icon)
+			if _, err := os.Stat(possibleIcon); err == nil {
+				iconPath = possibleIcon
+			}
+		}
+		if iconPath == "" && ext.SourceDir != "" {
+			possibleIcon := filepath.Join(ext.SourceDir, "icon.png")
+			if _, err := os.Stat(possibleIcon); err == nil {
+				iconPath = possibleIcon
+			}
+		}
+
+		infos[i] = ExtensionInfo{
+			ID:                     ext.ID,
+			Name:                   ext.Manifest.Name,
+			DisplayName:            ext.Manifest.DisplayName,
+			Version:                ext.Manifest.Version,
+			Author:                 ext.Manifest.Author,
+			Description:            ext.Manifest.Description,
+			Homepage:               ext.Manifest.Homepage,
+			IconPath:               iconPath,
+			Types:                  ext.Manifest.Types,
+			Enabled:                ext.Enabled,
+			Status:                 status,
+			Error:                  ext.Error,
+			Settings:               ext.Manifest.Settings,
+			QualityOptions:         ext.Manifest.QualityOptions,
+			Permissions:            permissions,
+			HasMetadataProvider:    ext.Manifest.IsMetadataProvider(),
+			HasDownloadProvider:    ext.Manifest.IsDownloadProvider(),
+			SkipMetadataEnrichment: ext.Manifest.SkipMetadataEnrichment,
+			SearchBehavior:         ext.Manifest.SearchBehavior,
+			TrackMatching:          ext.Manifest.TrackMatching,
+			PostProcessing:         ext.Manifest.PostProcessing,
+		}
+	}
+
+	jsonBytes, err := json.Marshal(infos)
+	if err != nil {
+		return "", err
+	}
+
+	return string(jsonBytes), nil
+}
+
+// ==================== Extension Lifecycle ====================
+
+// InitializeExtension calls the extension's initialize method with settings
+func (m *ExtensionManager) InitializeExtension(extensionID string, settings map[string]interface{}) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	if ext.VM == nil {
+		return fmt.Errorf("Extension failed to load. Please reinstall the extension")
+	}
+
+	settingsJSON, err := json.Marshal(settings)
+	if err != nil {
+		return fmt.Errorf("Failed to save settings")
+	}
+
+	script := fmt.Sprintf(`
+		(function() {
+			var settings = %s;
+			if (typeof extension !== 'undefined' && typeof extension.initialize === 'function') {
+				try {
+					extension.initialize(settings);
+					return { success: true };
+				} catch (e) {
+					return { success: false, error: e.toString() };
+				}
+			}
+			return { success: true, message: 'no initialize function' };
+		})()
+	`, string(settingsJSON))
+
+	result, err := ext.VM.RunString(script)
+	if err != nil {
+		ext.Error = fmt.Sprintf("initialize failed: %v", err)
+		ext.Enabled = false
+		GoLog("[Extension] Initialize error for %s: %v\n", extensionID, err)
+		return err
+	}
+
+	if result != nil && !goja.IsUndefined(result) {
+		exported := result.Export()
+		if resultMap, ok := exported.(map[string]interface{}); ok {
+			if success, ok := resultMap["success"].(bool); ok && !success {
+				errMsg := "unknown error"
+				if e, ok := resultMap["error"].(string); ok {
+					errMsg = e
+				}
+				ext.Error = errMsg
+				ext.Enabled = false
+				GoLog("[Extension] Initialize failed for %s: %s\n", extensionID, errMsg)
+				return fmt.Errorf("initialize failed: %s", errMsg)
+			}
+		}
+	}
+
+	GoLog("[Extension] Initialized %s\n", extensionID)
+	return nil
+}
+
+// CleanupExtension calls the extension's cleanup method
+func (m *ExtensionManager) CleanupExtension(extensionID string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	if ext.VM == nil {
+		return nil // No VM, nothing to cleanup
+	}
+
+	// Call cleanup function
+	script := `
+		(function() {
+			if (typeof extension !== 'undefined' && typeof extension.cleanup === 'function') {
+				try {
+					extension.cleanup();
+					return { success: true };
+				} catch (e) {
+					return { success: false, error: e.toString() };
+				}
+			}
+			return { success: true, message: 'no cleanup function' };
+		})()
+	`
+
+	result, err := ext.VM.RunString(script)
+	if err != nil {
+		GoLog("[Extension] Cleanup error for %s: %v\n", extensionID, err)
+		return err
+	}
+
+	if result != nil && !goja.IsUndefined(result) {
+		exported := result.Export()
+		if resultMap, ok := exported.(map[string]interface{}); ok {
+			if success, ok := resultMap["success"].(bool); ok && !success {
+				errMsg := "unknown error"
+				if e, ok := resultMap["error"].(string); ok {
+					errMsg = e
+				}
+				GoLog("[Extension] Cleanup failed for %s: %s\n", extensionID, errMsg)
+				return fmt.Errorf("cleanup failed: %s", errMsg)
+			}
+		}
+	}
+
+	GoLog("[Extension] Cleaned up %s\n", extensionID)
+	return nil
+}
+
+// UnloadAllExtensions unloads all extensions gracefully
+func (m *ExtensionManager) UnloadAllExtensions() {
+	m.mu.Lock()
+	extensionIDs := make([]string, 0, len(m.extensions))
+	for id := range m.extensions {
+		extensionIDs = append(extensionIDs, id)
+	}
+	m.mu.Unlock()
+
+	for _, id := range extensionIDs {
+		// Call cleanup first
+		m.CleanupExtension(id)
+		// Then unload
+		m.UnloadExtension(id)
+	}
+
+	GoLog("[Extension] All extensions unloaded\n")
+}

go_backend/extension_manifest.go

@@ -0,0 +1,315 @@
+// Package gobackend provides extension manifest parsing and validation
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ExtensionType represents the type of extension
+type ExtensionType string
+
+const (
+	ExtensionTypeMetadataProvider ExtensionType = "metadata_provider"
+	ExtensionTypeDownloadProvider ExtensionType = "download_provider"
+)
+
+// SettingType represents the type of a setting field
+type SettingType string
+
+const (
+	SettingTypeString SettingType = "string"
+	SettingTypeNumber SettingType = "number"
+	SettingTypeBool   SettingType = "boolean"
+	SettingTypeSelect SettingType = "select"
+)
+
+// ExtensionPermissions defines what resources an extension can access
+type ExtensionPermissions struct {
+	Network []string `json:"network"` // List of allowed domains
+	Storage bool     `json:"storage"` // Whether extension can use storage API
+	File    bool     `json:"file"`    // Whether extension can use file API
+}
+
+// ExtensionSetting defines a configurable setting for an extension
+type ExtensionSetting struct {
+	Key         string      `json:"key"`
+	Type        SettingType `json:"type"`
+	Label       string      `json:"label"`
+	Description string      `json:"description,omitempty"`
+	Required    bool        `json:"required,omitempty"`
+	Secret      bool        `json:"secret,omitempty"`
+	Default     interface{} `json:"default,omitempty"`
+	Options     []string    `json:"options,omitempty"` // For select type
+}
+
+// QualityOption represents a quality option for download providers
+type QualityOption struct {
+	ID          string                   `json:"id"`                 // Unique identifier (e.g., "mp3_320", "opus_128")
+	Label       string                   `json:"label"`              // Display name (e.g., "MP3 320kbps")
+	Description string                   `json:"description"`        // Optional description (e.g., "Best quality MP3")
+	Settings    []QualitySpecificSetting `json:"settings,omitempty"` // Quality-specific settings
+}
+
+// QualitySpecificSetting represents a setting that's specific to a quality option
+type QualitySpecificSetting struct {
+	Key         string      `json:"key"`
+	Type        SettingType `json:"type"`
+	Label       string      `json:"label"`
+	Description string      `json:"description,omitempty"`
+	Required    bool        `json:"required,omitempty"`
+	Secret      bool        `json:"secret,omitempty"`
+	Default     interface{} `json:"default,omitempty"`
+	Options     []string    `json:"options,omitempty"` // For select type
+}
+
+// SearchBehaviorConfig defines custom search behavior for an extension
+type SearchBehaviorConfig struct {
+	Enabled         bool   `json:"enabled"`                   // Whether extension provides custom search
+	Placeholder     string `json:"placeholder,omitempty"`     // Placeholder text for search box
+	Primary         bool   `json:"primary,omitempty"`         // If true, show as primary search tab
+	Icon            string `json:"icon,omitempty"`            // Icon for search tab
+	ThumbnailRatio  string `json:"thumbnailRatio,omitempty"`  // Thumbnail aspect ratio: "square" (1:1), "wide" (16:9), "portrait" (2:3)
+	ThumbnailWidth  int    `json:"thumbnailWidth,omitempty"`  // Custom thumbnail width in pixels
+	ThumbnailHeight int    `json:"thumbnailHeight,omitempty"` // Custom thumbnail height in pixels
+}
+
+// URLHandlerConfig defines custom URL handling for an extension
+type URLHandlerConfig struct {
+	Enabled  bool     `json:"enabled"`            // Whether extension handles URLs
+	Patterns []string `json:"patterns,omitempty"` // URL patterns to match (e.g., "music.youtube.com", "soundcloud.com")
+}
+
+// TrackMatchingConfig defines custom track matching behavior
+type TrackMatchingConfig struct {
+	CustomMatching    bool   `json:"customMatching"`              // Whether extension handles matching
+	Strategy          string `json:"strategy,omitempty"`          // "isrc", "name", "duration", "custom"
+	DurationTolerance int    `json:"durationTolerance,omitempty"` // Tolerance in seconds for duration matching
+}
+
+// PostProcessingHook defines a post-processing hook
+type PostProcessingHook struct {
+	ID               string   `json:"id"`                         // Unique identifier
+	Name             string   `json:"name"`                       // Display name
+	Description      string   `json:"description,omitempty"`      // Description
+	DefaultEnabled   bool     `json:"defaultEnabled,omitempty"`   // Whether enabled by default
+	SupportedFormats []string `json:"supportedFormats,omitempty"` // Supported file formats (e.g., ["flac", "mp3"])
+}
+
+// PostProcessingConfig defines post-processing capabilities
+type PostProcessingConfig struct {
+	Enabled bool                 `json:"enabled"`         // Whether extension provides post-processing
+	Hooks   []PostProcessingHook `json:"hooks,omitempty"` // Available hooks
+}
+
+// ExtensionManifest represents the manifest.json of an extension
+type ExtensionManifest struct {
+	Name                   string                `json:"name"`
+	DisplayName            string                `json:"displayName"`
+	Version                string                `json:"version"`
+	Author                 string                `json:"author"`
+	Description            string                `json:"description"`
+	Homepage               string                `json:"homepage,omitempty"`
+	Icon                   string                `json:"icon,omitempty"` // Icon filename (e.g., "icon.png")
+	Types                  []ExtensionType       `json:"type"`
+	Permissions            ExtensionPermissions  `json:"permissions"`
+	Settings               []ExtensionSetting    `json:"settings,omitempty"`
+	QualityOptions         []QualityOption       `json:"qualityOptions,omitempty"` // Custom quality options for download providers
+	MinAppVersion          string                `json:"minAppVersion,omitempty"`
+	SkipMetadataEnrichment bool                  `json:"skipMetadataEnrichment,omitempty"` // If true, don't enrich metadata from Deezer/Spotify
+	SkipBuiltInFallback    bool                  `json:"skipBuiltInFallback,omitempty"`    // If true, don't fallback to built-in providers (tidal/qobuz/amazon)
+	SearchBehavior         *SearchBehaviorConfig `json:"searchBehavior,omitempty"`         // Custom search behavior
+	URLHandler             *URLHandlerConfig     `json:"urlHandler,omitempty"`             // Custom URL handling
+	TrackMatching          *TrackMatchingConfig  `json:"trackMatching,omitempty"`          // Custom track matching
+	PostProcessing         *PostProcessingConfig `json:"postProcessing,omitempty"`         // Post-processing hooks
+}
+
+// ManifestValidationError represents a validation error in the manifest
+type ManifestValidationError struct {
+	Field   string
+	Message string
+}
+
+func (e *ManifestValidationError) Error() string {
+	return fmt.Sprintf("manifest validation error: %s - %s", e.Field, e.Message)
+}
+
+// ParseManifest parses and validates a manifest from JSON bytes
+func ParseManifest(data []byte) (*ExtensionManifest, error) {
+	var manifest ExtensionManifest
+	if err := json.Unmarshal(data, &manifest); err != nil {
+		return nil, fmt.Errorf("failed to parse manifest JSON: %w", err)
+	}
+
+	if err := manifest.Validate(); err != nil {
+		return nil, err
+	}
+
+	return &manifest, nil
+}
+
+// Validate checks if the manifest has all required fields and valid values
+func (m *ExtensionManifest) Validate() error {
+	// Check required fields
+	if strings.TrimSpace(m.Name) == "" {
+		return &ManifestValidationError{Field: "name", Message: "name is required"}
+	}
+
+	if strings.TrimSpace(m.Version) == "" {
+		return &ManifestValidationError{Field: "version", Message: "version is required"}
+	}
+
+	if strings.TrimSpace(m.Author) == "" {
+		return &ManifestValidationError{Field: "author", Message: "author is required"}
+	}
+
+	if strings.TrimSpace(m.Description) == "" {
+		return &ManifestValidationError{Field: "description", Message: "description is required"}
+	}
+
+	if len(m.Types) == 0 {
+		return &ManifestValidationError{Field: "type", Message: "at least one type is required"}
+	}
+
+	// Validate extension types
+	for _, t := range m.Types {
+		if t != ExtensionTypeMetadataProvider && t != ExtensionTypeDownloadProvider {
+			return &ManifestValidationError{
+				Field:   "type",
+				Message: fmt.Sprintf("invalid extension type: %s (must be 'metadata_provider' or 'download_provider')", t),
+			}
+		}
+	}
+
+	// Validate settings if present
+	for i, setting := range m.Settings {
+		if strings.TrimSpace(setting.Key) == "" {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].key", i),
+				Message: "setting key is required",
+			}
+		}
+
+		if setting.Type == "" {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].type", i),
+				Message: "setting type is required",
+			}
+		}
+
+		// Validate setting type
+		validTypes := map[SettingType]bool{
+			SettingTypeString: true,
+			SettingTypeNumber: true,
+			SettingTypeBool:   true,
+			SettingTypeSelect: true,
+		}
+		if !validTypes[setting.Type] {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].type", i),
+				Message: fmt.Sprintf("invalid setting type: %s", setting.Type),
+			}
+		}
+
+		// Select type requires options
+		if setting.Type == SettingTypeSelect && len(setting.Options) == 0 {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].options", i),
+				Message: "select type requires options",
+			}
+		}
+	}
+
+	return nil
+}
+
+// HasType checks if the extension has a specific type
+func (m *ExtensionManifest) HasType(t ExtensionType) bool {
+	for _, et := range m.Types {
+		if et == t {
+			return true
+		}
+	}
+	return false
+}
+
+// IsMetadataProvider returns true if extension provides metadata
+func (m *ExtensionManifest) IsMetadataProvider() bool {
+	return m.HasType(ExtensionTypeMetadataProvider)
+}
+
+// IsDownloadProvider returns true if extension provides downloads
+func (m *ExtensionManifest) IsDownloadProvider() bool {
+	return m.HasType(ExtensionTypeDownloadProvider)
+}
+
+// IsDomainAllowed checks if a domain is in the allowed network permissions
+func (m *ExtensionManifest) IsDomainAllowed(domain string) bool {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	for _, allowed := range m.Permissions.Network {
+		allowed = strings.ToLower(strings.TrimSpace(allowed))
+		if allowed == domain {
+			return true
+		}
+		// Support wildcard subdomains (e.g., *.example.com)
+		if strings.HasPrefix(allowed, "*.") {
+			suffix := allowed[1:] // Remove the *
+			if strings.HasSuffix(domain, suffix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// HasCustomSearch returns true if extension provides custom search
+func (m *ExtensionManifest) HasCustomSearch() bool {
+	return m.SearchBehavior != nil && m.SearchBehavior.Enabled
+}
+
+// HasCustomMatching returns true if extension provides custom track matching
+func (m *ExtensionManifest) HasCustomMatching() bool {
+	return m.TrackMatching != nil && m.TrackMatching.CustomMatching
+}
+
+// HasPostProcessing returns true if extension provides post-processing
+func (m *ExtensionManifest) HasPostProcessing() bool {
+	return m.PostProcessing != nil && m.PostProcessing.Enabled
+}
+
+// HasURLHandler returns true if extension handles custom URLs
+func (m *ExtensionManifest) HasURLHandler() bool {
+	return m.URLHandler != nil && m.URLHandler.Enabled && len(m.URLHandler.Patterns) > 0
+}
+
+// MatchesURL checks if a URL matches any of the extension's URL patterns
+func (m *ExtensionManifest) MatchesURL(urlStr string) bool {
+	if !m.HasURLHandler() {
+		return false
+	}
+
+	// Parse URL to get host
+	urlStr = strings.ToLower(strings.TrimSpace(urlStr))
+	for _, pattern := range m.URLHandler.Patterns {
+		pattern = strings.ToLower(strings.TrimSpace(pattern))
+		// Check if URL contains the pattern (host match)
+		if strings.Contains(urlStr, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetPostProcessingHooks returns all post-processing hooks
+func (m *ExtensionManifest) GetPostProcessingHooks() []PostProcessingHook {
+	if m.PostProcessing == nil {
+		return nil
+	}
+	return m.PostProcessing.Hooks
+}
+
+// ToJSON serializes the manifest to JSON
+func (m *ExtensionManifest) ToJSON() ([]byte, error) {
+	return json.Marshal(m)
+}

go_backend/extension_runtime.go

@@ -0,0 +1,335 @@
+// Package gobackend provides extension runtime with sandboxed execution
+package gobackend
+
+import (
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+const DefaultJSTimeout = 30 * time.Second
+
+var (
+	extensionAuthState   = make(map[string]*ExtensionAuthState)
+	extensionAuthStateMu sync.RWMutex
+)
+
+// ExtensionAuthState holds auth state for an extension
+type ExtensionAuthState struct {
+	PendingAuthURL  string
+	AuthCode        string
+	AccessToken     string
+	RefreshToken    string
+	ExpiresAt       time.Time
+	IsAuthenticated bool
+	// PKCE support
+	PKCEVerifier  string
+	PKCEChallenge string
+}
+
+// PendingAuthRequest holds a pending OAuth request that needs Flutter to open URL
+type PendingAuthRequest struct {
+	ExtensionID string
+	AuthURL     string
+	CallbackURL string
+}
+
+var (
+	pendingAuthRequests   = make(map[string]*PendingAuthRequest)
+	pendingAuthRequestsMu sync.RWMutex
+)
+
+// GetPendingAuthRequest returns pending auth request for an extension (called from Flutter)
+func GetPendingAuthRequest(extensionID string) *PendingAuthRequest {
+	pendingAuthRequestsMu.RLock()
+	defer pendingAuthRequestsMu.RUnlock()
+	return pendingAuthRequests[extensionID]
+}
+
+func ClearPendingAuthRequest(extensionID string) {
+	pendingAuthRequestsMu.Lock()
+	defer pendingAuthRequestsMu.Unlock()
+	delete(pendingAuthRequests, extensionID)
+}
+
+// SetExtensionAuthCode sets auth code for an extension (called from Flutter after OAuth callback)
+func SetExtensionAuthCode(extensionID string, authCode string) {
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[extensionID] = state
+	}
+	state.AuthCode = authCode
+}
+
+// SetExtensionTokens sets access/refresh tokens for an extension
+func SetExtensionTokens(extensionID string, accessToken, refreshToken string, expiresAt time.Time) {
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[extensionID] = state
+	}
+	state.AccessToken = accessToken
+	state.RefreshToken = refreshToken
+	state.ExpiresAt = expiresAt
+	state.IsAuthenticated = accessToken != ""
+}
+
+// ExtensionRuntime provides sandboxed APIs for extensions
+type ExtensionRuntime struct {
+	extensionID string
+	manifest    *ExtensionManifest
+	settings    map[string]interface{}
+	httpClient  *http.Client
+	cookieJar   http.CookieJar
+	dataDir     string
+	vm          *goja.Runtime
+}
+
+// NewExtensionRuntime creates a new runtime for an extension
+func NewExtensionRuntime(ext *LoadedExtension) *ExtensionRuntime {
+	jar, _ := newSimpleCookieJar()
+
+	runtime := &ExtensionRuntime{
+		extensionID: ext.ID,
+		manifest:    ext.Manifest,
+		settings:    make(map[string]interface{}),
+		cookieJar:   jar,
+		dataDir:     ext.DataDir,
+		vm:          ext.VM,
+	}
+
+	// Create HTTP client with redirect validation to prevent SSRF via open redirect
+	client := &http.Client{
+		Timeout: 30 * time.Second,
+		Jar:     jar,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			// Validate redirect target domain against allowed domains
+			domain := req.URL.Hostname()
+			if !ext.Manifest.IsDomainAllowed(domain) {
+				GoLog("[Extension:%s] Redirect blocked: domain '%s' not in allowed list\n", ext.ID, domain)
+				return &RedirectBlockedError{Domain: domain}
+			}
+			// Also block redirects to private/local networks (SSRF protection)
+			if isPrivateIP(domain) {
+				GoLog("[Extension:%s] Redirect blocked: private IP '%s'\n", ext.ID, domain)
+				return &RedirectBlockedError{Domain: domain, IsPrivate: true}
+			}
+			// Default redirect limit (10)
+			if len(via) >= 10 {
+				return http.ErrUseLastResponse
+			}
+			return nil
+		},
+	}
+	runtime.httpClient = client
+
+	return runtime
+}
+
+// RedirectBlockedError is returned when a redirect is blocked due to domain validation
+type RedirectBlockedError struct {
+	Domain    string
+	IsPrivate bool
+}
+
+func (e *RedirectBlockedError) Error() string {
+	if e.IsPrivate {
+		return "redirect blocked: private/local network access denied"
+	}
+	return "redirect blocked: domain '" + e.Domain + "' not in allowed list"
+}
+
+// isPrivateIP checks if a hostname resolves to a private/local IP address
+func isPrivateIP(host string) bool {
+	// Block common private network patterns
+	// This is a simple check - for production, consider DNS resolution
+	privatePatterns := []string{
+		"localhost",
+		"127.",
+		"10.",
+		"172.16.", "172.17.", "172.18.", "172.19.",
+		"172.20.", "172.21.", "172.22.", "172.23.",
+		"172.24.", "172.25.", "172.26.", "172.27.",
+		"172.28.", "172.29.", "172.30.", "172.31.",
+		"192.168.",
+		"169.254.", // Link-local
+		"::1",      // IPv6 localhost
+		"fc00:",    // IPv6 private
+		"fe80:",    // IPv6 link-local
+	}
+
+	hostLower := host
+	for _, pattern := range privatePatterns {
+		if hostLower == pattern || len(hostLower) > len(pattern) && hostLower[:len(pattern)] == pattern {
+			return true
+		}
+	}
+
+	// Also block .local domains
+	if len(host) > 6 && host[len(host)-6:] == ".local" {
+		return true
+	}
+
+	return false
+}
+
+// simpleCookieJar is a simple in-memory cookie jar
+type simpleCookieJar struct {
+	cookies map[string][]*http.Cookie
+	mu      sync.RWMutex
+}
+
+func newSimpleCookieJar() (*simpleCookieJar, error) {
+	return &simpleCookieJar{
+		cookies: make(map[string][]*http.Cookie),
+	}, nil
+}
+
+func (j *simpleCookieJar) SetCookies(u *url.URL, cookies []*http.Cookie) {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+	key := u.Host
+	j.cookies[key] = append(j.cookies[key], cookies...)
+}
+
+func (j *simpleCookieJar) Cookies(u *url.URL) []*http.Cookie {
+	j.mu.RLock()
+	defer j.mu.RUnlock()
+	return j.cookies[u.Host]
+}
+
+// SetSettings updates the runtime settings
+func (r *ExtensionRuntime) SetSettings(settings map[string]interface{}) {
+	r.settings = settings
+}
+
+// RegisterAPIs registers all sandboxed APIs to the Goja VM
+func (r *ExtensionRuntime) RegisterAPIs(vm *goja.Runtime) {
+	r.vm = vm
+
+	// HTTP client (sandboxed to allowed domains)
+	httpObj := vm.NewObject()
+	httpObj.Set("get", r.httpGet)
+	httpObj.Set("post", r.httpPost)
+	httpObj.Set("put", r.httpPut)
+	httpObj.Set("delete", r.httpDelete)
+	httpObj.Set("patch", r.httpPatch)
+	httpObj.Set("request", r.httpRequest) // Generic HTTP request (GET, POST, PUT, DELETE, etc.)
+	httpObj.Set("clearCookies", r.httpClearCookies)
+	vm.Set("http", httpObj)
+
+	// Storage API
+	storageObj := vm.NewObject()
+	storageObj.Set("get", r.storageGet)
+	storageObj.Set("set", r.storageSet)
+	storageObj.Set("remove", r.storageRemove)
+	vm.Set("storage", storageObj)
+
+	// Secure Credentials API (encrypted storage for sensitive data)
+	credentialsObj := vm.NewObject()
+	credentialsObj.Set("store", r.credentialsStore)
+	credentialsObj.Set("get", r.credentialsGet)
+	credentialsObj.Set("remove", r.credentialsRemove)
+	credentialsObj.Set("has", r.credentialsHas)
+	vm.Set("credentials", credentialsObj)
+
+	// Auth API (for OAuth and other auth flows)
+	authObj := vm.NewObject()
+	authObj.Set("openAuthUrl", r.authOpenUrl)
+	authObj.Set("getAuthCode", r.authGetCode)
+	authObj.Set("setAuthCode", r.authSetCode)
+	authObj.Set("clearAuth", r.authClear)
+	authObj.Set("isAuthenticated", r.authIsAuthenticated)
+	authObj.Set("getTokens", r.authGetTokens)
+	// PKCE support
+	authObj.Set("generatePKCE", r.authGeneratePKCE)
+	authObj.Set("getPKCE", r.authGetPKCE)
+	authObj.Set("startOAuthWithPKCE", r.authStartOAuthWithPKCE)
+	authObj.Set("exchangeCodeWithPKCE", r.authExchangeCodeWithPKCE)
+	vm.Set("auth", authObj)
+
+	// File operations (sandboxed)
+	fileObj := vm.NewObject()
+	fileObj.Set("download", r.fileDownload)
+	fileObj.Set("exists", r.fileExists)
+	fileObj.Set("delete", r.fileDelete)
+	fileObj.Set("read", r.fileRead)
+	fileObj.Set("write", r.fileWrite)
+	fileObj.Set("copy", r.fileCopy)
+	fileObj.Set("move", r.fileMove)
+	fileObj.Set("getSize", r.fileGetSize)
+	vm.Set("file", fileObj)
+
+	// FFmpeg API (for post-processing)
+	ffmpegObj := vm.NewObject()
+	ffmpegObj.Set("execute", r.ffmpegExecute)
+	ffmpegObj.Set("getInfo", r.ffmpegGetInfo)
+	ffmpegObj.Set("convert", r.ffmpegConvert)
+	vm.Set("ffmpeg", ffmpegObj)
+
+	// Track matching API
+	matchingObj := vm.NewObject()
+	matchingObj.Set("compareStrings", r.matchingCompareStrings)
+	matchingObj.Set("compareDuration", r.matchingCompareDuration)
+	matchingObj.Set("normalizeString", r.matchingNormalizeString)
+	vm.Set("matching", matchingObj)
+
+	// Utilities
+	utilsObj := vm.NewObject()
+	utilsObj.Set("base64Encode", r.base64Encode)
+	utilsObj.Set("base64Decode", r.base64Decode)
+	utilsObj.Set("md5", r.md5Hash)
+	utilsObj.Set("sha256", r.sha256Hash)
+	utilsObj.Set("hmacSHA256", r.hmacSHA256)
+	utilsObj.Set("hmacSHA256Base64", r.hmacSHA256Base64)
+	utilsObj.Set("hmacSHA1", r.hmacSHA1)
+	utilsObj.Set("parseJSON", r.parseJSON)
+	utilsObj.Set("stringifyJSON", r.stringifyJSON)
+	// Crypto utilities for developers
+	utilsObj.Set("encrypt", r.cryptoEncrypt)
+	utilsObj.Set("decrypt", r.cryptoDecrypt)
+	utilsObj.Set("generateKey", r.cryptoGenerateKey)
+	vm.Set("utils", utilsObj)
+
+	// Log object (already set in extension_manager.go, but we can enhance it)
+	logObj := vm.NewObject()
+	logObj.Set("debug", r.logDebug)
+	logObj.Set("info", r.logInfo)
+	logObj.Set("warn", r.logWarn)
+	logObj.Set("error", r.logError)
+	vm.Set("log", logObj)
+
+	// Go backend functions
+	gobackendObj := vm.NewObject()
+	gobackendObj.Set("sanitizeFilename", r.sanitizeFilenameWrapper)
+	vm.Set("gobackend", gobackendObj)
+
+	// ==================== Browser-like Polyfills ====================
+	// These make porting browser/Node.js libraries easier
+
+	// Global fetch() - Promise-style HTTP API (browser-compatible)
+	vm.Set("fetch", r.fetchPolyfill)
+
+	// Global atob/btoa - Base64 encoding (browser-compatible)
+	vm.Set("atob", r.atobPolyfill)
+	vm.Set("btoa", r.btoaPolyfill)
+
+	// TextEncoder/TextDecoder constructors
+	r.registerTextEncoderDecoder(vm)
+
+	// URL class for URL parsing
+	r.registerURLClass(vm)
+
+	// JSON global (browser-compatible)
+	r.registerJSONGlobal(vm)
+}

go_backend/extension_runtime_auth.go

@@ -0,0 +1,547 @@
+// Package gobackend provides Auth API and PKCE support for extension runtime
+package gobackend
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Auth API (OAuth Support) ====================
+
+// authOpenUrl requests Flutter to open an OAuth URL
+func (r *ExtensionRuntime) authOpenUrl(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "auth URL is required",
+		})
+	}
+
+	authURL := call.Arguments[0].String()
+	callbackURL := ""
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) {
+		callbackURL = call.Arguments[1].String()
+	}
+
+	// Store pending auth request for Flutter to pick up
+	pendingAuthRequestsMu.Lock()
+	pendingAuthRequests[r.extensionID] = &PendingAuthRequest{
+		ExtensionID: r.extensionID,
+		AuthURL:     authURL,
+		CallbackURL: callbackURL,
+	}
+	pendingAuthRequestsMu.Unlock()
+
+	// Update auth state
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PendingAuthURL = authURL
+	state.AuthCode = "" // Clear any previous auth code
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] Auth URL requested: %s\n", r.extensionID, authURL)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"message": "Auth URL will be opened by the app",
+	})
+}
+
+// authGetCode gets the auth code (set by Flutter after OAuth callback)
+func (r *ExtensionRuntime) authGetCode(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists || state.AuthCode == "" {
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(state.AuthCode)
+}
+
+// authSetCode sets auth code and tokens (can be called by extension after token exchange)
+func (r *ExtensionRuntime) authSetCode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	// Can accept either just auth code or an object with tokens
+	arg := call.Arguments[0].Export()
+
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+
+	switch v := arg.(type) {
+	case string:
+		state.AuthCode = v
+	case map[string]interface{}:
+		if code, ok := v["code"].(string); ok {
+			state.AuthCode = code
+		}
+		if accessToken, ok := v["access_token"].(string); ok {
+			state.AccessToken = accessToken
+			state.IsAuthenticated = true
+		}
+		if refreshToken, ok := v["refresh_token"].(string); ok {
+			state.RefreshToken = refreshToken
+		}
+		if expiresIn, ok := v["expires_in"].(float64); ok {
+			state.ExpiresAt = time.Now().Add(time.Duration(expiresIn) * time.Second)
+		}
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// authClear clears all auth state for the extension
+func (r *ExtensionRuntime) authClear(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.Lock()
+	delete(extensionAuthState, r.extensionID)
+	extensionAuthStateMu.Unlock()
+
+	pendingAuthRequestsMu.Lock()
+	delete(pendingAuthRequests, r.extensionID)
+	pendingAuthRequestsMu.Unlock()
+
+	GoLog("[Extension:%s] Auth state cleared\n", r.extensionID)
+	return r.vm.ToValue(true)
+}
+
+// authIsAuthenticated checks if extension has valid auth
+func (r *ExtensionRuntime) authIsAuthenticated(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		return r.vm.ToValue(false)
+	}
+
+	// Check if token is expired
+	if state.IsAuthenticated && !state.ExpiresAt.IsZero() && time.Now().After(state.ExpiresAt) {
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(state.IsAuthenticated)
+}
+
+// authGetTokens returns current tokens (for extension to use in API calls)
+func (r *ExtensionRuntime) authGetTokens(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		return r.vm.ToValue(map[string]interface{}{})
+	}
+
+	result := map[string]interface{}{
+		"access_token":     state.AccessToken,
+		"refresh_token":    state.RefreshToken,
+		"is_authenticated": state.IsAuthenticated,
+	}
+
+	if !state.ExpiresAt.IsZero() {
+		result["expires_at"] = state.ExpiresAt.Unix()
+		result["is_expired"] = time.Now().After(state.ExpiresAt)
+	}
+
+	return r.vm.ToValue(result)
+}
+
+// ==================== PKCE Support ====================
+
+// generatePKCEVerifier generates a cryptographically random code verifier
+// Length should be between 43-128 characters (RFC 7636)
+func generatePKCEVerifier(length int) (string, error) {
+	if length < 43 {
+		length = 43
+	}
+	if length > 128 {
+		length = 128
+	}
+
+	// Generate random bytes
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+
+	// Use base64url encoding without padding (RFC 7636 compliant)
+	verifier := base64.RawURLEncoding.EncodeToString(bytes)
+
+	// Trim to exact length
+	if len(verifier) > length {
+		verifier = verifier[:length]
+	}
+
+	return verifier, nil
+}
+
+// generatePKCEChallenge generates a code challenge from verifier using S256 method
+func generatePKCEChallenge(verifier string) string {
+	hash := sha256.Sum256([]byte(verifier))
+	// Base64url encode without padding (RFC 7636)
+	return base64.RawURLEncoding.EncodeToString(hash[:])
+}
+
+// authGeneratePKCE generates a PKCE code verifier and challenge pair
+// Returns: { verifier: string, challenge: string, method: "S256" }
+func (r *ExtensionRuntime) authGeneratePKCE(call goja.FunctionCall) goja.Value {
+	// Default length is 64 characters
+	length := 64
+	if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+		if l, ok := call.Arguments[0].Export().(float64); ok && l >= 43 && l <= 128 {
+			length = int(l)
+		}
+	}
+
+	verifier, err := generatePKCEVerifier(length)
+	if err != nil {
+		GoLog("[Extension:%s] PKCE generation error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	challenge := generatePKCEChallenge(verifier)
+
+	// Store in auth state for later use
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PKCEVerifier = verifier
+	state.PKCEChallenge = challenge
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE generated (verifier length: %d)\n", r.extensionID, len(verifier))
+
+	return r.vm.ToValue(map[string]interface{}{
+		"verifier":  verifier,
+		"challenge": challenge,
+		"method":    "S256",
+	})
+}
+
+// authGetPKCE returns the current PKCE verifier and challenge (if generated)
+func (r *ExtensionRuntime) authGetPKCE(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists || state.PKCEVerifier == "" {
+		return r.vm.ToValue(map[string]interface{}{})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"verifier":  state.PKCEVerifier,
+		"challenge": state.PKCEChallenge,
+		"method":    "S256",
+	})
+}
+
+// authStartOAuthWithPKCE is a high-level helper that generates PKCE and opens OAuth URL
+// config: { authUrl, clientId, redirectUri, scope, extraParams }
+// Returns: { success, authUrl, pkce: { verifier, challenge } }
+func (r *ExtensionRuntime) authStartOAuthWithPKCE(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config object is required",
+		})
+	}
+
+	configObj := call.Arguments[0].Export()
+	config, ok := configObj.(map[string]interface{})
+	if !ok {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config must be an object",
+		})
+	}
+
+	// Required fields
+	authURL, _ := config["authUrl"].(string)
+	clientID, _ := config["clientId"].(string)
+	redirectURI, _ := config["redirectUri"].(string)
+
+	if authURL == "" || clientID == "" || redirectURI == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "authUrl, clientId, and redirectUri are required",
+		})
+	}
+
+	// Optional fields
+	scope, _ := config["scope"].(string)
+	extraParams, _ := config["extraParams"].(map[string]interface{})
+
+	// Generate PKCE
+	verifier, err := generatePKCEVerifier(64)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to generate PKCE: %v", err),
+		})
+	}
+	challenge := generatePKCEChallenge(verifier)
+
+	// Store PKCE in auth state
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PKCEVerifier = verifier
+	state.PKCEChallenge = challenge
+	state.AuthCode = "" // Clear any previous auth code
+	extensionAuthStateMu.Unlock()
+
+	// Build OAuth URL with PKCE parameters
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("invalid authUrl: %v", err),
+		})
+	}
+
+	query := parsedURL.Query()
+	query.Set("client_id", clientID)
+	query.Set("redirect_uri", redirectURI)
+	query.Set("response_type", "code")
+	query.Set("code_challenge", challenge)
+	query.Set("code_challenge_method", "S256")
+
+	if scope != "" {
+		query.Set("scope", scope)
+	}
+
+	// Add extra params
+	for k, v := range extraParams {
+		query.Set(k, fmt.Sprintf("%v", v))
+	}
+
+	parsedURL.RawQuery = query.Encode()
+	fullAuthURL := parsedURL.String()
+
+	// Store pending auth request for Flutter
+	pendingAuthRequestsMu.Lock()
+	pendingAuthRequests[r.extensionID] = &PendingAuthRequest{
+		ExtensionID: r.extensionID,
+		AuthURL:     fullAuthURL,
+		CallbackURL: redirectURI,
+	}
+	pendingAuthRequestsMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE OAuth started: %s\n", r.extensionID, fullAuthURL)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"authUrl": fullAuthURL,
+		"pkce": map[string]interface{}{
+			"verifier":  verifier,
+			"challenge": challenge,
+			"method":    "S256",
+		},
+	})
+}
+
+// authExchangeCodeWithPKCE exchanges auth code for tokens using PKCE
+// config: { tokenUrl, clientId, redirectUri, code, extraParams }
+// Uses the stored PKCE verifier automatically
+func (r *ExtensionRuntime) authExchangeCodeWithPKCE(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config object is required",
+		})
+	}
+
+	configObj := call.Arguments[0].Export()
+	config, ok := configObj.(map[string]interface{})
+	if !ok {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config must be an object",
+		})
+	}
+
+	// Required fields
+	tokenURL, _ := config["tokenUrl"].(string)
+	clientID, _ := config["clientId"].(string)
+	redirectURI, _ := config["redirectUri"].(string)
+	code, _ := config["code"].(string)
+
+	if tokenURL == "" || clientID == "" || code == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "tokenUrl, clientId, and code are required",
+		})
+	}
+
+	// Get stored PKCE verifier
+	extensionAuthStateMu.RLock()
+	state, exists := extensionAuthState[r.extensionID]
+	var verifier string
+	if exists {
+		verifier = state.PKCEVerifier
+	}
+	extensionAuthStateMu.RUnlock()
+
+	if verifier == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "no PKCE verifier found - call generatePKCE or startOAuthWithPKCE first",
+		})
+	}
+
+	// Validate domain
+	if err := r.validateDomain(tokenURL); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Build token request body
+	formData := url.Values{}
+	formData.Set("grant_type", "authorization_code")
+	formData.Set("client_id", clientID)
+	formData.Set("code", code)
+	formData.Set("code_verifier", verifier)
+	if redirectURI != "" {
+		formData.Set("redirect_uri", redirectURI)
+	}
+
+	// Add extra params
+	if extraParams, ok := config["extraParams"].(map[string]interface{}); ok {
+		for k, v := range extraParams {
+			formData.Set(k, fmt.Sprintf("%v", v))
+		}
+	}
+
+	// Make token request
+	req, err := http.NewRequest("POST", tokenURL, strings.NewReader(formData.Encode()))
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Parse response
+	var tokenResp map[string]interface{}
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to parse token response: %v", err),
+			"body":    string(body),
+		})
+	}
+
+	// Check for error in response
+	if errMsg, ok := tokenResp["error"].(string); ok {
+		errDesc, _ := tokenResp["error_description"].(string)
+		return r.vm.ToValue(map[string]interface{}{
+			"success":           false,
+			"error":             errMsg,
+			"error_description": errDesc,
+		})
+	}
+
+	// Extract tokens
+	accessToken, _ := tokenResp["access_token"].(string)
+	refreshToken, _ := tokenResp["refresh_token"].(string)
+	expiresIn, _ := tokenResp["expires_in"].(float64)
+
+	if accessToken == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "no access_token in response",
+			"body":    string(body),
+		})
+	}
+
+	// Store tokens in auth state
+	extensionAuthStateMu.Lock()
+	state, exists = extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.AccessToken = accessToken
+	state.RefreshToken = refreshToken
+	state.IsAuthenticated = true
+	if expiresIn > 0 {
+		state.ExpiresAt = time.Now().Add(time.Duration(expiresIn) * time.Second)
+	}
+	// Clear PKCE after successful exchange
+	state.PKCEVerifier = ""
+	state.PKCEChallenge = ""
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE token exchange successful\n", r.extensionID)
+
+	// Return full token response
+	result := map[string]interface{}{
+		"success":       true,
+		"access_token":  accessToken,
+		"refresh_token": refreshToken,
+		"token_type":    tokenResp["token_type"],
+	}
+	if expiresIn > 0 {
+		result["expires_in"] = expiresIn
+	}
+	// Include any additional fields from response
+	if scope, ok := tokenResp["scope"].(string); ok {
+		result["scope"] = scope
+	}
+
+	return r.vm.ToValue(result)
+}

go_backend/extension_runtime_ffmpeg.go

@@ -0,0 +1,204 @@
+// Package gobackend provides FFmpeg API for extension runtime
+package gobackend
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== FFmpeg API (Post-Processing) ====================
+
+// FFmpegCommand holds a pending FFmpeg command for Flutter to execute
+type FFmpegCommand struct {
+	ExtensionID string
+	Command     string
+	InputPath   string
+	OutputPath  string
+	Completed   bool
+	Success     bool
+	Error       string
+	Output      string
+}
+
+// Global FFmpeg command queue
+var (
+	ffmpegCommands   = make(map[string]*FFmpegCommand)
+	ffmpegCommandsMu sync.RWMutex
+	ffmpegCommandID  int64
+)
+
+// GetPendingFFmpegCommand returns a pending FFmpeg command (called from Flutter)
+func GetPendingFFmpegCommand(commandID string) *FFmpegCommand {
+	ffmpegCommandsMu.RLock()
+	defer ffmpegCommandsMu.RUnlock()
+	return ffmpegCommands[commandID]
+}
+
+// SetFFmpegCommandResult sets the result of an FFmpeg command (called from Flutter)
+func SetFFmpegCommandResult(commandID string, success bool, output, errorMsg string) {
+	ffmpegCommandsMu.Lock()
+	defer ffmpegCommandsMu.Unlock()
+	if cmd, exists := ffmpegCommands[commandID]; exists {
+		cmd.Completed = true
+		cmd.Success = success
+		cmd.Output = output
+		cmd.Error = errorMsg
+	}
+}
+
+// ClearFFmpegCommand removes a completed FFmpeg command
+func ClearFFmpegCommand(commandID string) {
+	ffmpegCommandsMu.Lock()
+	defer ffmpegCommandsMu.Unlock()
+	delete(ffmpegCommands, commandID)
+}
+
+// ffmpegExecute queues an FFmpeg command for execution by Flutter
+func (r *ExtensionRuntime) ffmpegExecute(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "command is required",
+		})
+	}
+
+	command := call.Arguments[0].String()
+
+	// Generate unique command ID
+	ffmpegCommandsMu.Lock()
+	ffmpegCommandID++
+	cmdID := fmt.Sprintf("%s_%d", r.extensionID, ffmpegCommandID)
+	ffmpegCommands[cmdID] = &FFmpegCommand{
+		ExtensionID: r.extensionID,
+		Command:     command,
+		Completed:   false,
+	}
+	ffmpegCommandsMu.Unlock()
+
+	GoLog("[Extension:%s] FFmpeg command queued: %s\n", r.extensionID, cmdID)
+
+	// Wait for completion (with timeout)
+	timeout := 5 * time.Minute
+	start := time.Now()
+	for {
+		ffmpegCommandsMu.RLock()
+		cmd := ffmpegCommands[cmdID]
+		completed := cmd != nil && cmd.Completed
+		ffmpegCommandsMu.RUnlock()
+
+		if completed {
+			ffmpegCommandsMu.RLock()
+			result := map[string]interface{}{
+				"success": cmd.Success,
+				"output":  cmd.Output,
+			}
+			if cmd.Error != "" {
+				result["error"] = cmd.Error
+			}
+			ffmpegCommandsMu.RUnlock()
+
+			// Cleanup
+			ClearFFmpegCommand(cmdID)
+			return r.vm.ToValue(result)
+		}
+
+		if time.Since(start) > timeout {
+			ClearFFmpegCommand(cmdID)
+			return r.vm.ToValue(map[string]interface{}{
+				"success": false,
+				"error":   "FFmpeg command timed out",
+			})
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+}
+
+// ffmpegGetInfo gets audio file information using FFprobe
+func (r *ExtensionRuntime) ffmpegGetInfo(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "file path is required",
+		})
+	}
+
+	filePath := call.Arguments[0].String()
+
+	// Use Go's built-in audio quality function
+	quality, err := GetAudioQuality(filePath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success":       true,
+		"bit_depth":     quality.BitDepth,
+		"sample_rate":   quality.SampleRate,
+		"total_samples": quality.TotalSamples,
+		"duration":      float64(quality.TotalSamples) / float64(quality.SampleRate),
+	})
+}
+
+// ffmpegConvert is a helper for common conversion operations
+func (r *ExtensionRuntime) ffmpegConvert(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "input and output paths are required",
+		})
+	}
+
+	inputPath := call.Arguments[0].String()
+	outputPath := call.Arguments[1].String()
+
+	// Get options if provided
+	options := map[string]interface{}{}
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		if opts, ok := call.Arguments[2].Export().(map[string]interface{}); ok {
+			options = opts
+		}
+	}
+
+	// Build FFmpeg command
+	var cmdParts []string
+	cmdParts = append(cmdParts, "-i", fmt.Sprintf("%q", inputPath))
+
+	// Audio codec
+	if codec, ok := options["codec"].(string); ok {
+		cmdParts = append(cmdParts, "-c:a", codec)
+	}
+
+	// Bitrate
+	if bitrate, ok := options["bitrate"].(string); ok {
+		cmdParts = append(cmdParts, "-b:a", bitrate)
+	}
+
+	// Sample rate
+	if sampleRate, ok := options["sample_rate"].(float64); ok {
+		cmdParts = append(cmdParts, "-ar", fmt.Sprintf("%d", int(sampleRate)))
+	}
+
+	// Channels
+	if channels, ok := options["channels"].(float64); ok {
+		cmdParts = append(cmdParts, "-ac", fmt.Sprintf("%d", int(channels)))
+	}
+
+	// Overwrite output
+	cmdParts = append(cmdParts, "-y", fmt.Sprintf("%q", outputPath))
+
+	command := strings.Join(cmdParts, " ")
+
+	// Execute via ffmpegExecute
+	execCall := goja.FunctionCall{
+		Arguments: []goja.Value{r.vm.ToValue(command)},
+	}
+	return r.ffmpegExecute(execCall)
+}

go_backend/extension_runtime_file.go

@@ -0,0 +1,523 @@
+// Package gobackend provides File API for extension runtime
+package gobackend
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== File API (Sandboxed) ====================
+
+// List of allowed directories for file operations (set by Go backend for download operations)
+var (
+	allowedDownloadDirs   []string
+	allowedDownloadDirsMu sync.RWMutex
+)
+
+// SetAllowedDownloadDirs sets the list of directories where extensions can write files
+// This should be called by the Go backend when setting up download paths
+func SetAllowedDownloadDirs(dirs []string) {
+	allowedDownloadDirsMu.Lock()
+	defer allowedDownloadDirsMu.Unlock()
+	allowedDownloadDirs = dirs
+	GoLog("[Extension] Allowed download directories set: %v\n", dirs)
+}
+
+// AddAllowedDownloadDir adds a directory to the allowed list
+func AddAllowedDownloadDir(dir string) {
+	allowedDownloadDirsMu.Lock()
+	defer allowedDownloadDirsMu.Unlock()
+	absDir, err := filepath.Abs(dir)
+	if err == nil {
+		allowedDownloadDirs = append(allowedDownloadDirs, absDir)
+	}
+}
+
+// isPathInAllowedDirs checks if an absolute path is within any allowed directory
+func isPathInAllowedDirs(absPath string) bool {
+	allowedDownloadDirsMu.RLock()
+	defer allowedDownloadDirsMu.RUnlock()
+
+	for _, allowedDir := range allowedDownloadDirs {
+		if strings.HasPrefix(absPath, allowedDir) {
+			return true
+		}
+	}
+	return false
+}
+
+// validatePath checks if the path is within the extension's sandbox
+// Security: Absolute paths are BLOCKED unless they're in allowed download directories
+// Extensions should use relative paths for their own data storage
+func (r *ExtensionRuntime) validatePath(path string) (string, error) {
+	// Check if extension has file permission
+	if !r.manifest.Permissions.File {
+		return "", fmt.Errorf("file access denied: extension does not have 'file' permission")
+	}
+
+	// Clean and resolve the path
+	cleanPath := filepath.Clean(path)
+
+	// SECURITY: Block absolute paths by default
+	// Only allow if path is in explicitly allowed download directories
+	if filepath.IsAbs(cleanPath) {
+		absPath, err := filepath.Abs(cleanPath)
+		if err != nil {
+			return "", fmt.Errorf("invalid path: %w", err)
+		}
+
+		// Check if path is in allowed download directories
+		if isPathInAllowedDirs(absPath) {
+			return absPath, nil
+		}
+
+		// Block all other absolute paths
+		return "", fmt.Errorf("file access denied: absolute paths are not allowed. Use relative paths within extension sandbox")
+	}
+
+	// For relative paths, join with data directory (extension's sandbox)
+	fullPath := filepath.Join(r.dataDir, cleanPath)
+
+	// Resolve to absolute path
+	absPath, err := filepath.Abs(fullPath)
+	if err != nil {
+		return "", fmt.Errorf("invalid path: %w", err)
+	}
+
+	// Ensure path is within data directory (prevent path traversal)
+	absDataDir, _ := filepath.Abs(r.dataDir)
+	if !strings.HasPrefix(absPath, absDataDir) {
+		return "", fmt.Errorf("file access denied: path '%s' is outside sandbox", path)
+	}
+
+	return absPath, nil
+}
+
+// fileDownload downloads a file from URL to the specified path
+// Supports progress callback via options.onProgress
+func (r *ExtensionRuntime) fileDownload(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "URL and output path are required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+	outputPath := call.Arguments[1].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Validate output path (allows absolute paths for download queue)
+	fullPath, err := r.validatePath(outputPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Get options if provided
+	var onProgress goja.Callable
+	var headers map[string]string
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		optionsObj := call.Arguments[2].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			// Extract headers
+			if h, ok := opts["headers"].(map[string]interface{}); ok {
+				headers = make(map[string]string)
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+			// Extract onProgress callback
+			if progressVal, ok := opts["onProgress"]; ok {
+				if callable, ok := goja.AssertFunction(r.vm.ToValue(progressVal)); ok {
+					onProgress = callable
+				}
+			}
+		}
+	}
+
+	// Create directory if needed
+	dir := filepath.Dir(fullPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	// Create HTTP request
+	req, err := http.NewRequest("GET", urlStr, nil)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Set headers
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+	}
+
+	// Download file
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("HTTP error: %d", resp.StatusCode),
+		})
+	}
+
+	// Create output file
+	out, err := os.Create(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create file: %v", err),
+		})
+	}
+	defer out.Close()
+
+	// Get content length for progress
+	contentLength := resp.ContentLength
+
+	// Copy content with progress reporting
+	var written int64
+	buf := make([]byte, 32*1024) // 32KB buffer
+	for {
+		nr, er := resp.Body.Read(buf)
+		if nr > 0 {
+			nw, ew := out.Write(buf[0:nr])
+			if nw < 0 || nr < nw {
+				nw = 0
+				if ew == nil {
+					ew = fmt.Errorf("invalid write result")
+				}
+			}
+			written += int64(nw)
+			if ew != nil {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   fmt.Sprintf("failed to write file: %v", ew),
+				})
+			}
+			if nr != nw {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   "short write",
+				})
+			}
+
+			// Report progress
+			if onProgress != nil && contentLength > 0 {
+				_, _ = onProgress(goja.Undefined(), r.vm.ToValue(written), r.vm.ToValue(contentLength))
+			}
+		}
+		if er != nil {
+			if er != io.EOF {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   fmt.Sprintf("failed to read response: %v", er),
+				})
+			}
+			break
+		}
+	}
+
+	GoLog("[Extension:%s] Downloaded %d bytes to %s\n", r.extensionID, written, fullPath)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullPath,
+		"size":    written,
+	})
+}
+
+// fileExists checks if a file exists in the sandbox
+func (r *ExtensionRuntime) fileExists(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(false)
+	}
+
+	_, err = os.Stat(fullPath)
+	return r.vm.ToValue(err == nil)
+}
+
+// fileDelete deletes a file in the sandbox
+func (r *ExtensionRuntime) fileDelete(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	if err := os.Remove(fullPath); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+	})
+}
+
+// fileRead reads a file from the sandbox
+func (r *ExtensionRuntime) fileRead(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	data, err := os.ReadFile(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    string(data),
+	})
+}
+
+// fileWrite writes data to a file in the sandbox
+func (r *ExtensionRuntime) fileWrite(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path and data are required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	data := call.Arguments[1].String()
+
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Create directory if needed
+	dir := filepath.Dir(fullPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	if err := os.WriteFile(fullPath, []byte(data), 0644); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullPath,
+	})
+}
+
+// fileCopy copies a file within the sandbox
+func (r *ExtensionRuntime) fileCopy(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "source and destination paths are required",
+		})
+	}
+
+	srcPath := call.Arguments[0].String()
+	dstPath := call.Arguments[1].String()
+
+	fullSrc, err := r.validatePath(srcPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	fullDst, err := r.validatePath(dstPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Read source file
+	data, err := os.ReadFile(fullSrc)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to read source: %v", err),
+		})
+	}
+
+	// Create destination directory if needed
+	dir := filepath.Dir(fullDst)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	// Write to destination
+	if err := os.WriteFile(fullDst, data, 0644); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to write destination: %v", err),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullDst,
+	})
+}
+
+// fileMove moves/renames a file within the sandbox
+func (r *ExtensionRuntime) fileMove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "source and destination paths are required",
+		})
+	}
+
+	srcPath := call.Arguments[0].String()
+	dstPath := call.Arguments[1].String()
+
+	fullSrc, err := r.validatePath(srcPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	fullDst, err := r.validatePath(dstPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Create destination directory if needed
+	dir := filepath.Dir(fullDst)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	if err := os.Rename(fullSrc, fullDst); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to move file: %v", err),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullDst,
+	})
+}
+
+// fileGetSize returns the size of a file in bytes
+func (r *ExtensionRuntime) fileGetSize(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	info, err := os.Stat(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"size":    info.Size(),
+	})
+}

go_backend/extension_runtime_http.go

@@ -0,0 +1,505 @@
+// Package gobackend provides HTTP API for extension runtime
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== HTTP API (Sandboxed) ====================
+
+// HTTPResponse represents the response from an HTTP request
+type HTTPResponse struct {
+	StatusCode int               `json:"statusCode"`
+	Body       string            `json:"body"`
+	Headers    map[string]string `json:"headers"`
+}
+
+// validateDomain checks if the domain is allowed by the extension's permissions
+func (r *ExtensionRuntime) validateDomain(urlStr string) error {
+	parsed, err := url.Parse(urlStr)
+	if err != nil {
+		return fmt.Errorf("invalid URL: %w", err)
+	}
+
+	domain := parsed.Hostname()
+
+	// Block private/local network access (SSRF protection)
+	if isPrivateIP(domain) {
+		return fmt.Errorf("network access denied: private/local network '%s' not allowed", domain)
+	}
+
+	if !r.manifest.IsDomainAllowed(domain) {
+		return fmt.Errorf("network access denied: domain '%s' not in allowed list", domain)
+	}
+
+	return nil
+}
+
+// httpGet performs a GET request (sandboxed)
+func (r *ExtensionRuntime) httpGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Get headers if provided
+	headers := make(map[string]string)
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		headersObj := call.Arguments[1].Export()
+		if h, ok := headersObj.(map[string]interface{}); ok {
+			for k, v := range h {
+				headers[k] = fmt.Sprintf("%v", v)
+			}
+		}
+	}
+
+	// Create request
+	req, err := http.NewRequest("GET", urlStr, nil)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set default User-Agent if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers (cookies, etc.)
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+// httpPost performs a POST request (sandboxed)
+func (r *ExtensionRuntime) httpPost(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Get body if provided - support both string and object
+	var bodyStr string
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		bodyArg := call.Arguments[1].Export()
+		switch v := bodyArg.(type) {
+		case string:
+			bodyStr = v
+		case map[string]interface{}, []interface{}:
+			// Auto-stringify objects and arrays to JSON
+			jsonBytes, err := json.Marshal(v)
+			if err != nil {
+				return r.vm.ToValue(map[string]interface{}{
+					"error": fmt.Sprintf("failed to stringify body: %v", err),
+				})
+			}
+			bodyStr = string(jsonBytes)
+		default:
+			// Fallback to string conversion
+			bodyStr = call.Arguments[1].String()
+		}
+	}
+
+	// Get headers if provided
+	headers := make(map[string]string)
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		headersObj := call.Arguments[2].Export()
+		if h, ok := headersObj.(map[string]interface{}); ok {
+			for k, v := range h {
+				headers[k] = fmt.Sprintf("%v", v)
+			}
+		}
+	}
+
+	// Create request
+	req, err := http.NewRequest("POST", urlStr, strings.NewReader(bodyStr))
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set defaults if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+// httpRequest performs a generic HTTP request (GET, POST, PUT, DELETE, etc.)
+// Usage: http.request(url, options) where options = { method, body, headers }
+func (r *ExtensionRuntime) httpRequest(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Default options
+	method := "GET"
+	var bodyStr string
+	headers := make(map[string]string)
+
+	// Parse options if provided
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		optionsObj := call.Arguments[1].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			// Get method
+			if m, ok := opts["method"].(string); ok {
+				method = strings.ToUpper(m)
+			}
+
+			// Get body - support both string and object
+			if bodyArg, ok := opts["body"]; ok && bodyArg != nil {
+				switch v := bodyArg.(type) {
+				case string:
+					bodyStr = v
+				case map[string]interface{}, []interface{}:
+					// Auto-stringify objects and arrays to JSON
+					jsonBytes, err := json.Marshal(v)
+					if err != nil {
+						return r.vm.ToValue(map[string]interface{}{
+							"error": fmt.Sprintf("failed to stringify body: %v", err),
+						})
+					}
+					bodyStr = string(jsonBytes)
+				default:
+					bodyStr = fmt.Sprintf("%v", v)
+				}
+			}
+
+			// Get headers
+			if h, ok := opts["headers"].(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	}
+
+	// Create request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set defaults if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	// Return response with helper properties
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+// httpPut performs a PUT request (shortcut for http.request with method: "PUT")
+func (r *ExtensionRuntime) httpPut(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("PUT", call)
+}
+
+// httpDelete performs a DELETE request (shortcut for http.request with method: "DELETE")
+func (r *ExtensionRuntime) httpDelete(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("DELETE", call)
+}
+
+// httpPatch performs a PATCH request (shortcut for http.request with method: "PATCH")
+func (r *ExtensionRuntime) httpPatch(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("PATCH", call)
+}
+
+// httpMethodShortcut is a helper for PUT/DELETE/PATCH shortcuts
+// Signature: http.put(url, body, headers) / http.delete(url, headers) / http.patch(url, body, headers)
+func (r *ExtensionRuntime) httpMethodShortcut(method string, call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	var bodyStr string
+	headers := make(map[string]string)
+
+	// For DELETE, second arg is headers; for PUT/PATCH, second arg is body
+	if method == "DELETE" {
+		// http.delete(url, headers)
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+			headersObj := call.Arguments[1].Export()
+			if h, ok := headersObj.(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	} else {
+		// http.put(url, body, headers) / http.patch(url, body, headers)
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+			bodyArg := call.Arguments[1].Export()
+			switch v := bodyArg.(type) {
+			case string:
+				bodyStr = v
+			case map[string]interface{}, []interface{}:
+				jsonBytes, err := json.Marshal(v)
+				if err != nil {
+					return r.vm.ToValue(map[string]interface{}{
+						"error": fmt.Sprintf("failed to stringify body: %v", err),
+					})
+				}
+				bodyStr = string(jsonBytes)
+			default:
+				bodyStr = call.Arguments[1].String()
+			}
+		}
+
+		if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+			headersObj := call.Arguments[2].Export()
+			if h, ok := headersObj.(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	}
+
+	// Create request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode,
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+// httpClearCookies clears all cookies for this extension
+func (r *ExtensionRuntime) httpClearCookies(call goja.FunctionCall) goja.Value {
+	if jar, ok := r.cookieJar.(*simpleCookieJar); ok {
+		jar.mu.Lock()
+		jar.cookies = make(map[string][]*http.Cookie)
+		jar.mu.Unlock()
+		GoLog("[Extension:%s] Cookies cleared\n", r.extensionID)
+		return r.vm.ToValue(true)
+	}
+	return r.vm.ToValue(false)
+}

go_backend/extension_runtime_matching.go

@@ -0,0 +1,151 @@
+// Package gobackend provides Track Matching API for extension runtime
+package gobackend
+
+import (
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Track Matching API ====================
+
+// matchingCompareStrings compares two strings with fuzzy matching
+func (r *ExtensionRuntime) matchingCompareStrings(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(0.0)
+	}
+
+	str1 := strings.ToLower(strings.TrimSpace(call.Arguments[0].String()))
+	str2 := strings.ToLower(strings.TrimSpace(call.Arguments[1].String()))
+
+	if str1 == str2 {
+		return r.vm.ToValue(1.0)
+	}
+
+	// Calculate Levenshtein distance-based similarity
+	similarity := calculateStringSimilarity(str1, str2)
+	return r.vm.ToValue(similarity)
+}
+
+// matchingCompareDuration compares two durations with tolerance
+func (r *ExtensionRuntime) matchingCompareDuration(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(false)
+	}
+
+	dur1 := int(call.Arguments[0].ToInteger())
+	dur2 := int(call.Arguments[1].ToInteger())
+
+	// Default tolerance: 3 seconds
+	tolerance := 3000 // milliseconds
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) {
+		tolerance = int(call.Arguments[2].ToInteger())
+	}
+
+	diff := dur1 - dur2
+	if diff < 0 {
+		diff = -diff
+	}
+
+	return r.vm.ToValue(diff <= tolerance)
+}
+
+// matchingNormalizeString normalizes a string for comparison
+func (r *ExtensionRuntime) matchingNormalizeString(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+
+	str := call.Arguments[0].String()
+	normalized := normalizeStringForMatching(str)
+	return r.vm.ToValue(normalized)
+}
+
+// calculateStringSimilarity calculates similarity between two strings (0-1)
+func calculateStringSimilarity(s1, s2 string) float64 {
+	if len(s1) == 0 && len(s2) == 0 {
+		return 1.0
+	}
+	if len(s1) == 0 || len(s2) == 0 {
+		return 0.0
+	}
+
+	// Use Levenshtein distance
+	distance := levenshteinDistance(s1, s2)
+	maxLen := len(s1)
+	if len(s2) > maxLen {
+		maxLen = len(s2)
+	}
+
+	return 1.0 - float64(distance)/float64(maxLen)
+}
+
+// levenshteinDistance calculates the Levenshtein distance between two strings
+func levenshteinDistance(s1, s2 string) int {
+	if len(s1) == 0 {
+		return len(s2)
+	}
+	if len(s2) == 0 {
+		return len(s1)
+	}
+
+	// Create matrix
+	matrix := make([][]int, len(s1)+1)
+	for i := range matrix {
+		matrix[i] = make([]int, len(s2)+1)
+		matrix[i][0] = i
+	}
+	for j := range matrix[0] {
+		matrix[0][j] = j
+	}
+
+	// Fill matrix
+	for i := 1; i <= len(s1); i++ {
+		for j := 1; j <= len(s2); j++ {
+			cost := 1
+			if s1[i-1] == s2[j-1] {
+				cost = 0
+			}
+			matrix[i][j] = min(
+				matrix[i-1][j]+1,      // deletion
+				matrix[i][j-1]+1,      // insertion
+				matrix[i-1][j-1]+cost, // substitution
+			)
+		}
+	}
+
+	return matrix[len(s1)][len(s2)]
+}
+
+// normalizeStringForMatching normalizes a string for comparison
+func normalizeStringForMatching(s string) string {
+	// Convert to lowercase
+	s = strings.ToLower(s)
+
+	// Remove common suffixes/prefixes
+	suffixes := []string{
+		" (remastered)", " (remaster)", " - remastered", " - remaster",
+		" (deluxe)", " (deluxe edition)", " - deluxe", " - deluxe edition",
+		" (explicit)", " (clean)", " [explicit]", " [clean]",
+		" (album version)", " (single version)", " (radio edit)",
+		" (feat.", " (ft.", " feat.", " ft.",
+	}
+	for _, suffix := range suffixes {
+		if idx := strings.Index(s, suffix); idx != -1 {
+			s = s[:idx]
+		}
+	}
+
+	// Remove special characters
+	var result strings.Builder
+	for _, r := range s {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == ' ' {
+			result.WriteRune(r)
+		}
+	}
+
+	// Collapse multiple spaces
+	s = strings.Join(strings.Fields(result.String()), " ")
+
+	return strings.TrimSpace(s)
+}

go_backend/extension_runtime_polyfills.go

@@ -0,0 +1,488 @@
+// Package gobackend provides Browser-like Polyfills for extension runtime
+package gobackend
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Browser-like Polyfills ====================
+// These polyfills make porting browser/Node.js libraries easier
+// without compromising sandbox security
+
+// fetchPolyfill implements browser-compatible fetch() API
+// Returns a Promise-like object with json(), text() methods
+func (r *ExtensionRuntime) fetchPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.createFetchError("URL is required")
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] fetch blocked: %v\n", r.extensionID, err)
+		return r.createFetchError(err.Error())
+	}
+
+	// Parse options
+	method := "GET"
+	var bodyStr string
+	headers := make(map[string]string)
+
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		optionsObj := call.Arguments[1].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			// Method
+			if m, ok := opts["method"].(string); ok {
+				method = strings.ToUpper(m)
+			}
+
+			// Body - support string, object (auto-stringify), or nil
+			if bodyArg, ok := opts["body"]; ok && bodyArg != nil {
+				switch v := bodyArg.(type) {
+				case string:
+					bodyStr = v
+				case map[string]interface{}, []interface{}:
+					jsonBytes, err := json.Marshal(v)
+					if err != nil {
+						return r.createFetchError(fmt.Sprintf("failed to stringify body: %v", err))
+					}
+					bodyStr = string(jsonBytes)
+				default:
+					bodyStr = fmt.Sprintf("%v", v)
+				}
+			}
+
+			// Headers
+			if h, ok := opts["headers"]; ok && h != nil {
+				switch hv := h.(type) {
+				case map[string]interface{}:
+					for k, v := range hv {
+						headers[k] = fmt.Sprintf("%v", v)
+					}
+				}
+			}
+		}
+	}
+
+	// Create HTTP request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Set defaults if not provided
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+
+	// Extract response headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v
+		}
+	}
+
+	// Create Response object (browser-compatible)
+	responseObj := r.vm.NewObject()
+	responseObj.Set("ok", resp.StatusCode >= 200 && resp.StatusCode < 300)
+	responseObj.Set("status", resp.StatusCode)
+	responseObj.Set("statusText", http.StatusText(resp.StatusCode))
+	responseObj.Set("headers", respHeaders)
+	responseObj.Set("url", urlStr)
+
+	// Store body for methods
+	bodyString := string(body)
+
+	// text() method - returns body as string
+	responseObj.Set("text", func(call goja.FunctionCall) goja.Value {
+		return r.vm.ToValue(bodyString)
+	})
+
+	// json() method - parses body as JSON
+	responseObj.Set("json", func(call goja.FunctionCall) goja.Value {
+		var result interface{}
+		if err := json.Unmarshal(body, &result); err != nil {
+			GoLog("[Extension:%s] fetch json() parse error: %v\n", r.extensionID, err)
+			return goja.Undefined()
+		}
+		return r.vm.ToValue(result)
+	})
+
+	// arrayBuffer() method - returns body as array (simplified)
+	responseObj.Set("arrayBuffer", func(call goja.FunctionCall) goja.Value {
+		// Return as array of bytes
+		byteArray := make([]interface{}, len(body))
+		for i, b := range body {
+			byteArray[i] = int(b)
+		}
+		return r.vm.ToValue(byteArray)
+	})
+
+	return responseObj
+}
+
+// createFetchError creates a fetch error response
+func (r *ExtensionRuntime) createFetchError(message string) goja.Value {
+	errorObj := r.vm.NewObject()
+	errorObj.Set("ok", false)
+	errorObj.Set("status", 0)
+	errorObj.Set("statusText", "Network Error")
+	errorObj.Set("error", message)
+	errorObj.Set("text", func(call goja.FunctionCall) goja.Value {
+		return r.vm.ToValue("")
+	})
+	errorObj.Set("json", func(call goja.FunctionCall) goja.Value {
+		return goja.Undefined()
+	})
+	return errorObj
+}
+
+// atobPolyfill implements browser atob() - decode base64 to string
+func (r *ExtensionRuntime) atobPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	decoded, err := base64.StdEncoding.DecodeString(input)
+	if err != nil {
+		// Try URL-safe base64
+		decoded, err = base64.URLEncoding.DecodeString(input)
+		if err != nil {
+			GoLog("[Extension:%s] atob decode error: %v\n", r.extensionID, err)
+			return r.vm.ToValue("")
+		}
+	}
+	return r.vm.ToValue(string(decoded))
+}
+
+// btoaPolyfill implements browser btoa() - encode string to base64
+func (r *ExtensionRuntime) btoaPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString([]byte(input)))
+}
+
+// registerTextEncoderDecoder registers TextEncoder and TextDecoder classes
+func (r *ExtensionRuntime) registerTextEncoderDecoder(vm *goja.Runtime) {
+	// TextEncoder constructor
+	vm.Set("TextEncoder", func(call goja.ConstructorCall) *goja.Object {
+		encoder := call.This
+		encoder.Set("encoding", "utf-8")
+
+		// encode() method - string to Uint8Array
+		encoder.Set("encode", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]byte{})
+			}
+			input := call.Arguments[0].String()
+			bytes := []byte(input)
+
+			// Return as array (Uint8Array-like)
+			result := make([]interface{}, len(bytes))
+			for i, b := range bytes {
+				result[i] = int(b)
+			}
+			return vm.ToValue(result)
+		})
+
+		// encodeInto() method
+		encoder.Set("encodeInto", func(call goja.FunctionCall) goja.Value {
+			// Simplified implementation
+			if len(call.Arguments) < 2 {
+				return vm.ToValue(map[string]interface{}{"read": 0, "written": 0})
+			}
+			input := call.Arguments[0].String()
+			return vm.ToValue(map[string]interface{}{
+				"read":    len(input),
+				"written": len([]byte(input)),
+			})
+		})
+
+		return nil
+	})
+
+	// TextDecoder constructor
+	vm.Set("TextDecoder", func(call goja.ConstructorCall) *goja.Object {
+		decoder := call.This
+
+		// Get encoding from arguments (default: utf-8)
+		encoding := "utf-8"
+		if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+			encoding = call.Arguments[0].String()
+		}
+		decoder.Set("encoding", encoding)
+		decoder.Set("fatal", false)
+		decoder.Set("ignoreBOM", false)
+
+		// decode() method - Uint8Array to string
+		decoder.Set("decode", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue("")
+			}
+
+			// Handle different input types
+			input := call.Arguments[0].Export()
+			var bytes []byte
+
+			switch v := input.(type) {
+			case []byte:
+				bytes = v
+			case []interface{}:
+				bytes = make([]byte, len(v))
+				for i, val := range v {
+					switch n := val.(type) {
+					case int64:
+						bytes[i] = byte(n)
+					case float64:
+						bytes[i] = byte(n)
+					case int:
+						bytes[i] = byte(n)
+					}
+				}
+			case string:
+				// Already a string, just return it
+				return vm.ToValue(v)
+			default:
+				return vm.ToValue("")
+			}
+
+			return vm.ToValue(string(bytes))
+		})
+
+		return nil
+	})
+}
+
+// registerURLClass registers the URL class for URL parsing
+func (r *ExtensionRuntime) registerURLClass(vm *goja.Runtime) {
+	vm.Set("URL", func(call goja.ConstructorCall) *goja.Object {
+		urlObj := call.This
+
+		if len(call.Arguments) < 1 {
+			urlObj.Set("href", "")
+			return nil
+		}
+
+		urlStr := call.Arguments[0].String()
+
+		// Handle relative URLs with base
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) {
+			baseStr := call.Arguments[1].String()
+			baseURL, err := url.Parse(baseStr)
+			if err == nil {
+				relURL, err := url.Parse(urlStr)
+				if err == nil {
+					urlStr = baseURL.ResolveReference(relURL).String()
+				}
+			}
+		}
+
+		parsed, err := url.Parse(urlStr)
+		if err != nil {
+			urlObj.Set("href", urlStr)
+			return nil
+		}
+
+		// Set URL properties
+		urlObj.Set("href", parsed.String())
+		urlObj.Set("protocol", parsed.Scheme+":")
+		urlObj.Set("host", parsed.Host)
+		urlObj.Set("hostname", parsed.Hostname())
+		urlObj.Set("port", parsed.Port())
+		urlObj.Set("pathname", parsed.Path)
+		urlObj.Set("search", "")
+		if parsed.RawQuery != "" {
+			urlObj.Set("search", "?"+parsed.RawQuery)
+		}
+		urlObj.Set("hash", "")
+		if parsed.Fragment != "" {
+			urlObj.Set("hash", "#"+parsed.Fragment)
+		}
+		urlObj.Set("origin", parsed.Scheme+"://"+parsed.Host)
+		urlObj.Set("username", parsed.User.Username())
+		password, _ := parsed.User.Password()
+		urlObj.Set("password", password)
+
+		// searchParams object
+		searchParams := vm.NewObject()
+		queryValues := parsed.Query()
+
+		searchParams.Set("get", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return goja.Null()
+			}
+			key := call.Arguments[0].String()
+			if val := queryValues.Get(key); val != "" {
+				return vm.ToValue(val)
+			}
+			return goja.Null()
+		})
+
+		searchParams.Set("getAll", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]string{})
+			}
+			key := call.Arguments[0].String()
+			return vm.ToValue(queryValues[key])
+		})
+
+		searchParams.Set("has", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue(false)
+			}
+			key := call.Arguments[0].String()
+			return vm.ToValue(queryValues.Has(key))
+		})
+
+		searchParams.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(queryValues.Encode())
+		})
+
+		urlObj.Set("searchParams", searchParams)
+
+		// toString method
+		urlObj.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(parsed.String())
+		})
+
+		// toJSON method
+		urlObj.Set("toJSON", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(parsed.String())
+		})
+
+		return nil
+	})
+
+	// URLSearchParams constructor
+	vm.Set("URLSearchParams", func(call goja.ConstructorCall) *goja.Object {
+		paramsObj := call.This
+		values := url.Values{}
+
+		// Parse initial value if provided
+		if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+			init := call.Arguments[0].Export()
+			switch v := init.(type) {
+			case string:
+				// Parse query string
+				parsed, _ := url.ParseQuery(strings.TrimPrefix(v, "?"))
+				values = parsed
+			case map[string]interface{}:
+				for k, val := range v {
+					values.Set(k, fmt.Sprintf("%v", val))
+				}
+			}
+		}
+
+		paramsObj.Set("append", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 2 {
+				values.Add(call.Arguments[0].String(), call.Arguments[1].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("delete", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 1 {
+				values.Del(call.Arguments[0].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("get", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return goja.Null()
+			}
+			if val := values.Get(call.Arguments[0].String()); val != "" {
+				return vm.ToValue(val)
+			}
+			return goja.Null()
+		})
+
+		paramsObj.Set("getAll", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]string{})
+			}
+			return vm.ToValue(values[call.Arguments[0].String()])
+		})
+
+		paramsObj.Set("has", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue(false)
+			}
+			return vm.ToValue(values.Has(call.Arguments[0].String()))
+		})
+
+		paramsObj.Set("set", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 2 {
+				values.Set(call.Arguments[0].String(), call.Arguments[1].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(values.Encode())
+		})
+
+		return nil
+	})
+}
+
+// registerJSONGlobal ensures JSON global is properly set up
+func (r *ExtensionRuntime) registerJSONGlobal(vm *goja.Runtime) {
+	// JSON is already built-in to Goja, but we can enhance it
+	// This ensures JSON.parse and JSON.stringify work as expected
+
+	// The built-in JSON object should already work, but let's verify
+	// and add any missing functionality if needed
+	jsonScript := `
+		if (typeof JSON === 'undefined') {
+			var JSON = {
+				parse: function(text) {
+					return utils.parseJSON(text);
+				},
+				stringify: function(value, replacer, space) {
+					return utils.stringifyJSON(value);
+				}
+			};
+		}
+	`
+	_, _ = vm.RunString(jsonScript)
+}

go_backend/extension_runtime_storage.go

@@ -0,0 +1,381 @@
+// Package gobackend provides Storage and Credentials API for extension runtime
+package gobackend
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Storage API ====================
+
+// getStoragePath returns the path to the extension's storage file
+func (r *ExtensionRuntime) getStoragePath() string {
+	return filepath.Join(r.dataDir, "storage.json")
+}
+
+// loadStorage loads the storage data from disk
+func (r *ExtensionRuntime) loadStorage() (map[string]interface{}, error) {
+	storagePath := r.getStoragePath()
+	data, err := os.ReadFile(storagePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	var storage map[string]interface{}
+	if err := json.Unmarshal(data, &storage); err != nil {
+		return nil, err
+	}
+
+	return storage, nil
+}
+
+// saveStorage saves the storage data to disk
+func (r *ExtensionRuntime) saveStorage(storage map[string]interface{}) error {
+	storagePath := r.getStoragePath()
+	data, err := json.MarshalIndent(storage, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(storagePath, data, 0644)
+}
+
+// storageGet retrieves a value from storage
+func (r *ExtensionRuntime) storageGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+
+	key := call.Arguments[0].String()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	value, exists := storage[key]
+	if !exists {
+		// Return default value if provided
+		if len(call.Arguments) > 1 {
+			return call.Arguments[1]
+		}
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(value)
+}
+
+// storageSet stores a value in storage
+func (r *ExtensionRuntime) storageSet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+	value := call.Arguments[1].Export()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	storage[key] = value
+
+	if err := r.saveStorage(storage); err != nil {
+		GoLog("[Extension:%s] Storage save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// storageRemove removes a value from storage
+func (r *ExtensionRuntime) storageRemove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	delete(storage, key)
+
+	if err := r.saveStorage(storage); err != nil {
+		GoLog("[Extension:%s] Storage save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// ==================== Credentials API (Encrypted Storage) ====================
+
+// getCredentialsPath returns the path to the extension's encrypted credentials file
+func (r *ExtensionRuntime) getCredentialsPath() string {
+	return filepath.Join(r.dataDir, ".credentials.enc")
+}
+
+// getSaltPath returns the path to the extension's encryption salt file
+func (r *ExtensionRuntime) getSaltPath() string {
+	return filepath.Join(r.dataDir, ".cred_salt")
+}
+
+// getOrCreateSalt gets existing salt or creates a new random one
+func (r *ExtensionRuntime) getOrCreateSalt() ([]byte, error) {
+	saltPath := r.getSaltPath()
+
+	// Try to read existing salt
+	salt, err := os.ReadFile(saltPath)
+	if err == nil && len(salt) == 32 {
+		return salt, nil
+	}
+
+	// Generate new random salt (32 bytes)
+	salt = make([]byte, 32)
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, fmt.Errorf("failed to generate salt: %w", err)
+	}
+
+	// Save salt to file
+	if err := os.WriteFile(saltPath, salt, 0600); err != nil {
+		return nil, fmt.Errorf("failed to save salt: %w", err)
+	}
+
+	return salt, nil
+}
+
+// getEncryptionKey derives an encryption key from extension ID + random salt
+func (r *ExtensionRuntime) getEncryptionKey() ([]byte, error) {
+	// Get or create per-installation random salt
+	salt, err := r.getOrCreateSalt()
+	if err != nil {
+		return nil, err
+	}
+
+	// Combine extension ID + random salt for key derivation
+	// This makes each installation unique, preventing mass decryption attacks
+	combined := append([]byte(r.extensionID), salt...)
+	hash := sha256.Sum256(combined)
+	return hash[:], nil
+}
+
+// loadCredentials loads and decrypts credentials from disk
+func (r *ExtensionRuntime) loadCredentials() (map[string]interface{}, error) {
+	credPath := r.getCredentialsPath()
+	data, err := os.ReadFile(credPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	// Decrypt the data
+	key, err := r.getEncryptionKey()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get encryption key: %w", err)
+	}
+	decrypted, err := decryptAES(data, key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt credentials: %w", err)
+	}
+
+	var creds map[string]interface{}
+	if err := json.Unmarshal(decrypted, &creds); err != nil {
+		return nil, err
+	}
+
+	return creds, nil
+}
+
+// saveCredentials encrypts and saves credentials to disk
+func (r *ExtensionRuntime) saveCredentials(creds map[string]interface{}) error {
+	data, err := json.Marshal(creds)
+	if err != nil {
+		return err
+	}
+
+	// Encrypt the data
+	key, err := r.getEncryptionKey()
+	if err != nil {
+		return fmt.Errorf("failed to get encryption key: %w", err)
+	}
+	encrypted, err := encryptAES(data, key)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt credentials: %w", err)
+	}
+
+	credPath := r.getCredentialsPath()
+	return os.WriteFile(credPath, encrypted, 0600) // Restrictive permissions
+}
+
+// credentialsStore stores an encrypted credential
+func (r *ExtensionRuntime) credentialsStore(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "key and value are required",
+		})
+	}
+
+	key := call.Arguments[0].String()
+	value := call.Arguments[1].Export()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	creds[key] = value
+
+	if err := r.saveCredentials(creds); err != nil {
+		GoLog("[Extension:%s] Credentials save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+	})
+}
+
+// credentialsGet retrieves a decrypted credential
+func (r *ExtensionRuntime) credentialsGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	value, exists := creds[key]
+	if !exists {
+		// Return default value if provided
+		if len(call.Arguments) > 1 {
+			return call.Arguments[1]
+		}
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(value)
+}
+
+// credentialsRemove removes a credential
+func (r *ExtensionRuntime) credentialsRemove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	delete(creds, key)
+
+	if err := r.saveCredentials(creds); err != nil {
+		GoLog("[Extension:%s] Credentials save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// credentialsHas checks if a credential exists
+func (r *ExtensionRuntime) credentialsHas(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		return r.vm.ToValue(false)
+	}
+
+	_, exists := creds[key]
+	return r.vm.ToValue(exists)
+}
+
+// ==================== Crypto Utilities ====================
+
+// encryptAES encrypts data using AES-GCM
+func encryptAES(plaintext []byte, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+	return ciphertext, nil
+}
+
+// decryptAES decrypts data using AES-GCM
+func decryptAES(ciphertext []byte, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonceSize := gcm.NonceSize()
+	if len(ciphertext) < nonceSize {
+		return nil, fmt.Errorf("ciphertext too short")
+	}
+
+	nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
+	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return plaintext, nil
+}

go_backend/extension_runtime_utils.go

@@ -0,0 +1,372 @@
+// Package gobackend provides Utility functions for extension runtime
+package gobackend
+
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Utility Functions ====================
+
+// base64Encode encodes a string to base64
+func (r *ExtensionRuntime) base64Encode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString([]byte(input)))
+}
+
+// base64Decode decodes a base64 string
+func (r *ExtensionRuntime) base64Decode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	decoded, err := base64.StdEncoding.DecodeString(input)
+	if err != nil {
+		return r.vm.ToValue("")
+	}
+	return r.vm.ToValue(string(decoded))
+}
+
+// md5Hash computes MD5 hash of a string
+func (r *ExtensionRuntime) md5Hash(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	hash := md5.Sum([]byte(input))
+	return r.vm.ToValue(hex.EncodeToString(hash[:]))
+}
+
+// sha256Hash computes SHA256 hash of a string
+func (r *ExtensionRuntime) sha256Hash(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	hash := sha256.Sum256([]byte(input))
+	return r.vm.ToValue(hex.EncodeToString(hash[:]))
+}
+
+// hmacSHA256 computes HMAC-SHA256 of a message with a key
+func (r *ExtensionRuntime) hmacSHA256(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue("")
+	}
+	message := call.Arguments[0].String()
+	key := call.Arguments[1].String()
+
+	mac := hmac.New(sha256.New, []byte(key))
+	mac.Write([]byte(message))
+	return r.vm.ToValue(hex.EncodeToString(mac.Sum(nil)))
+}
+
+// hmacSHA256Base64 computes HMAC-SHA256 and returns base64 encoded result
+func (r *ExtensionRuntime) hmacSHA256Base64(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue("")
+	}
+	message := call.Arguments[0].String()
+	key := call.Arguments[1].String()
+
+	mac := hmac.New(sha256.New, []byte(key))
+	mac.Write([]byte(message))
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString(mac.Sum(nil)))
+}
+
+// hmacSHA1 computes HMAC-SHA1 of a message with a key (for TOTP)
+// Arguments: message (string or array of bytes), key (string or array of bytes)
+// Returns: array of bytes (for TOTP dynamic truncation)
+func (r *ExtensionRuntime) hmacSHA1(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue([]byte{})
+	}
+
+	// Get key - can be string or array of bytes
+	var keyBytes []byte
+	keyArg := call.Arguments[0].Export()
+	switch k := keyArg.(type) {
+	case string:
+		keyBytes = []byte(k)
+	case []interface{}:
+		keyBytes = make([]byte, len(k))
+		for i, v := range k {
+			if num, ok := v.(int64); ok {
+				keyBytes[i] = byte(num)
+			} else if num, ok := v.(float64); ok {
+				keyBytes[i] = byte(int(num))
+			}
+		}
+	default:
+		return r.vm.ToValue([]byte{})
+	}
+
+	// Get message - can be string or array of bytes
+	var msgBytes []byte
+	msgArg := call.Arguments[1].Export()
+	switch m := msgArg.(type) {
+	case string:
+		msgBytes = []byte(m)
+	case []interface{}:
+		msgBytes = make([]byte, len(m))
+		for i, v := range m {
+			if num, ok := v.(int64); ok {
+				msgBytes[i] = byte(num)
+			} else if num, ok := v.(float64); ok {
+				msgBytes[i] = byte(int(num))
+			}
+		}
+	default:
+		return r.vm.ToValue([]byte{})
+	}
+
+	mac := hmac.New(sha1.New, keyBytes)
+	mac.Write(msgBytes)
+	result := mac.Sum(nil)
+
+	// Convert to array of numbers for JavaScript
+	jsArray := make([]interface{}, len(result))
+	for i, b := range result {
+		jsArray[i] = int(b)
+	}
+	return r.vm.ToValue(jsArray)
+}
+
+// parseJSON parses a JSON string
+func (r *ExtensionRuntime) parseJSON(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+	input := call.Arguments[0].String()
+
+	var result interface{}
+	if err := json.Unmarshal([]byte(input), &result); err != nil {
+		GoLog("[Extension:%s] JSON parse error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(result)
+}
+
+// stringifyJSON converts a value to JSON string
+func (r *ExtensionRuntime) stringifyJSON(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].Export()
+
+	data, err := json.Marshal(input)
+	if err != nil {
+		GoLog("[Extension:%s] JSON stringify error: %v\n", r.extensionID, err)
+		return r.vm.ToValue("")
+	}
+
+	return r.vm.ToValue(string(data))
+}
+
+// ==================== Crypto Utilities for Extensions ====================
+
+// cryptoEncrypt encrypts a string using AES-GCM (for extension use)
+func (r *ExtensionRuntime) cryptoEncrypt(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "plaintext and key are required",
+		})
+	}
+
+	plaintext := call.Arguments[0].String()
+	keyStr := call.Arguments[1].String()
+
+	// Derive 32-byte key from provided key string
+	keyHash := sha256.Sum256([]byte(keyStr))
+
+	encrypted, err := encryptAES([]byte(plaintext), keyHash[:])
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    base64.StdEncoding.EncodeToString(encrypted),
+	})
+}
+
+// cryptoDecrypt decrypts a string using AES-GCM (for extension use)
+func (r *ExtensionRuntime) cryptoDecrypt(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "ciphertext and key are required",
+		})
+	}
+
+	ciphertextB64 := call.Arguments[0].String()
+	keyStr := call.Arguments[1].String()
+
+	ciphertext, err := base64.StdEncoding.DecodeString(ciphertextB64)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "invalid base64 ciphertext",
+		})
+	}
+
+	// Derive 32-byte key from provided key string
+	keyHash := sha256.Sum256([]byte(keyStr))
+
+	decrypted, err := decryptAES(ciphertext, keyHash[:])
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    string(decrypted),
+	})
+}
+
+// cryptoGenerateKey generates a random encryption key
+func (r *ExtensionRuntime) cryptoGenerateKey(call goja.FunctionCall) goja.Value {
+	length := 32 // Default 256-bit key
+	if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+		if l, ok := call.Arguments[0].Export().(float64); ok {
+			length = int(l)
+		}
+	}
+
+	key := make([]byte, length)
+	if _, err := rand.Read(key); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"key":     base64.StdEncoding.EncodeToString(key),
+		"hex":     hex.EncodeToString(key),
+	})
+}
+
+// ==================== Logging Functions ====================
+
+func (r *ExtensionRuntime) logDebug(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:DEBUG] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logInfo(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:INFO] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logWarn(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:WARN] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logError(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:ERROR] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) formatLogArgs(args []goja.Value) string {
+	parts := make([]string, len(args))
+	for i, arg := range args {
+		parts[i] = fmt.Sprintf("%v", arg.Export())
+	}
+	return strings.Join(parts, " ")
+}
+
+// ==================== Go Backend Wrappers ====================
+
+func (r *ExtensionRuntime) sanitizeFilenameWrapper(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(sanitizeFilename(input))
+}
+
+// RegisterGoBackendAPIs adds more Go backend functions to the VM
+func (r *ExtensionRuntime) RegisterGoBackendAPIs(vm *goja.Runtime) {
+	gobackendObj := vm.Get("gobackend")
+	if gobackendObj == nil || goja.IsUndefined(gobackendObj) {
+		gobackendObj = vm.NewObject()
+		vm.Set("gobackend", gobackendObj)
+	}
+
+	obj := gobackendObj.(*goja.Object)
+
+	// Expose sanitizeFilename
+	obj.Set("sanitizeFilename", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 1 {
+			return vm.ToValue("")
+		}
+		return vm.ToValue(sanitizeFilename(call.Arguments[0].String()))
+	})
+
+	// Expose getAudioQuality
+	obj.Set("getAudioQuality", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 1 {
+			return vm.ToValue(map[string]interface{}{
+				"error": "file path is required",
+			})
+		}
+
+		filePath := call.Arguments[0].String()
+		quality, err := GetAudioQuality(filePath)
+		if err != nil {
+			return vm.ToValue(map[string]interface{}{
+				"error": err.Error(),
+			})
+		}
+
+		return vm.ToValue(map[string]interface{}{
+			"bitDepth":     quality.BitDepth,
+			"sampleRate":   quality.SampleRate,
+			"totalSamples": quality.TotalSamples,
+		})
+	})
+
+	// Expose buildFilename
+	obj.Set("buildFilename", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 2 {
+			return vm.ToValue("")
+		}
+
+		template := call.Arguments[0].String()
+		metadataObj := call.Arguments[1].Export()
+
+		metadata, ok := metadataObj.(map[string]interface{})
+		if !ok {
+			return vm.ToValue("")
+		}
+
+		return vm.ToValue(buildFilenameFromTemplate(template, metadata))
+	})
+}

go_backend/extension_settings.go

@@ -0,0 +1,221 @@
+// Package gobackend provides extension settings storage
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+// ExtensionSettingsStore manages settings for all extensions
+type ExtensionSettingsStore struct {
+	mu       sync.RWMutex
+	dataDir  string
+	settings map[string]map[string]interface{} // extensionID -> settings
+}
+
+// Global settings store
+var (
+	globalSettingsStore     *ExtensionSettingsStore
+	globalSettingsStoreOnce sync.Once
+)
+
+// GetExtensionSettingsStore returns the global settings store
+func GetExtensionSettingsStore() *ExtensionSettingsStore {
+	globalSettingsStoreOnce.Do(func() {
+		globalSettingsStore = &ExtensionSettingsStore{
+			settings: make(map[string]map[string]interface{}),
+		}
+	})
+	return globalSettingsStore
+}
+
+// SetDataDir sets the data directory for settings storage
+func (s *ExtensionSettingsStore) SetDataDir(dataDir string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.dataDir = dataDir
+	if err := os.MkdirAll(dataDir, 0755); err != nil {
+		return fmt.Errorf("failed to create settings directory: %w", err)
+	}
+
+	// Load all existing settings
+	return s.loadAllSettings()
+}
+
+// getSettingsPath returns the path to an extension's settings file
+func (s *ExtensionSettingsStore) getSettingsPath(extensionID string) string {
+	return filepath.Join(s.dataDir, extensionID, "settings.json")
+}
+
+// loadAllSettings loads settings for all extensions from disk
+func (s *ExtensionSettingsStore) loadAllSettings() error {
+	entries, err := os.ReadDir(s.dataDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			extensionID := entry.Name()
+			settings, err := s.loadSettings(extensionID)
+			if err != nil {
+				GoLog("[ExtensionSettings] Failed to load settings for %s: %v\n", extensionID, err)
+				continue
+			}
+			s.settings[extensionID] = settings
+		}
+	}
+
+	return nil
+}
+
+// loadSettings loads settings for a specific extension
+func (s *ExtensionSettingsStore) loadSettings(extensionID string) (map[string]interface{}, error) {
+	settingsPath := s.getSettingsPath(extensionID)
+	data, err := os.ReadFile(settingsPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	var settings map[string]interface{}
+	if err := json.Unmarshal(data, &settings); err != nil {
+		return nil, err
+	}
+
+	return settings, nil
+}
+
+// saveSettings saves settings for a specific extension
+func (s *ExtensionSettingsStore) saveSettings(extensionID string, settings map[string]interface{}) error {
+	settingsPath := s.getSettingsPath(extensionID)
+
+	// Create directory if needed
+	dir := filepath.Dir(settingsPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return err
+	}
+
+	data, err := json.MarshalIndent(settings, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(settingsPath, data, 0644)
+}
+
+// Get retrieves a setting value for an extension
+// Returns error if extension or key not found (gomobile compatible)
+func (s *ExtensionSettingsStore) Get(extensionID, key string) (interface{}, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return nil, fmt.Errorf("extension '%s' settings not found", extensionID)
+	}
+
+	value, exists := extSettings[key]
+	if !exists {
+		return nil, fmt.Errorf("setting '%s' not found for extension '%s'", key, extensionID)
+	}
+	return value, nil
+}
+
+// GetAll retrieves all settings for an extension
+func (s *ExtensionSettingsStore) GetAll(extensionID string) map[string]interface{} {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return make(map[string]interface{})
+	}
+
+	// Return a copy
+	result := make(map[string]interface{})
+	for k, v := range extSettings {
+		result[k] = v
+	}
+	return result
+}
+
+// Set stores a setting value for an extension
+func (s *ExtensionSettingsStore) Set(extensionID, key string, value interface{}) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.settings[extensionID]; !exists {
+		s.settings[extensionID] = make(map[string]interface{})
+	}
+
+	s.settings[extensionID][key] = value
+
+	// Persist to disk
+	return s.saveSettings(extensionID, s.settings[extensionID])
+}
+
+// SetAll stores all settings for an extension
+func (s *ExtensionSettingsStore) SetAll(extensionID string, settings map[string]interface{}) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.settings[extensionID] = settings
+
+	// Persist to disk
+	return s.saveSettings(extensionID, settings)
+}
+
+// Remove removes a setting for an extension
+func (s *ExtensionSettingsStore) Remove(extensionID, key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return nil
+	}
+
+	delete(extSettings, key)
+
+	// Persist to disk
+	return s.saveSettings(extensionID, extSettings)
+}
+
+// RemoveAll removes all settings for an extension
+func (s *ExtensionSettingsStore) RemoveAll(extensionID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.settings, extensionID)
+
+	// Remove settings file
+	settingsPath := s.getSettingsPath(extensionID)
+	if err := os.Remove(settingsPath); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	return nil
+}
+
+// GetAllExtensionSettings returns settings for all extensions as JSON
+func (s *ExtensionSettingsStore) GetAllExtensionSettingsJSON() (string, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	data, err := json.Marshal(s.settings)
+	if err != nil {
+		return "", err
+	}
+
+	return string(data), nil
+}

go_backend/extension_store.go

@@ -0,0 +1,453 @@
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+)
+
+// Extension categories
+const (
+	CategoryMetadata    = "metadata"
+	CategoryDownload    = "download"
+	CategoryUtility     = "utility"
+	CategoryLyrics      = "lyrics"
+	CategoryIntegration = "integration"
+)
+
+// StoreExtension represents an extension in the store
+type StoreExtension struct {
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	DisplayName   string   `json:"display_name,omitempty"`
+	Version       string   `json:"version"`
+	Author        string   `json:"author"`
+	Description   string   `json:"description"`
+	DownloadURL   string   `json:"download_url,omitempty"`
+	IconURL       string   `json:"icon_url,omitempty"`
+	Category      string   `json:"category"`
+	Tags          []string `json:"tags,omitempty"`
+	Downloads     int      `json:"downloads"`
+	UpdatedAt     string   `json:"updated_at"`
+	MinAppVersion string   `json:"min_app_version,omitempty"`
+	// Alternative camelCase fields (for flexibility)
+	DisplayNameAlt   string `json:"displayName,omitempty"`
+	DownloadURLAlt   string `json:"downloadUrl,omitempty"`
+	IconURLAlt       string `json:"iconUrl,omitempty"`
+	MinAppVersionAlt string `json:"minAppVersion,omitempty"`
+}
+
+// getDisplayName returns display name, falling back to name (private to avoid gomobile conflict)
+func (e *StoreExtension) getDisplayName() string {
+	if e.DisplayName != "" {
+		return e.DisplayName
+	}
+	if e.DisplayNameAlt != "" {
+		return e.DisplayNameAlt
+	}
+	return e.Name
+}
+
+// getDownloadURL returns download URL from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getDownloadURL() string {
+	if e.DownloadURL != "" {
+		return e.DownloadURL
+	}
+	return e.DownloadURLAlt
+}
+
+// getIconURL returns icon URL from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getIconURL() string {
+	if e.IconURL != "" {
+		return e.IconURL
+	}
+	return e.IconURLAlt
+}
+
+// getMinAppVersion returns min app version from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getMinAppVersion() string {
+	if e.MinAppVersion != "" {
+		return e.MinAppVersion
+	}
+	return e.MinAppVersionAlt
+}
+
+// StoreRegistry represents the extension registry
+type StoreRegistry struct {
+	Version    int              `json:"version"`
+	UpdatedAt  string           `json:"updated_at"`
+	Extensions []StoreExtension `json:"extensions"`
+}
+
+// StoreExtensionResponse is the normalized response sent to Flutter
+type StoreExtensionResponse struct {
+	ID               string   `json:"id"`
+	Name             string   `json:"name"`
+	DisplayName      string   `json:"display_name"`
+	Version          string   `json:"version"`
+	Author           string   `json:"author"`
+	Description      string   `json:"description"`
+	DownloadURL      string   `json:"download_url"`
+	IconURL          string   `json:"icon_url,omitempty"`
+	Category         string   `json:"category"`
+	Tags             []string `json:"tags,omitempty"`
+	Downloads        int      `json:"downloads"`
+	UpdatedAt        string   `json:"updated_at"`
+	MinAppVersion    string   `json:"min_app_version,omitempty"`
+	IsInstalled      bool     `json:"is_installed"`
+	InstalledVersion string   `json:"installed_version,omitempty"`
+	HasUpdate        bool     `json:"has_update"`
+}
+
+// ToResponse converts StoreExtension to normalized response
+func (e *StoreExtension) ToResponse() StoreExtensionResponse {
+	return StoreExtensionResponse{
+		ID:            e.ID,
+		Name:          e.Name,
+		DisplayName:   e.getDisplayName(),
+		Version:       e.Version,
+		Author:        e.Author,
+		Description:   e.Description,
+		DownloadURL:   e.getDownloadURL(),
+		IconURL:       e.getIconURL(),
+		Category:      e.Category,
+		Tags:          e.Tags,
+		Downloads:     e.Downloads,
+		UpdatedAt:     e.UpdatedAt,
+		MinAppVersion: e.getMinAppVersion(),
+	}
+}
+
+// ExtensionStore manages the extension store
+type ExtensionStore struct {
+	registryURL string
+	cacheDir    string
+	cache       *StoreRegistry
+	cacheMu     sync.RWMutex
+	cacheTime   time.Time
+	cacheTTL    time.Duration
+}
+
+var (
+	extensionStore   *ExtensionStore
+	extensionStoreMu sync.Mutex
+)
+
+const (
+	defaultRegistryURL = "https://raw.githubusercontent.com/zarzet/SpotiFLAC-Extension/main/registry.json"
+	cacheTTL           = 30 * time.Minute
+	cacheFileName      = "store_cache.json"
+)
+
+// InitExtensionStore initializes the extension store
+func InitExtensionStore(cacheDir string) *ExtensionStore {
+	extensionStoreMu.Lock()
+	defer extensionStoreMu.Unlock()
+
+	if extensionStore == nil {
+		extensionStore = &ExtensionStore{
+			registryURL: defaultRegistryURL,
+			cacheDir:    cacheDir,
+			cacheTTL:    cacheTTL,
+		}
+		// Try to load from disk cache
+		extensionStore.loadDiskCache()
+	}
+	return extensionStore
+}
+
+// GetExtensionStore returns the singleton store instance
+func GetExtensionStore() *ExtensionStore {
+	extensionStoreMu.Lock()
+	defer extensionStoreMu.Unlock()
+	return extensionStore
+}
+
+// loadDiskCache loads cached registry from disk
+func (s *ExtensionStore) loadDiskCache() {
+	if s.cacheDir == "" {
+		return
+	}
+
+	cachePath := filepath.Join(s.cacheDir, cacheFileName)
+	data, err := os.ReadFile(cachePath)
+	if err != nil {
+		return
+	}
+
+	var cacheData struct {
+		Registry  StoreRegistry `json:"registry"`
+		CacheTime int64         `json:"cache_time"`
+	}
+
+	if err := json.Unmarshal(data, &cacheData); err != nil {
+		return
+	}
+
+	s.cache = &cacheData.Registry
+	s.cacheTime = time.Unix(cacheData.CacheTime, 0)
+	LogDebug("ExtensionStore", "Loaded %d extensions from disk cache", len(s.cache.Extensions))
+}
+
+// saveDiskCache saves registry to disk cache
+func (s *ExtensionStore) saveDiskCache() {
+	if s.cacheDir == "" || s.cache == nil {
+		return
+	}
+
+	cacheData := struct {
+		Registry  StoreRegistry `json:"registry"`
+		CacheTime int64         `json:"cache_time"`
+	}{
+		Registry:  *s.cache,
+		CacheTime: s.cacheTime.Unix(),
+	}
+
+	data, err := json.Marshal(cacheData)
+	if err != nil {
+		return
+	}
+
+	cachePath := filepath.Join(s.cacheDir, cacheFileName)
+	os.WriteFile(cachePath, data, 0644)
+}
+
+// FetchRegistry fetches the extension registry from GitHub
+func (s *ExtensionStore) FetchRegistry(forceRefresh bool) (*StoreRegistry, error) {
+	s.cacheMu.Lock()
+	defer s.cacheMu.Unlock()
+
+	// Return cached if valid and not forcing refresh
+	if !forceRefresh && s.cache != nil && time.Since(s.cacheTime) < s.cacheTTL {
+		LogDebug("ExtensionStore", "Using cached registry (%d extensions)", len(s.cache.Extensions))
+		return s.cache, nil
+	}
+
+	LogInfo("ExtensionStore", "Fetching registry from %s", s.registryURL)
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Get(s.registryURL)
+	if err != nil {
+		// Return cached data if available on network error
+		if s.cache != nil {
+			LogWarn("ExtensionStore", "Network error, using cached registry: %v", err)
+			return s.cache, nil
+		}
+		return nil, fmt.Errorf("failed to fetch registry: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if s.cache != nil {
+			LogWarn("ExtensionStore", "HTTP %d, using cached registry", resp.StatusCode)
+			return s.cache, nil
+		}
+		return nil, fmt.Errorf("registry returned HTTP %d", resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read registry: %w", err)
+	}
+
+	var registry StoreRegistry
+	if err := json.Unmarshal(body, &registry); err != nil {
+		return nil, fmt.Errorf("failed to parse registry: %w", err)
+	}
+
+	s.cache = &registry
+	s.cacheTime = time.Now()
+	s.saveDiskCache()
+
+	LogInfo("ExtensionStore", "Fetched %d extensions from registry", len(registry.Extensions))
+	return &registry, nil
+}
+
+// GetExtensionsWithStatus returns extensions with installation status
+func (s *ExtensionStore) GetExtensionsWithStatus() ([]StoreExtensionResponse, error) {
+	registry, err := s.FetchRegistry(false)
+	if err != nil {
+		return nil, err
+	}
+
+	manager := GetExtensionManager()
+	installed := make(map[string]string) // id -> version
+
+	if manager != nil {
+		for _, ext := range manager.GetAllExtensions() {
+			installed[ext.ID] = ext.Manifest.Version
+		}
+	}
+
+	result := make([]StoreExtensionResponse, len(registry.Extensions))
+	for i, ext := range registry.Extensions {
+		resp := ext.ToResponse()
+
+		if installedVersion, ok := installed[ext.ID]; ok {
+			resp.IsInstalled = true
+			resp.InstalledVersion = installedVersion
+			resp.HasUpdate = compareVersions(ext.Version, installedVersion) > 0
+		}
+
+		result[i] = resp
+	}
+
+	return result, nil
+}
+
+// DownloadExtension downloads an extension package to the specified path
+func (s *ExtensionStore) DownloadExtension(extensionID string, destPath string) error {
+	registry, err := s.FetchRegistry(false)
+	if err != nil {
+		return err
+	}
+
+	var ext *StoreExtension
+	for _, e := range registry.Extensions {
+		if e.ID == extensionID {
+			ext = &e
+			break
+		}
+	}
+
+	if ext == nil {
+		return fmt.Errorf("extension %s not found in store", extensionID)
+	}
+
+	LogInfo("ExtensionStore", "Downloading %s from %s", ext.getDisplayName(), ext.getDownloadURL())
+
+	client := &http.Client{Timeout: 5 * time.Minute}
+	resp, err := client.Get(ext.getDownloadURL())
+	if err != nil {
+		return fmt.Errorf("failed to download: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download returned HTTP %d", resp.StatusCode)
+	}
+
+	// Create destination file
+	out, err := os.Create(destPath)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, resp.Body)
+	if err != nil {
+		os.Remove(destPath)
+		return fmt.Errorf("failed to write file: %w", err)
+	}
+
+	LogInfo("ExtensionStore", "Downloaded %s to %s", ext.getDisplayName(), destPath)
+	return nil
+}
+
+// GetCategories returns all available categories
+func (s *ExtensionStore) GetCategories() []string {
+	return []string{
+		CategoryMetadata,
+		CategoryDownload,
+		CategoryUtility,
+		CategoryLyrics,
+		CategoryIntegration,
+	}
+}
+
+// SearchExtensions searches extensions by query
+func (s *ExtensionStore) SearchExtensions(query string, category string) ([]StoreExtensionResponse, error) {
+	extensions, err := s.GetExtensionsWithStatus()
+	if err != nil {
+		return nil, err
+	}
+
+	if query == "" && category == "" {
+		return extensions, nil
+	}
+
+	var result []StoreExtensionResponse
+	queryLower := toLower(query)
+
+	for _, ext := range extensions {
+		// Filter by category
+		if category != "" && ext.Category != category {
+			continue
+		}
+
+		// Filter by query
+		if query != "" {
+			if !containsIgnoreCase(ext.Name, queryLower) &&
+				!containsIgnoreCase(ext.DisplayName, queryLower) &&
+				!containsIgnoreCase(ext.Description, queryLower) &&
+				!containsIgnoreCase(ext.Author, queryLower) {
+				// Check tags
+				found := false
+				for _, tag := range ext.Tags {
+					if containsIgnoreCase(tag, queryLower) {
+						found = true
+						break
+					}
+				}
+				if !found {
+					continue
+				}
+			}
+		}
+
+		result = append(result, ext)
+	}
+
+	return result, nil
+}
+
+// ClearCache clears the in-memory and disk cache
+func (s *ExtensionStore) ClearCache() {
+	s.cacheMu.Lock()
+	defer s.cacheMu.Unlock()
+
+	s.cache = nil
+	s.cacheTime = time.Time{}
+
+	if s.cacheDir != "" {
+		cachePath := filepath.Join(s.cacheDir, cacheFileName)
+		os.Remove(cachePath)
+	}
+
+	LogInfo("ExtensionStore", "Cache cleared")
+}
+
+// Helper: case-insensitive contains
+func containsIgnoreCase(s, substr string) bool {
+	return containsStr(toLower(s), substr)
+}
+
+func toLower(s string) string {
+	result := make([]byte, len(s))
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if c >= 'A' && c <= 'Z' {
+			c += 'a' - 'A'
+		}
+		result[i] = c
+	}
+	return string(result)
+}
+
+func containsStr(s, substr string) bool {
+	return len(substr) == 0 || (len(s) >= len(substr) && findSubstring(s, substr) >= 0)
+}
+
+func findSubstring(s, substr string) int {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return i
+		}
+	}
+	return -1
+}

go_backend/extension_test.go

@@ -0,0 +1,329 @@
+package gobackend
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/dop251/goja"
+)
+
+func TestParseManifest_Valid(t *testing.T) {
+	validManifest := `{
+		"name": "test-provider",
+		"displayName": "Test Provider",
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension",
+		"type": ["metadata_provider"],
+		"permissions": {
+			"network": ["api.test.com"],
+			"storage": true
+		}
+	}`
+
+	manifest, err := ParseManifest([]byte(validManifest))
+	if err != nil {
+		t.Fatalf("Expected valid manifest to parse, got error: %v", err)
+	}
+
+	if manifest.Name != "test-provider" {
+		t.Errorf("Expected name 'test-provider', got '%s'", manifest.Name)
+	}
+
+	if manifest.Version != "1.0.0" {
+		t.Errorf("Expected version '1.0.0', got '%s'", manifest.Version)
+	}
+
+	if !manifest.IsMetadataProvider() {
+		t.Error("Expected IsMetadataProvider() to return true")
+	}
+
+	if manifest.IsDownloadProvider() {
+		t.Error("Expected IsDownloadProvider() to return false")
+	}
+}
+
+func TestParseManifest_MissingName(t *testing.T) {
+	invalidManifest := `{
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension",
+		"type": ["metadata_provider"]
+	}`
+
+	_, err := ParseManifest([]byte(invalidManifest))
+	if err == nil {
+		t.Fatal("Expected error for missing name")
+	}
+}
+
+func TestParseManifest_MissingType(t *testing.T) {
+	invalidManifest := `{
+		"name": "test-provider",
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension"
+	}`
+
+	_, err := ParseManifest([]byte(invalidManifest))
+	if err == nil {
+		t.Fatal("Expected error for missing type")
+	}
+}
+
+func TestIsDomainAllowed(t *testing.T) {
+	manifest := &ExtensionManifest{
+		Permissions: ExtensionPermissions{
+			Network: []string{"api.test.com", "*.example.com"},
+		},
+	}
+
+	tests := []struct {
+		domain   string
+		expected bool
+	}{
+		{"api.test.com", true},
+		{"api.example.com", true},
+		{"sub.example.com", true},
+		{"notallowed.com", false},
+		{"test.com", false},
+	}
+
+	for _, tt := range tests {
+		result := manifest.IsDomainAllowed(tt.domain)
+		if result != tt.expected {
+			t.Errorf("IsDomainAllowed(%s) = %v, expected %v", tt.domain, result, tt.expected)
+		}
+	}
+}
+
+func TestExtensionRuntime_NetworkSandbox(t *testing.T) {
+	// Create a mock extension with limited network permissions
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				Network: []string{"api.allowed.com", "*.wildcard.com"},
+			},
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test allowed domains
+	if err := runtime.validateDomain("https://api.allowed.com/path"); err != nil {
+		t.Errorf("Expected api.allowed.com to be allowed, got error: %v", err)
+	}
+
+	if err := runtime.validateDomain("https://sub.wildcard.com/path"); err != nil {
+		t.Errorf("Expected sub.wildcard.com to be allowed (wildcard), got error: %v", err)
+	}
+
+	// Test blocked domains
+	if err := runtime.validateDomain("https://blocked.com/path"); err == nil {
+		t.Error("Expected blocked.com to be denied")
+	}
+
+	if err := runtime.validateDomain("https://notallowed.com/path"); err == nil {
+		t.Error("Expected notallowed.com to be denied")
+	}
+}
+
+func TestExtensionRuntime_FileSandbox(t *testing.T) {
+	tempDir := t.TempDir()
+
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				File: true, // Enable file permission for test
+			},
+		},
+		DataDir: tempDir,
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test valid path within sandbox
+	validPath, err := runtime.validatePath("test.txt")
+	if err != nil {
+		t.Errorf("Expected relative path to be valid, got error: %v", err)
+	}
+	if validPath == "" {
+		t.Error("Expected non-empty path")
+	}
+
+	// Test path traversal attack
+	_, err = runtime.validatePath("../../../etc/passwd")
+	if err == nil {
+		t.Error("Expected path traversal to be blocked")
+	}
+
+	// Test nested path within sandbox (should be allowed)
+	nestedPath, err := runtime.validatePath("subdir/file.txt")
+	if err != nil {
+		t.Errorf("Expected nested path to be valid, got error: %v", err)
+	}
+	if nestedPath == "" {
+		t.Error("Expected non-empty nested path")
+	}
+
+	// Test absolute path should be blocked (security fix)
+	// Use platform-appropriate absolute path
+	var absPath string
+	if filepath.IsAbs("C:\\Windows\\System32") {
+		absPath = "C:\\Windows\\System32\\test.txt" // Windows
+	} else {
+		absPath = "/etc/passwd" // Unix
+	}
+	_, err = runtime.validatePath(absPath)
+	if err == nil {
+		t.Error("Expected absolute path to be blocked")
+	}
+
+	// Test that extension without file permission is blocked
+	extNoFile := &LoadedExtension{
+		ID: "test-ext-no-file",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext-no-file",
+			Permissions: ExtensionPermissions{
+				File: false, // No file permission
+			},
+		},
+		DataDir: tempDir,
+	}
+	runtimeNoFile := NewExtensionRuntime(extNoFile)
+	_, err = runtimeNoFile.validatePath("test.txt")
+	if err == nil {
+		t.Error("Expected file access to be denied without file permission")
+	}
+}
+
+func TestExtensionRuntime_UtilityFunctions(t *testing.T) {
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+	vm := goja.New()
+	runtime.RegisterAPIs(vm)
+
+	// Test base64 encode/decode
+	result, err := vm.RunString(`utils.base64Encode("hello")`)
+	if err != nil {
+		t.Fatalf("base64Encode failed: %v", err)
+	}
+	if result.String() != "aGVsbG8=" {
+		t.Errorf("Expected 'aGVsbG8=', got '%s'", result.String())
+	}
+
+	result, err = vm.RunString(`utils.base64Decode("aGVsbG8=")`)
+	if err != nil {
+		t.Fatalf("base64Decode failed: %v", err)
+	}
+	if result.String() != "hello" {
+		t.Errorf("Expected 'hello', got '%s'", result.String())
+	}
+
+	// Test MD5
+	result, err = vm.RunString(`utils.md5("hello")`)
+	if err != nil {
+		t.Fatalf("md5 failed: %v", err)
+	}
+	if result.String() != "5d41402abc4b2a76b9719d911017c592" {
+		t.Errorf("Expected '5d41402abc4b2a76b9719d911017c592', got '%s'", result.String())
+	}
+
+	// Test JSON parse/stringify
+	result, err = vm.RunString(`utils.stringifyJSON({name: "test", value: 123})`)
+	if err != nil {
+		t.Fatalf("stringifyJSON failed: %v", err)
+	}
+	// JSON output may vary in order, just check it's valid
+	if result.String() == "" {
+		t.Error("Expected non-empty JSON string")
+	}
+}
+
+func TestExtensionRuntime_SSRFProtection(t *testing.T) {
+	// Create extension with limited network permissions
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				Network: []string{"api.example.com"},
+			},
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test that private IPs are blocked (SSRF protection)
+	privateIPs := []string{
+		"http://localhost/admin",
+		"http://127.0.0.1/admin",
+		"http://192.168.1.1/admin",
+		"http://10.0.0.1/admin",
+		"http://172.16.0.1/admin",
+		"http://169.254.169.254/latest/meta-data/", // AWS metadata
+		"http://router.local/admin",
+	}
+
+	for _, url := range privateIPs {
+		err := runtime.validateDomain(url)
+		if err == nil {
+			t.Errorf("Expected private IP/host '%s' to be blocked", url)
+		}
+	}
+
+	// Test that allowed public domain still works
+	if err := runtime.validateDomain("https://api.example.com/path"); err != nil {
+		t.Errorf("Expected api.example.com to be allowed, got error: %v", err)
+	}
+}
+
+func TestIsPrivateIP(t *testing.T) {
+	tests := []struct {
+		host     string
+		expected bool
+	}{
+		// Private IPs should be blocked
+		{"localhost", true},
+		{"127.0.0.1", true},
+		{"127.0.0.2", true},
+		{"10.0.0.1", true},
+		{"10.255.255.255", true},
+		{"172.16.0.1", true},
+		{"172.31.255.255", true},
+		{"192.168.0.1", true},
+		{"192.168.255.255", true},
+		{"169.254.169.254", true}, // AWS metadata
+		{"router.local", true},
+		{"mydevice.local", true},
+
+		// Public IPs should be allowed
+		{"8.8.8.8", false},
+		{"1.1.1.1", false},
+		{"api.example.com", false},
+		{"google.com", false},
+		{"172.15.0.1", false},  // Just outside 172.16-31 range
+		{"172.32.0.1", false},  // Just outside 172.16-31 range
+		{"192.167.0.1", false}, // Not 192.168.x.x
+	}
+
+	for _, tt := range tests {
+		result := isPrivateIP(tt.host)
+		if result != tt.expected {
+			t.Errorf("isPrivateIP(%s) = %v, expected %v", tt.host, result, tt.expected)
+		}
+	}
+}

go_backend/extension_timeout.go

@@ -0,0 +1,118 @@
+// Package gobackend provides timeout execution for extension JS code
+package gobackend
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// JSExecutionError represents an error during JS execution
+type JSExecutionError struct {
+	Message   string
+	IsTimeout bool
+}
+
+func (e *JSExecutionError) Error() string {
+	return e.Message
+}
+
+// RunWithTimeout executes JavaScript code with a timeout
+// Returns the result value and any error (including timeout)
+func RunWithTimeout(vm *goja.Runtime, script string, timeout time.Duration) (goja.Value, error) {
+	if timeout <= 0 {
+		timeout = DefaultJSTimeout
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	// Channel to receive result
+	type result struct {
+		value goja.Value
+		err   error
+	}
+	resultCh := make(chan result, 1)
+
+	// Track if we've interrupted
+	var interrupted bool
+	var interruptMu sync.Mutex
+
+	// Run script in goroutine
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				// Check if this was our interrupt
+				interruptMu.Lock()
+				wasInterrupted := interrupted
+				interruptMu.Unlock()
+
+				if wasInterrupted {
+					resultCh <- result{nil, &JSExecutionError{
+						Message:   "execution timeout exceeded",
+						IsTimeout: true,
+					}}
+				} else {
+					resultCh <- result{nil, fmt.Errorf("panic during execution: %v", r)}
+				}
+			}
+		}()
+
+		val, err := vm.RunString(script)
+		resultCh <- result{val, err}
+	}()
+
+	// Wait for result or timeout
+	select {
+	case res := <-resultCh:
+		return res.value, res.err
+	case <-ctx.Done():
+		// Timeout - interrupt the VM
+		interruptMu.Lock()
+		interrupted = true
+		interruptMu.Unlock()
+
+		vm.Interrupt("execution timeout")
+
+		// Wait a bit for the goroutine to finish
+		select {
+		case res := <-resultCh:
+			// If we got a result after interrupt, it might be the timeout error
+			if res.err != nil {
+				return nil, res.err
+			}
+			return nil, &JSExecutionError{
+				Message:   "execution timeout exceeded",
+				IsTimeout: true,
+			}
+		case <-time.After(1 * time.Second):
+			// Force return timeout error
+			return nil, &JSExecutionError{
+				Message:   "execution timeout exceeded (force)",
+				IsTimeout: true,
+			}
+		}
+	}
+}
+
+// RunWithTimeoutAndRecover runs JS with timeout and clears interrupt state after
+// This should be used when you want to continue using the VM after a timeout
+func RunWithTimeoutAndRecover(vm *goja.Runtime, script string, timeout time.Duration) (goja.Value, error) {
+	result, err := RunWithTimeout(vm, script, timeout)
+
+	// Clear any interrupt state so VM can be reused
+	vm.ClearInterrupt()
+
+	return result, err
+}
+
+// IsTimeoutError checks if an error is a timeout error
+func IsTimeoutError(err error) bool {
+	if jsErr, ok := err.(*JSExecutionError); ok {
+		return jsErr.IsTimeout
+	}
+	return false
+}

go_backend/filename.go

@@ -11,23 +11,18 @@ var invalidChars = regexp.MustCompile(`[<>:"/\\|?*\x00-\x1f]`)
 
 // sanitizeFilename removes invalid characters from filename
 func sanitizeFilename(filename string) string {
-	// Replace invalid characters with underscore
 	sanitized := invalidChars.ReplaceAllString(filename, "_")
 	
-	// Remove leading/trailing spaces and dots
 	sanitized = strings.TrimSpace(sanitized)
 	sanitized = strings.Trim(sanitized, ".")
 	
-	// Collapse multiple underscores
 	multiUnderscore := regexp.MustCompile(`_+`)
 	sanitized = multiUnderscore.ReplaceAllString(sanitized, "_")
 	
-	// Limit length (Android has 255 byte limit for filenames)
 	if len(sanitized) > 200 {
 		sanitized = sanitized[:200]
 	}
 	
-	// Ensure not empty
 	if sanitized == "" {
 		sanitized = "untitled"
 	}
@@ -43,7 +38,6 @@ func buildFilenameFromTemplate(template string, metadata map[string]interface{})
 	
 	result := template
 	
-	// Replace placeholders
 	placeholders := map[string]string{
 		"{title}":  getString(metadata, "title"),
 		"{artist}": getString(metadata, "artist"),
@@ -63,7 +57,6 @@ func buildFilenameFromTemplate(template string, metadata map[string]interface{})
 func getString(m map[string]interface{}, key string) string {
 	if v, ok := m[key]; ok {
 		if s, ok := v.(string); ok {
-			// Trim leading/trailing whitespace to prevent filename issues
 			return strings.TrimSpace(s)
 		}
 	}

go_backend/go.mod

@@ -5,14 +5,19 @@ go 1.24.0
 toolchain go1.24.5
 
 require (
+	github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3
 	github.com/go-flac/flacpicture v0.3.0
 	github.com/go-flac/flacvorbis v0.2.0
 	github.com/go-flac/go-flac v1.0.0
 )
 
 require (
+	github.com/dlclark/regexp2 v1.11.4 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
+	github.com/google/pprof v0.0.0-20230207041349-798e818bf904 // indirect
 	golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 // indirect
 	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/text v0.3.8 // indirect
 	golang.org/x/tools v0.40.0 // indirect
 )

go_backend/go.sum

@@ -1,14 +1,28 @@
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
+github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3 h1:bVp3yUzvSAJzu9GqID+Z96P+eu5TKnIMJSV4QaZMauM=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
 github.com/go-flac/flacpicture v0.3.0 h1:LkmTxzFLIynwfhHiZsX0s8xcr3/u33MzvV89u+zOT8I=
 github.com/go-flac/flacpicture v0.3.0/go.mod h1:DPbrzVYQ3fJcvSgLFp9HXIrEQEdfdk/+m0nQCzwodZI=
 github.com/go-flac/flacvorbis v0.2.0 h1:KH0xjpkNTXFER4cszH4zeJxYcrHbUobz/RticWGOESs=
 github.com/go-flac/flacvorbis v0.2.0/go.mod h1:uIysHOtuU7OLGoCRG92bvnkg7QEqHx19qKRV6K1pBrI=
 github.com/go-flac/go-flac v1.0.0 h1:6qI9XOVLcO50xpzm3nXvO31BgDgHhnr/p/rER/K/doY=
 github.com/go-flac/go-flac v1.0.0/go.mod h1:WnZhcpmq4u1UdZMNn9LYSoASpWOCMOoxXxcWEHSzkW8=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/google/pprof v0.0.0-20230207041349-798e818bf904 h1:4/hN5RUoecvl+RmJRE2YxKWtnnQls6rQjjW5oV7qg2U=
+github.com/google/pprof v0.0.0-20230207041349-798e818bf904/go.mod h1:uglQLonpP8qtYCYyzA+8c/9qtqgA3qsXGYqCPKARAFg=
 golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 h1:Cr6kbEvA6nqvdHynE4CtVKlqpZB9dS1Jva/6IsHA19g=
 golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294/go.mod h1:RdZ+3sb4CVgpCFnzv+I4haEpwqFfsfzlLHs3L7ok+e0=
 golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
 golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
 golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

go_backend/httputil.go

@@ -1,12 +1,17 @@
 package gobackend
 
 import (
+	"crypto/tls"
+	"errors"
 	"fmt"
 	"io"
 	"math/rand"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
+	"syscall"
 	"time"
 )
 
@@ -15,14 +20,12 @@ import (
 // getRandomUserAgent generates a random Windows Chrome User-Agent string
 // Uses same format as PC version (referensi/backend/spotify_metadata.go) for better API compatibility
 func getRandomUserAgent() string {
-	// Windows 10/11 Chrome format - same as PC version for maximum compatibility
-	// Some APIs may block mobile User-Agents, so we use desktop format
-	winMajor := rand.Intn(2) + 10  // Windows 10 or 11
-	
-	chromeVersion := rand.Intn(25) + 100 // Chrome 100-124
-	chromeBuild := rand.Intn(1500) + 3000 // Build 3000-4500
-	chromePatch := rand.Intn(65) + 60 // Patch 60-125
-	
+	winMajor := rand.Intn(2) + 10
+
+	chromeVersion := rand.Intn(25) + 100
+	chromeBuild := rand.Intn(1500) + 3000
+	chromePatch := rand.Intn(65) + 60
+
 	return fmt.Sprintf(
 		"Mozilla/5.0 (Windows NT %d.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/537.36",
 		winMajor,
@@ -34,50 +37,48 @@ func getRandomUserAgent() string {
 
 // getRandomMacUserAgent generates a random Mac Chrome User-Agent string
 // Alternative format matching referensi/backend/spotify_metadata.go exactly
-func getRandomMacUserAgent() string {
-	macMajor := rand.Intn(4) + 11  // macOS 11-14
-	macMinor := rand.Intn(5) + 4   // Minor 4-8
-	webkitMajor := rand.Intn(7) + 530
-	webkitMinor := rand.Intn(7) + 30
-	chromeMajor := rand.Intn(25) + 80
-	chromeBuild := rand.Intn(1500) + 3000
-	chromePatch := rand.Intn(65) + 60
-	safariMajor := rand.Intn(7) + 530
-	safariMinor := rand.Intn(6) + 30
-
-	return fmt.Sprintf(
-		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_%d_%d) AppleWebKit/%d.%d (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/%d.%d",
-		macMajor,
-		macMinor,
-		webkitMajor,
-		webkitMinor,
-		chromeMajor,
-		chromeBuild,
-		chromePatch,
-		safariMajor,
-		safariMinor,
-	)
-}
+// func getRandomMacUserAgent() string {
+// 	macMajor := rand.Intn(4) + 11 // macOS 11-14
+// 	macMinor := rand.Intn(5) + 4  // Minor 4-8
+// 	webkitMajor := rand.Intn(7) + 530
+// 	webkitMinor := rand.Intn(7) + 30
+// 	chromeMajor := rand.Intn(25) + 80
+// 	chromeBuild := rand.Intn(1500) + 3000
+// 	chromePatch := rand.Intn(65) + 60
+// 	safariMajor := rand.Intn(7) + 530
+// 	safariMinor := rand.Intn(6) + 30
+//
+// 	return fmt.Sprintf(
+// 		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_%d_%d) AppleWebKit/%d.%d (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/%d.%d",
+// 		macMajor,
+// 		macMinor,
+// 		webkitMajor,
+// 		webkitMinor,
+// 		chromeMajor,
+// 		chromeBuild,
+// 		chromePatch,
+// 		safariMajor,
+// 		safariMinor,
+// 	)
+// }
 
 // getRandomDesktopUserAgent randomly picks between Windows and Mac User-Agent
-func getRandomDesktopUserAgent() string {
-	if rand.Intn(2) == 0 {
-		return getRandomUserAgent() // Windows
-	}
-	return getRandomMacUserAgent() // Mac
-}
+// func getRandomDesktopUserAgent() string {
+// 	if rand.Intn(2) == 0 {
+// 		return getRandomUserAgent() // Windows
+// 	}
+// 	return getRandomMacUserAgent() // Mac
+// }
 
-// Default timeout values
 const (
-	DefaultTimeout     = 60 * time.Second  // Default HTTP timeout
-	DownloadTimeout    = 120 * time.Second // Timeout for file downloads
-	SongLinkTimeout    = 30 * time.Second  // Timeout for SongLink API
-	DefaultMaxRetries  = 3                 // Default retry count
-	DefaultRetryDelay  = 1 * time.Second   // Initial retry delay
+	DefaultTimeout    = 60 * time.Second
+	DownloadTimeout   = 120 * time.Second
+	SongLinkTimeout   = 30 * time.Second
+	DefaultMaxRetries = 3
+	DefaultRetryDelay = 1 * time.Second
 )
 
 // Shared transport with connection pooling to prevent TCP exhaustion
-// Optimized for large file downloads (FLAC ~30-50MB)
 var sharedTransport = &http.Transport{
 	DialContext: (&net.Dialer{
 		Timeout:   30 * time.Second,
@@ -89,27 +90,24 @@ var sharedTransport = &http.Transport{
 	IdleConnTimeout:       90 * time.Second,
 	TLSHandshakeTimeout:   10 * time.Second,
 	ExpectContinueTimeout: 1 * time.Second,
-	DisableKeepAlives:     false, // Enable keep-alives for connection reuse
+	DisableKeepAlives:     false,
 	ForceAttemptHTTP2:     true,
-	WriteBufferSize:       64 * 1024,  // 64KB write buffer
-	ReadBufferSize:        64 * 1024,  // 64KB read buffer
-	DisableCompression:    true,       // FLAC is already compressed
+	WriteBufferSize:       64 * 1024,
+	ReadBufferSize:        64 * 1024,
+	DisableCompression:    true,
 }
 
-// Shared HTTP client for general requests (reuses connections)
 var sharedClient = &http.Client{
 	Transport: sharedTransport,
 	Timeout:   DefaultTimeout,
 }
 
-// Shared HTTP client for downloads (longer timeout, reuses connections)
 var downloadClient = &http.Client{
 	Transport: sharedTransport,
 	Timeout:   DownloadTimeout,
 }
 
 // NewHTTPClientWithTimeout creates an HTTP client with specified timeout
-// Uses shared transport for connection reuse
 func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client {
 	return &http.Client{
 		Transport: sharedTransport,
@@ -117,26 +115,28 @@ func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client {
 	}
 }
 
-// GetSharedClient returns the shared HTTP client for general requests
 func GetSharedClient() *http.Client {
 	return sharedClient
 }
 
-// GetDownloadClient returns the shared HTTP client for downloads
 func GetDownloadClient() *http.Client {
 	return downloadClient
 }
 
 // CloseIdleConnections closes idle connections in the shared transport
-// Call this periodically during large batch downloads to prevent connection buildup
 func CloseIdleConnections() {
 	sharedTransport.CloseIdleConnections()
 }
 
 // DoRequestWithUserAgent executes an HTTP request with a random User-Agent header
+// Also checks for ISP blocking on errors
 func DoRequestWithUserAgent(client *http.Client, req *http.Request) (*http.Response, error) {
 	req.Header.Set("User-Agent", getRandomUserAgent())
-	return client.Do(req)
+	resp, err := client.Do(req)
+	if err != nil {
+		CheckAndLogISPBlocking(err, req.URL.String(), "HTTP")
+	}
+	return resp, err
 }
 
 // RetryConfig holds configuration for retry logic
@@ -159,9 +159,11 @@ func DefaultRetryConfig() RetryConfig {
 
 // DoRequestWithRetry executes an HTTP request with retry logic and exponential backoff
 // Handles 429 (Too Many Requests) responses with Retry-After header
+// Also detects and logs ISP blocking
 func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConfig) (*http.Response, error) {
 	var lastErr error
 	delay := config.InitialDelay
+	requestURL := req.URL.String()
 
 	for attempt := 0; attempt <= config.MaxRetries; attempt++ {
 		// Clone request for retry (body needs to be re-readable)
@@ -171,7 +173,16 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 		resp, err := client.Do(reqCopy)
 		if err != nil {
 			lastErr = err
+
+			// Check for ISP blocking on network errors
+			if CheckAndLogISPBlocking(err, requestURL, "HTTP") {
+				// Don't retry if ISP blocking is detected - it won't help
+				return nil, WrapErrorWithISPCheck(err, requestURL, "HTTP")
+			}
+
 			if attempt < config.MaxRetries {
+				GoLog("[HTTP] Request failed (attempt %d/%d): %v, retrying in %v...\n",
+					attempt+1, config.MaxRetries+1, err, delay)
 				time.Sleep(delay)
 				delay = calculateNextDelay(delay, config)
 			}
@@ -192,17 +203,43 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 			}
 			lastErr = fmt.Errorf("rate limited (429)")
 			if attempt < config.MaxRetries {
+				GoLog("[HTTP] Rate limited, waiting %v before retry...\n", delay)
 				time.Sleep(delay)
 				delay = calculateNextDelay(delay, config)
 			}
 			continue
 		}
 
+		// Check for ISP blocking via HTTP status codes
+		// Some ISPs return 403 or 451 when blocking content
+		if resp.StatusCode == 403 || resp.StatusCode == 451 {
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			bodyStr := strings.ToLower(string(body))
+
+			// Check if response looks like ISP blocking page
+			ispBlockingIndicators := []string{
+				"blocked", "forbidden", "access denied", "not available in your",
+				"restricted", "censored", "unavailable for legal", "blocked by",
+			}
+
+			for _, indicator := range ispBlockingIndicators {
+				if strings.Contains(bodyStr, indicator) {
+					LogError("HTTP", "ISP BLOCKING DETECTED via HTTP %d response", resp.StatusCode)
+					LogError("HTTP", "Domain: %s", req.URL.Host)
+					LogError("HTTP", "Response contains: %s", indicator)
+					LogError("HTTP", "Suggestion: Try using a VPN or changing your DNS to 1.1.1.1 or 8.8.8.8")
+					return nil, fmt.Errorf("ISP blocking detected for %s (HTTP %d) - try using VPN or change DNS", req.URL.Host, resp.StatusCode)
+				}
+			}
+		}
+
 		// Server errors (5xx) - retry
 		if resp.StatusCode >= 500 {
 			resp.Body.Close()
 			lastErr = fmt.Errorf("server error: HTTP %d", resp.StatusCode)
 			if attempt < config.MaxRetries {
+				GoLog("[HTTP] Server error %d, retrying in %v...\n", resp.StatusCode, delay)
 				time.Sleep(delay)
 				delay = calculateNextDelay(delay, config)
 			}
@@ -219,10 +256,7 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 // calculateNextDelay calculates the next delay with exponential backoff
 func calculateNextDelay(currentDelay time.Duration, config RetryConfig) time.Duration {
 	nextDelay := time.Duration(float64(currentDelay) * config.BackoffFactor)
-	if nextDelay > config.MaxDelay {
-		nextDelay = config.MaxDelay
-	}
-	return nextDelay
+	return min(nextDelay, config.MaxDelay)
 }
 
 // getRetryAfterDuration parses Retry-After header and returns duration
@@ -296,3 +330,172 @@ func BuildErrorMessage(apiURL string, statusCode int, responsePreview string) st
 	}
 	return msg
 }
+
+// ISPBlockingError represents an error caused by ISP blocking
+type ISPBlockingError struct {
+	Domain      string
+	Reason      string
+	OriginalErr error
+}
+
+func (e *ISPBlockingError) Error() string {
+	return fmt.Sprintf("ISP blocking detected for %s: %s", e.Domain, e.Reason)
+}
+
+// IsISPBlocking checks if an error is likely caused by ISP blocking
+// Returns the ISPBlockingError if detected, nil otherwise
+func IsISPBlocking(err error, requestURL string) *ISPBlockingError {
+	if err == nil {
+		return nil
+	}
+
+	// Extract domain from URL
+	domain := extractDomain(requestURL)
+	errStr := strings.ToLower(err.Error())
+
+	// Check for DNS resolution failure (common ISP blocking method)
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		if dnsErr.IsNotFound || dnsErr.IsTemporary {
+			return &ISPBlockingError{
+				Domain:      domain,
+				Reason:      "DNS resolution failed - domain may be blocked by ISP",
+				OriginalErr: err,
+			}
+		}
+	}
+
+	// Check for connection refused (ISP firewall blocking)
+	var opErr *net.OpError
+	if errors.As(err, &opErr) {
+		if opErr.Op == "dial" {
+			// Check for specific syscall errors
+			var syscallErr syscall.Errno
+			if errors.As(opErr.Err, &syscallErr) {
+				switch syscallErr {
+				case syscall.ECONNREFUSED:
+					return &ISPBlockingError{
+						Domain:      domain,
+						Reason:      "Connection refused - port may be blocked by ISP/firewall",
+						OriginalErr: err,
+					}
+				case syscall.ECONNRESET:
+					return &ISPBlockingError{
+						Domain:      domain,
+						Reason:      "Connection reset - ISP may be intercepting traffic",
+						OriginalErr: err,
+					}
+				case syscall.ETIMEDOUT:
+					return &ISPBlockingError{
+						Domain:      domain,
+						Reason:      "Connection timed out - ISP may be blocking access",
+						OriginalErr: err,
+					}
+				case syscall.ENETUNREACH:
+					return &ISPBlockingError{
+						Domain:      domain,
+						Reason:      "Network unreachable - ISP may be blocking route",
+						OriginalErr: err,
+					}
+				case syscall.EHOSTUNREACH:
+					return &ISPBlockingError{
+						Domain:      domain,
+						Reason:      "Host unreachable - ISP may be blocking destination",
+						OriginalErr: err,
+					}
+				}
+			}
+		}
+	}
+
+	// Check for TLS handshake failure (ISP MITM or blocking HTTPS)
+	var tlsErr *tls.RecordHeaderError
+	if errors.As(err, &tlsErr) {
+		return &ISPBlockingError{
+			Domain:      domain,
+			Reason:      "TLS handshake failed - ISP may be intercepting HTTPS traffic",
+			OriginalErr: err,
+		}
+	}
+
+	// Check error message patterns for common ISP blocking indicators
+	blockingPatterns := []struct {
+		pattern string
+		reason  string
+	}{
+		{"connection reset by peer", "Connection reset - ISP may be intercepting traffic"},
+		{"connection refused", "Connection refused - port may be blocked"},
+		{"no such host", "DNS lookup failed - domain may be blocked by ISP"},
+		{"i/o timeout", "Connection timed out - ISP may be blocking access"},
+		{"network is unreachable", "Network unreachable - ISP may be blocking route"},
+		{"tls: ", "TLS error - ISP may be intercepting HTTPS traffic"},
+		{"certificate", "Certificate error - ISP may be using MITM proxy"},
+		{"eof", "Connection closed unexpectedly - ISP may be blocking"},
+		{"context deadline exceeded", "Request timed out - ISP may be throttling"},
+	}
+
+	for _, bp := range blockingPatterns {
+		if strings.Contains(errStr, bp.pattern) {
+			return &ISPBlockingError{
+				Domain:      domain,
+				Reason:      bp.reason,
+				OriginalErr: err,
+			}
+		}
+	}
+
+	return nil
+}
+
+// CheckAndLogISPBlocking checks for ISP blocking and logs if detected
+// Returns true if ISP blocking was detected
+func CheckAndLogISPBlocking(err error, requestURL string, tag string) bool {
+	ispErr := IsISPBlocking(err, requestURL)
+	if ispErr != nil {
+		LogError(tag, "ISP BLOCKING DETECTED: %s", ispErr.Error())
+		LogError(tag, "Domain: %s", ispErr.Domain)
+		LogError(tag, "Reason: %s", ispErr.Reason)
+		LogError(tag, "Original error: %v", ispErr.OriginalErr)
+		LogError(tag, "Suggestion: Try using a VPN or changing your DNS to 1.1.1.1 or 8.8.8.8")
+		return true
+	}
+	return false
+}
+
+// extractDomain extracts the domain from a URL string
+func extractDomain(rawURL string) string {
+	if rawURL == "" {
+		return "unknown"
+	}
+
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		// Try to extract domain manually
+		rawURL = strings.TrimPrefix(rawURL, "https://")
+		rawURL = strings.TrimPrefix(rawURL, "http://")
+		if idx := strings.Index(rawURL, "/"); idx > 0 {
+			return rawURL[:idx]
+		}
+		return rawURL
+	}
+
+	if parsed.Host != "" {
+		return parsed.Host
+	}
+	return "unknown"
+}
+
+// WrapErrorWithISPCheck wraps an error with ISP blocking detection
+// If ISP blocking is detected, returns a more descriptive error
+func WrapErrorWithISPCheck(err error, requestURL string, tag string) error {
+	if err == nil {
+		return nil
+	}
+
+	if CheckAndLogISPBlocking(err, requestURL, tag) {
+		domain := extractDomain(requestURL)
+		return fmt.Errorf("ISP blocking detected for %s - try using VPN or change DNS to 1.1.1.1/8.8.8.8: %w", domain, err)
+	}
+
+	return err
+}

go_backend/logbuffer.go

@@ -0,0 +1,199 @@
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+)
+
+// LogEntry represents a single log entry
+type LogEntry struct {
+	Timestamp string `json:"timestamp"`
+	Level     string `json:"level"`
+	Tag       string `json:"tag"`
+	Message   string `json:"message"`
+}
+
+// LogBuffer stores logs in a circular buffer for retrieval by Flutter
+type LogBuffer struct {
+	entries        []LogEntry
+	maxSize        int
+	mu             sync.RWMutex
+	loggingEnabled bool
+}
+
+var (
+	globalLogBuffer *LogBuffer
+	logBufferOnce   sync.Once
+)
+
+// GetLogBuffer returns the singleton log buffer instance
+func GetLogBuffer() *LogBuffer {
+	logBufferOnce.Do(func() {
+		globalLogBuffer = &LogBuffer{
+			entries:        make([]LogEntry, 0, 1000),
+			maxSize:        1000,
+			loggingEnabled: false, // Default: disabled for performance (user can enable in settings)
+		}
+	})
+	return globalLogBuffer
+}
+
+// SetLoggingEnabled enables or disables logging
+func (lb *LogBuffer) SetLoggingEnabled(enabled bool) {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+	lb.loggingEnabled = enabled
+}
+
+// IsLoggingEnabled returns whether logging is enabled
+func (lb *LogBuffer) IsLoggingEnabled() bool {
+	lb.mu.RLock()
+	defer lb.mu.RUnlock()
+	return lb.loggingEnabled
+}
+
+// Add adds a log entry to the buffer
+func (lb *LogBuffer) Add(level, tag, message string) {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+
+	if !lb.loggingEnabled && level != "ERROR" && level != "FATAL" {
+		return
+	}
+
+	entry := LogEntry{
+		Timestamp: time.Now().Format("15:04:05.000"),
+		Level:     level,
+		Tag:       tag,
+		Message:   message,
+	}
+
+	if len(lb.entries) >= lb.maxSize {
+		lb.entries = lb.entries[1:]
+	}
+	lb.entries = append(lb.entries, entry)
+
+	fmt.Printf("[%s] %s\n", tag, message)
+}
+
+// GetAll returns all log entries as JSON
+func (lb *LogBuffer) GetAll() string {
+	lb.mu.RLock()
+	defer lb.mu.RUnlock()
+
+	jsonBytes, _ := json.Marshal(lb.entries)
+	return string(jsonBytes)
+}
+
+func (lb *LogBuffer) getSince(index int) ([]LogEntry, int) {
+	lb.mu.RLock()
+	defer lb.mu.RUnlock()
+
+	if index < 0 {
+		index = 0
+	}
+	if index >= len(lb.entries) {
+		return []LogEntry{}, len(lb.entries)
+	}
+
+	entries := lb.entries[index:]
+	return entries, len(lb.entries)
+}
+
+// Clear clears all log entries
+func (lb *LogBuffer) Clear() {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+	lb.entries = lb.entries[:0]
+}
+
+// Count returns the number of log entries
+func (lb *LogBuffer) Count() int {
+	lb.mu.RLock()
+	defer lb.mu.RUnlock()
+	return len(lb.entries)
+}
+
+// Helper functions for logging with different levels
+func LogDebug(tag, format string, args ...interface{}) {
+	GetLogBuffer().Add("DEBUG", tag, fmt.Sprintf(format, args...))
+}
+
+func LogInfo(tag, format string, args ...interface{}) {
+	GetLogBuffer().Add("INFO", tag, fmt.Sprintf(format, args...))
+}
+
+func LogWarn(tag, format string, args ...interface{}) {
+	GetLogBuffer().Add("WARN", tag, fmt.Sprintf(format, args...))
+}
+
+func LogError(tag, format string, args ...interface{}) {
+	GetLogBuffer().Add("ERROR", tag, fmt.Sprintf(format, args...))
+}
+
+// GoLog is a drop-in replacement for fmt.Printf that also logs to buffer
+// It parses the tag from the format string if it starts with [Tag]
+func GoLog(format string, args ...interface{}) {
+	message := fmt.Sprintf(format, args...)
+	message = strings.TrimSuffix(message, "\n")
+
+	// Extract tag from message if present (e.g., "[Tidal] message")
+	tag := "Go"
+	level := "INFO"
+
+	if strings.HasPrefix(message, "[") {
+		endBracket := strings.Index(message, "]")
+		if endBracket > 1 {
+			tag = message[1:endBracket]
+			message = strings.TrimSpace(message[endBracket+1:])
+		}
+	}
+
+	// Determine level from message content
+	msgLower := strings.ToLower(message)
+	if strings.Contains(msgLower, "error") || strings.Contains(msgLower, "failed") || strings.HasPrefix(message, "✗") {
+		level = "ERROR"
+	} else if strings.Contains(msgLower, "warning") || strings.Contains(msgLower, "warn") {
+		level = "WARN"
+	} else if strings.HasPrefix(message, "✓") || strings.Contains(msgLower, "success") || strings.Contains(msgLower, "match found") {
+		level = "INFO"
+	} else if strings.Contains(msgLower, "searching") || strings.Contains(msgLower, "trying") || strings.Contains(msgLower, "found") {
+		level = "DEBUG"
+	}
+
+	GetLogBuffer().Add(level, tag, message)
+}
+
+// Exported functions for Flutter
+
+// GetLogs returns all logs as JSON array
+func GetLogs() string {
+	return GetLogBuffer().GetAll()
+}
+
+// GetLogsSince returns logs since the given index
+// Returns JSON: {"logs": [...], "next_index": N}
+func GetLogsSince(index int) string {
+	entries, nextIndex := GetLogBuffer().getSince(index)
+	logsJson, _ := json.Marshal(entries)
+	result := fmt.Sprintf(`{"logs":%s,"next_index":%d}`, string(logsJson), nextIndex)
+	return result
+}
+
+// ClearLogs clears all logs
+func ClearLogs() {
+	GetLogBuffer().Clear()
+}
+
+// GetLogCount returns the number of log entries
+func GetLogCount() int {
+	return GetLogBuffer().Count()
+}
+
+// SetLoggingEnabled enables or disables logging from Flutter
+func SetLoggingEnabled(enabled bool) {
+	GetLogBuffer().SetLoggingEnabled(enabled)
+}

go_backend/lyrics.go

@@ -3,14 +3,100 @@ package gobackend
 import (
 	"encoding/json"
 	"fmt"
+	"math"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 )
 
+// ========================================
+// Lyrics Cache with TTL
+// ========================================
+
+const (
+	lyricsCacheTTL       = 24 * time.Hour // Cache lyrics for 24 hours
+	durationToleranceSec = 10.0           // Duration matching tolerance in seconds
+)
+
+type lyricsCacheEntry struct {
+	response  *LyricsResponse
+	expiresAt time.Time
+}
+
+type lyricsCache struct {
+	mu    sync.RWMutex
+	cache map[string]*lyricsCacheEntry
+}
+
+var globalLyricsCache = &lyricsCache{
+	cache: make(map[string]*lyricsCacheEntry),
+}
+
+func (c *lyricsCache) generateKey(artist, track string, durationSec float64) string {
+	// Normalize key: lowercase, trim spaces
+	normalizedArtist := strings.ToLower(strings.TrimSpace(artist))
+	normalizedTrack := strings.ToLower(strings.TrimSpace(track))
+	// Round duration to nearest 10 seconds for cache key
+	roundedDuration := math.Round(durationSec/10) * 10
+	return fmt.Sprintf("%s|%s|%.0f", normalizedArtist, normalizedTrack, roundedDuration)
+}
+
+func (c *lyricsCache) Get(artist, track string, durationSec float64) (*LyricsResponse, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	key := c.generateKey(artist, track, durationSec)
+	entry, exists := c.cache[key]
+	if !exists {
+		return nil, false
+	}
+
+	// Check if expired
+	if time.Now().After(entry.expiresAt) {
+		return nil, false
+	}
+
+	return entry.response, true
+}
+
+func (c *lyricsCache) Set(artist, track string, durationSec float64, response *LyricsResponse) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	key := c.generateKey(artist, track, durationSec)
+	c.cache[key] = &lyricsCacheEntry{
+		response:  response,
+		expiresAt: time.Now().Add(lyricsCacheTTL),
+	}
+}
+
+// CleanExpired removes expired entries from cache
+func (c *lyricsCache) CleanExpired() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := time.Now()
+	cleaned := 0
+	for key, entry := range c.cache {
+		if now.After(entry.expiresAt) {
+			delete(c.cache, key)
+			cleaned++
+		}
+	}
+	return cleaned
+}
+
+// Size returns current cache size
+func (c *lyricsCache) Size() int {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return len(c.cache)
+}
+
 type LRCLibResponse struct {
 	ID           int     `json:"id"`
 	Name         string  `json:"name"`
@@ -86,7 +172,9 @@ func (c *LyricsClient) FetchLyricsWithMetadata(artist, track string) (*LyricsRes
 	return c.parseLRCLibResponse(&lrcResp), nil
 }
 
-func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsResponse, error) {
+// FetchLyricsFromLRCLibSearch searches lyrics with optional duration matching
+// durationSec: track duration in seconds, use 0 to skip duration matching
+func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string, durationSec float64) (*LyricsResponse, error) {
 	baseURL := "https://lrclib.net/api/search"
 	params := url.Values{}
 	params.Set("q", query)
@@ -118,6 +206,13 @@ func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsRespons
 		return nil, fmt.Errorf("no lyrics found")
 	}
 
+	// Filter and score results based on duration matching and synced lyrics
+	bestMatch := c.findBestMatch(results, durationSec)
+	if bestMatch != nil {
+		return c.parseLRCLibResponse(bestMatch), nil
+	}
+
+	// Fallback: return first result with synced lyrics
 	for _, result := range results {
 		if result.SyncedLyrics != "" {
 			return c.parseLRCLibResponse(&result), nil
@@ -127,38 +222,89 @@ func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsRespons
 	return c.parseLRCLibResponse(&results[0]), nil
 }
 
-func (c *LyricsClient) FetchLyricsAllSources(spotifyID, trackName, artistName string) (*LyricsResponse, error) {
-	// Strategy 1: Direct match with artist and track name
-	lyrics, err := c.FetchLyricsWithMetadata(artistName, trackName)
+// findBestMatch finds the best matching lyrics based on duration and sync status
+func (c *LyricsClient) findBestMatch(results []LRCLibResponse, targetDurationSec float64) *LRCLibResponse {
+	var bestSynced *LRCLibResponse
+	var bestPlain *LRCLibResponse
+
+	for i := range results {
+		result := &results[i]
+
+		// Check duration match if target duration is provided
+		durationMatches := targetDurationSec == 0 || c.durationMatches(result.Duration, targetDurationSec)
+
+		if durationMatches {
+			// Prefer synced lyrics over plain
+			if result.SyncedLyrics != "" && bestSynced == nil {
+				bestSynced = result
+			} else if result.PlainLyrics != "" && bestPlain == nil {
+				bestPlain = result
+			}
+		}
+	}
+
+	// Return synced first, then plain
+	if bestSynced != nil {
+		return bestSynced
+	}
+	return bestPlain
+}
+
+// durationMatches checks if two durations are within tolerance
+func (c *LyricsClient) durationMatches(lrcDuration, targetDuration float64) bool {
+	diff := math.Abs(lrcDuration - targetDuration)
+	return diff <= durationToleranceSec
+}
+
+// FetchLyricsAllSources fetches lyrics from multiple sources with caching and duration matching
+// durationSec: track duration in seconds for matching, use 0 to skip duration matching
+func (c *LyricsClient) FetchLyricsAllSources(spotifyID, trackName, artistName string, durationSec float64) (*LyricsResponse, error) {
+	// Check cache first
+	if cached, found := globalLyricsCache.Get(artistName, trackName, durationSec); found {
+		fmt.Printf("[Lyrics] Cache hit for: %s - %s\n", artistName, trackName)
+		cachedCopy := *cached
+		cachedCopy.Source = cached.Source + " (cached)"
+		return &cachedCopy, nil
+	}
+
+	var lyrics *LyricsResponse
+	var err error
+
+	// Try exact match first
+	lyrics, err = c.FetchLyricsWithMetadata(artistName, trackName)
 	if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
 		lyrics.Source = "LRCLIB"
+		globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 		return lyrics, nil
 	}
 
-	// Strategy 2: Try with simplified track name
+	// Try with simplified track name
 	simplifiedTrack := simplifyTrackName(trackName)
 	if simplifiedTrack != trackName {
 		lyrics, err = c.FetchLyricsWithMetadata(artistName, simplifiedTrack)
 		if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
 			lyrics.Source = "LRCLIB (simplified)"
+			globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 			return lyrics, nil
 		}
 	}
 
-	// Strategy 3: Search with full query
+	// Search with duration matching
 	query := artistName + " " + trackName
-	lyrics, err = c.FetchLyricsFromLRCLibSearch(query)
+	lyrics, err = c.FetchLyricsFromLRCLibSearch(query, durationSec)
 	if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
 		lyrics.Source = "LRCLIB Search"
+		globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 		return lyrics, nil
 	}
 
-	// Strategy 4: Search with simplified query
+	// Search with simplified name and duration matching
 	if simplifiedTrack != trackName {
 		query = artistName + " " + simplifiedTrack
-		lyrics, err = c.FetchLyricsFromLRCLibSearch(query)
+		lyrics, err = c.FetchLyricsFromLRCLibSearch(query, durationSec)
 		if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
 			lyrics.Source = "LRCLIB Search (simplified)"
+			globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 			return lyrics, nil
 		}
 	}
@@ -250,29 +396,30 @@ func msToLRCTimestamp(ms int64) string {
 
 // convertToLRC converts lyrics to LRC format string (without metadata headers)
 // Use convertToLRCWithMetadata for full LRC with headers
-func convertToLRC(lyrics *LyricsResponse) string {
-	if lyrics == nil || len(lyrics.Lines) == 0 {
-		return ""
-	}
-
-	var builder strings.Builder
-
-	if lyrics.SyncType == "LINE_SYNCED" {
-		for _, line := range lyrics.Lines {
-			timestamp := msToLRCTimestamp(line.StartTimeMs)
-			builder.WriteString(timestamp)
-			builder.WriteString(line.Words)
-			builder.WriteString("\n")
-		}
-	} else {
-		for _, line := range lyrics.Lines {
-			builder.WriteString(line.Words)
-			builder.WriteString("\n")
-		}
-	}
-
-	return builder.String()
-}
+// Kept for potential future use
+// func convertToLRC(lyrics *LyricsResponse) string {
+// 	if lyrics == nil || len(lyrics.Lines) == 0 {
+// 		return ""
+// 	}
+//
+// 	var builder strings.Builder
+//
+// 	if lyrics.SyncType == "LINE_SYNCED" {
+// 		for _, line := range lyrics.Lines {
+// 			timestamp := msToLRCTimestamp(line.StartTimeMs)
+// 			builder.WriteString(timestamp)
+// 			builder.WriteString(line.Words)
+// 			builder.WriteString("\n")
+// 		}
+// 	} else {
+// 		for _, line := range lyrics.Lines {
+// 			builder.WriteString(line.Words)
+// 			builder.WriteString("\n")
+// 		}
+// 	}
+//
+// 	return builder.String()
+// }
 
 // convertToLRCWithMetadata converts lyrics to LRC format with metadata headers
 // Includes [ti:], [ar:], [by:] headers

go_backend/metadata.go

@@ -33,7 +33,6 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		return fmt.Errorf("failed to parse FLAC file: %w", err)
 	}
 
-	// Find or create vorbis comment block
 	var cmtIdx int = -1
 	var cmt *flacvorbis.MetaDataBlockVorbisComment
 
@@ -52,13 +51,12 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		cmt = flacvorbis.New()
 	}
 
-	// Set metadata fields
 	setComment(cmt, "TITLE", metadata.Title)
 	setComment(cmt, "ARTIST", metadata.Artist)
 	setComment(cmt, "ALBUM", metadata.Album)
 	setComment(cmt, "ALBUMARTIST", metadata.AlbumArtist)
 	setComment(cmt, "DATE", metadata.Date)
-	
+
 	if metadata.TrackNumber > 0 {
 		if metadata.TotalTracks > 0 {
 			setComment(cmt, "TRACKNUMBER", fmt.Sprintf("%d/%d", metadata.TrackNumber, metadata.TotalTracks))
@@ -66,15 +64,15 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 			setComment(cmt, "TRACKNUMBER", strconv.Itoa(metadata.TrackNumber))
 		}
 	}
-	
+
 	if metadata.DiscNumber > 0 {
 		setComment(cmt, "DISCNUMBER", strconv.Itoa(metadata.DiscNumber))
 	}
-	
+
 	if metadata.ISRC != "" {
 		setComment(cmt, "ISRC", metadata.ISRC)
 	}
-	
+
 	if metadata.Description != "" {
 		setComment(cmt, "DESCRIPTION", metadata.Description)
 	}
@@ -84,7 +82,6 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		setComment(cmt, "UNSYNCEDLYRICS", metadata.Lyrics)
 	}
 
-	// Update or add vorbis comment block
 	cmtBlock := cmt.Marshal()
 	if cmtIdx >= 0 {
 		f.Meta[cmtIdx] = &cmtBlock
@@ -92,20 +89,18 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		f.Meta = append(f.Meta, &cmtBlock)
 	}
 
-	// Add cover art if provided
 	if coverPath != "" {
 		if fileExists(coverPath) {
 			coverData, err := os.ReadFile(coverPath)
 			if err != nil {
 				fmt.Printf("[Metadata] Warning: Failed to read cover file %s: %v\n", coverPath, err)
 			} else {
-				// Remove existing picture blocks first (like PC version)
 				for i := len(f.Meta) - 1; i >= 0; i-- {
 					if f.Meta[i].Type == flac.Picture {
 						f.Meta = append(f.Meta[:i], f.Meta[i+1:]...)
 					}
 				}
-				
+
 				picture, err := flacpicture.NewFromImageData(
 					flacpicture.PictureTypeFrontCover,
 					"Front Cover",
@@ -125,7 +120,6 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		}
 	}
 
-	// Save file
 	return f.Save(filePath)
 }
 
@@ -137,7 +131,6 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		return fmt.Errorf("failed to parse FLAC file: %w", err)
 	}
 
-	// Find or create vorbis comment block
 	var cmtIdx int = -1
 	var cmt *flacvorbis.MetaDataBlockVorbisComment
 
@@ -156,13 +149,12 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		cmt = flacvorbis.New()
 	}
 
-	// Set metadata fields
 	setComment(cmt, "TITLE", metadata.Title)
 	setComment(cmt, "ARTIST", metadata.Artist)
 	setComment(cmt, "ALBUM", metadata.Album)
 	setComment(cmt, "ALBUMARTIST", metadata.AlbumArtist)
 	setComment(cmt, "DATE", metadata.Date)
-	
+
 	if metadata.TrackNumber > 0 {
 		if metadata.TotalTracks > 0 {
 			setComment(cmt, "TRACKNUMBER", fmt.Sprintf("%d/%d", metadata.TrackNumber, metadata.TotalTracks))
@@ -170,15 +162,15 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 			setComment(cmt, "TRACKNUMBER", strconv.Itoa(metadata.TrackNumber))
 		}
 	}
-	
+
 	if metadata.DiscNumber > 0 {
 		setComment(cmt, "DISCNUMBER", strconv.Itoa(metadata.DiscNumber))
 	}
-	
+
 	if metadata.ISRC != "" {
 		setComment(cmt, "ISRC", metadata.ISRC)
 	}
-	
+
 	if metadata.Description != "" {
 		setComment(cmt, "DESCRIPTION", metadata.Description)
 	}
@@ -188,7 +180,6 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		setComment(cmt, "UNSYNCEDLYRICS", metadata.Lyrics)
 	}
 
-	// Update or add vorbis comment block
 	cmtBlock := cmt.Marshal()
 	if cmtIdx >= 0 {
 		f.Meta[cmtIdx] = &cmtBlock
@@ -196,15 +187,13 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		f.Meta = append(f.Meta, &cmtBlock)
 	}
 
-	// Add cover art if provided
 	if len(coverData) > 0 {
-		// Remove existing picture blocks first
 		for i := len(f.Meta) - 1; i >= 0; i-- {
 			if f.Meta[i].Type == flac.Picture {
 				f.Meta = append(f.Meta[:i], f.Meta[i+1:]...)
 			}
 		}
-		
+
 		picture, err := flacpicture.NewFromImageData(
 			flacpicture.PictureTypeFrontCover,
 			"Front Cover",
@@ -220,7 +209,6 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		}
 	}
 
-	// Save file
 	return f.Save(filePath)
 }
 
@@ -257,11 +245,27 @@ func ReadMetadata(filePath string) (*Metadata, error) {
 			if trackNum != "" {
 				fmt.Sscanf(trackNum, "%d", &metadata.TrackNumber)
 			}
+			if metadata.TrackNumber == 0 {
+				trackNum = getComment(cmt, "TRACK")
+				if trackNum != "" {
+					fmt.Sscanf(trackNum, "%d", &metadata.TrackNumber)
+				}
+			}
 
 			discNum := getComment(cmt, "DISCNUMBER")
 			if discNum != "" {
 				fmt.Sscanf(discNum, "%d", &metadata.DiscNumber)
 			}
+			if metadata.DiscNumber == 0 {
+				discNum = getComment(cmt, "DISC")
+				if discNum != "" {
+					fmt.Sscanf(discNum, "%d", &metadata.DiscNumber)
+				}
+			}
+
+			if metadata.Date == "" {
+				metadata.Date = getComment(cmt, "YEAR")
+			}
 
 			break
 		}
@@ -274,7 +278,6 @@ func setComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key, value string) {
 	if value == "" {
 		return
 	}
-	// Remove existing (case-insensitive comparison for Vorbis comments)
 	keyUpper := strings.ToUpper(key)
 	for i := len(cmt.Comments) - 1; i >= 0; i-- {
 		comment := cmt.Comments[i]
@@ -286,20 +289,22 @@ func setComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key, value string) {
 			}
 		}
 	}
-	// Add new
 	cmt.Comments = append(cmt.Comments, key+"="+value)
 }
 
 func getComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key string) string {
+	keyUpper := strings.ToUpper(key) + "="
 	for _, comment := range cmt.Comments {
-		if len(comment) > len(key)+1 && comment[:len(key)+1] == key+"=" {
-			return comment[len(key)+1:]
+		if len(comment) > len(key) {
+			commentUpper := strings.ToUpper(comment[:len(key)+1])
+			if commentUpper == keyUpper {
+				return comment[len(key)+1:]
+			}
 		}
 	}
 	return ""
 }
 
-// fileExists checks if a file exists
 func fileExists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
@@ -356,14 +361,12 @@ func ExtractLyrics(filePath string) (string, error) {
 			if err != nil {
 				continue
 			}
-			
-			// Try LYRICS tag first
+
 			lyrics, err := cmt.Get("LYRICS")
 			if err == nil && len(lyrics) > 0 && lyrics[0] != "" {
 				return lyrics[0], nil
 			}
-			
-			// Fallback to UNSYNCEDLYRICS
+
 			lyrics, err = cmt.Get("UNSYNCEDLYRICS")
 			if err == nil && len(lyrics) > 0 && lyrics[0] != "" {
 				return lyrics[0], nil
@@ -376,8 +379,9 @@ func ExtractLyrics(filePath string) (string, error) {
 
 // AudioQuality represents audio quality info from a FLAC file
 type AudioQuality struct {
-	BitDepth   int `json:"bit_depth"`
-	SampleRate int `json:"sample_rate"`
+	BitDepth     int   `json:"bit_depth"`
+	SampleRate   int   `json:"sample_rate"`
+	TotalSamples int64 `json:"total_samples"`
 }
 
 // GetAudioQuality reads bit depth and sample rate from a FLAC file's StreamInfo block
@@ -390,16 +394,12 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 	}
 	defer file.Close()
 
-	// Read first 4 bytes to detect file type
 	marker := make([]byte, 4)
 	if _, err := file.Read(marker); err != nil {
 		return AudioQuality{}, fmt.Errorf("failed to read marker: %w", err)
 	}
-	
-	// Check if it's a FLAC file
+
 	if string(marker) == "fLaC" {
-		// Continue reading FLAC metadata
-		// Read metadata block header (4 bytes)
 		header := make([]byte, 4)
 		if _, err := file.Read(header); err != nil {
 			return AudioQuality{}, fmt.Errorf("failed to read header: %w", err)
@@ -410,82 +410,74 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 			return AudioQuality{}, fmt.Errorf("first block is not STREAMINFO")
 		}
 
-		// Read STREAMINFO block (34 bytes minimum)
 		streamInfo := make([]byte, 34)
 		if _, err := file.Read(streamInfo); err != nil {
 			return AudioQuality{}, fmt.Errorf("failed to read STREAMINFO: %w", err)
 		}
 
-		// Parse sample rate (20 bits starting at byte 10)
 		sampleRate := (int(streamInfo[10]) << 12) | (int(streamInfo[11]) << 4) | (int(streamInfo[12]) >> 4)
 
-		// Parse bits per sample (5 bits)
 		bitsPerSample := ((int(streamInfo[12]) & 0x01) << 4) | (int(streamInfo[13]) >> 4) + 1
 
+		totalSamples := int64(streamInfo[13]&0x0F)<<32 |
+			int64(streamInfo[14])<<24 |
+			int64(streamInfo[15])<<16 |
+			int64(streamInfo[16])<<8 |
+			int64(streamInfo[17])
+
 		return AudioQuality{
-			BitDepth:   bitsPerSample,
-			SampleRate: sampleRate,
+			BitDepth:     bitsPerSample,
+			SampleRate:   sampleRate,
+			TotalSamples: totalSamples,
 		}, nil
 	}
-	
-	// Check if it's an M4A/MP4 file (starts with size + "ftyp")
-	// First 4 bytes are size, next 4 should be "ftyp"
-	file.Seek(0, 0) // Reset to beginning
+
+	file.Seek(0, 0)
 	header8 := make([]byte, 8)
 	if _, err := file.Read(header8); err != nil {
 		return AudioQuality{}, fmt.Errorf("failed to read header: %w", err)
 	}
-	
+
 	if string(header8[4:8]) == "ftyp" {
-		// It's an M4A/MP4 file, use M4A quality reader
-		file.Close() // Close before calling GetM4AQuality which opens the file again
+		file.Close()
 		return GetM4AQuality(filePath)
 	}
-	
+
 	return AudioQuality{}, fmt.Errorf("unsupported file format (not FLAC or M4A)")
 }
 
-
 // ========================================
 // M4A (MP4/AAC) Metadata Embedding
 // ========================================
 
 // EmbedM4AMetadata embeds metadata into an M4A file using iTunes-style atoms
-// This is a simplified implementation that writes metadata to the file
 func EmbedM4AMetadata(filePath string, metadata Metadata, coverData []byte) error {
-	// Read the entire file
 	data, err := os.ReadFile(filePath)
 	if err != nil {
 		return fmt.Errorf("failed to read M4A file: %w", err)
 	}
 
-	// Find moov atom position
 	moovPos := findAtom(data, "moov", 0)
 	if moovPos < 0 {
 		return fmt.Errorf("moov atom not found in M4A file")
 	}
 
-	// Find udta atom inside moov, or create one
-	moovSize := int(data[moovPos]<<24 | data[moovPos+1]<<16 | data[moovPos+2]<<8 | data[moovPos+3])
+	moovSize := int(uint32(data[moovPos])<<24 | uint32(data[moovPos+1])<<16 | uint32(data[moovPos+2])<<8 | uint32(data[moovPos+3]))
 	udtaPos := findAtom(data, "udta", moovPos+8)
-	
-	// Build new metadata atoms
+
 	metaAtom := buildMetaAtom(metadata, coverData)
-	
+
 	var newData []byte
 	if udtaPos >= 0 && udtaPos < moovPos+moovSize {
-		// udta exists, find meta inside it or replace
-		udtaSize := int(data[udtaPos]<<24 | data[udtaPos+1]<<16 | data[udtaPos+2]<<8 | data[udtaPos+3])
+		udtaSize := int(uint32(data[udtaPos])<<24 | uint32(data[udtaPos+1])<<16 | uint32(data[udtaPos+2])<<8 | uint32(data[udtaPos+3]))
 		metaPos := findAtom(data, "meta", udtaPos+8)
-		
+
 		if metaPos >= 0 && metaPos < udtaPos+udtaSize {
-			// Replace existing meta atom
-			metaSize := int(data[metaPos]<<24 | data[metaPos+1]<<16 | data[metaPos+2]<<8 | data[metaPos+3])
+			metaSize := int(uint32(data[metaPos])<<24 | uint32(data[metaPos+1])<<16 | uint32(data[metaPos+2])<<8 | uint32(data[metaPos+3]))
 			newData = append(newData, data[:metaPos]...)
 			newData = append(newData, metaAtom...)
 			newData = append(newData, data[metaPos+metaSize:]...)
 		} else {
-			// Add meta atom to udta
 			newUdtaContent := append(data[udtaPos+8:udtaPos+udtaSize], metaAtom...)
 			newUdtaSize := 8 + len(newUdtaContent)
 			newUdta := make([]byte, 4)
@@ -495,13 +487,12 @@ func EmbedM4AMetadata(filePath string, metadata Metadata, coverData []byte) erro
 			newUdta[3] = byte(newUdtaSize)
 			newUdta = append(newUdta, []byte("udta")...)
 			newUdta = append(newUdta, newUdtaContent...)
-			
+
 			newData = append(newData, data[:udtaPos]...)
 			newData = append(newData, newUdta...)
 			newData = append(newData, data[udtaPos+udtaSize:]...)
 		}
 	} else {
-		// Create new udta with meta
 		udtaContent := metaAtom
 		udtaSize := 8 + len(udtaContent)
 		newUdta := make([]byte, 4)
@@ -511,22 +502,19 @@ func EmbedM4AMetadata(filePath string, metadata Metadata, coverData []byte) erro
 		newUdta[3] = byte(udtaSize)
 		newUdta = append(newUdta, []byte("udta")...)
 		newUdta = append(newUdta, udtaContent...)
-		
-		// Insert udta at end of moov
+
 		insertPos := moovPos + moovSize
 		newData = append(newData, data[:insertPos]...)
 		newData = append(newData, newUdta...)
 		newData = append(newData, data[insertPos:]...)
 	}
-	
-	// Update moov size
+
 	newMoovSize := moovSize + len(newData) - len(data)
 	newData[moovPos] = byte(newMoovSize >> 24)
 	newData[moovPos+1] = byte(newMoovSize >> 16)
 	newData[moovPos+2] = byte(newMoovSize >> 8)
 	newData[moovPos+3] = byte(newMoovSize)
 
-	// Write back to file
 	if err := os.WriteFile(filePath, newData, 0644); err != nil {
 		return fmt.Errorf("failed to write M4A file: %w", err)
 	}
@@ -538,7 +526,7 @@ func EmbedM4AMetadata(filePath string, metadata Metadata, coverData []byte) erro
 // findAtom finds an atom by name starting from offset
 func findAtom(data []byte, name string, offset int) int {
 	for i := offset; i < len(data)-8; {
-		size := int(data[i]<<24 | data[i+1]<<16 | data[i+2]<<8 | data[i+3])
+		size := int(uint32(data[i])<<24 | uint32(data[i+1])<<16 | uint32(data[i+2])<<8 | uint32(data[i+3]))
 		if size < 8 {
 			break
 		}
@@ -553,55 +541,44 @@ func findAtom(data []byte, name string, offset int) int {
 
 // buildMetaAtom builds a complete meta atom with ilst containing metadata
 func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
-	// Build ilst content
 	var ilst []byte
-	
-	// ©nam - Title
+
 	if metadata.Title != "" {
 		ilst = append(ilst, buildTextAtom("©nam", metadata.Title)...)
 	}
-	
-	// ©ART - Artist
+
 	if metadata.Artist != "" {
 		ilst = append(ilst, buildTextAtom("©ART", metadata.Artist)...)
 	}
-	
-	// ©alb - Album
+
 	if metadata.Album != "" {
 		ilst = append(ilst, buildTextAtom("©alb", metadata.Album)...)
 	}
-	
-	// aART - Album Artist
+
 	if metadata.AlbumArtist != "" {
 		ilst = append(ilst, buildTextAtom("aART", metadata.AlbumArtist)...)
 	}
-	
-	// ©day - Year/Date
+
 	if metadata.Date != "" {
 		ilst = append(ilst, buildTextAtom("©day", metadata.Date)...)
 	}
-	
-	// trkn - Track Number
+
 	if metadata.TrackNumber > 0 {
 		ilst = append(ilst, buildTrackNumberAtom(metadata.TrackNumber, metadata.TotalTracks)...)
 	}
-	
-	// disk - Disc Number
+
 	if metadata.DiscNumber > 0 {
 		ilst = append(ilst, buildDiscNumberAtom(metadata.DiscNumber, 0)...)
 	}
-	
-	// ©lyr - Lyrics
+
 	if metadata.Lyrics != "" {
 		ilst = append(ilst, buildTextAtom("©lyr", metadata.Lyrics)...)
 	}
-	
-	// covr - Cover Art
+
 	if len(coverData) > 0 {
 		ilst = append(ilst, buildCoverAtom(coverData)...)
 	}
-	
-	// Build ilst atom
+
 	ilstSize := 8 + len(ilst)
 	ilstAtom := make([]byte, 4)
 	ilstAtom[0] = byte(ilstSize >> 24)
@@ -610,8 +587,7 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 	ilstAtom[3] = byte(ilstSize)
 	ilstAtom = append(ilstAtom, []byte("ilst")...)
 	ilstAtom = append(ilstAtom, ilst...)
-	
-	// Build hdlr atom (required for meta)
+
 	hdlr := []byte{
 		0, 0, 0, 33, // size = 33
 		'h', 'd', 'l', 'r',
@@ -623,11 +599,10 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 		0, 0, 0, 0, // component flags mask
 		0, // null terminator
 	}
-	
-	// Build meta atom
+
 	metaContent := append([]byte{0, 0, 0, 0}, hdlr...) // version + flags + hdlr
 	metaContent = append(metaContent, ilstAtom...)
-	
+
 	metaSize := 8 + len(metaContent)
 	metaAtom := make([]byte, 4)
 	metaAtom[0] = byte(metaSize >> 24)
@@ -636,15 +611,14 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 	metaAtom[3] = byte(metaSize)
 	metaAtom = append(metaAtom, []byte("meta")...)
 	metaAtom = append(metaAtom, metaContent...)
-	
+
 	return metaAtom
 }
 
 // buildTextAtom builds a text metadata atom (©nam, ©ART, etc.)
 func buildTextAtom(name, value string) []byte {
 	valueBytes := []byte(value)
-	
-	// data atom
+
 	dataSize := 16 + len(valueBytes)
 	dataAtom := make([]byte, 4)
 	dataAtom[0] = byte(dataSize >> 24)
@@ -655,8 +629,7 @@ func buildTextAtom(name, value string) []byte {
 	dataAtom = append(dataAtom, 0, 0, 0, 1) // type = UTF-8
 	dataAtom = append(dataAtom, 0, 0, 0, 0) // locale
 	dataAtom = append(dataAtom, valueBytes...)
-	
-	// container atom
+
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -665,13 +638,12 @@ func buildTextAtom(name, value string) []byte {
 	atom[3] = byte(atomSize)
 	atom = append(atom, []byte(name)...)
 	atom = append(atom, dataAtom...)
-	
+
 	return atom
 }
 
 // buildTrackNumberAtom builds trkn atom
 func buildTrackNumberAtom(track, total int) []byte {
-	// data atom with track number
 	dataAtom := []byte{
 		0, 0, 0, 24, // size
 		'd', 'a', 't', 'a',
@@ -682,8 +654,7 @@ func buildTrackNumberAtom(track, total int) []byte {
 		byte(total >> 8), byte(total), // total tracks
 		0, 0, // padding
 	}
-	
-	// trkn atom
+
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -692,13 +663,12 @@ func buildTrackNumberAtom(track, total int) []byte {
 	atom[3] = byte(atomSize)
 	atom = append(atom, []byte("trkn")...)
 	atom = append(atom, dataAtom...)
-	
+
 	return atom
 }
 
 // buildDiscNumberAtom builds disk atom
 func buildDiscNumberAtom(disc, total int) []byte {
-	// data atom with disc number
 	dataAtom := []byte{
 		0, 0, 0, 22, // size
 		'd', 'a', 't', 'a',
@@ -708,8 +678,7 @@ func buildDiscNumberAtom(disc, total int) []byte {
 		byte(disc >> 8), byte(disc), // disc number
 		byte(total >> 8), byte(total), // total discs
 	}
-	
-	// disk atom
+
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -718,19 +687,17 @@ func buildDiscNumberAtom(disc, total int) []byte {
 	atom[3] = byte(atomSize)
 	atom = append(atom, []byte("disk")...)
 	atom = append(atom, dataAtom...)
-	
+
 	return atom
 }
 
 // buildCoverAtom builds covr atom with image data
 func buildCoverAtom(coverData []byte) []byte {
-	// Detect image type (JPEG = 13, PNG = 14)
 	imageType := byte(13) // default JPEG
 	if len(coverData) > 8 && coverData[0] == 0x89 && coverData[1] == 'P' && coverData[2] == 'N' && coverData[3] == 'G' {
 		imageType = 14 // PNG
 	}
-	
-	// data atom
+
 	dataSize := 16 + len(coverData)
 	dataAtom := make([]byte, 4)
 	dataAtom[0] = byte(dataSize >> 24)
@@ -741,8 +708,7 @@ func buildCoverAtom(coverData []byte) []byte {
 	dataAtom = append(dataAtom, 0, 0, 0, imageType) // type = JPEG or PNG
 	dataAtom = append(dataAtom, 0, 0, 0, 0)         // locale
 	dataAtom = append(dataAtom, coverData...)
-	
-	// covr atom
+
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -751,7 +717,7 @@ func buildCoverAtom(coverData []byte) []byte {
 	atom[3] = byte(atomSize)
 	atom = append(atom, []byte("covr")...)
 	atom = append(atom, dataAtom...)
-	
+
 	return atom
 }
 
@@ -762,24 +728,18 @@ func GetM4AQuality(filePath string) (AudioQuality, error) {
 		return AudioQuality{}, fmt.Errorf("failed to read M4A file: %w", err)
 	}
 
-	// Find moov -> trak -> mdia -> minf -> stbl -> stsd
 	moovPos := findAtom(data, "moov", 0)
 	if moovPos < 0 {
 		return AudioQuality{}, fmt.Errorf("moov atom not found")
 	}
 
-	// Search for mp4a or alac atom which contains audio info
-	// This is a simplified search - real implementation would traverse the atom tree
 	for i := moovPos; i < len(data)-20; i++ {
 		if string(data[i:i+4]) == "mp4a" || string(data[i:i+4]) == "alac" {
-			// Sample rate is at offset 22-23 from atom start (16-bit big-endian)
 			if i+24 < len(data) {
 				sampleRate := int(data[i+22])<<8 | int(data[i+23])
-				// For AAC, bit depth is typically 16
 				bitDepth := 16
 				if string(data[i:i+4]) == "alac" {
-					// ALAC can have higher bit depth, check esds or alac specific data
-					bitDepth = 24 // Assume 24-bit for ALAC
+					bitDepth = 24
 				}
 				return AudioQuality{BitDepth: bitDepth, SampleRate: sampleRate}, nil
 			}

go_backend/parallel.go

@@ -35,7 +35,7 @@ func GetTrackIDCache() *TrackIDCache {
 	trackIDCacheOnce.Do(func() {
 		globalTrackIDCache = &TrackIDCache{
 			cache: make(map[string]*TrackIDCacheEntry),
-			ttl:   30 * time.Minute, // Cache for 30 minutes
+			ttl:   30 * time.Minute,
 		}
 	})
 	return globalTrackIDCache
@@ -124,6 +124,7 @@ type ParallelDownloadResult struct {
 
 // FetchCoverAndLyricsParallel downloads cover and fetches lyrics in parallel
 // This runs while the main audio download is happening
+// durationMs: track duration in milliseconds for lyrics matching
 func FetchCoverAndLyricsParallel(
 	coverURL string,
 	maxQualityCover bool,
@@ -131,11 +132,11 @@ func FetchCoverAndLyricsParallel(
 	trackName string,
 	artistName string,
 	embedLyrics bool,
+	durationMs int64,
 ) *ParallelDownloadResult {
 	result := &ParallelDownloadResult{}
 	var wg sync.WaitGroup
 
-	// Download cover in parallel
 	if coverURL != "" {
 		wg.Add(1)
 		go func() {
@@ -159,13 +160,13 @@ func FetchCoverAndLyricsParallel(
 			defer wg.Done()
 			fmt.Println("[Parallel] Starting lyrics fetch...")
 			client := NewLyricsClient()
-			lyrics, err := client.FetchLyricsAllSources(spotifyID, trackName, artistName)
+			durationSec := float64(durationMs) / 1000.0
+			lyrics, err := client.FetchLyricsAllSources(spotifyID, trackName, artistName, durationSec)
 			if err != nil {
 				result.LyricsErr = err
 				fmt.Printf("[Parallel] Lyrics fetch failed: %v\n", err)
 			} else if lyrics != nil && len(lyrics.Lines) > 0 {
 				result.LyricsData = lyrics
-				// Use LRC with metadata headers (like PC version)
 				result.LyricsLRC = convertToLRCWithMetadata(lyrics, trackName, artistName)
 				fmt.Printf("[Parallel] Lyrics fetched: %d lines\n", len(lyrics.Lines))
 			} else {
@@ -202,12 +203,10 @@ func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 	fmt.Printf("[Cache] Pre-warming cache for %d tracks...\n", len(requests))
 	cache := GetTrackIDCache()
 
-	// Limit concurrent pre-warm requests
-	semaphore := make(chan struct{}, 3) // Max 3 concurrent
+	semaphore := make(chan struct{}, 3)
 	var wg sync.WaitGroup
 
 	for _, req := range requests {
-		// Skip if already cached
 		if cached := cache.Get(req.ISRC); cached != nil {
 			continue
 		}
@@ -233,7 +232,7 @@ func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 	fmt.Printf("[Cache] Pre-warm complete. Cache size: %d\n", cache.Size())
 }
 
-func preWarmTidalCache(isrc, trackName, artistName string) {
+func preWarmTidalCache(isrc, _, _ string) {
 	downloader := NewTidalDownloader()
 	track, err := downloader.SearchTrackByISRC(isrc)
 	if err == nil && track != nil {
@@ -252,11 +251,9 @@ func preWarmQobuzCache(isrc string) {
 }
 
 func preWarmAmazonCache(isrc, spotifyID string) {
-	// Amazon uses SongLink to get URL, so we pre-warm by checking availability
 	client := NewSongLinkClient()
 	availability, err := client.CheckTrackAvailability(spotifyID, isrc)
 	if err == nil && availability != nil && availability.Amazon {
-		// Store Amazon URL in cache (using ISRC as key)
 		GetTrackIDCache().SetAmazon(isrc, availability.AmazonURL)
 		fmt.Printf("[Cache] Cached Amazon URL for ISRC %s\n", isrc)
 	}
@@ -270,10 +267,8 @@ func preWarmAmazonCache(isrc, spotifyID string) {
 // tracksJSON is a JSON array of {isrc, track_name, artist_name, service}
 func PreWarmCache(tracksJSON string) error {
 	var requests []PreWarmCacheRequest
-	// Parse JSON (simplified - in production use proper JSON parsing)
-	// For now, this is called from exports.go with proper parsing
-	
-	go PreWarmTrackCache(requests) // Run in background
+
+	go PreWarmTrackCache(requests)
 	return nil
 }
 

go_backend/progress.go

@@ -23,7 +23,7 @@ type ItemProgress struct {
 	ItemID        string  `json:"item_id"`
 	BytesTotal    int64   `json:"bytes_total"`
 	BytesReceived int64   `json:"bytes_received"`
-	Progress      float64 `json:"progress"` // 0.0 to 1.0
+	Progress      float64 `json:"progress"`   // 0.0 to 1.0
 	SpeedMBps     float64 `json:"speed_mbps"` // Download speed in MB/s
 	IsDownloading bool    `json:"is_downloading"`
 	Status        string  `json:"status"` // "downloading", "finalizing", "completed"
@@ -44,16 +44,14 @@ var (
 )
 
 // getProgress returns current download progress from multi-progress system
-// Returns first active item's progress for backward compatibility
 func getProgress() DownloadProgress {
 	multiMu.RLock()
 	defer multiMu.RUnlock()
 
-	// Find first active item
 	for _, item := range multiProgress.Items {
 		return DownloadProgress{
 			CurrentFile:   item.ItemID,
-			Progress:      item.Progress * 100, // Convert to percentage
+			Progress:      item.Progress * 100,
 			BytesTotal:    item.BytesTotal,
 			BytesReceived: item.BytesReceived,
 			IsDownloading: item.IsDownloading,
@@ -204,11 +202,12 @@ func setDownloadDir(path string) error {
 }
 
 // getDownloadDir returns the default download directory
-func getDownloadDir() string {
-	downloadDirMu.RLock()
-	defer downloadDirMu.RUnlock()
-	return downloadDir
-}
+// Kept for potential future use
+// func getDownloadDir() string {
+// 	downloadDirMu.RLock()
+// 	defer downloadDirMu.RUnlock()
+// 	return downloadDir
+// }
 
 // ItemProgressWriter wraps io.Writer to track download progress for a specific item
 type ItemProgressWriter struct {
@@ -239,16 +238,16 @@ func NewItemProgressWriter(w interface{ Write([]byte) (int, error) }, itemID str
 
 // Write implements io.Writer with threshold-based progress updates and speed tracking
 func (pw *ItemProgressWriter) Write(p []byte) (int, error) {
+	if pw.itemID != "" && isDownloadCancelled(pw.itemID) {
+		return 0, ErrDownloadCancelled
+	}
 	n, err := pw.writer.Write(p)
 	if err != nil {
 		return n, err
 	}
 	pw.current += int64(n)
 
-	// Update progress when we've received at least 64KB since last update
-	// Also update on first write to show download has started
 	if pw.lastReported == 0 || pw.current-pw.lastReported >= progressUpdateThreshold {
-		// Calculate speed (MB/s) based on bytes received since last update
 		now := time.Now()
 		elapsed := now.Sub(pw.lastTime).Seconds()
 		var speedMBps float64
@@ -256,7 +255,7 @@ func (pw *ItemProgressWriter) Write(p []byte) (int, error) {
 			bytesInInterval := pw.current - pw.lastBytes
 			speedMBps = float64(bytesInInterval) / (1024 * 1024) / elapsed
 		}
-		
+
 		SetItemBytesReceivedWithSpeed(pw.itemID, pw.current, speedMBps)
 		pw.lastReported = pw.current
 		pw.lastTime = now

go_backend/ratelimit.go

@@ -30,31 +30,25 @@ func (r *RateLimiter) WaitForSlot() {
 
 	now := time.Now()
 
-	// Remove timestamps outside the window
 	r.cleanOldTimestamps(now)
 
-	// If under limit, record and return immediately
 	if len(r.timestamps) < r.maxRequests {
 		r.timestamps = append(r.timestamps, now)
 		return
 	}
 
-	// Calculate wait time until oldest timestamp expires
 	oldestTimestamp := r.timestamps[0]
 	waitUntil := oldestTimestamp.Add(r.window)
 	waitDuration := waitUntil.Sub(now)
 
 	if waitDuration > 0 {
-		// Release lock while waiting
 		r.mu.Unlock()
 		time.Sleep(waitDuration)
 		r.mu.Lock()
 
-		// Clean again after waiting
 		r.cleanOldTimestamps(time.Now())
 	}
 
-	// Record this request
 	r.timestamps = append(r.timestamps, time.Now())
 }
 

go_backend/songlink.go

@@ -31,7 +31,6 @@ type TrackAvailability struct {
 }
 
 var (
-	// Global SongLink client instance for connection reuse
 	globalSongLinkClient *SongLinkClient
 	songLinkClientOnce   sync.Once
 )
@@ -40,7 +39,7 @@ var (
 func NewSongLinkClient() *SongLinkClient {
 	songLinkClientOnce.Do(func() {
 		globalSongLinkClient = &SongLinkClient{
-			client: NewHTTPClientWithTimeout(SongLinkTimeout), // 30s timeout
+			client: NewHTTPClientWithTimeout(SongLinkTimeout),
 		}
 	})
 	return globalSongLinkClient
@@ -48,15 +47,12 @@ func NewSongLinkClient() *SongLinkClient {
 
 // CheckTrackAvailability checks track availability on streaming platforms
 func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc string) (*TrackAvailability, error) {
-	// Validate Spotify ID format (should be 22 characters alphanumeric)
 	if spotifyTrackID == "" {
 		return nil, fmt.Errorf("spotify track ID is empty")
 	}
 	
-	// Use global rate limiter - blocks until request is allowed
 	songLinkRateLimiter.WaitForSlot()
 
-	// Build API URL
 	spotifyBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly9vcGVuLnNwb3RpZnkuY29tL3RyYWNrLw==")
 	spotifyURL := fmt.Sprintf("%s%s", string(spotifyBase), spotifyTrackID)
 
@@ -68,7 +64,6 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
 
-	// Use retry logic with User-Agent
 	retryConfig := DefaultRetryConfig()
 	resp, err := DoRequestWithRetry(s.client, req, retryConfig)
 	if err != nil {
@@ -76,7 +71,6 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 	}
 	defer resp.Body.Close()
 
-	// Handle specific error codes
 	if resp.StatusCode == 400 {
 		return nil, fmt.Errorf("track not found on SongLink (invalid Spotify ID or track unavailable)")
 	}
@@ -109,27 +103,22 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 		SpotifyID: spotifyTrackID,
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
-		// Extract Deezer ID from URL (e.g., https://www.deezer.com/track/123456)
 		availability.DeezerID = extractDeezerIDFromURL(deezerLink.URL)
 	}
 
-	// Check Qobuz using ISRC (SongLink doesn't support Qobuz directly)
 	if isrc != "" {
 		availability.Qobuz = checkQobuzAvailability(isrc)
 	}
@@ -191,12 +180,9 @@ func checkQobuzAvailability(isrc string) bool {
 
 // extractDeezerIDFromURL extracts Deezer track/album/artist ID from URL
 func extractDeezerIDFromURL(deezerURL string) string {
-	// URL format: https://www.deezer.com/track/123456 or https://www.deezer.com/en/track/123456
 	parts := strings.Split(deezerURL, "/")
 	if len(parts) > 0 {
-		// Get the last part which should be the ID
 		lastPart := parts[len(parts)-1]
-		// Remove any query parameters
 		if idx := strings.Index(lastPart, "?"); idx > 0 {
 			lastPart = lastPart[:idx]
 		}
@@ -274,7 +260,6 @@ func (s *SongLinkClient) CheckAlbumAvailability(spotifyAlbumID string) (*AlbumAv
 		SpotifyID: spotifyAlbumID,
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
@@ -309,13 +294,10 @@ func (s *SongLinkClient) CheckAvailabilityFromDeezer(deezerTrackID string) (*Tra
 		return nil, fmt.Errorf("deezer track ID is empty")
 	}
 	
-	// Use global rate limiter
 	songLinkRateLimiter.WaitForSlot()
 
-	// Build Deezer URL
 	deezerURL := fmt.Sprintf("https://www.deezer.com/track/%s", deezerTrackID)
 
-	// Build API URL using Deezer URL as source
 	apiBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly9hcGkuc29uZy5saW5rL3YxLWFscGhhLjEvbGlua3M/dXJsPQ==")
 	apiURL := fmt.Sprintf("%s%s&userCountry=US", string(apiBase), url.QueryEscape(deezerURL))
 
@@ -371,25 +353,20 @@ func (s *SongLinkClient) CheckAvailabilityFromDeezer(deezerTrackID string) (*Tra
 		DeezerID: deezerTrackID,
 	}
 
-	// Check Spotify
 	if spotifyLink, ok := songLinkResp.LinksByPlatform["spotify"]; ok && spotifyLink.URL != "" {
-		// Extract Spotify ID from URL
 		availability.SpotifyID = extractSpotifyIDFromURL(spotifyLink.URL)
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer URL
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.DeezerURL = deezerLink.URL
 	}
@@ -459,24 +436,20 @@ func (s *SongLinkClient) CheckAvailabilityByPlatform(platform, entityType, entit
 
 	availability := &TrackAvailability{}
 
-	// Check Spotify
 	if spotifyLink, ok := songLinkResp.LinksByPlatform["spotify"]; ok && spotifyLink.URL != "" {
 		availability.SpotifyID = extractSpotifyIDFromURL(spotifyLink.URL)
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
@@ -488,10 +461,8 @@ func (s *SongLinkClient) CheckAvailabilityByPlatform(platform, entityType, entit
 
 // extractSpotifyIDFromURL extracts Spotify track ID from URL
 func extractSpotifyIDFromURL(spotifyURL string) string {
-	// URL format: https://open.spotify.com/track/0Jcij1eWd5bDMU5iPbxe2i
 	parts := strings.Split(spotifyURL, "/track/")
 	if len(parts) > 1 {
-		// Get the ID part and remove any query parameters
 		idPart := parts[1]
 		if idx := strings.Index(idPart, "?"); idx > 0 {
 			idPart = idPart[:idx]

go_backend/spotify.go

@@ -2,7 +2,6 @@ package gobackend
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -17,14 +16,14 @@ import (
 )
 
 const (
-	spotifyTokenURL     = "https://accounts.spotify.com/api/token"
-	playlistBaseURL     = "https://api.spotify.com/v1/playlists/%s"
-	albumBaseURL        = "https://api.spotify.com/v1/albums/%s"
-	trackBaseURL        = "https://api.spotify.com/v1/tracks/%s"
-	artistBaseURL       = "https://api.spotify.com/v1/artists/%s"
-	artistAlbumsURL     = "https://api.spotify.com/v1/artists/%s/albums"
-	searchBaseURL       = "https://api.spotify.com/v1/search"
-	
+	spotifyTokenURL = "https://accounts.spotify.com/api/token"
+	playlistBaseURL = "https://api.spotify.com/v1/playlists/%s"
+	albumBaseURL    = "https://api.spotify.com/v1/albums/%s"
+	trackBaseURL    = "https://api.spotify.com/v1/tracks/%s"
+	artistBaseURL   = "https://api.spotify.com/v1/artists/%s"
+	artistAlbumsURL = "https://api.spotify.com/v1/artists/%s/albums"
+	searchBaseURL   = "https://api.spotify.com/v1/search"
+
 	// Cache TTL settings
 	artistCacheTTL = 10 * time.Minute
 	searchCacheTTL = 5 * time.Minute
@@ -54,7 +53,7 @@ type SpotifyMetadataClient struct {
 	rng            *rand.Rand
 	rngMu          sync.Mutex
 	userAgent      string
-	
+
 	// Caches to reduce API calls
 	artistCache map[string]*cacheEntry // key: artistID
 	searchCache map[string]*cacheEntry // key: query+type
@@ -69,8 +68,10 @@ var (
 	credentialsMu      sync.RWMutex
 )
 
+// ErrNoSpotifyCredentials is returned when Spotify credentials are not configured
+var ErrNoSpotifyCredentials = errors.New("Spotify credentials not configured. Please set your own Client ID and Secret in Settings, or use Deezer as metadata source (free, no credentials required)")
+
 // SetSpotifyCredentials sets custom Spotify API credentials
-// Pass empty strings to use default credentials
 func SetSpotifyCredentials(clientID, clientSecret string) {
 	credentialsMu.Lock()
 	defer credentialsMu.Unlock()
@@ -78,42 +79,53 @@ func SetSpotifyCredentials(clientID, clientSecret string) {
 	customClientSecret = clientSecret
 }
 
-// getCredentials returns the current credentials (custom or default)
-func getCredentials() (string, string) {
+// HasSpotifyCredentials checks if Spotify credentials are configured
+func HasSpotifyCredentials() bool {
 	credentialsMu.RLock()
 	defer credentialsMu.RUnlock()
-	
+
 	if customClientID != "" && customClientSecret != "" {
-		return customClientID, customClientSecret
-	}
-	
-	// Fall back to default credentials
-	clientID := os.Getenv("SPOTIFY_CLIENT_ID")
-	if clientID == "" {
-		if decoded, err := base64.StdEncoding.DecodeString("NWY1NzNjOTYyMDQ5NGJhZTg3ODkwYzBmMDhhNjAyOTM="); err == nil {
-			clientID = string(decoded)
-		}
+		return true
 	}
 
-	clientSecret := os.Getenv("SPOTIFY_CLIENT_SECRET")
-	if clientSecret == "" {
-		if decoded, err := base64.StdEncoding.DecodeString("MjEyNDc2ZDliMGYzNDcyZWFhNzYyZDkwYjE5YjBiYTg="); err == nil {
-			clientSecret = string(decoded)
-		}
+	if os.Getenv("SPOTIFY_CLIENT_ID") != "" && os.Getenv("SPOTIFY_CLIENT_SECRET") != "" {
+		return true
 	}
-	
-	return clientID, clientSecret
+
+	return false
+}
+
+// getCredentials returns the current credentials or error if not configured
+func getCredentials() (string, string, error) {
+	credentialsMu.RLock()
+	defer credentialsMu.RUnlock()
+
+	if customClientID != "" && customClientSecret != "" {
+		return customClientID, customClientSecret, nil
+	}
+
+	clientID := os.Getenv("SPOTIFY_CLIENT_ID")
+	clientSecret := os.Getenv("SPOTIFY_CLIENT_SECRET")
+
+	if clientID != "" && clientSecret != "" {
+		return clientID, clientSecret, nil
+	}
+
+	return "", "", ErrNoSpotifyCredentials
 }
 
 // NewSpotifyMetadataClient creates a new Spotify client
-func NewSpotifyMetadataClient() *SpotifyMetadataClient {
+// Returns error if credentials are not configured
+func NewSpotifyMetadataClient() (*SpotifyMetadataClient, error) {
+	clientID, clientSecret, err := getCredentials()
+	if err != nil {
+		return nil, err
+	}
+
 	src := rand.NewSource(time.Now().UnixNano())
 
-	// Get credentials (custom or default)
-	clientID, clientSecret := getCredentials()
-
 	c := &SpotifyMetadataClient{
-		httpClient:   NewHTTPClientWithTimeout(15 * time.Second), // Use shared transport for connection pooling
+		httpClient:   NewHTTPClientWithTimeout(15 * time.Second),
 		clientID:     clientID,
 		clientSecret: clientSecret,
 		rng:          rand.New(src),
@@ -122,7 +134,7 @@ func NewSpotifyMetadataClient() *SpotifyMetadataClient {
 		albumCache:   make(map[string]*cacheEntry),
 	}
 	c.userAgent = c.randomUserAgent()
-	return c
+	return c, nil
 }
 
 // TrackMetadata represents track information
@@ -140,6 +152,7 @@ type TrackMetadata struct {
 	DiscNumber  int    `json:"disc_number,omitempty"`
 	ExternalURL string `json:"external_urls"`
 	ISRC        string `json:"isrc"`
+	AlbumType   string `json:"album_type,omitempty"` // album, single, ep, compilation
 }
 
 // AlbumTrackMetadata holds per-track info for album/playlist
@@ -159,6 +172,7 @@ type AlbumTrackMetadata struct {
 	ISRC        string `json:"isrc"`
 	AlbumID     string `json:"album_id,omitempty"`
 	AlbumURL    string `json:"album_url,omitempty"`
+	AlbumType   string `json:"album_type,omitempty"` // album, single, ep, compilation
 }
 
 // AlbumInfoMetadata holds album information
@@ -283,6 +297,7 @@ type albumSimplified struct {
 	Images      []image     `json:"images"`
 	ExternalURL externalURL `json:"external_urls"`
 	Artists     []artist    `json:"artists"`
+	AlbumType   string      `json:"album_type"` // album, single, compilation
 }
 
 type trackFull struct {
@@ -331,14 +346,14 @@ func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string,
 	}
 
 	searchURL := fmt.Sprintf("%s?q=%s&type=track&limit=%d", searchBaseURL, url.QueryEscape(query), limit)
-	
+
 	var response struct {
 		Tracks struct {
 			Items []trackFull `json:"items"`
 			Total int         `json:"total"`
 		} `json:"tracks"`
 	}
-	
+
 	if err := c.getJSON(ctx, searchURL, token, &response); err != nil {
 		return nil, err
 	}
@@ -363,6 +378,7 @@ func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string,
 			DiscNumber:  track.DiscNumber,
 			ExternalURL: track.ExternalURL.Spotify,
 			ISRC:        track.ExternalID.ISRC,
+			AlbumType:   track.Album.AlbumType,
 		})
 	}
 
@@ -371,10 +387,8 @@ func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string,
 
 // SearchAll searches for tracks and artists on Spotify
 func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, trackLimit, artistLimit int) (*SearchAllResult, error) {
-	// Create cache key
 	cacheKey := fmt.Sprintf("all:%s:%d:%d", query, trackLimit, artistLimit)
-	
-	// Check cache first
+
 	c.cacheMu.RLock()
 	if entry, ok := c.searchCache[cacheKey]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -388,24 +402,24 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 	}
 
 	searchURL := fmt.Sprintf("%s?q=%s&type=track,artist&limit=%d", searchBaseURL, url.QueryEscape(query), trackLimit)
-	
+
 	var response struct {
 		Tracks struct {
 			Items []trackFull `json:"items"`
 		} `json:"tracks"`
 		Artists struct {
 			Items []struct {
-				ID         string  `json:"id"`
-				Name       string  `json:"name"`
-				Images     []image `json:"images"`
-				Followers  struct {
+				ID        string  `json:"id"`
+				Name      string  `json:"name"`
+				Images    []image `json:"images"`
+				Followers struct {
 					Total int `json:"total"`
 				} `json:"followers"`
 				Popularity int `json:"popularity"`
 			} `json:"items"`
 		} `json:"artists"`
 	}
-	
+
 	if err := c.getJSON(ctx, searchURL, token, &response); err != nil {
 		return nil, err
 	}
@@ -430,15 +444,15 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 			DiscNumber:  track.DiscNumber,
 			ExternalURL: track.ExternalURL.Spotify,
 			ISRC:        track.ExternalID.ISRC,
+			AlbumType:   track.Album.AlbumType,
 		})
 	}
 
-	// Limit artists to artistLimit
 	artistCount := len(response.Artists.Items)
 	if artistCount > artistLimit {
 		artistCount = artistLimit
 	}
-	
+
 	for i := 0; i < artistCount; i++ {
 		artist := response.Artists.Items[i]
 		result.Artists = append(result.Artists, SearchArtistResult{
@@ -450,7 +464,6 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 		})
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.searchCache[cacheKey] = &cacheEntry{
 		data:      result,
@@ -487,7 +500,6 @@ func (c *SpotifyMetadataClient) fetchTrack(ctx context.Context, trackID, token s
 }
 
 func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token string) (*AlbumResponsePayload, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if entry, ok := c.albumCache[albumID]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -534,7 +546,7 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 	// Collect all tracks (including paginated)
 	allTrackItems := data.Tracks.Items
 	nextURL := data.Tracks.Next
-	
+
 	// Fetch remaining tracks using pagination (no limit)
 	for nextURL != "" {
 		var pageData struct {
@@ -563,7 +575,7 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 	tracks := make([]AlbumTrackMetadata, 0, len(allTrackItems))
 	for _, item := range allTrackItems {
 		isrc := isrcMap[item.ID]
-		
+
 		tracks = append(tracks, AlbumTrackMetadata{
 			SpotifyID:   item.ID,
 			Artists:     joinArtists(item.Artists),
@@ -587,7 +599,6 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 		TrackList: tracks,
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.albumCache[albumID] = &cacheEntry{
 		data:      result,
@@ -602,23 +613,23 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 // Similar to Deezer implementation for consistency
 func (c *SpotifyMetadataClient) fetchISRCsParallel(ctx context.Context, trackIDs []string, token string) map[string]string {
 	const maxParallelISRC = 10 // Max concurrent ISRC fetches
-	
+
 	result := make(map[string]string)
 	var resultMu sync.Mutex
-	
+
 	if len(trackIDs) == 0 {
 		return result
 	}
-	
+
 	// Use semaphore to limit concurrent requests
 	sem := make(chan struct{}, maxParallelISRC)
 	var wg sync.WaitGroup
-	
+
 	for _, trackID := range trackIDs {
 		wg.Add(1)
 		go func(id string) {
 			defer wg.Done()
-			
+
 			// Acquire semaphore
 			select {
 			case sem <- struct{}{}:
@@ -626,15 +637,15 @@ func (c *SpotifyMetadataClient) fetchISRCsParallel(ctx context.Context, trackIDs
 			case <-ctx.Done():
 				return
 			}
-			
+
 			isrc := c.fetchTrackISRC(ctx, id, token)
-			
+
 			resultMu.Lock()
 			result[id] = isrc
 			resultMu.Unlock()
 		}(trackID)
 	}
-	
+
 	wg.Wait()
 	return result
 }
@@ -668,7 +679,7 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 
 	// Pre-allocate with expected capacity
 	tracks := make([]AlbumTrackMetadata, 0, data.Tracks.Total)
-	
+
 	// Add first batch of tracks
 	for _, item := range data.Tracks.Items {
 		if item.Track == nil {
@@ -695,7 +706,7 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 
 	// Fetch remaining tracks using pagination (NO LIMIT - fetch all tracks)
 	nextURL := data.Tracks.Next
-	
+
 	for nextURL != "" {
 		var pageData struct {
 			Items []struct {
@@ -745,7 +756,6 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 }
 
 func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token string) (*ArtistResponsePayload, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if entry, ok := c.artistCache[artistID]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -755,10 +765,10 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 
 	// Fetch artist info
 	var artistData struct {
-		ID         string  `json:"id"`
-		Name       string  `json:"name"`
-		Images     []image `json:"images"`
-		Followers  struct {
+		ID        string  `json:"id"`
+		Name      string  `json:"name"`
+		Images    []image `json:"images"`
+		Followers struct {
 			Total int `json:"total"`
 		} `json:"followers"`
 		Popularity int `json:"popularity"`
@@ -833,7 +843,6 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 		Albums:     albums,
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.artistCache[artistID] = &cacheEntry{
 		data:      result,
@@ -941,15 +950,15 @@ func (c *SpotifyMetadataClient) randomUserAgent() string {
 	defer c.rngMu.Unlock()
 
 	// Use Mac User-Agent format (same as PC version)
-	macMajor := c.rng.Intn(4) + 11    // 11-14
-	macMinor := c.rng.Intn(5) + 4     // 4-8
-	webkitMajor := c.rng.Intn(7) + 530 // 530-536
-	webkitMinor := c.rng.Intn(7) + 30  // 30-36
-	chromeMajor := c.rng.Intn(25) + 80 // 80-104
+	macMajor := c.rng.Intn(4) + 11         // 11-14
+	macMinor := c.rng.Intn(5) + 4          // 4-8
+	webkitMajor := c.rng.Intn(7) + 530     // 530-536
+	webkitMinor := c.rng.Intn(7) + 30      // 30-36
+	chromeMajor := c.rng.Intn(25) + 80     // 80-104
 	chromeBuild := c.rng.Intn(1500) + 3000 // 3000-4499
-	chromePatch := c.rng.Intn(65) + 60 // 60-124
-	safariMajor := c.rng.Intn(7) + 530 // 530-536
-	safariMinor := c.rng.Intn(6) + 30  // 30-35
+	chromePatch := c.rng.Intn(65) + 60     // 60-124
+	safariMajor := c.rng.Intn(7) + 530     // 530-536
+	safariMinor := c.rng.Intn(6) + 30      // 30-35
 
 	return fmt.Sprintf(
 		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_%d_%d) AppleWebKit/%d.%d (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/%d.%d",

ios/Runner.xcodeproj/project.pbxproj

@@ -427,7 +427,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = AppIcon;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
 				CLANG_CXX_LIBRARY = "libc++";
@@ -484,7 +484,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = AppIcon;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
 				CLANG_CXX_LIBRARY = "libc++";

ios/Runner/AppDelegate.swift

@@ -120,6 +120,12 @@ import Gobackend  // Import Go framework
             let itemId = args["item_id"] as! String
             GobackendClearItemProgress(itemId)
             return nil
+
+        case "cancelDownload":
+            let args = call.arguments as! [String: Any]
+            let itemId = args["item_id"] as! String
+            GobackendCancelDownload(itemId)
+            return nil
             
         case "setDownloadDirectory":
             let args = call.arguments as! [String: Any]
@@ -155,7 +161,8 @@ import Gobackend  // Import Go framework
             let spotifyId = args["spotify_id"] as! String
             let trackName = args["track_name"] as! String
             let artistName = args["artist_name"] as! String
-            let response = GobackendFetchLyrics(spotifyId, trackName, artistName, &error)
+            let durationMs = args["duration_ms"] as? Int64 ?? 0
+            let response = GobackendFetchLyrics(spotifyId, trackName, artistName, durationMs, &error)
             if let error = error { throw error }
             return response
             
@@ -165,7 +172,8 @@ import Gobackend  // Import Go framework
             let trackName = args["track_name"] as! String
             let artistName = args["artist_name"] as! String
             let filePath = args["file_path"] as? String ?? ""
-            let response = GobackendGetLyricsLRC(spotifyId, trackName, artistName, filePath, &error)
+            let durationMs = args["duration_ms"] as? Int64 ?? 0
+            let response = GobackendGetLyricsLRC(spotifyId, trackName, artistName, filePath, durationMs, &error)
             if let error = error { throw error }
             return response
             
@@ -181,6 +189,407 @@ import Gobackend  // Import Go framework
             GobackendCleanupConnections()
             return nil
             
+        case "readFileMetadata":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendReadFileMetadata(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "searchDeezerAll":
+            let args = call.arguments as! [String: Any]
+            let query = args["query"] as! String
+            let trackLimit = args["track_limit"] as? Int ?? 15
+            let artistLimit = args["artist_limit"] as? Int ?? 3
+            let response = GobackendSearchDeezerAll(query, Int(trackLimit), Int(artistLimit), &error)
+            if let error = error { throw error }
+            return response
+
+        case "getDeezerMetadata":
+            let args = call.arguments as! [String: Any]
+            let resourceType = args["resource_type"] as! String
+            let resourceId = args["resource_id"] as! String
+            let response = GobackendGetDeezerMetadata(resourceType, resourceId, &error)
+            if let error = error { throw error }
+            return response
+
+        case "parseDeezerUrl":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendParseDeezerURLExport(url, &error)
+            if let error = error { throw error }
+            return response
+
+        case "searchDeezerByISRC":
+            let args = call.arguments as! [String: Any]
+            let isrc = args["isrc"] as! String
+            let response = GobackendSearchDeezerByISRC(isrc, &error)
+            if let error = error { throw error }
+            return response
+
+        case "convertSpotifyToDeezer":
+            let args = call.arguments as! [String: Any]
+            let resourceType = args["resource_type"] as! String
+            let spotifyId = args["spotify_id"] as! String
+            let response = GobackendConvertSpotifyToDeezer(resourceType, spotifyId, &error)
+            if let error = error { throw error }
+            return response
+
+        case "getSpotifyMetadataWithFallback":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendGetSpotifyMetadataWithDeezerFallback(url, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "preWarmTrackCache":
+            let args = call.arguments as! [String: Any]
+            let tracksJson = args["tracks"] as! String
+            let _ = GobackendPreWarmTrackCacheJSON(tracksJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getTrackCacheSize":
+            let response = GobackendGetTrackCacheSize()
+            return response
+            
+        case "clearTrackCache":
+            GobackendClearTrackCache()
+            return nil
+            
+        case "setSpotifyCredentials":
+            let args = call.arguments as! [String: Any]
+            let clientId = args["client_id"] as! String
+            let clientSecret = args["client_secret"] as! String
+            GobackendSetSpotifyAPICredentials(clientId, clientSecret)
+            return nil
+            
+        case "hasSpotifyCredentials":
+            let hasCredentials = GobackendCheckSpotifyCredentials()
+            return hasCredentials
+            
+        // Log methods
+        case "getLogs":
+            let response = GobackendGetLogs()
+            return response
+            
+        case "getLogsSince":
+            let args = call.arguments as! [String: Any]
+            let index = args["index"] as? Int ?? 0
+            let response = GobackendGetLogsSince(Int(index))
+            return response
+            
+        case "clearLogs":
+            GobackendClearLogs()
+            return nil
+            
+        case "getLogCount":
+            let response = GobackendGetLogCount()
+            return response
+            
+        case "setLoggingEnabled":
+            let args = call.arguments as! [String: Any]
+            let enabled = args["enabled"] as? Bool ?? false
+            GobackendSetLoggingEnabled(enabled)
+            return nil
+            
+        // Extension System methods
+        case "initExtensionSystem":
+            let args = call.arguments as! [String: Any]
+            let extensionsDir = args["extensions_dir"] as! String
+            let dataDir = args["data_dir"] as! String
+            GobackendInitExtensionSystem(extensionsDir, dataDir, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "loadExtensionsFromDir":
+            let args = call.arguments as! [String: Any]
+            let dirPath = args["dir_path"] as! String
+            let response = GobackendLoadExtensionsFromDir(dirPath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "loadExtensionFromPath":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendLoadExtensionFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "unloadExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendUnloadExtensionByID(extensionId, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getInstalledExtensions":
+            let response = GobackendGetInstalledExtensions(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionEnabled":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let enabled = args["enabled"] as? Bool ?? false
+            GobackendSetExtensionEnabledByID(extensionId, enabled, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "setProviderPriority":
+            let args = call.arguments as! [String: Any]
+            let priorityJson = args["priority"] as! String
+            GobackendSetProviderPriorityJSON(priorityJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getProviderPriority":
+            let response = GobackendGetProviderPriorityJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "setMetadataProviderPriority":
+            let args = call.arguments as! [String: Any]
+            let priorityJson = args["priority"] as! String
+            GobackendSetMetadataProviderPriorityJSON(priorityJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getMetadataProviderPriority":
+            let response = GobackendGetMetadataProviderPriorityJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "getExtensionSettings":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionSettingsJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionSettings":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let settingsJson = args["settings"] as! String
+            GobackendSetExtensionSettingsJSON(extensionId, settingsJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "searchTracksWithExtensions":
+            let args = call.arguments as! [String: Any]
+            let query = args["query"] as! String
+            let limit = args["limit"] as? Int ?? 20
+            let response = GobackendSearchTracksWithExtensionsJSON(query, Int(limit), &error)
+            if let error = error { throw error }
+            return response
+            
+        case "downloadWithExtensions":
+            let requestJson = call.arguments as! String
+            let response = GobackendDownloadWithExtensionsJSON(requestJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "removeExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendRemoveExtensionByID(extensionId, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "upgradeExtension":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendUpgradeExtensionFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "checkExtensionUpgrade":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendCheckExtensionUpgradeFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "cleanupExtensions":
+            GobackendCleanupExtensions()
+            return nil
+            
+        // Extension Auth API
+        case "getExtensionPendingAuth":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionPendingAuthJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionAuthCode":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let authCode = args["auth_code"] as! String
+            GobackendSetExtensionAuthCodeByID(extensionId, authCode)
+            return nil
+            
+        case "setExtensionTokens":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let accessToken = args["access_token"] as! String
+            let refreshToken = args["refresh_token"] as? String ?? ""
+            let expiresIn = args["expires_in"] as? Int ?? 0
+            GobackendSetExtensionTokensByID(extensionId, accessToken, refreshToken, Int(expiresIn))
+            return nil
+            
+        case "clearExtensionPendingAuth":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendClearExtensionPendingAuthByID(extensionId)
+            return nil
+            
+        case "isExtensionAuthenticated":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendIsExtensionAuthenticatedByID(extensionId)
+            return response
+            
+        case "getAllPendingAuthRequests":
+            let response = GobackendGetAllPendingAuthRequestsJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension FFmpeg API
+        case "getPendingFFmpegCommand":
+            let args = call.arguments as! [String: Any]
+            let commandId = args["command_id"] as! String
+            let response = GobackendGetPendingFFmpegCommandJSON(commandId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setFFmpegCommandResult":
+            let args = call.arguments as! [String: Any]
+            let commandId = args["command_id"] as! String
+            let success = args["success"] as? Bool ?? false
+            let output = args["output"] as? String ?? ""
+            let errorMsg = args["error"] as? String ?? ""
+            GobackendSetFFmpegCommandResult(commandId, success, output, errorMsg)
+            return nil
+            
+        case "getAllPendingFFmpegCommands":
+            let response = GobackendGetAllPendingFFmpegCommandsJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Custom Search API
+        case "customSearchWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let query = args["query"] as! String
+            let optionsJson = args["options"] as? String ?? ""
+            let response = GobackendCustomSearchWithExtensionJSON(extensionId, query, optionsJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getSearchProviders":
+            let response = GobackendGetSearchProvidersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension URL Handler API
+        case "handleURLWithExtension":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendHandleURLWithExtensionJSON(url, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "findURLHandler":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendFindURLHandlerJSON(url)
+            return response
+            
+        case "getURLHandlers":
+            let response = GobackendGetURLHandlersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "getAlbumWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let albumId = args["album_id"] as! String
+            let response = GobackendGetAlbumWithExtensionJSON(extensionId, albumId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getPlaylistWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let playlistId = args["playlist_id"] as! String
+            let response = GobackendGetPlaylistWithExtensionJSON(extensionId, playlistId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getArtistWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let artistId = args["artist_id"] as! String
+            let response = GobackendGetArtistWithExtensionJSON(extensionId, artistId, &error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Post-Processing API
+        case "runPostProcessing":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let metadataJson = args["metadata"] as? String ?? ""
+            let response = GobackendRunPostProcessingJSON(filePath, metadataJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getPostProcessingProviders":
+            let response = GobackendGetPostProcessingProvidersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Store
+        case "initExtensionStore":
+            let args = call.arguments as! [String: Any]
+            let cacheDir = args["cache_dir"] as! String
+            GobackendInitExtensionStoreJSON(cacheDir, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getStoreExtensions":
+            let args = call.arguments as! [String: Any]
+            let forceRefresh = args["force_refresh"] as? Bool ?? false
+            let response = GobackendGetStoreExtensionsJSON(forceRefresh, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "searchStoreExtensions":
+            let args = call.arguments as! [String: Any]
+            let query = args["query"] as? String ?? ""
+            let category = args["category"] as? String ?? ""
+            let response = GobackendSearchStoreExtensionsJSON(query, category, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getStoreCategories":
+            let response = GobackendGetStoreCategoriesJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "downloadStoreExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let destDir = args["dest_dir"] as! String
+            let response = GobackendDownloadStoreExtensionJSON(extensionId, destDir, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "clearStoreCache":
+            GobackendClearStoreCacheJSON(&error)
+            if let error = error { throw error }
+            return nil
+            
         default:
             throw NSError(
                 domain: "SpotiFLAC",

ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,122 +1 @@
-{
-  "images" : [
-    {
-      "size" : "20x20",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-20x20@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "20x20",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-20x20@3x.png",
-      "scale" : "3x"
-    },
-    {
-      "size" : "29x29",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-29x29@1x.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "29x29",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-29x29@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "29x29",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-29x29@3x.png",
-      "scale" : "3x"
-    },
-    {
-      "size" : "40x40",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-40x40@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "40x40",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-40x40@3x.png",
-      "scale" : "3x"
-    },
-    {
-      "size" : "60x60",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-60x60@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "60x60",
-      "idiom" : "iphone",
-      "filename" : "Icon-App-60x60@3x.png",
-      "scale" : "3x"
-    },
-    {
-      "size" : "20x20",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-20x20@1x.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "20x20",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-20x20@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "29x29",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-29x29@1x.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "29x29",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-29x29@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "40x40",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-40x40@1x.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "40x40",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-40x40@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "76x76",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-76x76@1x.png",
-      "scale" : "1x"
-    },
-    {
-      "size" : "76x76",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-76x76@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "83.5x83.5",
-      "idiom" : "ipad",
-      "filename" : "Icon-App-83.5x83.5@2x.png",
-      "scale" : "2x"
-    },
-    {
-      "size" : "1024x1024",
-      "idiom" : "ios-marketing",
-      "filename" : "Icon-App-1024x1024@1x.png",
-      "scale" : "1x"
-    }
-  ],
-  "info" : {
-    "version" : 1,
-    "author" : "xcode"
-  }
-}
+{"images":[{"size":"20x20","idiom":"iphone","filename":"Icon-App-20x20@2x.png","scale":"2x"},{"size":"20x20","idiom":"iphone","filename":"Icon-App-20x20@3x.png","scale":"3x"},{"size":"29x29","idiom":"iphone","filename":"Icon-App-29x29@1x.png","scale":"1x"},{"size":"29x29","idiom":"iphone","filename":"Icon-App-29x29@2x.png","scale":"2x"},{"size":"29x29","idiom":"iphone","filename":"Icon-App-29x29@3x.png","scale":"3x"},{"size":"40x40","idiom":"iphone","filename":"Icon-App-40x40@2x.png","scale":"2x"},{"size":"40x40","idiom":"iphone","filename":"Icon-App-40x40@3x.png","scale":"3x"},{"size":"57x57","idiom":"iphone","filename":"Icon-App-57x57@1x.png","scale":"1x"},{"size":"57x57","idiom":"iphone","filename":"Icon-App-57x57@2x.png","scale":"2x"},{"size":"60x60","idiom":"iphone","filename":"Icon-App-60x60@2x.png","scale":"2x"},{"size":"60x60","idiom":"iphone","filename":"Icon-App-60x60@3x.png","scale":"3x"},{"size":"20x20","idiom":"ipad","filename":"Icon-App-20x20@1x.png","scale":"1x"},{"size":"20x20","idiom":"ipad","filename":"Icon-App-20x20@2x.png","scale":"2x"},{"size":"29x29","idiom":"ipad","filename":"Icon-App-29x29@1x.png","scale":"1x"},{"size":"29x29","idiom":"ipad","filename":"Icon-App-29x29@2x.png","scale":"2x"},{"size":"40x40","idiom":"ipad","filename":"Icon-App-40x40@1x.png","scale":"1x"},{"size":"40x40","idiom":"ipad","filename":"Icon-App-40x40@2x.png","scale":"2x"},{"size":"50x50","idiom":"ipad","filename":"Icon-App-50x50@1x.png","scale":"1x"},{"size":"50x50","idiom":"ipad","filename":"Icon-App-50x50@2x.png","scale":"2x"},{"size":"72x72","idiom":"ipad","filename":"Icon-App-72x72@1x.png","scale":"1x"},{"size":"72x72","idiom":"ipad","filename":"Icon-App-72x72@2x.png","scale":"2x"},{"size":"76x76","idiom":"ipad","filename":"Icon-App-76x76@1x.png","scale":"1x"},{"size":"76x76","idiom":"ipad","filename":"Icon-App-76x76@2x.png","scale":"2x"},{"size":"83.5x83.5","idiom":"ipad","filename":"Icon-App-83.5x83.5@2x.png","scale":"2x"},{"size":"1024x1024","idiom":"ios-marketing","filename":"Icon-App-1024x1024@1x.png","scale":"1x"}],"info":{"version":1,"author":"xcode"}}

ios/Runner/Info.plist

@@ -4,6 +4,23 @@
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleLocalizations</key>
+	<array>
+		<string>en</string>
+		<string>de</string>
+		<string>es</string>
+		<string>fr</string>
+		<string>hi</string>
+		<string>id</string>
+		<string>ja</string>
+		<string>ko</string>
+		<string>nl</string>
+		<string>pt</string>
+		<string>ru</string>
+		<string>zh</string>
+		<string>zh-Hans</string>
+		<string>zh-Hant</string>
+	</array>
 	<key>CFBundleDisplayName</key>
 	<string>SpotiFLAC</string>
 	<key>CFBundleExecutable</key>

l10n.yaml

@@ -0,0 +1,6 @@
+arb-dir: lib/l10n/arb
+template-arb-file: app_en.arb
+output-localization-file: app_localizations.dart
+output-class: AppLocalizations
+output-dir: lib/l10n
+nullable-getter: false

lib/app.dart

@@ -1,13 +1,14 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
 import 'package:go_router/go_router.dart';
 import 'package:spotiflac_android/screens/main_shell.dart';
 import 'package:spotiflac_android/screens/setup_screen.dart';
 import 'package:spotiflac_android/providers/settings_provider.dart';
 import 'package:spotiflac_android/theme/dynamic_color_wrapper.dart';
+import 'package:spotiflac_android/l10n/app_localizations.dart';
 
 final _routerProvider = Provider<GoRouter>((ref) {
-  // Only watch isFirstLaunch to prevent router rebuild on other settings changes
   final isFirstLaunch = ref.watch(settingsProvider.select((s) => s.isFirstLaunch));
   
   return GoRouter(
@@ -31,6 +32,12 @@ class SpotiFLACApp extends ConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final router = ref.watch(_routerProvider);
+    final localeString = ref.watch(settingsProvider.select((s) => s.locale));
+    
+    Locale? locale;
+    if (localeString != 'system') {
+      locale = Locale(localeString);
+    }
     
     return DynamicColorWrapper(
       builder: (lightTheme, darkTheme, themeMode) {
@@ -43,6 +50,14 @@ class SpotiFLACApp extends ConsumerWidget {
           themeAnimationDuration: const Duration(milliseconds: 300),
           themeAnimationCurve: Curves.easeInOut,
           routerConfig: router,
+          locale: locale,
+          localizationsDelegates: const [
+            AppLocalizations.delegate,
+            GlobalMaterialLocalizations.delegate,
+            GlobalWidgetsLocalizations.delegate,
+            GlobalCupertinoLocalizations.delegate,
+          ],
+          supportedLocales: AppLocalizations.supportedLocales,
         );
       },
     );

lib/constants/app_info.dart

@@ -1,8 +1,8 @@
 /// App version and info constants
 /// Update version here only - all other files will reference this
 class AppInfo {
-  static const String version = '2.1.6';
-  static const String buildNumber = '44';
+  static const String version = '3.1.1';
+  static const String buildNumber = '60';
   static const String fullVersion = '$version+$buildNumber';