Two large changes since Beta15: the connection is now encrypted end to end with a real pairing flow, and the app has been refocused to do one job -- be a SendSpin player.
Requires a server that speaks the encrypted dialect
This build removes the legacy plaintext dialect entirely. The encrypted Noise handshake is now the only way it talks to a server, so a server that speaks only the old dialect will not connect.
Music Assistant 2.9.x already satisfies this: it pins aiosendspin 9.1.0, which ships the full Noise implementation. Encryption has been normative in the SendSpin spec since spec #84.
Added: encryption and pairing
- Noise KKpsk2 handshake for both cipher suites, over a new encrypted wire layer
- Per-device Pairing PSK, plus a trust store for long-term PSK records; trust level and activation follow the matched PSK
- Pairing and abort in both directions with an attempt timeout, and
server/unpairhandling - The pairing token is shown as a scannable QR code
- In-band re-handshake with an atomic key swap, so keys rotate without dropping the connection
- Management API:
get-pairing-config/set-pairing-configwith patch semantics, and record list/add/remove - Message fragmentation for binary types 2 and 3
Changed: this is a SendSpin player now
Library browsing, search, the queue and the track detail screens are gone. The SendSpin spec's player role receives synchronized audio and metadata -- it has no library, browse, search or viewable queue. Those screens were Music Assistant features rather than SendSpin ones, and Music Assistant's own app remains the better tool for browsing a library.
What remains is Now Playing with transport controls, and a server picker when disconnected.
- Android Auto now shows a single "Connect" tab for choosing or switching servers. Library browsing in the car is gone.
- Remote access over WebRTC and the HTTP proxy has been removed. Connect over the local network, or by typing a server address directly. A SendSpin-native remote story may come later.
Fixed
- Track changes no longer mis-anchor audio. Decode chunks now carry a stream generation, so audio decoded against the previous stream cannot be played against the new one.
server/statedeltas are merged rather than replacing the whole state, so a partial update no longer wipes existing metadata.- Diagnostics report the current network instead of whatever it was when the service started.
Size
The APK is 4.6 MB, down from 52.7 MB in Beta15 -- a 91% reduction. Most of it is the removed WebRTC native library, along with the QR scanner and CameraX artifacts that existed only for the old remote-access setup flow.