fix(dist): stop stripping .py sources; wipe payload on NSIS upgrade

Two root causes for the 'imaging extension was built for another version
of Pillow' error users hit after install:

1) cleanup_site_packages ran 'find ... -name "*.py" ! -name "__init__.py"
   -delete' with a comment claiming 'keep .pyc only' — but no compileall
   step exists. Result: the dist shipped __init__.py + .pyd only, missing
   every submodule (Image.py, ImageDraw.py, _version.py, ...). Fresh
   installs were broken; in-place upgrades produced a half-old/half-new
   site-packages. Removed the deletion entirely.

2) NSIS installer extracted over the previous install without cleaning
   python/, app/, scripts/. Upgrades left stale files (old PIL/_version.py
   next to new PIL/_imaging.pyd) which raised the Pillow ABI mismatch.
   Wipe those subtrees before File /r, preserving config.yaml at the
   install root.

RELEASE_NOTES.md

@@ -1,11 +1,19 @@
-## v0.1.2 (2026-03-29)
-
-### Features
-- Redesign media browser UI ([cad6e8a](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/cad6e8a))
-- Add media folder management from WebUI ([c9ee41a](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/c9ee41a))
+## v0.1.4 (2026-04-07)
 
 ### Bug Fixes
-- Make folder status visible with dot + text label ([c50a8f4](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/c50a8f4))
+- Prevent dialog `showModal` from auto-focusing first input ([db777fa](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/db777fa))
+
+---
+
+### Development / Internal
+
+#### CI/Build
+- Replace `uvicorn[standard]` with explicit Windows-safe extras; avoids uvloop cross-build deadlock ([28293c6](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/28293c6))
+- Move `pystray` into the unified cross-deps resolve so its Pillow matches the core one ([8450040](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/8450040))
+- Hybrid pip-download: single call for cross-platform deps (consistent `pydantic-core`), per-dep loop with `--pre` for Windows-only ([39b3aed](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/39b3aed))
+- Normalize non-PEP440 versions before stamping `pyproject.toml` ([69df9b6](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/69df9b6))
+- Pass `--pre` to `pip download` for winsdk beta wheels ([760c3df](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/760c3df))
+- Revert broken action caching (Gitea cache backend not configured) ([60f287b](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/60f287b))
 
 ---
 
@@ -14,8 +22,14 @@
 
 | Hash | Message | Author |
 |------|---------|--------|
-| [c50a8f4](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/c50a8f4) | fix: make folder status visible with dot + text label | alexei.dolgolyov |
-| [cad6e8a](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/cad6e8a) | feat: redesign media browser UI | alexei.dolgolyov |
-| [c9ee41a](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/c9ee41a) | feat: add media folder management from WebUI | alexei.dolgolyov |
+| [8450040](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/8450040) | fix(ci): move pystray to VIS_DEPS so its Pillow resolves with core | alexei.dolgolyov |
+| [28293c6](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/28293c6) | fix(ci): replace uvicorn[standard] with explicit extras for cross-build | alexei.dolgolyov |
+| [39b3aed](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/39b3aed) | fix(ci): hybrid pip download - single call for cross-platform deps | alexei.dolgolyov |
+| [ba90dff](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/ba90dff) | fix(ci): revert to per-dep pip download loop with --pre | alexei.dolgolyov |
+| [69df9b6](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/69df9b6) | fix(ci): normalize non-PEP440 versions before stamping pyproject.toml | alexei.dolgolyov |
+| [760c3df](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/760c3df) | fix(ci): pass --pre to pip download for winsdk beta wheels | alexei.dolgolyov |
+| [60f287b](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/60f287b) | ci: revert action caching, gitea cache backend not configured | alexei.dolgolyov |
+| [f52af51](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/f52af51) | ci: cache pip wheels, npm deps, and embedded Python in release workflow | alexei.dolgolyov |
+| [db777fa](https://git.dolgolyov-family.by/alexei.dolgolyov/media-player-server/commit/db777fa) | fix: prevent dialog showModal from auto-focusing first input | alexei.dolgolyov |
 
 </details>

build-common.sh

@@ -23,6 +23,17 @@ detect_version() {
 
     VERSION_CLEAN="${VERSION#v}"
 
+    # Normalize non-PEP440 labels (e.g. "dev", "nightly", "snapshot") to a
+    # valid PEP440 dev release. Without this, pip/setuptools rejects
+    # pyproject.toml with: `project.version` must be pep440.
+    #
+    # Valid forms:   1.2.3, 1.2.3a1, 1.2.3rc2, 1.2.3.dev0, 1.2.3.post1, +local
+    # Invalid forms: dev, vdev, nightly, snapshot-2024
+    if ! [[ "$VERSION_CLEAN" =~ ^[0-9]+(\.[0-9]+)*((a|b|rc|\.dev|\.post)[0-9]+)*(\+[a-zA-Z0-9.]+)?$ ]]; then
+        echo "  Warning: '$VERSION_CLEAN' is not PEP440-compliant, using 0.0.0.dev0"
+        VERSION_CLEAN="0.0.0.dev0"
+    fi
+
     # Stamp version into pyproject.toml (single source of truth)
     sed -i "s/^version = .*/version = \"${VERSION_CLEAN}\"/" pyproject.toml
 }
@@ -98,6 +109,13 @@ cleanup_site_packages() {
     # Strip debug symbols from native extensions
     find "$sp_dir" -name "*.$ext_suffix" -exec strip --strip-debug {} \; 2>/dev/null || true
 
-    # Remove .py source files (keep .pyc only) — saves ~30-40% on pure-Python packages
-    find "$sp_dir" -name "*.py" ! -name "__init__.py" -delete 2>/dev/null || true
+    # NOTE: do NOT strip .py source files. A previous version of this function
+    # ran `find ... -name "*.py" ! -name "__init__.py" -delete` with a comment
+    # claiming "keep .pyc only" — but no compileall step exists, so the dist
+    # shipped with __init__.py + .pyd only, missing every submodule (Image.py,
+    # ImageDraw.py, _version.py, ...). Fresh installs would fail with
+    # ModuleNotFoundError; in-place upgrades over an older install produced a
+    # half-old/half-new site-packages where PIL/__init__.py was new but
+    # PIL/_version.py was stale, yielding the runtime "_imaging extension was
+    # built for another version of Pillow" import error.
 }

build-dist-windows.sh

@@ -19,10 +19,15 @@ BUILD_OUTPUT="build/MediaServer-v${VERSION_CLEAN}-win-x64"
 
 clean_dist "${DIST_DIR}" "${WHEEL_DIR}" "${SITE_PACKAGES}"
 
-# --- Download embedded Python ---
-echo "Downloading embedded Python ${PYTHON_VERSION}..."
-curl -sL "https://www.python.org/ftp/python/${PYTHON_VERSION}/python-${PYTHON_VERSION}-embed-amd64.zip" \
-    -o build/python-embed.zip
+# --- Download embedded Python (cache-friendly) ---
+mkdir -p build
+if [ ! -f build/python-embed.zip ]; then
+    echo "Downloading embedded Python ${PYTHON_VERSION}..."
+    curl -sL "https://www.python.org/ftp/python/${PYTHON_VERSION}/python-${PYTHON_VERSION}-embed-amd64.zip" \
+        -o build/python-embed.zip
+else
+    echo "Using cached embedded Python ${PYTHON_VERSION}"
+fi
 unzip -qo build/python-embed.zip -d "${DIST_DIR}/python"
 
 # Patch ._pth to enable site-packages and app source
@@ -35,9 +40,18 @@ echo '..\app' >> "$PTH_FILE"
 echo "Downloading Windows wheels..."
 
 # Core dependencies
+# NOTE: uvicorn[standard] pulls in uvloop via `sys_platform != 'win32'` marker.
+# pip evaluates env markers against the HOST (Linux in CI), so uvloop is
+# requested, but `--platform win_amd64 --only-binary :all:` cannot find a
+# Windows wheel for uvloop (none exist). Result: pip backtracks across every
+# uvicorn[standard] version and ResolutionImpossible. Fix: use plain uvicorn
+# and list only the Windows-compatible standard extras we actually need.
 CORE_DEPS=(
     "fastapi>=0.109.0"
-    "uvicorn[standard]>=0.27.0"
+    "uvicorn>=0.27.0"
+    "httptools>=0.5.0"
+    "websockets>=10.4"
+    "python-dotenv>=0.13"
     "pydantic>=2.0"
     "pydantic-settings>=2.0"
     "pyyaml>=6.0"
@@ -53,23 +67,37 @@ WIN_DEPS=(
     "pycaw>=20230407"
     "screen-brightness-control>=0.20.0"
     "monitorcontrol>=3.0.0"
-    "pystray>=0.19.0"
 )
 
 # Visualizer dependencies
 VIS_DEPS=(
     "soundcard>=0.4.0"
     "numpy>=1.24.0,<2.0"
+    # pystray lives here (not WIN_DEPS) so its transitive Pillow resolves in the
+    # same pass as CORE_DEPS. Keeping it in the per-dep WIN_DEPS loop downloaded
+    # a second Pillow version that clobbered the core one on unzip, producing
+    # "_imaging extension was built for another version of Pillow" at runtime.
+    "pystray>=0.19.0"
 )
 
-ALL_DEPS=("${CORE_DEPS[@]}" "${WIN_DEPS[@]}" "${VIS_DEPS[@]}")
+# Resolve core + visualizer deps in a SINGLE call so pip picks compatible
+# transitive versions (notably pydantic/pydantic-core must match).
+# Per-dep loops resolve each dep independently and can leave mismatched
+# transitive versions that overwrite each other in the site-packages unzip.
+CROSS_DEPS=("${CORE_DEPS[@]}" "${VIS_DEPS[@]}")
+pip download --quiet --no-cache-dir --dest "$WHEEL_DIR" \
+    --platform win_amd64 --python-version "${PYTHON_SHORT}" \
+    --implementation cp --only-binary :all: \
+    "${CROSS_DEPS[@]}"
 
-for dep in "${ALL_DEPS[@]}"; do
-    pip download --quiet --no-cache-dir --dest "$WHEEL_DIR" \
+# Windows-only deps in a loop with --pre: winsdk only ships beta wheels
+# (1.0.0bNN) and each dep needs its own platform/non-platform fallback.
+for dep in "${WIN_DEPS[@]}"; do
+    pip download --pre --quiet --no-cache-dir --dest "$WHEEL_DIR" \
         --platform win_amd64 --python-version "${PYTHON_SHORT}" \
         --implementation cp --only-binary :all: \
         "$dep" 2>/dev/null || \
-    pip download --quiet --no-cache-dir --dest "$WHEEL_DIR" \
+    pip download --pre --quiet --no-cache-dir --dest "$WHEEL_DIR" \
         --only-binary :all: \
         "$dep"
 done

installer.nsi

@@ -70,6 +70,19 @@ Section "!Core (required)" SecCore
 
     SetOutPath "$INSTDIR"
 
+    ; Wipe previous payload before extracting so stale files from an older
+    ; version cannot survive an upgrade. Without this, in-place upgrades
+    ; produce a half-old/half-new site-packages — e.g. an old PIL/_version.py
+    ; alongside a new PIL/_imaging.pyd, which raises "_imaging extension was
+    ; built for another version of Pillow" at runtime. config.yaml lives at
+    ; $INSTDIR root and is preserved.
+    RMDir /r "$INSTDIR\python"
+    RMDir /r "$INSTDIR\app"
+    RMDir /r "$INSTDIR\scripts"
+    Delete "$INSTDIR\${EXENAME}"
+    Delete "$INSTDIR\VERSION"
+    Delete "$INSTDIR\config.example.yaml"
+
     ; Copy entire distribution
     File /r "dist\media-server\*.*"
 

media_server/static/js/app.js

@@ -133,6 +133,23 @@ Object.assign(window, {
 // Initialization (DOMContentLoaded)
 // ============================================================
 
+// Prevent <dialog>.showModal() from auto-focusing the first input field.
+// On touch devices this pops up the on-screen keyboard, which is confusing
+// when the user just opened a dialog. Force focus onto the dialog itself.
+const _origShowModal = HTMLDialogElement.prototype.showModal;
+HTMLDialogElement.prototype.showModal = function (...args) {
+    if (!this.hasAttribute('tabindex')) {
+        this.setAttribute('tabindex', '-1');
+    }
+    const result = _origShowModal.apply(this, args);
+    const active = document.activeElement;
+    if (active && active !== this && this.contains(active)) {
+        active.blur();
+        this.focus({ preventScroll: true });
+    }
+    return result;
+};
+
 window.addEventListener('DOMContentLoaded', async () => {
     // Cache DOM references
     cacheDom();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "media-server-frontend",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "private": true,
   "description": "Frontend build tooling for media server WebUI",
   "scripts": {

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "media-server"
-version = "0.1.2"
+version = "0.1.4"
 description = "REST API server for controlling system-wide media playback"
 readme = "README.md"
 license = { text = "MIT" }