Music workspace

When voicePlugin() is enabled, every shared server receives a Music workspace at /app/servers/:guildId/music.

The player-first workspace places search and queue entry at the top, followed by prominent artwork and track metadata, playback progress, transport controls, the live queue, and synchronized lyrics. Signed-in members sharing the guild with the bot can add a song, artist, album, or supported music link while they are connected to a Discord voice channel. They can pause, resume, or vote to skip using the same Voice runtime as Discord commands.

Guild managers and configured Popii owners can additionally clear the queue, remove queued tracks, and disconnect the bot. Destructive actions are absent for ordinary members and are rejected again by server-side authorization.

The browser polls a private same-origin endpoint every three seconds. That endpoint requires the current server-side session and revalidates guild access; the browser never supplies trusted playback or permission state. Every mutation requires CSRF validation and produces a guild audit event.

Dashboard-submitted URLs are restricted to YouTube, SoundCloud, Spotify, and Apple Music. Plain text is treated as a search. This prevents the dashboard from becoming a general-purpose server-side URL fetcher.

Synchronized lyrics are looked up server-side through LRCLIB, cached for ten minutes, and fetched with a five-second timeout. Lyrics are treated as text, never HTML. When synchronized lyrics are unavailable, playback and queue controls continue normally.

The workspace works without client-side routing. JavaScript only enhances the server-rendered page with live progress, polling, queue refresh, and lyric highlighting.