Enhance ResolvConf migration to support multiple DHCP script variants

This update allows the service to correctly patch both /etc/udhcpc.d/50default and /opt/Bose/udhcpc.script (used in SoundTouch 10 firmware) for DNS redirection. It also improves robustness by adding file existence checks in rc.local and ensures clean state by reverting to .original backups during migration.
fix(setup): prevent and clean up corrupted rc.local with cat error message
2026-08-31 14:57:17 +00:00 · 2026-02-16 18:52:25 +01:00 · 2026-02-16 18:20:16 +01:00 · 2026-02-16 18:04:28 +01:00 · 2026-02-16 18:04:28 +01:00 · 2026-02-16 18:04:28 +01:00
125 changed files with 9070 additions and 742 deletions
@@ -1,6 +1,9 @@
 # Bose SoundTouch Configuration
 # Copy this file to .env and customize for your setup

+# Docker/Service Settings
+SOUNDTOUCH_HOSTNAME=soundtouch.local
+
 # Discovery Settings
 DISCOVERY_TIMEOUT=5s
 UPNP_ENABLED=true
@@ -149,8 +149,8 @@ jobs:
          # Check that all documented endpoints exist in code
          echo "Validating API documentation consistency..."

-          # Extract endpoint patterns from cookbook
-          if [ -f "docs/API-COOKBOOK.md" ]; then
+          # Check API cookbook
+          if [ -f "docs/reference/API-COOKBOOK.md" ]; then
            echo "✓ API Cookbook exists"
          else
            echo "✗ API Cookbook missing"
@@ -158,7 +158,7 @@ jobs:
          fi

          # Check getting started guide
-          if [ -f "docs/GETTING-STARTED.md" ]; then
+          if [ -f "docs/guides/GETTING-STARTED.md" ]; then
            echo "✓ Getting Started guide exists"
          else
            echo "✗ Getting Started guide missing"
@@ -0,0 +1,37 @@
+name: Deploy Documentation
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+      - name: Build with Jekyll
+        uses: actions/jekyll-build-pages@v1
+        with:
+          source: 'docs/'
+          destination: '_site'
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: '_site'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
@@ -133,10 +133,13 @@ jobs:
            local CMD_PATH=$2
            local OUTPUT_NAME

+            # Ensure build directory exists
+            mkdir -p build
+
            if [[ "${{ matrix.goos }}" == "windows" ]]; then
-              OUTPUT_NAME="${BINARY_NAME}-v${{ needs.validate.outputs.version }}-${ARCH_SUFFIX}.exe"
+              OUTPUT_NAME="build/${BINARY_NAME}-v${{ needs.validate.outputs.version }}-${ARCH_SUFFIX}.exe"
            else
-              OUTPUT_NAME="${BINARY_NAME}-v${{ needs.validate.outputs.version }}-${ARCH_SUFFIX}"
+              OUTPUT_NAME="build/${BINARY_NAME}-v${{ needs.validate.outputs.version }}-${ARCH_SUFFIX}"
            fi

            echo "Building $BINARY_NAME: $OUTPUT_NAME"
@@ -193,8 +196,8 @@ jobs:
        with:
          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goarm }}
          path: |
-            soundtouch-cli-v*
-            soundtouch-service-v*
+            build/soundtouch-cli-v*
+            build/soundtouch-service-v*
          retention-days: 1

  checksums:
@@ -19,14 +19,17 @@ dist/
 /example-unified
 /mdns-scanner
 /websocket-demo
+/main

 # Environment configuration
 .env
 .env.local
 .env.*.local
+docker-compose.override.yml

 # Test coverage reports
 coverage.out
+coverage*.out
 coverage.html
 *.prof

@@ -76,7 +76,7 @@ When filing a bug report, include:
 Feature requests are welcome! Please:

 1. **Check if the feature already exists** in documentation
-2. **Verify it's supported by the SoundTouch API** (see [official API docs](docs/API-Endpoints-Overview.md))
+2. **Verify it's supported by the SoundTouch API** (see [official API docs](docs/reference/API-ENDPOINTS.md))
 3. **Explain the use case** and how it benefits users

 ### 🔧 Contributing Code
@@ -469,10 +469,10 @@ Contributors will be:

 - [Go Documentation](https://golang.org/doc/)
 - [Effective Go](https://golang.org/doc/effective_go.html)
- [Bose SoundTouch API Documentation](docs/API-Endpoints-Overview.md)
+- [Bose SoundTouch API Documentation](docs/reference/API-ENDPOINTS.md)
 - [Project Architecture](docs/PROJECT-PATTERNS.md)
- [Development Status](docs/STATUS.md)
+- [Development Status](docs/archive/STATUS.md)

 ---

-**Thank you for contributing!** Every contribution helps make this library better for the entire SoundTouch community.
+**Thank you for contributing!** Every contribution helps make this library better for the entire SoundTouch community.
@@ -20,9 +20,12 @@ A comprehensive solution for controlling and preserving Bose SoundTouch devices,
 - 🎙️ **Station Management**: Add and play radio stations without presets
 - 🖥️ **CLI Tool**: Comprehensive command-line interface
 - 🌐 **SoundTouch Service**: Emulate Bose cloud services for offline device operation
- 🔧 **Service Migration**: Migrate devices to use local services instead of Bose cloud
+- 🔧 **Service Migration**: Migrate devices to use local services instead of Bose cloud (XML, Hosts, or DNS redirection)
+- 🔍 **DNS Discovery & Interception**: Dynamic DNS server for intercepting and logging Bose service queries (requires port 53)
+- 📊 **DNS Discovery Analysis**: Track and deduplicate all device DNS queries to discover hidden hostnames
 - 📊 **Traffic Analysis**: Proxy and log device communications
 - 📝 **HTTP Recording**: Persist interactions as re-playable `.http` files
+- 🧹 **Session Management**: Manage and cleanup recorded interaction sessions
 - 🔒 **Production Ready**: Extensive testing with real SoundTouch hardware
 - 🌐 **Cross-Platform**: Windows, macOS, Linux support

@@ -61,7 +64,7 @@ soundtouch-cli --host 192.168.1.100 volume set --level 50
 soundtouch-cli --host 192.168.1.100 preset list
 ```

-For full CLI documentation, see [docs/CLI-REFERENCE.md](docs/CLI-REFERENCE.md).
+For full CLI documentation, see the [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html).

 ### SoundTouch Service (Cloud Shutdown Protection)

@@ -69,21 +72,25 @@ The `soundtouch-service` is a local server that emulates Bose's cloud services.

 #### Key Features:
 - **🏠 Local Emulation**: BMX and Marge service implementation
+- **🔌 Easy Setup**: Activate SSH via USB stick (`remote_services` file)
 - **🔧 Device Migration**: Seamlessly transition devices to local control
 - **🌐 Web Management UI**: Easy browser-based setup and management
 - **💾 Persistent Data**: Store presets, recents, and sources locally
 - **📝 HTTP Recording**: Persist all interactions as re-playable `.http` files
+- **🧹 Session Management**: Manage and cleanup recorded interaction sessions

 #### Quick Start:
 ```bash
 # Start the service
 soundtouch-service
 ```
-Open `http://localhost:8000` in your browser to manage your devices.
+Open `http://localhost:8000` in your browser to manage your devices. Documentation is also available directly through the web interface.

-For a comprehensive guide on transitioning your system, see the [Bose Cloud Shutdown: Survival Guide](docs/CLOUD-SHUTDOWN-GUIDE.md).
+For a comprehensive guide on transitioning your system, see the [Bose Cloud Shutdown: Survival Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SURVIVAL-GUIDE.html).

-Detailed service configuration and Docker instructions can be found in [docs/SOUNDTOUCH-SERVICE.md](docs/SOUNDTOUCH-SERVICE.md).
+Detailed service configuration and Docker instructions can be found in [SoundTouch Service Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SOUNDTOUCH-SERVICE.html).
+
+For professional migration tips and safety measures, see the [Migration & Safety Guide](https://gesellix.github.io/Bose-SoundTouch/guides/MIGRATION-SAFETY.html).

 ### Library Usage

@@ -376,19 +383,19 @@ This library supports all Bose SoundTouch-compatible devices, including:
 ## Documentation

 - 📖 [Contributing Guide](CONTRIBUTING.md) - How to contribute to the project
- 📚 [API Reference](docs/API-Endpoints-Overview.md) - Complete endpoint documentation
- 🔧 [CLI Reference](docs/CLI-REFERENCE.md) - Command-line tool guide
- 🌐 [SoundTouch Service Guide](docs/SOUNDTOUCH-SERVICE.md) - Local service setup and migration
- 🎯 [Getting Started](docs/GETTING-STARTED.md) - Detailed setup and usage
- 📻 [Preset Quick Start](docs/PRESET-QUICKSTART.md) - Favorite content management
- 🧭 [Navigation Guide](docs/NAVIGATION-GUIDE.md) - Content browsing and station management
- 📋 [Navigation API Reference](docs/API-NAVIGATION-REFERENCE.md) - Navigation API documentation
- ⚙️ [Advanced Features](docs/SYSTEM-ENDPOINTS.md) - Advanced functionality
- 🏠 [Multiroom Setup](docs/zone-management.md) - Zone configuration guide
- ⚡ [WebSocket Events](docs/websocket-events.md) - Real-time event handling
- 🔔 [Speaker Notifications](docs/SPEAKER_ENDPOINT.md) - TTS and audio notifications guide
- 🔍 [Device Discovery](docs/DISCOVERY.md) - Discovery configuration
- 🛠️ [Troubleshooting](docs/TROUBLESHOOTING.md) - Common issues and solutions
+ - 📚 [API Reference](https://gesellix.github.io/Bose-SoundTouch/reference/API-ENDPOINTS.html) - Complete endpoint documentation
+- 🔧 [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html) - Command-line tool guide
+- 🌐 [SoundTouch Service Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SOUNDTOUCH-SERVICE.html) - Local service setup and migration
+- 🎯 [Getting Started](https://gesellix.github.io/Bose-SoundTouch/guides/GETTING-STARTED.html) - Detailed setup and usage
+- 📻 [Preset Quick Start](https://gesellix.github.io/Bose-SoundTouch/PRESET-QUICKSTART.md) - Favorite content management
+- 🧭 [Navigation Guide](https://gesellix.github.io/Bose-SoundTouch/NAVIGATION-GUIDE.md) - Content browsing and station management
+- 📋 [Navigation API Reference](https://gesellix.github.io/Bose-SoundTouch/API-NAVIGATION-REFERENCE.md) - Navigation API documentation
+- ⚙️ [Advanced Features](https://gesellix.github.io/Bose-SoundTouch/reference/SYSTEM-ENDPOINTS.html) - Advanced functionality
+- 🏠 [Multiroom Setup](https://gesellix.github.io/Bose-SoundTouch/reference/ZONE-MANAGEMENT.html) - Zone configuration guide
+- ⚡ [WebSocket Events](https://gesellix.github.io/Bose-SoundTouch/reference/WEBSOCKET-EVENTS.html) - Real-time event handling
+- 🔔 [Speaker Notifications](https://gesellix.github.io/Bose-SoundTouch/reference/SPEAKER-ENDPOINT.html) - TTS and audio notifications guide
+- 🔍 [Device Discovery](https://gesellix.github.io/Bose-SoundTouch/reference/DISCOVERY.html) - Discovery configuration
+- 🛠️ [Troubleshooting](https://gesellix.github.io/Bose-SoundTouch/guides/TROUBLESHOOTING.html) - Common issues and solutions

 ## Development

@@ -476,7 +483,7 @@ This project builds upon the excellent work of several community projects:
 ### SoundCork 🍾
 - **Project**: [SoundCork - SoundTouch API Intercept](https://github.com/deborahgu/soundcork)
 - **Authors**: Deborah Kaplan and contributors
- **Our Implementation**: The `soundtouch-service` in this project is heavily inspired by and based on SoundCork's Python implementation. SoundCork pioneered the approach of intercepting and emulating Bose's cloud services, providing the foundation for offline SoundTouch operation.
+- **Our Implementation**: The `soundtouch-service` in this project is heavily inspired by SoundCork's Python implementation. SoundCork pioneered the approach of intercepting and emulating Bose's cloud services, providing the foundation for offline SoundTouch operation.
 - **Key Contributions**: Service emulation architecture, BMX/Marge endpoint discovery, device migration strategies
 - **License**: MIT License

@@ -523,13 +530,13 @@ If you discover new endpoints, features, or improvements through this library, p
 - 🐛 **Bug Reports**: [Create an issue](https://github.com/gesellix/bose-soundtouch/issues/new)
 - 💡 **Feature Requests**: [Start a discussion](https://github.com/gesellix/bose-soundtouch/discussions)
 - ❓ **Questions**: Check [existing discussions](https://github.com/gesellix/bose-soundtouch/discussions)
- 📖 **Documentation**: Browse the [docs/](docs/) directory
- 🔍 **New Discoveries**: See [Undocumented Community Features](docs/UNDOCUMENTED-COMMUNITY-FEATURES.md) for advanced API research
- 🌐 **Upstream Analysis**: [Upstream URLs & Domains](docs/UPSTREAM-URLS-ANALYSIS.md) for cloud dependency research
- 🔧 **Redirection Guide**: [Device Redirect Methods](docs/DEVICE-REDIRECT-METHODS.md) for custom service setup
- 🐣 **Initial Setup**: [Device Initial Setup Variants](docs/DEVICE-INITIAL-SETUP.md) for out-of-the-box configuration
- 📜 **Logging & Debugging**: [Device Logging Guide](docs/DEVICE-LOGGING.md) for accessing system and traffic logs
- 🔒 **HTTPS & CA Setup**: [HTTPS & Custom CA Guide](docs/HTTPS-SETUP.md) for secure `/etc/hosts` redirection
+- 📖 **Documentation**: [Online Documentation](https://gesellix.github.io/Bose-SoundTouch/)
+- 🔍 **New Discoveries**: [Undocumented Community Features](https://gesellix.github.io/Bose-SoundTouch/UNDOCUMENTED-COMMUNITY-FEATURES.md)
+- 🌐 **Upstream Analysis**: [Upstream URLs & Domains](https://gesellix.github.io/Bose-SoundTouch/analysis/UPSTREAM-URLS.html)
+- 🔧 **Redirection Guide**: [Device Redirect Methods](https://gesellix.github.io/Bose-SoundTouch/analysis/DEVICE-REDIRECT-METHODS.html)
+- 🐣 **Initial Setup**: [Device Initial Setup Variants](https://gesellix.github.io/Bose-SoundTouch/guides/DEVICE-INITIAL-SETUP.html)
+- 📜 **Logging & Debugging**: [Device Logging Guide](https://gesellix.github.io/Bose-SoundTouch/DEVICE-LOGGING.md)
+- 🔒 **HTTPS & CA Setup**: [HTTPS & Custom CA Guide](https://gesellix.github.io/Bose-SoundTouch/guides/HTTPS-SETUP.html)

 ---

@@ -7,6 +7,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"os"
 	"regexp"
 	"runtime"
 	"strconv"
@@ -331,7 +332,7 @@ func PrintWarning(message string) {

 // showVersionInfo displays detailed version information including build details
 func showVersionInfo(_ *cli.Context) error {
-	fmt.Printf("soundtouch-cli version %s\n", version)
+	fmt.Printf("%s version %s\n", os.Args[0], version)
 	fmt.Printf("Build commit: %s\n", commit)
 	fmt.Printf("Build date: %s\n", date)
 	fmt.Printf("Go version: %s\n", runtime.Version())
@@ -104,7 +104,7 @@ func main() {
 		Version: version,
 		Authors: []*cli.Author{
 			{
-				Name: "Tobias Gesellchen, and the SoundTouch CLI Contributors",
+				Name: "Tobias Gesellchen, and the Bose-SoundTouch Contributors",
 			},
 		},
 		Flags: CommonFlags,
@@ -5,17 +5,19 @@ package main
 import (
 	"context"
 	"crypto/tls"
-	"flag"
+	"encoding/json"
 	"fmt"
 	"log"
 	"net/http"
-	"net/http/httputil"
 	"net/url"
 	"os"
 	"path/filepath"
+	"runtime"
+	"runtime/debug"
 	"strings"
 	"time"

+	"github.com/gesellix/bose-soundtouch/pkg/discovery"
 	"github.com/gesellix/bose-soundtouch/pkg/service/certmanager"
 	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/handlers"
@@ -23,85 +25,292 @@ import (
 	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
+	"github.com/urfave/cli/v2"
 )

+var (
+	version = "dev"
+	commit  = "unknown"
+	date    = "unknown"
+)
+
+func updateBuildInfo() {
+	if info, ok := debug.ReadBuildInfo(); ok {
+		if info.Main.Version != "" && info.Main.Version != "(devel)" {
+			version = info.Main.Version
+		}
+
+		for _, setting := range info.Settings {
+			switch setting.Key {
+			case "vcs.revision":
+				commit = setting.Value
+			case "vcs.time":
+				if t, err := time.Parse(time.RFC3339, setting.Value); err == nil {
+					date = t.Format("2006-01-02_15:04:05")
+				}
+			}
+		}
+	}
+}
+
 func main() {
-	config := loadConfig()
-	ds := initDataStore(config.dataDir)
-	cm := initCertificateManager(config.dataDir)
-	sm := setup.NewManager(config.serverURL, ds, cm)
-	server := handlers.NewServer(ds, sm, config.serverURL, config.redact, config.logBody, config.record)
+	updateBuildInfo()

-	recorder := proxy.NewRecorder(config.dataDir)
-	recorder.Redact = config.redact
-	patternsPath := filepath.Join(config.dataDir, "patterns.json")
+	app := &cli.App{
+		Name:  "soundtouch-service",
+		Usage: "Local service for Bose SoundTouch cloud emulation and management",
+		Description: `⠎⠕⠥⠝⠙⠤⠞⠕⠥⠉⠓ A local server that emulates Bose cloud services (BMX, Marge).
+   It enables offline operation, device migration, and HTTP interaction recording.`,
+		Version: version,
+		Authors: []*cli.Author{
+			{
+				Name: "Tobias Gesellchen, and the Bose-SoundTouch Contributors",
+			},
+		},
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "port",
+				Aliases: []string{"p"},
+				Usage:   "HTTP port to bind the service to",
+				Value:   "8000",
+				EnvVars: []string{"PORT"},
+			},
+			&cli.StringFlag{
+				Name:    "bind",
+				Usage:   "Network interface to bind to",
+				EnvVars: []string{"BIND_ADDR"},
+			},
+			&cli.StringFlag{
+				Name:    "soundcork-url",
+				Usage:   "URL for Soundcork-based service components (legacy)",
+				Value:   "http://localhost:8001",
+				EnvVars: []string{"SOUNDCORK_BACKEND_URL", "TARGET_URL"},
+			},
+			&cli.BoolFlag{
+				Name:    "enable-soundcork-proxy",
+				Usage:   "Enable proxying unknown requests to the Soundcork backend",
+				EnvVars: []string{"ENABLE_SOUNDCORK_PROXY"},
+			},
+			&cli.StringFlag{
+				Name:    "data-dir",
+				Usage:   "Directory for persistent data",
+				Value:   "data",
+				EnvVars: []string{"DATA_DIR"},
+			},
+			&cli.StringFlag{
+				Name:    "server-url",
+				Aliases: []string{"s"},
+				Usage:   "External URL of this service",
+				EnvVars: []string{"SERVER_URL"},
+			},
+			&cli.StringFlag{
+				Name:    "https-port",
+				Usage:   "HTTPS port to bind the service to",
+				Value:   "8443",
+				EnvVars: []string{"HTTPS_PORT"},
+			},
+			&cli.StringFlag{
+				Name:    "https-server-url",
+				Aliases: []string{"S"},
+				Usage:   "External HTTPS URL",
+				EnvVars: []string{"HTTPS_SERVER_URL"},
+			},
+			&cli.BoolFlag{
+				Name:    "redact-logs",
+				Usage:   "Redact sensitive data in proxy logs",
+				Value:   true,
+				EnvVars: []string{"REDACT_PROXY_LOGS"},
+			},
+			&cli.BoolFlag{
+				Name:    "log-bodies",
+				Usage:   "Log full request/response bodies",
+				EnvVars: []string{"LOG_PROXY_BODY"},
+			},
+			&cli.BoolFlag{
+				Name:    "record-interactions",
+				Usage:   "Record HTTP interactions to disk",
+				Value:   true,
+				EnvVars: []string{"RECORD_INTERACTIONS"},
+			},
+			&cli.StringFlag{
+				Name:    "discovery-interval",
+				Usage:   "Device discovery interval",
+				Value:   "5m",
+				EnvVars: []string{"DISCOVERY_INTERVAL"},
+			},
+			&cli.BoolFlag{
+				Name:    "dns-discovery",
+				Usage:   "Enable DNS discovery server",
+				EnvVars: []string{"ENABLE_DNS_DISCOVERY"},
+			},
+			&cli.StringFlag{
+				Name:    "dns-upstream",
+				Usage:   "Upstream DNS server for non-Bose queries",
+				Value:   "8.8.8.8",
+				EnvVars: []string{"DNS_UPSTREAM"},
+			},
+			&cli.StringFlag{
+				Name:    "dns-bind",
+				Usage:   "Bind address for the DNS discovery server",
+				Value:   ":53",
+				EnvVars: []string{"DNS_BIND_ADDR"},
+			},
+		},
+		Action: func(c *cli.Context) error {
+			config := loadConfig(c)
+			ds := initDataStore(config.dataDir)

-	patterns, err := proxy.LoadPatterns(patternsPath)
-	if err == nil && len(patterns) > 0 {
-		recorder.Patterns = patterns
-	} else if err != nil {
-		log.Printf("Warning: Failed to load patterns from %s: %v", patternsPath, err)
+			persisted := applyPersistedSettings(ds, &config)
+
+			if persisted.ServerURL == "" {
+				log.Printf("Creating default settings.json in %s", config.dataDir)
+				persisted = createDefaultSettings(ds, config)
+			}
+
+			// Recalculate domains if settings changed
+			hostname, _ := os.Hostname()
+			if hostname == "" {
+				hostname = "localhost"
+			}
+
+			config.domains = getDomains(config.serverURL, config.httpsServerURL, hostname)
+
+			cm := initCertificateManager(config.dataDir)
+			sm := setup.NewManager(config.serverURL, ds, cm)
+			server := handlers.NewServer(ds, sm, config.serverURL, config.redact, config.logBody, config.record, config.enableSoundcorkProxy)
+			sm.GetDNSRunning = server.GetDNSRunning
+			server.SetSoundcorkURL(config.soundcorkURL)
+			server.SetHTTPServerURL(config.httpsServerURL)
+			server.SetVersionInfo(version, commit, date)
+			server.SetDiscoverySettings(config.discoveryInterval, persisted.DiscoveryEnabled)
+			server.SetDNSSettings(persisted.DNSEnabled, persisted.DNSUpstream, persisted.DNSBindAddr)
+
+			// Load and set initial DNS discoveries
+			dnsDiscoveries, err := ds.LoadDNSDiscoveries()
+			if err == nil && len(dnsDiscoveries) > 0 {
+				initial := make(map[string]*discovery.DiscoveredHost)
+				for _, entry := range dnsDiscoveries {
+					initial[entry.Hostname] = &discovery.DiscoveredHost{
+						Hostname:      entry.Hostname,
+						FirstSeen:     entry.FirstSeen,
+						LastSeen:      entry.LastSeen,
+						QueryCount:    entry.QueryCount,
+						IsBoseService: entry.IsBoseService,
+						IsIntercepted: entry.IsIntercepted,
+						RemoteAddr:    entry.RemoteAddr,
+					}
+				}
+
+				server.SetDNSDiscoveries(initial)
+			}
+
+			server.SetShortcuts(persisted.Shortcuts)
+
+			for path, status := range persisted.Shortcuts {
+				log.Printf("Warning: configured shortcut: %s -> %d", path, status)
+			}
+
+			recorder := proxy.NewRecorder(config.dataDir)
+			recorder.Redact = config.redact
+			patternsPath := filepath.Join(config.dataDir, "patterns.json")
+
+			patterns, err := proxy.LoadPatterns(patternsPath)
+			if err != nil {
+				log.Printf("Warning: Failed to load patterns from %s: %v", patternsPath, err)
+			}
+
+			if len(patterns) == 0 {
+				log.Printf("Creating default patterns at %s", patternsPath)
+
+				patterns = proxy.DefaultPatterns()
+
+				patternsData, jsonErr := json.MarshalIndent(patterns, "", "  ")
+				if jsonErr != nil {
+					log.Printf("Warning: Failed to marshal default patterns: %v", jsonErr)
+				} else {
+					_ = os.WriteFile(patternsPath, patternsData, 0644)
+				}
+			}
+
+			if len(patterns) > 0 {
+				recorder.Patterns = patterns
+			}
+
+			server.SetRecorder(recorder)
+
+			tlsConfig, err := cm.GetServerTLSConfig(config.domains)
+			if err != nil {
+				log.Printf("Warning: Failed to setup TLS: %v", err)
+			}
+
+			startDeviceDiscovery(server)
+
+			r := setupRouter(server)
+
+			log.Printf("Go service starting on %s, proxying to %s", config.serverURL, config.soundcorkURL)
+
+			if tlsConfig != nil {
+				startHTTPSServer(config.httpsAddr, r, tlsConfig, config.httpsServerURL)
+			}
+
+			return http.ListenAndServe(config.addr, r)
+		},
+		Commands: []*cli.Command{
+			{
+				Name:    "version",
+				Aliases: []string{"v"},
+				Usage:   "Show detailed version information",
+				Action:  showVersionInfo,
+			},
+		},
 	}

-	server.SetRecorder(recorder)
-
-	tlsConfig, err := cm.GetServerTLSConfig(config.domains)
-	if err != nil {
-		log.Printf("Warning: Failed to setup TLS: %v", err)
+	if err := app.Run(os.Args); err != nil {
+		log.Fatal(err)
 	}
+}

-	pyProxy := setupPythonProxy(config.targetURL, config.redact, config.logBody, recorder, server)
+func showVersionInfo(_ *cli.Context) error {
+	fmt.Printf("%s version %s\n", os.Args[0], version)
+	fmt.Printf("Build commit: %s\n", commit)
+	fmt.Printf("Build date: %s\n", date)
+	fmt.Printf("Go version: %s\n", runtime.Version())
+	fmt.Printf("Platform: %s/%s\n", runtime.GOOS, runtime.GOARCH)

-	startDeviceDiscovery(server)
-
-	r := setupRouter(server, pyProxy)
-
-	log.Printf("Go service starting on %s, proxying to %s", config.serverURL, config.targetURL)
-
-	if tlsConfig != nil {
-		startHTTPSServer(config.httpsAddr, r, tlsConfig, config.httpsServerURL)
-	}
-
-	log.Fatal(http.ListenAndServe(config.addr, r))
+	return nil
 }

 type serviceConfig struct {
-	port           string
-	bindAddr       string
-	addr           string
-	targetURL      string
-	dataDir        string
-	serverURL      string
-	httpsServerURL string
-	httpsAddr      string
-	redact         bool
-	logBody        bool
-	record         bool
-	domains        []string
+	port                 string
+	bindAddr             string
+	addr                 string
+	soundcorkURL         string
+	dataDir              string
+	serverURL            string
+	httpsServerURL       string
+	httpsAddr            string
+	redact               bool
+	logBody              bool
+	record               bool
+	enableSoundcorkProxy bool
+	dnsEnabled           bool
+	dnsUpstream          string
+	dnsBind              string
+	discoveryInterval    time.Duration
+	domains              []string
 }

-func loadConfig() serviceConfig {
-	// Define flags
-	fPort, fBindAddr, fTargetURL, fDataDir, fServerURL, fHTTPSPort, fHTTPSServerURL, fRedact, fLogBody, fRecord := defineFlags()
-
-	flag.Usage = func() {
-		fmt.Fprintf(os.Stderr, "Usage of soundtouch-service:\n")
-		flag.PrintDefaults()
-		fmt.Fprintf(os.Stderr, "\nConfiguration can also be set via environment variables.\n")
-	}
-
-	flag.Parse()
-
-	port := getEnvOrDefault("PORT", *fPort, "8000")
-	bindAddr := getEnvOrDefault("BIND_ADDR", *fBindAddr, "")
+func loadConfig(c *cli.Context) serviceConfig {
+	port := c.String("port")
+	bindAddr := c.String("bind")

 	addr := bindAddr + ":" + port
 	if bindAddr == "" {
 		addr = ":" + port
 	}

-	targetURL := getEnvOrDefault("PYTHON_BACKEND_URL", *fTargetURL, "http://localhost:8001")
-	dataDir := getEnvOrDefault("DATA_DIR", *fDataDir, "data")
+	soundcorkURL := c.String("soundcork-url")
+	dataDir := c.String("data-dir")

 	hostname, _ := os.Hostname()
 	if hostname == "" {
@@ -110,78 +319,64 @@ func loadConfig() serviceConfig {

 	hostname = strings.ToLower(hostname)

-	serverURL := getEnvOrDefault("SERVER_URL", *fServerURL, "")
+	serverURL := c.String("server-url")
 	if serverURL == "" {
 		serverURL = "http://" + hostname + ":" + port
 	}

-	httpsPort := getEnvOrDefault("HTTPS_PORT", *fHTTPSPort, "8443")
+	httpsPort := c.String("https-port")

 	httpsAddr := bindAddr + ":" + httpsPort
 	if bindAddr == "" {
 		httpsAddr = ":" + httpsPort
 	}

-	httpsServerURL := getEnvOrDefault("HTTPS_SERVER_URL", *fHTTPSServerURL, "")
+	httpsServerURL := c.String("https-server-url")
 	if httpsServerURL == "" {
 		httpsServerURL = "https://" + hostname + ":" + httpsPort
 	}

 	domains := getDomains(serverURL, httpsServerURL, hostname)

-	redactVal := getEnvOrDefault("REDACT_PROXY_LOGS", *fRedact, "")
-	redact := redactVal != "false"
+	redact := c.Bool("redact-logs")
+	logBody := c.Bool("log-bodies")
+	record := c.Bool("record-interactions")
+	enableSoundcorkProxy := c.Bool("enable-soundcork-proxy")

-	logBodyVal := getEnvOrDefault("LOG_PROXY_BODY", *fLogBody, "")
-	logBody := logBodyVal == "true"
+	dnsEnabled := c.Bool("dns-discovery")
+	dnsUpstream := c.String("dns-upstream")
+	dnsBind := c.String("dns-bind")

-	recordVal := getEnvOrDefault("RECORD_INTERACTIONS", *fRecord, "")
-	record := recordVal != "false"
+	discoveryIntervalStr := c.String("discovery-interval")
+
+	discoveryInterval, err := time.ParseDuration(discoveryIntervalStr)
+	if err != nil {
+		log.Printf("Warning: Failed to parse discovery interval %s, using default 5m: %v", discoveryIntervalStr, err)
+
+		discoveryInterval = 5 * time.Minute
+	}

 	return serviceConfig{
-		port:           port,
-		bindAddr:       bindAddr,
-		addr:           addr,
-		targetURL:      targetURL,
-		dataDir:        dataDir,
-		serverURL:      serverURL,
-		httpsServerURL: httpsServerURL,
-		httpsAddr:      httpsAddr,
-		redact:         redact,
-		logBody:        logBody,
-		record:         record,
-		domains:        domains,
+		port:                 port,
+		bindAddr:             bindAddr,
+		addr:                 addr,
+		soundcorkURL:         soundcorkURL,
+		dataDir:              dataDir,
+		serverURL:            serverURL,
+		httpsServerURL:       httpsServerURL,
+		httpsAddr:            httpsAddr,
+		redact:               redact,
+		logBody:              logBody,
+		record:               record,
+		enableSoundcorkProxy: enableSoundcorkProxy,
+		dnsEnabled:           dnsEnabled,
+		dnsUpstream:          dnsUpstream,
+		dnsBind:              dnsBind,
+		discoveryInterval:    discoveryInterval,
+		domains:              domains,
 	}
 }

-func defineFlags() (port, bind, target, data, server, httpsPort, httpsServer, redact, logBody, record *string) {
-	port = flag.String("port", "", "Port to bind the service to (env: PORT)")
-	bind = flag.String("bind", "", "Network interface to bind to (env: BIND_ADDR)")
-	target = flag.String("target-url", "", "URL for Python-based service components (env: PYTHON_BACKEND_URL)")
-	data = flag.String("data-dir", "", "Directory for persistent data (env: DATA_DIR)")
-	server = flag.String("server-url", "", "External URL of this service (env: SERVER_URL)")
-	httpsPort = flag.String("https-port", "", "HTTPS port to bind the service to (env: HTTPS_PORT)")
-	httpsServer = flag.String("https-server-url", "", "External HTTPS URL (env: HTTPS_SERVER_URL)")
-	redact = flag.String("redact-logs", "", "Redact sensitive data in proxy logs (true/false, env: REDACT_PROXY_LOGS)")
-	logBody = flag.String("log-bodies", "", "Log full request/response bodies (true/false, env: LOG_PROXY_BODY)")
-	record = flag.String("record-interactions", "", "Record HTTP interactions to disk (true/false, env: RECORD_INTERACTIONS)")
-
-	return
-}
-
-func getEnvOrDefault(envKey, flagVal, defaultVal string) string {
-	if flagVal != "" {
-		return flagVal
-	}
-
-	val := os.Getenv(envKey)
-	if val != "" {
-		return val
-	}
-
-	return defaultVal
-}
-
 func getDomains(serverURL, httpsServerURL, hostname string) []string {
 	domainsMap := map[string]bool{
 		"streaming.bose.com":  true,
@@ -211,6 +406,71 @@ func getDomains(serverURL, httpsServerURL, hostname string) []string {
 	return domains
 }

+func applyPersistedSettings(ds *datastore.DataStore, config *serviceConfig) datastore.Settings {
+	persisted, err := ds.GetSettings()
+	if err != nil {
+		return datastore.Settings{}
+	}
+
+	if persisted.ServerURL != "" {
+		config.serverURL = persisted.ServerURL
+	}
+
+	if persisted.SoundcorkURL != "" {
+		config.soundcorkURL = persisted.SoundcorkURL
+	}
+
+	if persisted.HTTPServerURL != "" {
+		config.httpsServerURL = persisted.HTTPServerURL
+	}
+
+	if persisted.DiscoveryInterval != "" {
+		if d, durErr := time.ParseDuration(persisted.DiscoveryInterval); durErr == nil {
+			config.discoveryInterval = d
+		}
+	}
+
+	config.redact = persisted.RedactLogs
+	config.logBody = persisted.LogBodies
+	config.record = persisted.RecordInteractions
+	config.enableSoundcorkProxy = persisted.EnableSoundcorkProxy
+
+	config.dnsEnabled = persisted.DNSEnabled
+	if persisted.DNSUpstream != "" {
+		config.dnsUpstream = persisted.DNSUpstream
+	}
+
+	if persisted.DNSBindAddr != "" {
+		config.dnsBind = persisted.DNSBindAddr
+	}
+
+	return persisted
+}
+
+func createDefaultSettings(ds *datastore.DataStore, config serviceConfig) datastore.Settings {
+	settings := datastore.Settings{
+		ServerURL:            config.serverURL,
+		SoundcorkURL:         config.soundcorkURL,
+		HTTPServerURL:        config.httpsServerURL,
+		RedactLogs:           config.redact,
+		LogBodies:            config.logBody,
+		RecordInteractions:   config.record,
+		DiscoveryInterval:    config.discoveryInterval.String(),
+		DiscoveryEnabled:     true,
+		EnableSoundcorkProxy: config.enableSoundcorkProxy,
+		DNSEnabled:           config.dnsEnabled,
+		DNSUpstream:          config.dnsUpstream,
+		DNSBindAddr:          config.dnsBind,
+		Shortcuts: map[string]int{
+			"/.well-known/appspecific/com.chrome.devtools.json": http.StatusNotFound,
+			"/sw.js": http.StatusNotFound,
+		},
+	}
+	_ = ds.SaveSettings(settings)
+
+	return settings
+}
+
 func initDataStore(dataDir string) *datastore.DataStore {
 	ds := datastore.NewDataStore(dataDir)
 	if err := ds.Initialize(); err != nil {
@@ -229,55 +489,24 @@ func initCertificateManager(dataDir string) *certmanager.CertificateManager {
 	return cm
 }

-func setupPythonProxy(targetURL string, redact, logBody bool, recorder *proxy.Recorder, server *handlers.Server) *httputil.ReverseProxy {
-	target, err := url.Parse(targetURL)
-	if err != nil {
-		log.Fatalf("Failed to parse target URL: %v", err)
-	}
-
-	pyProxy := httputil.NewSingleHostReverseProxy(target)
-	pyProxy.ModifyResponse = func(res *http.Response) error {
-		if etags, ok := res.Header["Etag"]; ok {
-			delete(res.Header, "Etag")
-			res.Header["ETag"] = etags
-		}
-
-		currentLp := proxy.NewLoggingProxy(target.String(), redact)
-		currentLp.LogBody = logBody
-		currentLp.RecordEnabled = server.GetRecordEnabled()
-		currentLp.SetRecorder(recorder)
-		currentLp.LogResponse(res)
-
-		return nil
-	}
-
-	originalPyDirector := pyProxy.Director
-	pyProxy.Director = func(req *http.Request) {
-		originalPyDirector(req)
-
-		currentLp := proxy.NewLoggingProxy(target.String(), redact)
-		currentLp.LogBody = logBody
-		currentLp.RecordEnabled = server.GetRecordEnabled()
-		currentLp.SetRecorder(recorder)
-		currentLp.LogRequest(req)
-	}
-
-	return pyProxy
-}
-
 func startDeviceDiscovery(server *handlers.Server) {
 	go func() {
 		for {
-			server.DiscoverDevices(context.Background())
-			time.Sleep(5 * time.Minute)
+			currentInterval, enabled := server.GetDiscoverySettings()
+			if enabled {
+				server.DiscoverDevices(context.Background())
+			}
+
+			time.Sleep(currentInterval)
 		}
 	}()
 }

-func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.Mux {
+func setupRouter(server *handlers.Server) *chi.Mux {
 	r := chi.NewRouter()
-	r.Use(middleware.Logger)
+	r.Use(server.OriginMiddleware)
 	r.Use(middleware.Recoverer)
+	r.Use(server.ShortcutMiddleware)
 	r.Use(server.RecordMiddleware)

 	r.Get("/", server.HandleRoot)
@@ -289,6 +518,7 @@ func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.M

 	r.Get("/media/*", server.HandleMedia())
 	r.Get("/web/*", server.HandleWeb())
+	r.Get("/docs/*", server.HandleDocs)

 	r.Route("/bmx", func(r chi.Router) {
 		r.Get("/registry/v1/services", server.HandleBMXRegistry)
@@ -298,6 +528,13 @@ func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.M
 		r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
 	})

+	// Legacy or direct domain calls without /bmx prefix
+	r.Get("/registry/v1/services", server.HandleBMXRegistry)
+	r.Get("/tunein/v1/playback/station/{stationID}", server.HandleTuneInPlayback)
+	r.Get("/tunein/v1/playback/episodes/{podcastID}", server.HandleTuneInPodcastInfo)
+	r.Get("/tunein/v1/playback/episode/{podcastID}", server.HandleTuneInPlaybackPodcast)
+	r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
+
 	r.Route("/marge", func(r chi.Router) {
 		r.Get("/streaming/sourceproviders", server.HandleMargeSourceProviders)
 		r.Get("/accounts/{account}/full", server.HandleMargeAccountFull)
@@ -311,6 +548,37 @@ func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.M
 		r.Get("/streaming/account/{account}/provider_settings", server.HandleMargeProviderSettings)
 		r.Get("/streaming/device/{device}/streaming_token", server.HandleMargeStreamingToken)
 		r.Post("/streaming/support/customersupport", server.HandleMargeCustomerSupport)
+		r.Get("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeGetDeviceSettings)
+		r.Post("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeUpdateDeviceSettings)
+		r.Get("/streaming/account/{account}/emailaddress", server.HandleMargeGetEmailAddress)
+	})
+
+	// Legacy or direct domain calls without /marge prefix
+	r.Get("/streaming/sourceproviders", server.HandleMargeSourceProviders)
+	r.Get("/accounts/{account}/full", server.HandleMargeAccountFull)
+	r.Post("/streaming/support/power_on", server.HandleMargePowerOn)
+	r.Get("/updates/soundtouch", server.HandleMargeSoftwareUpdate)
+	r.Get("/accounts/{account}/devices/{device}/presets", server.HandleMargePresets)
+	r.Post("/accounts/{account}/devices/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
+	r.Post("/accounts/{account}/devices/{device}/recents", server.HandleMargeAddRecent)
+	r.Post("/accounts/{account}/devices", server.HandleMargeAddDevice)
+	r.Delete("/accounts/{account}/devices/{device}", server.HandleMargeRemoveDevice)
+	r.Get("/streaming/account/{account}/provider_settings", server.HandleMargeProviderSettings)
+	r.Get("/streaming/device/{device}/streaming_token", server.HandleMargeStreamingToken)
+	r.Post("/streaming/support/customersupport", server.HandleMargeCustomerSupport)
+	r.Get("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeGetDeviceSettings)
+	r.Post("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeUpdateDeviceSettings)
+	r.Get("/streaming/account/{account}/emailaddress", server.HandleMargeGetEmailAddress)
+
+	r.Route("/customer", func(r chi.Router) {
+		r.Get("/account/{account}", server.HandleMargeAccountProfile)
+		r.Post("/account/{account}", server.HandleMargeUpdateAccountProfile)
+		r.Post("/account/{account}/password", server.HandleMargeChangePassword)
+	})
+
+	r.Route("/v1", func(r chi.Router) {
+		r.Post("/stapp/{deviceId}", server.HandleAppEvents)
+		r.Post("/scmudc/{deviceId}", server.HandleAppEvents)
 	})

 	r.Route("/streaming/stats", func(r chi.Router) {
@@ -323,12 +591,16 @@ func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.M
 	r.Route("/setup", func(r chi.Router) {
 		r.Get("/devices", server.HandleListDiscoveredDevices)
 		r.Post("/devices", server.HandleAddManualDevice)
+		r.Delete("/devices/{deviceId}", server.HandleRemoveDevice)
 		r.Post("/discover", server.HandleTriggerDiscovery)
 		r.Get("/discovery-status", server.HandleGetDiscoveryStatus)
 		r.Get("/settings", server.HandleGetSettings)
+		r.Post("/settings", server.HandleUpdateSettings)
 		r.Get("/info/{deviceIP}", server.HandleGetDeviceInfo)
 		r.Get("/summary/{deviceIP}", server.HandleGetMigrationSummary)
 		r.Post("/migrate/{deviceIP}", server.HandleMigrateDevice)
+		r.Post("/revert/{deviceIP}", server.HandleRevertMigration)
+		r.Post("/reboot/{deviceIP}", server.HandleRebootDevice)
 		r.Post("/trust-ca/{deviceIP}", server.HandleTrustCACert)
 		r.Post("/ensure-remote-services/{deviceIP}", server.HandleEnsureRemoteServices)
 		r.Post("/remove-remote-services/{deviceIP}", server.HandleRemoveRemoteServices)
@@ -336,15 +608,25 @@ func setupRouter(server *handlers.Server, pyProxy *httputil.ReverseProxy) *chi.M
 		r.Post("/sync/{deviceIP}", server.HandleInitialSync)
 		r.Post("/test-connection/{deviceIP}", server.HandleTestConnection)
 		r.Post("/test-hosts/{deviceIP}", server.HandleTestHostsRedirection)
+		r.Post("/test-dns/{deviceIP}", server.HandleTestDNSRedirection)
 		r.Get("/ca.crt", server.HandleGetCACert)
 		r.Get("/proxy-settings", server.HandleGetProxySettings)
 		r.Post("/proxy-settings", server.HandleUpdateProxySettings)
+		r.Get("/version", server.HandleGetVersionInfo)
+		r.Get("/interaction-stats", server.HandleGetInteractionStats)
+		r.Get("/interactions", server.HandleListInteractions)
+		r.Get("/interaction-content", server.HandleGetInteractionContent)
+		r.Get("/interactions/sessions/{session}/download", server.HandleDownloadSession)
+		r.Delete("/interactions/sessions/{session}", server.HandleDeleteSession)
+		r.Delete("/interactions/sessions", server.HandleCleanupSessions)
+
+		r.Get("/dns-discoveries", server.HandleGetDNSDiscoveries)
+		r.Delete("/dns-discoveries", server.HandleClearDNSDiscoveries)
+
 		r.Get("/devices/{deviceId}/events", server.HandleGetDeviceEvents)
 	})

-	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
-		pyProxy.ServeHTTP(w, r)
-	})
+	r.NotFound(server.HandleNotFound)

 	return r
 }
@@ -0,0 +1,97 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
+)
+
+func TestApplyPersistedSettings(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "main-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	ds := datastore.NewDataStore(tmpDir)
+
+	t.Run("overrides true with false", func(t *testing.T) {
+		config := &serviceConfig{
+			redact:               true,
+			logBody:              true,
+			record:               true,
+			enableSoundcorkProxy: true,
+		}
+
+		// Simulate the bug by using the old bitwise OR logic in the test,
+		// which should fail if we expect false.
+		// config.redact = config.redact || false -> stays true
+
+		settings := datastore.Settings{
+			RedactLogs:           false,
+			LogBodies:            false,
+			RecordInteractions:   false,
+			EnableSoundcorkProxy: false,
+		}
+		err := ds.SaveSettings(settings)
+		if err != nil {
+			t.Fatalf("Failed to save settings: %v", err)
+		}
+
+		applyPersistedSettings(ds, config)
+
+		if config.redact != false {
+			t.Errorf("Expected redact to be false, got true")
+		}
+		if config.logBody != false {
+			t.Errorf("Expected logBody to be false, got true")
+		}
+		if config.record != false {
+			t.Errorf("Expected record to be false, got true")
+		}
+		if config.enableSoundcorkProxy != false {
+			t.Errorf("Expected enableSoundcorkProxy to be false, got true")
+		}
+	})
+
+	t.Run("retains false when settings are false", func(t *testing.T) {
+		settings := datastore.Settings{
+			RedactLogs: false,
+		}
+		err := ds.SaveSettings(settings)
+		if err != nil {
+			t.Fatalf("Failed to save settings: %v", err)
+		}
+
+		config := &serviceConfig{
+			redact: false,
+		}
+
+		applyPersistedSettings(ds, config)
+
+		if config.redact != false {
+			t.Errorf("Expected redact to be false, got true")
+		}
+	})
+
+	t.Run("overrides false with true", func(t *testing.T) {
+		settings := datastore.Settings{
+			RedactLogs: true,
+		}
+		err := ds.SaveSettings(settings)
+		if err != nil {
+			t.Fatalf("Failed to save settings: %v", err)
+		}
+
+		config := &serviceConfig{
+			redact: false,
+		}
+
+		applyPersistedSettings(ds, config)
+
+		if config.redact != true {
+			t.Errorf("Expected redact to be true, got false")
+		}
+	})
+}
@@ -1,3 +1,7 @@
+accounts/
 certs/
 default/
+dns/
 interactions/
+patterns.json
+settings.json
@@ -1,17 +0,0 @@
-[
-  {
-    "name": "IPv4",
-    "regexp": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-    "replacement": "{ip}"
-  },
-  {
-    "name": "DeviceID",
-    "regexp": "^[A-F0-9]{12}$",
-    "replacement": "{deviceId}"
-  },
-  {
-    "name": "AccountID",
-    "regexp": "^\\d{1,10}$",
-    "replacement": "{accountId}"
-  }
-]
@@ -1,8 +1,11 @@
-// Package soundtouch provides a comprehensive Go library and CLI tool for controlling Bose SoundTouch devices.
+// Package soundtouch provides a comprehensive Go library, CLI tool, and local service for controlling and emulating Bose SoundTouch devices.
 //
-// This library implements the complete Bose SoundTouch Web API, enabling programmatic control
+// This project implements the complete Bose SoundTouch Web API, enabling programmatic control
 // of SoundTouch speakers including playback control, volume management, source selection,
-// multiroom zone management, and real-time event monitoring via WebSocket connections.
+// multiroom zone management, and real-time event monitoring.
+//
+// It also provides a local service (`soundtouch-service`) that can emulate the Bose Cloud,
+// allowing for offline control and enhanced debugging through HTTP interaction recording.
 //
 // # Quick Start
 //
@@ -41,63 +44,20 @@
 //		if err != nil {
 //			log.Fatal(err)
 //		}
-//
-//		// Set volume
-//		err = client.SetVolume(50)
-//		if err != nil {
-//			log.Fatal(err)
-//		}
 //	}
 //
-// # Device Discovery
+// # SoundTouch Service
 //
-// Automatically discover SoundTouch devices on your network:
+// The `soundtouch-service` provides several advanced features:
 //
-//	import "github.com/gesellix/bose-soundtouch/pkg/discovery"
+//   - Bose Cloud Emulation: Allows speakers to work without an internet connection.
+//   - HTTP Interaction Recording: Captures all traffic as IntelliJ-compatible .http files.
+//   - Speaker Migration: Automated tools to redirect speakers to the local service.
+//   - Web Interface: A management dashboard for proxy settings and speaker setup.
 //
-//	// Discover devices using UPnP/SSDP
-//	service := discovery.NewService(5*time.Second)
-//	devices, err := service.DiscoverDevices(ctx)
-//	if err != nil {
-//		log.Fatal(err)
-//	}
+// Install the service:
 //
-//	for _, device := range devices {
-//		fmt.Printf("Found device: %s at %s\n", device.Name, device.Host)
-//	}
-//
-// # Real-time Events
-//
-// Monitor device state changes in real-time using WebSocket connections:
-//
-//	// Subscribe to device events
-//	events, err := client.SubscribeToEvents(ctx)
-//	if err != nil {
-//		log.Fatal(err)
-//	}
-//
-//	for event := range events {
-//		switch e := event.(type) {
-//		case *models.NowPlayingUpdated:
-//			fmt.Printf("Now playing: %s by %s\n", e.Track, e.Artist)
-//		case *models.VolumeUpdated:
-//			fmt.Printf("Volume changed to: %d\n", e.ActualVolume)
-//		}
-//	}
-//
-// # Multiroom Zone Management
-//
-// Create and manage multiroom zones:
-//
-//	// Create a zone with multiple speakers
-//	zone := &models.Zone{
-//		Master: "192.168.1.100",
-//		Members: []models.ZoneMember{
-//			{IPAddress: "192.168.1.101"},
-//			{IPAddress: "192.168.1.102"},
-//		},
-//	}
-//	err = client.SetZone(zone)
+//	go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-service@latest
 //
 // # CLI Tool
 //
@@ -111,45 +71,33 @@
 //
 //	# Control a device
 //	soundtouch-cli --host 192.168.1.100 play start
-//	soundtouch-cli --host 192.168.1.100 volume set --level 50
-//	soundtouch-cli --host 192.168.1.100 source select --source SPOTIFY
 //
 // # Supported Features
 //
 //   - ✅ Device Information & Capabilities
-//   - ✅ Playback Control (Play/Pause/Stop/Next/Previous)
-//   - ✅ Volume, Bass, and Balance Control
-//   - ✅ Source Selection (Spotify, Bluetooth, AUX, etc.)
-//   - ✅ Preset Management
-//   - ✅ Clock/Time Management
-//   - ✅ Network Information
+//   - ✅ Playback, Volume, Bass, and Balance Control
+//   - ✅ Source Selection & Preset Management
 //   - ✅ Real-time WebSocket Events
 //   - ✅ Multiroom Zone Management
 //   - ✅ Device Discovery (UPnP/SSDP and mDNS)
-//   - ✅ Cross-platform Support (Windows, macOS, Linux)
+//   - ✅ Local Cloud Emulation (soundtouch-service)
+//   - ✅ HTTP Traffic Recording & Sanitization
+//   - ✅ Automated Speaker Migration & Revert
 //
 // # Package Structure
 //
 //   - client: HTTP client for SoundTouch Web API
 //   - discovery: Device discovery using UPnP/SSDP and mDNS
 //   - models: Data structures for API requests/responses
-//   - config: Configuration management
+//   - service: Core logic for the soundtouch-service (proxy, recording, setup)
 //   - cmd/soundtouch-cli: Command-line interface tool
-//
-// # Hardware Compatibility
-//
-// This library has been tested with real Bose SoundTouch hardware and supports
-// all SoundTouch-compatible devices including:
-//   - SoundTouch 10, 20, 30 series
-//   - SoundTouch Portable
-//   - Wave SoundTouch music system
-//   - And other SoundTouch-enabled Bose speakers
+//   - cmd/soundtouch-service: Local cloud emulation service
 //
 // # Implementation Notes
 //
-// This implementation is based on the official Bose SoundTouch Web API documentation
-// and provides 90% coverage of all available endpoints. It is an independent project
-// and is not affiliated with or endorsed by Bose Corporation.
+// This project is an independent effort to preserve the functionality of Bose SoundTouch
+// devices and provide enhanced debugging and control capabilities. It is not
+// affiliated with or endorsed by Bose Corporation.
 //
 // For detailed API documentation, examples, and advanced usage patterns, visit:
 // https://pkg.go.dev/github.com/gesellix/bose-soundtouch
@@ -1,15 +1,41 @@
 services:
  soundtouch-service:
-    build: .
+    image: ghcr.io/gesellix/bose-soundtouch:latest
+    # build: .
    container_name: soundtouch-service
-    # network_mode: host # Linux only, required for discovery
+    # Linux only, required for discovery. Swarm requires host network at the task level.
+    # network_mode: host
    ports:
      - "8000:8000"
+      - "8443:8443"
    environment:
      - PORT=8000
+      - HTTPS_PORT=8443
      - DATA_DIR=/app/data
      - LOG_PROXY_BODY=false
      - REDACT_PROXY_LOGS=true
+      - RECORD_INTERACTIONS=true
+      - DISCOVERY_INTERVAL=5m
+      - SERVER_URL=http://${SOUNDTOUCH_HOSTNAME:-soundtouch.local}:8000
+      - HTTPS_SERVER_URL=https://${SOUNDTOUCH_HOSTNAME:-soundtouch.local}:8443
    volumes:
-      - ./data:/app/data
+      - soundtouch-data:/app/data
+      # Use host volume for local development if preferred:
+      # - ./data:/app/data
    restart: unless-stopped
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+      resources:
+        limits:
+          cpus: '0.50'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 128M
+
+volumes:
+  soundtouch-data:
+    # Named volumes are preferred in Swarm. For multi-node persistence,
+    # consider using a volume driver like NFS or GlusterFS.
@@ -4,9 +4,9 @@

 This document contains important development guidelines for working on the Bose SoundTouch project. Please also read the following documentation:

- **[PLAN.md](PLAN.md)** - Project planning and roadmap
+- **[PLAN.md](archive/PLAN.md)** - Project planning and roadmap
 - **[PROJECT-PATTERNS.md](PROJECT-PATTERNS.md)** - Project structure and design patterns
- **[API-Endpoints-Overview.md](API-Endpoints-Overview.md)** - API endpoints overview
+- **[API-ENDPOINTS.md](reference/API-ENDPOINTS.md)** - API endpoints overview
 - **[SoundTouch Web API.pdf](2025.12.18%20SoundTouch%20Web%20API.pdf)** - Official API documentation

 ## Development Guidelines
@@ -95,4 +95,3 @@ When creating test data for API endpoints, prefer real device responses over hyp
 - **Documentation**: Completely in English for international accessibility
 - Conduct regular code reviews
 - Consider performance from the beginning
-
@@ -195,8 +195,9 @@ soundtouch-cli --host 192.168.1.100 source internet-radio \
 - [SoundTouch WebServices API Wiki](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API)
 - [LOCAL_INTERNET_RADIO - streamUrl format](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API#select-local_internet_radio---streamurl-format)
 - [LOCAL_MUSIC](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API#select-local_music)
- [Content Selection Example](/examples/content-selection/)
- [CLI Reference](/docs/CLI-REFERENCE.md)
+- [Content Selection Example](../examples/content-selection/README.md)
+- [CLI Reference](guides/CLI-REFERENCE.md)
+- [Content Selection Example (Direct)](../examples/content-selection/)

 ## ✅ Verification

@@ -208,4 +209,4 @@ This implementation has been verified to:
 5. ✅ Include complete documentation and examples
 6. ✅ Maintain backward compatibility

-**Status**: 🎉 **COMPLETE** - All requested content selection features are fully implemented and ready for use!
+**Status**: 🎉 **COMPLETE** - All requested content selection features are fully implemented and ready for use!
@@ -74,7 +74,7 @@ If you have a managed switch or a router capable of port mirroring, you can use
 ### "IsItBose" Validation Failures
 If the device fails to connect to your custom service despite correct configuration, it may be failing the internal `IsItBose` regex check.
 -   **Evidence**: Look for SSL handshake failures or "Unauthorized" errors in your service logs.
-   **Solution**: See the [Binary Patching section in DEVICE-REDIRECT-METHODS.md](DEVICE-REDIRECT-METHODS.md#method-3-binary-patching).
+-   **Solution**: See the [Binary Patching section in DEVICE-REDIRECT-METHODS.md](analysis/DEVICE-REDIRECT-METHODS.md#method-3-binary-patching).

 ### Disappearing Sources (TuneIn/Local Radio)
 If `TUNEIN` or `LOCAL_INTERNET_RADIO` sources disappear after a reboot in an offline environment.
@@ -895,4 +895,4 @@ For additional help:

 ---

-*This guide covers the complete navigation and station management functionality. For preset management, see [PRESET-MANAGEMENT.md](PRESET-MANAGEMENT.md).*
+*This guide covers the complete navigation and station management functionality. For preset management, see [PRESET-MANAGEMENT.md](reference/PRESET-MANAGEMENT.md).*
@@ -332,14 +332,14 @@ soundtouch-cli --host 192.168.1.100 info

 ## Next Steps

- 📖 [Complete CLI Reference](CLI-REFERENCE.md)
- 🔧 [Full Implementation Guide](preset-store.md)
- 📡 [WebSocket Events Documentation](websocket-events.md)
+- 📖 [Complete CLI Reference](guides/CLI-REFERENCE.md)
+- 🔧 [Full Implementation Guide](reference/PRESET-MANAGEMENT.md)
+- 📡 [WebSocket Events Documentation](reference/WEBSOCKET-EVENTS.md)
 - 💻 [Preset Management Example](../examples/preset-management/)
- 📚 [API Endpoints Overview](API-Endpoints-Overview.md)
+- 📚 [API Endpoints Overview](reference/API-ENDPOINTS.md)

 ## Need Help?

 - 🐛 **Bug Reports**: [Create an issue](https://github.com/gesellix/bose-soundtouch/issues)
 - 💡 **Feature Requests**: [Start a discussion](https://github.com/gesellix/bose-soundtouch/discussions)
- ❓ **Questions**: [Browse discussions](https://github.com/gesellix/bose-soundtouch/discussions)
+- ❓ **Questions**: [Browse discussions](https://github.com/gesellix/bose-soundtouch/discussions)
@@ -0,0 +1,32 @@
+# Bose SoundTouch Toolkit Documentation
+
+Welcome to the documentation for the Bose SoundTouch Toolkit. This toolkit helps you keep your Bose SoundTouch speakers functional even after the Bose Cloud shutdown in May 2026.
+
+## 📖 Quick Links
+
+- [Cloud Shutdown Survival Guide](guides/SURVIVAL-GUIDE.md)
+- [Migration & Safety Guide](guides/MIGRATION-SAFETY.md)
+- [CLI Reference](guides/CLI-REFERENCE.md)
+- [Getting Started](guides/GETTING-STARTED.md)
+- [SoundTouch Service Guide](guides/SOUNDTOUCH-SERVICE.md)
+
+## 🗂 Documentation Structure
+
+### User Guides
+- [Initial Device Setup](guides/DEVICE-INITIAL-SETUP.md)
+- [HTTPS Setup](guides/HTTPS-SETUP.md)
+- [Deployment Guide](guides/DEPLOYMENT.md)
+- [Raspberry Pi Setup](guides/RASPBERRY-PI.md)
+- [Troubleshooting](guides/TROUBLESHOOTING.md)
+
+### Technical Reference
+- [API Endpoints](reference/API-ENDPOINTS.md)
+- [WebSocket Events](reference/WEBSOCKET-EVENTS.md)
+- [Zone Management](reference/ZONE-MANAGEMENT.md)
+- [Preset Management](reference/PRESET-MANAGEMENT.md)
+
+### Analysis & Research
+- [Upstream URLs](analysis/UPSTREAM-URLS.md)
+- [Device Redirect Methods](analysis/DEVICE-REDIRECT-METHODS.md)
+
+For a complete list of all documents, see the [Summary](SUMMARY.md).
@@ -23,7 +23,7 @@ This document summarizes the implementation of the `/serviceAvailability` endpoi
 ### Modified Files

 1. **`pkg/client/client.go`** - Added `GetServiceAvailability()` method
-2. **`docs/API-Endpoints-Overview.md`** - Updated implementation status
+2. **`docs/reference/API-ENDPOINTS.md`** - Updated implementation status
 3. **`docs/UNIMPLEMENTED-ENDPOINTS.md`** - Marked as implemented

 ## API Interface
@@ -263,4 +263,4 @@ BenchmarkGetServiceAvailability-8                         1000    1.2ms/op
 ✅ **Performance benchmarks established**  
 ✅ **Error handling verified**  

-The ServiceAvailability implementation is production-ready and provides a solid foundation for building user-friendly SoundTouch applications with better service discovery and user feedback capabilities.
+The ServiceAvailability implementation is production-ready and provides a solid foundation for building user-friendly SoundTouch applications with better service discovery and user feedback capabilities.
@@ -144,10 +144,10 @@ LOG_PROXY_BODY=true soundtouch-service

 ## 📚 Documentation

- **[Complete Service Guide](SOUNDTOUCH-SERVICE.md)**: Comprehensive setup and configuration
- **[API Reference](SOUNDTOUCH-SERVICE.md#api-reference)**: Full endpoint documentation
- **[Migration Guide](SOUNDTOUCH-SERVICE.md#device-migration)**: Step-by-step device migration
- **[Troubleshooting](SOUNDTOUCH-SERVICE.md#troubleshooting)**: Common issues and solutions
+- **[Complete Service Guide](guides/SOUNDTOUCH-SERVICE.md)**: Comprehensive setup and configuration
+- **[API Reference](guides/SOUNDTOUCH-SERVICE.md#api-reference)**: Full endpoint documentation
+- **[Migration Guide](guides/SOUNDTOUCH-SERVICE.md#device-migration)**: Step-by-step device migration
+- **[Troubleshooting](guides/SOUNDTOUCH-SERVICE.md#troubleshooting)**: Common issues and solutions

 ## 🤝 Contributing

@@ -172,9 +172,9 @@ The collaborative spirit of reverse engineering and documentation in the SoundTo
 ## 🔗 Links

 - **[Main Repository](https://github.com/gesellix/bose-soundtouch)**
- **[Service Documentation](SOUNDTOUCH-SERVICE.md)**
- **[CLI Documentation](CLI-REFERENCE.md)**
- **[Getting Started Guide](GETTING-STARTED.md)**
+- **[Service Documentation](guides/SOUNDTOUCH-SERVICE.md)**
+- **[CLI Documentation](guides/CLI-REFERENCE.md)**
+- **[Getting Started Guide](guides/GETTING-STARTED.md)**
 - **[SoundCork Project](https://github.com/deborahgu/soundcork)**
 - **[ÜberBöse API](https://github.com/julius-d/ueberboese-api)**

@@ -187,4 +187,4 @@ go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-service@latest
 soundtouch-service
 ```

-Open `http://localhost:8000` and start your journey to local SoundTouch control! 🎵
+Open `http://localhost:8000` and start your journey to local SoundTouch control! 🎵
@@ -0,0 +1,65 @@
+# Table of Contents
+
+* [Introduction](README.md)
+
+## User Guides
+* [Cloud Shutdown Survival Guide](guides/SURVIVAL-GUIDE.md)
+* [Migration & Safety Guide](guides/MIGRATION-SAFETY.md)
+* [CLI Reference](guides/CLI-REFERENCE.md)
+* [Getting Started](guides/GETTING-STARTED.md)
+* [SoundTouch Service](guides/SOUNDTOUCH-SERVICE.md)
+* [Initial Device Setup](guides/DEVICE-INITIAL-SETUP.md)
+* [HTTPS Setup](guides/HTTPS-SETUP.md)
+* [Deployment](guides/DEPLOYMENT.md)
+* [Raspberry Pi Guide](guides/RASPBERRY-PI.md)
+* [Troubleshooting](guides/TROUBLESHOOTING.md)
+* [Useful Links](#useful-links)
+
+### Useful Links
+* [Cloud Shutdown Survival Guide](guides/SURVIVAL-GUIDE.md)
+* [Raspberry Pi Installer](../scripts/raspberry-pi/README.md)
+* [Updating the Service](../scripts/raspberry-pi/README.md#updating-to-a-new-version)
+* [CLI Reference](guides/CLI-REFERENCE.md)
+
+## Technical Reference
+* [API Cookbook](reference/API-COOKBOOK.md)
+* [API Endpoints](reference/API-ENDPOINTS.md)
+* [Cloud API Emulation](reference/CLOUD-API.md)
+* [System Endpoints](reference/SYSTEM-ENDPOINTS.md)
+* [Speaker Endpoint](reference/SPEAKER-ENDPOINT.md)
+* [WebSocket Events](reference/WEBSOCKET-EVENTS.md)
+* [Discovery](reference/DISCOVERY.md)
+* [Zone Management](reference/ZONE-MANAGEMENT.md)
+* [Preset Management](reference/PRESET-MANAGEMENT.md)
+* [Source Selection](reference/SOURCE-SELECTION.md)
+* [Volume Controls](reference/VOLUME-CONTROLS.md)
+* [Bass Controls](reference/BASS-CONTROLS.md)
+* [Key Controls](reference/KEY-CONTROLS.md)
+* [Feature Mapping](reference/FEATURE-MAPPING.md)
+
+## Analysis & Research
+* [API Coverage Analysis](analysis/API-COVERAGE.md)
+* [Supported URLs](analysis/SUPPORTED-URLS.md)
+* [Upstream URLs](analysis/UPSTREAM-URLS.md)
+* [Anonymization Summary](analysis/ANONYMIZATION-SUMMARY.md)
+* [Device Redirect Methods](analysis/DEVICE-REDIRECT-METHODS.md)
+* [Wiki API Comparison](analysis/WIKI-COMPARISON.md)
+
+## Appendix (Other Documents)
+* [API Navigation Reference](API-NAVIGATION-REFERENCE.md)
+* [Claude Instructions](CLAUDE.md)
+* [Content Selection Implementation](CONTENT-SELECTION-IMPLEMENTATION.md)
+* [Device Customization Setup](DEVICE-CUSTOMIZATION-SETUP.md)
+* [Device Logging](DEVICE-LOGGING.md)
+* [Feature History](FEATURE_HISTORY.md)
+* [Host/Port Parsing](HOST-PORT-PARSING.md)
+* [Manual Network Discovery](MANUAL-NETWORK-DISCOVERY.md)
+* [Navigation Guide](NAVIGATION-GUIDE.md)
+* [Official API Verification](OFFICIAL-API-VERIFICATION.md)
+* [Preset Quickstart](PRESET-QUICKSTART.md)
+* [Project Patterns](PROJECT-PATTERNS.md)
+* [Service Availability Implementation](SERVICE-AVAILABILITY-IMPLEMENTATION.md)
+* [SoundTouch Service Announcement](SOUNDTOUCH-SERVICE-ANNOUNCEMENT.md)
+* [Undocumented Community Features](UNDOCUMENTED-COMMUNITY-FEATURES.md)
+* [Unimplemented Endpoints](UNIMPLEMENTED-ENDPOINTS.md)
+* [Preset Store](preset-store.md)
@@ -0,0 +1,11 @@
+title: Bose SoundTouch Toolkit
+description: Documentation for controlling and preserving Bose SoundTouch devices
+remote_theme: pages-themes/minimal@v0.2.0
+plugins:
+  - jekyll-remote-theme
+  - jekyll-relative-links
+relative_links:
+  enabled: true
+  collections: true
+include:
+  - SUMMARY.md
@@ -9,6 +9,9 @@ SoundTouch devices primarily communicate with the following domains:
 - `updates.bose.com`: Software updates
 - `stats.bose.com`: Telemetry and analytics
 - `bmx.bose.com`: Bose Media eXchange registry
+- `events.api.bosecm.com`: Stockholm app analytics
+- `bose-prod.apigee.net`: Apigee gateway (used by some services)
+- `worldwide.bose.com`: Software update metadata and secondary services

 ---

@@ -153,7 +156,7 @@ For developers creating a completely isolated "dark" environment (no internet at
 1.  **XML**: Point all URLs to local services.
 2.  **Binary Patch**: Neutralize `IsItBose` to allow non-Bose domains/IPs.
 3.  **`/etc/hosts`**: Redirect hardcoded domains that aren't exposed in the XML (like analytics or NTP) to prevent leakage to the real Bose cloud.
-4.  **Process Instrumentation**: Use [SoundTouch Hook](https://github.com/CodeFinder2/bose-soundtouch-hook) to monitor and override internal behavior in real-time.
+4.  **Process Instrumentation**: Use [SoundTouch Hook](https://github.com/CodeFinder2/bose-soundtouch-hook) to monitor and override internal behavior in real-time. This is particularly useful for handling unknown hostnames or deep-hooking into service discovery logic that might bypass standard DNS lookups.

 ---

@@ -784,4 +784,4 @@ docker-compose up  # Mock devices + web app
 - [UPnP Device Architecture](http://upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.0.pdf) 
 - [Go Embed Directive](https://pkg.go.dev/embed)
 - [Gorilla WebSocket](https://github.com/gorilla/websocket)
- [PROJECT-PATTERNS.md](./PROJECT-PATTERNS.md) - Detailed pattern documentation
+- [PROJECT-PATTERNS.md](../PROJECT-PATTERNS.md) - Detailed pattern documentation
@@ -206,14 +206,14 @@ This project implements a comprehensive Go client library and CLI tool for Bose

 ### ✅ Complete Documentation
 - `README.md` - Project overview and usage examples ✅
- `docs/API-Endpoints-Overview.md` - API reference with status ✅
- `docs/KEY-CONTROLS.md` - Media control implementation ✅
- `docs/VOLUME-CONTROLS.md` - Volume management guide ✅
- `docs/PRESET-MANAGEMENT.md` - Preset analysis and limitations ✅
+- `docs/reference/API-ENDPOINTS.md` - API reference with status ✅
+- `docs/reference/KEY-CONTROLS.md` - Media control implementation ✅
+- `docs/guides/VOLUME-CONTROLS.md` - Volume management guide ✅
+- `docs/reference/PRESET-MANAGEMENT.md` - Preset analysis and limitations ✅
 - `docs/HOST-PORT-PARSING.md` - Enhanced CLI feature ✅
- `docs/PLAN.md` - Development roadmap (updated) ✅
+- `docs/archive/PLAN.md` - Development roadmap (updated) ✅
 - `docs/PROJECT-PATTERNS.md` - Development guidelines ✅
- `SPEAKER_ENDPOINT.md` - Complete speaker notification documentation ✅
+- `docs/reference/SPEAKER-ENDPOINT.md` - Complete speaker notification documentation ✅

 ### 📝 Documentation Notes
 - All docs are synchronized with current implementation
@@ -1248,6 +1248,6 @@ SOUNDTOUCH_DISCOVERY_TIMEOUT=10s
 ## See Also

 - [Getting Started Guide](GETTING-STARTED.md) - Basic setup and usage
- [WebSocket Events](websocket-events.md) - Real-time monitoring
- [Zone Management](zone-management.md) - Multi-room setup
- [API Endpoints](API-Endpoints-Overview.md) - Complete API reference
+- [WebSocket Events](../reference/WEBSOCKET-EVENTS.md) - Real-time monitoring
+- [Zone Management](../reference/ZONE-MANAGEMENT.md) - Multi-room setup
+- [API Endpoints](../reference/API-ENDPOINTS.md) - Complete API reference
@@ -13,6 +13,10 @@ This guide covers everything you need to know to deploy robust, scalable SoundTo
 - [Performance Optimization](#performance-optimization)
 - [Error Handling Recovery](#error-handling-recovery)
 - [Deployment Strategies](#deployment-strategies)
+    - [Docker Deployment](#docker-deployment)
+    - [Kubernetes Deployment](#kubernetes-deployment)
+    - [Systemd Service](#systemd-service)
+    - [Raspberry Pi Installer](#raspberry-pi-installer)
 - [Maintenance Operations](#maintenance-operations)

 ---
@@ -926,39 +930,49 @@ data:
  device_hosts: "192.168.1.100,192.168.1.101,192.168.1.102"
 ```

-### Systemd Service
+#### Systemd Service
+
+A standard systemd unit for manual installation. This example assumes the binary is at `/usr/local/bin/soundtouch-service` and data is stored in `/var/lib/soundtouch-service`.

 ```ini
-# /etc/systemd/system/soundtouch.service
+# /etc/systemd/system/soundtouch-service.service
 [Unit]
-Description=SoundTouch Control Service
-After=network.target
-Wants=network.target
+Description=Bose SoundTouch Service
+Wants=network-online.target
+After=network-online.target

 [Service]
 Type=simple
 User=soundtouch
 Group=soundtouch
-WorkingDirectory=/opt/soundtouch
-ExecStart=/opt/soundtouch/bin/soundtouch-app
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=always
-RestartSec=5
-Environment=DEVICE_HOSTS=192.168.1.100,192.168.1.101
-Environment=LOG_LEVEL=info
-Environment=CONFIG_FILE=/opt/soundtouch/config/production.yaml
+WorkingDirectory=/var/lib/soundtouch-service
+ExecStart=/usr/local/bin/soundtouch-service
+Environment=PORT=80
+Environment=SERVER_URL=http://soundtouch.local

-# Security settings
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/opt/soundtouch/logs
+# Allow binding to privileged ports (80/443) without running as root
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+Restart=on-failure
+RestartSec=5
+
+# Security hardening
 PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+ReadWritePaths=/var/lib/soundtouch-service

 [Install]
 WantedBy=multi-user.target
 ```

+#### Raspberry Pi Installer
+
+For users deploying on a Raspberry Pi, we provide a specialized automated installer that handles everything from architecture detection to security hardening.
+
+See the [Raspberry Pi Installation Guide](RASPBERRY-PI.md) for step-by-step instructions.
+
 ---

 ## Maintenance Operations
@@ -1071,4 +1085,4 @@ func init() {
    
    // Set GC target percentage
    if os.Getenv("GOGC") == "" {
-        debug.SetGCPerc
+        debug.SetGCPerc
@@ -1,6 +1,6 @@
 # HTTPS Setup & Custom CA Certificate

-To use the `/etc/hosts` redirection method safely, SoundTouch devices must communicate over HTTPS. This requires the device to trust the Root CA certificate used by the local `soundtouch-service`.
+To use the `/etc/hosts` redirection method safely, SoundTouch devices must communicate over HTTPS. This requires the device to trust the AfterTouch Root CA certificate used by the local service.

 ## 1. Automated Migration (Hosts Method)

@@ -13,12 +13,12 @@ curl -X POST "http://localhost:8000/setup/migrate/{deviceIP}?method=hosts"
 This command will:
 1.  Connect to the device via SSH.
 2.  Update `/etc/hosts` to point Bose domains to the service IP.
-3.  Inject the auto-generated Root CA into the device's trust store (`/etc/pki/tls/certs/ca-bundle.crt`).
+3.  Inject the auto-generated AfterTouch Root CA into the device's trust store (`/etc/pki/tls/certs/ca-bundle.crt`).
 4.  Reboot the device.

 ## 2. Managing the Root CA

-The `soundtouch-service` automatically generates a Root CA when it first starts.
+The AfterTouch service automatically generates a Root CA when it first starts.

 - **CA Certificate**: `data/certs/ca.crt`
 - **CA Private Key**: `data/certs/ca.key`
@@ -34,7 +34,7 @@ The `soundtouch-service` now includes a built-in HTTPS listener. This simplifies
 - **HTTPS Port**: Configurable via `HTTPS_PORT` environment variable (defaults to `8443`).
 - **HTTPS Server URL**: Configurable via `HTTPS_SERVER_URL` (e.g., `https://mysoundtouch.local:8443`). If not set, the service attempts to guess it using the system hostname.
 - **Domain Coverage**: Automatically presents a certificate for `streaming.bose.com`, `updates.bose.com`, `stats.bose.com`, `bmx.bose.com`, and `content.api.bose.io`.
- **Automatic Setup**: On first start, it generates a server certificate signed by your local Root CA.
+- **Automatic Setup**: On first start, it generates a server certificate signed by your AfterTouch local Root CA.

 #### TLS Security

@@ -0,0 +1,44 @@
+### Professional Migration & Safety Guide
+
+Starting a migration on real hardware requires a "Safety First" approach. This guide outlines the safety features implemented in the `soundtouch-service` and provides a checklist for a successful migration.
+
+#### 🛠 Technical Safety Enhancements
+
+The following features are built into the `soundtouch-service` to ensure stability and easy rollbacks:
+
+1.  **Off-Device Backups**: Before any migration starts, the service automatically fetches the original `SoundTouchSdkPrivateCfg.xml` and `/etc/hosts` from your speaker and saves them locally in your `data/default/devices/<SERIAL>/` directory. This ensures you have a recovery path even if the speaker's filesystem becomes inaccessible.
+2.  **Pre-flight Write Verification**: The migration process includes a mandatory check for SSH write access (`rw`) before attempting any modifications. This prevents "half-baked" migrations where a script might fail halfway through due to a read-only filesystem.
+3.  **Automatic Safety on Sync**: Running a "Sync" in the Web UI or CLI automatically triggers an off-device backup, making it the perfect first step for any new device discovery.
+
+#### 📋 Professional Migration Checklist
+
+Before you proceed with the actual migration, follow these steps:
+
+1.  **Enable SSH Access (Prerequisite)**: This toolkit requires SSH access to your speakers, which is not enabled by default. 
+    - Create an empty file named `remote_services` on a USB stick.
+    - Insert the USB stick into the SoundTouch speaker's **SERVICE** port.
+    - Reboot the speaker (unplug and replug).
+    - The speaker will now allow SSH connections as `root` with no password.
+    - **Verify**: Run `ssh -oHostKeyAlgorithms=+ssh-rsa root@<SPEAKER-IP>` to confirm access. (Note: older devices may require enabling `ssh-rsa` support).
+2.  **Network Isolation (Optional but Recommended)**: Ensure the device is on a stable wired connection if possible, or a dedicated 2.4GHz SSID to avoid drops during SSH operations.
+3.  **Initial Discovery & Sync**: 
+    - Run `soundtouch-cli discover devices` to ensure connectivity.
+    - Use the Web UI or CLI to "Sync" the device. This will automatically backup your presets and system configuration files to your local server.
+4.  **Validate SSH Access**: Confirm the device responds to SSH without a password. 
+    - In the Web UI **Migration** tab, select your speaker and verify that the "SSH Connection" status shows ✅ Success.
+    - This toolkit automatically handles the necessary SSH parameters (ciphers and key exchanges) required by older Bose firmware.
+5.  **Migration Methods**: 
+    - **XML Migration (Default)**: Less invasive, only changes the application config. Best for simple redirection.
+    - **Hosts Migration**: Modifies `/etc/hosts` on the device. Good for system-wide redirection of specific domains.
+    - **ResolvConf Migration**: Points the device to the AfterTouch DNS server. Best for discovering unknown Bose endpoints and dynamic interception. **Note**: This method requires the DNS Discovery Server to be running on port 53. The service includes a pre-flight check to ensure the server is properly bound before allowing this migration.
+6.  **Monitor Logs**: Run the `soundtouch-service` with `DEBUG` or `INFO` logging to see the step-by-step progress of the migration.
+
+#### 🔄 Rollback Strategy
+
+If something goes wrong or you want to return to the original Bose cloud services:
+
+*   **Standard Revert**: Use the "Revert Migration" button in the Web UI or the corresponding CLI command. This restores the `.original` files created on the device.
+*   **Emergency Recovery**: If the device is unreachable via the UI but SSH still works, you can manually restore the files from your local `data/` directory using `scp` or the backups created on-device (`.original`).
+*   **Factory Reset**: As a last resort, Bose SoundTouch devices can be factory reset (usually by holding '1' and 'Volume Down' while plugging in). This will wipe all settings and return the device to the stock firmware configuration (the firmware itself remains at the current version, but configurations are reset).
+
+By using the built-in off-device backups and pre-flight checks, the risk of "bricking" or losing configuration during the transition is significantly reduced.
@@ -0,0 +1,69 @@
+# Raspberry Pi Installation Guide
+
+This guide explains how to install the `soundtouch-service` as a persistent systemd service on a Raspberry Pi (tested on Raspberry Pi Zero 2W, 3, and 4).
+
+## Automated Installer
+
+We provide a specialized installer script located in the `scripts/raspberry-pi/` directory of the repository.
+
+### Features
+*   **Automatic start on boot**: Installs a systemd unit.
+*   **Non-root operation**: Uses `AmbientCapabilities` to bind to ports 80/443 without root privileges.
+*   **Arch Detection**: Automatically selects the correct binary for `armv7`, `arm64`, or `amd64`.
+*   **Easy Updates**: Re-running the script updates the binary to the latest version.
+
+### Installation Steps
+
+1.  **Download the installer**:
+    ```bash
+    curl -fsSL -o install.sh https://raw.githubusercontent.com/gesellix/bose-soundtouch/main/scripts/raspberry-pi/install.sh
+    ```
+
+2.  **Run with sudo**:
+    ```bash
+    sudo bash install.sh
+    ```
+
+### Overriding Defaults
+
+You can customize the installation using environment variables:
+
+```bash
+sudo \
+  VERSION=v0.17.0 \
+  HOSTNAME_FQDN=soundtouch.local \
+  HTTP_PORT=80 \
+  HTTPS_PORT=443 \
+  bash install.sh
+```
+
+### Updating the Service
+
+To update the service to a specific version, run the installer with the version as an argument:
+
+```bash
+sudo bash install.sh v0.18.1
+```
+
+The installer will automatically fetch the latest version of itself for that release and then update the service binary and restart it.
+
+## Management
+
+Once installed, use standard `systemctl` commands to manage the service:
+
+```bash
+# Check status
+systemctl status soundtouch-service
+
+# Follow logs
+journalctl -u soundtouch-service -f
+
+# Restart
+sudo systemctl restart soundtouch-service
+```
+
+## Configuration
+
+Configuration is stored in `/etc/soundtouch-service/soundtouch-service.env`. Note that settings saved via the Web UI (in `settings.json`) will take precedence over these environment variables once the service is running.
+
+For more details, see the [scripts/raspberry-pi/README.md](../../scripts/raspberry-pi/README.md) in the repository.
@@ -7,13 +7,16 @@ The `soundtouch-service` is a comprehensive local server that emulates Bose's cl
 The service provides:

 - **🏠 Local Service Emulation**: Complete BMX (Bose Media eXchange) and Marge service implementation
- **🔧 Device Migration**: Seamlessly migrate devices from Bose cloud to local services  
+- **🔧 Device Migration**: Seamlessly migrate devices from Bose cloud to local services via XML config, `/etc/hosts`, or `/etc/resolv.conf`
+- **🔍 DNS Discovery & Interception**: Built-in DNS server to discover unknown Bose endpoints and selectively intercept cloud traffic
 - **📊 Traffic Proxying**: Inspect and log all device communications for debugging
 - **🌐 Web Management UI**: Browser-based interface for device management
 - **💾 Persistent Data**: Store device configurations, presets, and usage statistics
 - **📝 HTTP Recording**: Persist all interactions as re-playable `.http` files
+- **📥 Session Archiving**: Download entire interaction sessions as `.tar.gz` for offline analysis
 - **🔍 Auto-Discovery**: Automatically detect and configure SoundTouch devices
 - **🔒 Offline Operation**: Continue using full device functionality without internet
+- **🔗 Bose Proxy & Soundcork Fallback**: Dynamic proxying with automatic fallback to local [SoundCork](https://github.com/deborahgu/soundcork) emulation if enabled

 ## Architecture

@@ -100,8 +103,11 @@ services:
      - HTTPS_SERVER_URL=https://soundtouch.local:8443
      - DATA_DIR=/app/data
    volumes:
-      - ./data:/app/data
+      - soundtouch-data:/app/data
    restart: unless-stopped
+
+volumes:
+  soundtouch-data:
 ```

 And run:
@@ -133,20 +139,35 @@ Use the web interface or API to migrate devices from Bose cloud services to your

 ## Configuration

-The service can be configured via environment variables or command-line flags:
+### Configuration Precedence

-| Variable              | Flag                    | Description                                      | Default                   |
-|-----------------------|-------------------------|--------------------------------------------------|---------------------------|
-| `PORT`                | `--port`                | Port to bind the service to                      | `8000`                    |
-| `BIND_ADDR`           | `--bind`                | Network interface to bind to                     | all (ipv4 and ipv6)       |
-| `DATA_DIR`            | `--data-dir`            | Directory for persistent data                    | `./data`                  |
-| `SERVER_URL`          | `--server-url`          | External URL of this service                     | `http://<hostname>:8000`  |
-| `HTTPS_SERVER_URL`    | `--https-server-url`    | External HTTPS URL                               | `https://<hostname>:8443` |
-| `PYTHON_BACKEND_URL`  |                         | URL for Python-based service components (legacy) |                           |
-| `REDACT_PROXY_LOGS`   | `--redact-logs`         | Redact sensitive data in proxy logs              | `true`                    |
-| `LOG_PROXY_BODY`      | `--log-bodies`          | Log full request/response bodies                 | `false`                   |
-| `RECORD_INTERACTIONS` | `--record-interactions` | Record HTTP interactions to disk                 | `true`                    |
-| `DISCOVERY_INTERVAL`  | `--discovery-interval`  | Device discovery interval                        | `5m`                      |
+The service supports multiple ways to configure its behavior. When multiple sources provide the same setting, the following precedence rules apply (highest to lowest):
+
+1.  **`settings.json`**: Settings saved via the Web UI (stored in the data directory) take the highest precedence. This ensures that changes made in the browser persist across service restarts even if environment variables or flags change.
+2.  **Environment Variables / CLI Flags**: If a setting is not present in `settings.json`, environment variables and flags are used.
+3.  **Default Values**: If no configuration is provided, the service uses its built-in defaults.
+
+> **Tip**: If you find that changes to environment variables are not taking effect, check the **Settings** tab in the Web UI or inspect the `settings.json` file in your data directory, as it might be overriding your manual configuration.
+
+### Configuration Options
+
+| Variable                           | Flag                       | Description                                                                                             | Default                   |
+|------------------------------------|----------------------------|---------------------------------------------------------------------------------------------------------|---------------------------|
+| `PORT`                             | `--port`, `-p`             | HTTP port to bind the service to                                                                        | `8000`                    |
+| `BIND_ADDR`                        | `--bind`                   | Network interface to bind to                                                                            | all (ipv4 and ipv6)       |
+| `DATA_DIR`                         | `--data-dir`               | Directory for persistent data                                                                           | `./data`                  |
+| `SERVER_URL`                       | `--server-url`, `-s`       | External URL of this service                                                                            | `http://<hostname>:8000`  |
+| `HTTPS_PORT`                       | `--https-port`             | HTTPS port to bind the service to                                                                       | `8443`                    |
+| `HTTPS_SERVER_URL`                 | `--https-server-url`, `-S` | External HTTPS URL                                                                                      | `https://<hostname>:8443` |
+| `PYTHON_BACKEND_URL`, `TARGET_URL` | `--target-url`             | URL for Python-based service components (legacy)                                                        | `http://localhost:8001`   |
+| `REDACT_PROXY_LOGS`                | `--redact-logs`            | Redact sensitive data in proxy logs                                                                     | `true`                    |
+| `LOG_PROXY_BODY`                   | `--log-bodies`             | Log full request/response bodies                                                                        | `false`                   |
+| `RECORD_INTERACTIONS`              | `--record-interactions`    | Record HTTP interactions to disk                                                                        | `true`                    |
+| `DISCOVERY_INTERVAL`               | `--discovery-interval`     | Device discovery interval                                                                               | `5m`                      |
+| `ENABLE_DNS_DISCOVERY`             | `--dns-discovery`          | Enable DNS discovery server                                                                             | `false`                   |
+| `DNS_UPSTREAM`                     | `--dns-upstream`           | Upstream DNS server for non-Bose queries                                                                | `8.8.8.8`                 |
+| `DNS_BIND_ADDR`                    | `--dns-bind`               | Bind address for the DNS discovery server (standard port `:53` is required for `resolv.conf` migration) | `:53`                     |
+| `DISCOVERY_DISABLED`               |                            | Disable automated device discovery                                                                      | `false`                   |

 ### Configuration Examples

@@ -220,6 +241,75 @@ curl "http://192.168.1.100:8090/presets"
 curl "http://localhost:8000/events/192.168.1.100"
 ```

+#### ResolvConf Migration (DHCP-Aware DNS Redirection)
+
+The most robust and flexible DNS-based migration method. It utilizes the device's persistent `/mnt/nv/rc.local` script to inject a priority DNS hook into the system's DHCP configuration.
+
+> **Note**: This method requires the DNS Discovery Server to be bound to **port 53** on your local IP and **actually running**. Most devices do not support custom DNS ports in `/etc/resolv.conf`. If you use a custom port for testing, remember to switch back to `:53` and ensure the server has successfully bound to it (check Settings for status) before the actual migration.
+
+**Advantages:**
+- **Discovery**: Automatically discover all Bose endpoints queried by the device.
+- **Dynamic Interception**: Intercept new or unknown services without further device modifications.
+- **Fail-Safe**: Falls back to the standard network DNS (provided by your router) if the Aftertouch service is unavailable.
+- **DHCP Compatible**: Preserves your router's assigned search domain and secondary DNS servers.
+- **Wildcard Support**: Seamlessly handles `*.bose.com` redirection via your local DNS server.
+- **Persistent**: Survives reboots and DHCP renewals.
+
+**How it works:**
+1. **Configuration**: A custom file named `/mnt/nv/aftertouch.resolv.conf` is created on the device's persistent partition.
+2. **Boot Hook**: On every boot, `/mnt/nv/rc.local` checks if the system's DHCP scripts (`/etc/udhcpc.d/50default` or `/opt/Bose/udhcpc.script`) have been patched.
+3. **Surgical Patch**: If not patched, it injects a one-line check into the relevant DHCP scripts.
+4. **Resolution**: Whenever the device acquires a DHCP lease, the scripts now read your `aftertouch.resolv.conf` first, placing your DNS server at the top of `/etc/resolv.conf` while keeping all other DHCP-provided settings.
+
+**Setup:**
+1. Enable SSH via the `remote_services` USB trick.
+2. Create `/mnt/nv/aftertouch.resolv.conf` with your server details:
+   ```text
+   # Created by Aftertouch/SoundTouch-Service
+   # Priority nameserver for Bose service redirection
+   nameserver 192.168.1.XXX
+   ```
+3. Update `/mnt/nv/rc.local` with the idempotent patch:
+   ```sh
+   #!/bin/sh
+   # Aftertouch DNS hook: prioritizes our custom nameserver if it exists
+   HOOK_MARKER="/mnt/nv/aftertouch.resolv.conf"
+   if [ -f "$HOOK_MARKER" ]; then
+       # Patch 50default if it exists
+       TARGET_FILE="/etc/udhcpc.d/50default"
+       if [ -f "$TARGET_FILE" ] && ! grep -q "$HOOK_MARKER" "$TARGET_FILE"; then
+           sed -i '/echo "search \$domain"/a \        [ -f '"$HOOK_MARKER"' ] && cat '"$HOOK_MARKER"' && dns=""' "$TARGET_FILE"
+       fi
+       # Patch udhcpc.script if it exists (e.g. SoundTouch 10)
+       TARGET_SCRIPT="/opt/Bose/udhcpc.script"
+       if [ -f "$TARGET_SCRIPT" ] && ! grep -q "$HOOK_MARKER" "$TARGET_SCRIPT"; then
+           sed -i '/echo "search \$search_list # \$interface" >> \$RESOLV_CONF/a \                [ -f '"$HOOK_MARKER"' ] && cat '"$HOOK_MARKER"' >> '"$RESOLV_CONF"' && dns=""' "$TARGET_SCRIPT"
+       fi
+   fi
+   ```
+4. Make the script executable: `chmod +x /mnt/nv/rc.local`.
+5. Reboot the speaker.
+
+### DNS Discovery Server
+
+The SoundTouch service includes a built-in DNS server specifically designed for Bose devices.
+
+#### How it Works
+When enabled, the DNS server:
+1. Receives DNS queries from migrated SoundTouch devices.
+2. **Intercepts** known Bose domains (e.g., `api.bose.com`, `streaming.bose.com`, `bmx.bose.com`) and resolves them to the AfterTouch service IP.
+3. **Logs** all other queries for discovery purposes, allowing you to identify new Bose cloud endpoints.
+4. **Forwards** unknown or non-Bose queries to the configured upstream DNS server (default: `8.8.8.8`).
+
+#### Configuration
+You can enable and configure the DNS server via the Web UI or environment variables:
+- `ENABLE_DNS_DISCOVERY=true`: Turns on the DNS server.
+- `DNS_BIND_ADDR=:53`: The port to listen on (requires root privileges for port 53).
+- `DNS_UPSTREAM=1.1.1.1`: Your preferred upstream DNS provider.
+
+#### Manual Discovery via DNS
+Even without migrating a device, you can use the DNS server to discover what a device is querying by manually setting your router's DNS or the device's DNS to point to the AfterTouch service.
+
 ## API Reference

 ### Discovery & Setup
@@ -360,6 +450,15 @@ The web management interface provides a comprehensive dashboard for managing you
 - **Statistics Dashboard**: Usage and error analytics
 - **Debug Tools**: Device communication testing utilities

+#### Interactions & Traffic Analysis
+- **Traffic Overview**: View aggregate request counts for self-handled and proxied traffic.
+- **Session Browsing**: Browse recorded interactions grouped by session.
+- **Advanced Filtering**: Filter interactions by session, category (Self/Upstream), and timestamp.
+- **Interaction Viewer**: View raw `.http` recording content directly in the browser.
+- **Session Management**: Delete individual sessions or perform bulk cleanup to keep only recent sessions.
+- **Session Download**: Download complete interaction sessions as `.tar.gz` archives for offline analysis or bug reports.
+- **DNS Discoveries**: Real-time table of all hostnames discovered via the AfterTouch DNS server, categorized by interception status (Self/Upstream).
+
 ### Usage Tips

 1. **First Time Setup**: The interface will guide you through initial device discovery
@@ -378,6 +477,7 @@ The service automatically records all HTTP interactions (both those handled loca
 - **Path-Based Structure**: Recordings are organized into subdirectories based on their URL path for better discoverability.
 - **Automatic Sanitization**: Variable path segments like IP addresses, Device IDs, and Account IDs are automatically identified and replaced with placeholders (e.g., `{{ip}}`, `{{deviceId}}`). The original values are preserved as comments at the top of the recorded `.http` files for easy identification.
 - **Re-playability**: An `http-client.env.json` file is generated for each session, allowing you to re-play the recorded requests immediately in IntelliJ IDEA.
+- **Management UI**: The **5. Interactions** tab provides a built-in viewer and management tools for all recorded data.

 ### Configuration

@@ -387,6 +487,8 @@ By default, the service redacts sensitive information from the recorded `.http`
 - `Authorization` headers
 - `Cookie` headers
 - `X-Bose-Token` headers
+- `X-Bose-Key` headers
+- `Proxy-Authorization` headers

 This behavior is controlled by the `--redact-logs` flag or the `REDACT_PROXY_LOGS` environment variable.

@@ -436,6 +538,8 @@ data/
 │       │   └── {PATH}/
 │       │       └── {SEQ}-{TIME}-{METHOD}.http
 │       └── http-client.env.json
+├── dns/
+│   └── discoveries.json
 ├── stats/
 │   ├── usage/
 │   │   └── *.json
@@ -457,6 +561,9 @@ data/
 - **Presets.xml**: Cross-device preset synchronization
 - **Recents.xml**: Recent playback history

+#### DNS Data (`dns/`)
+- **discoveries.json**: Persisted DNS discovery logs with hostname deduplication
+
 #### Statistics (`stats/`)
 - **usage/**: Device usage analytics and patterns
 - **error/**: Error logs and diagnostic information
@@ -516,6 +623,34 @@ find data/stats/ -name "*.json" -mtime +90 -delete
 - `POST /setup/migrate/{deviceIP}`: Migrate a device using the specified method (XML/Hosts).
 - `GET /setup/ca.crt`: Download the Root CA certificate for manual installation.

+#### `GET /setup/interactions`
+Lists recorded interactions with optional filtering.
+
+**Query Parameters:**
+- `session`: Filter by session ID (optional)
+- `category`: Filter by category (`self` or `upstream`) (optional)
+- `since`: Filter by timestamp (e.g., `2026-02-15 15:00:00`) (optional)
+
+#### `GET /setup/interaction-stats`
+Returns aggregate statistics about recorded interactions across all sessions.
+
+#### `GET /setup/interaction-content?file={path}`
+Returns the raw content of a specific recorded `.http` file.
+
+#### `DELETE /setup/interactions/sessions/{sessionID}`
+Deletes all recordings associated with a specific session.
+
+#### `DELETE /setup/interactions/sessions?keep={N}`
+Bulk cleanup: deletes all but the most recent `N` sessions.
+
+### DNS Discovery API
+
+#### `GET /setup/dns-discoveries`
+Returns merged in-memory and persisted DNS discoveries, sorted by last seen timestamp.
+
+#### `DELETE /setup/dns-discoveries`
+Clears all recorded DNS discovery data from memory and disk.
+
 ### Emulated Services
 - `/bmx/registry/v1/services`: BMX service registry.
 - `/bmx/tunein/v1/*`: TuneIn radio emulation.
@@ -40,16 +40,20 @@ Open your web browser and navigate to the service's web interface:
 To migrate your speakers, the service needs SSH access. You can enable it by:
 1. Creating an empty file named `remote_services` on a USB stick.
 2. Inserting the USB stick into the SoundTouch speaker's service port.
-3. Rebooting the speaker.
+3. Rebooting the speaker (unplug/replug).
+
+**Verify SSH Access:**
+- Confirm the device responds to SSH without a password: `ssh -oHostKeyAlgorithms=+ssh-rsa root@<IP>`
+- Or use the **Migration** tab in the Web UI to see if the device shows a "✅ Success" status for SSH.
 Once enabled, you can log in as `root` (no password).

-#### 4. Discover and Sync Device Data
-The web interface handles the entire process in a guided flow across four tabs:
+#### 4. Setup Through the Web UI
+The web interface handles the entire process in a guided flow. Before proceeding, we strongly recommend reviewing the [Migration & Safety Guide](MIGRATION-SAFETY.md).

-*   **Step 1: Devices**: The service automatically scans for SoundTouch devices on your network. If a device is not found, you can manually add its IP address.
-*   **Step 2: Data Sync**: Select your device and click "Start Sync". This will automatically fetch your presets, recents, and configured sources from the speaker and store them in the local `data/` directory.
-*   **Step 3: Migration**: Choose your redirection method (XML Recommended) and click "Confirm Migration & Reboot".
-*   **Step 4: Settings**: Configure global server URLs and proxy behavior (logging, redaction).
+*   **Step 1: Settings**: Configure your server's IP or domain. This ensures the speakers know where to find the local services.
+*   **Step 2: Devices**: The service automatically scans for SoundTouch devices on your network. If a device is not found, you can manually add its IP address.
+*   **Step 3: Data Sync**: Select your device and click "Start Sync". This will automatically fetch your presets, recents, and configured sources from the speaker and store them in the local `data/` directory.
+*   **Step 4: Migration**: Choose your redirection method (XML Recommended) and click "Confirm Migration". After the migration, reboot your speaker to apply the changes.

 #### 5. Verify Your Local Data
 Once migrated, your speaker will use the data captured during the Sync step.
@@ -418,10 +418,10 @@ soundtouch-cli -host <discovered-ip> -bass  # Verify final state

 ## Related Documentation

- **[API Endpoints Overview](API-Endpoints-Overview.md)** - Complete API reference
+- **[API Endpoints Overview](API-ENDPOINTS.md)** - Complete API reference
 - **[Volume Controls](VOLUME-CONTROLS.md)** - Related audio control documentation
- **[Client Usage Examples](../cmd/soundtouch-cli/main.go)** - CLI implementation reference
- **[Models](../pkg/models/bass.go)** - Bass model implementation
+- **[Client Usage Examples](../../cmd/soundtouch-cli/main.go)** - CLI implementation reference
+- **[Models](../../pkg/models/bass.go)** - Bass model implementation

 ## API Compliance

@@ -443,4 +443,4 @@ The implementation follows the official SoundTouch API:
 **Implementation Date**: 2026-01-09  
 **Status**: ✅ Complete and tested  
 **Real Device Validation**: SoundTouch 10, SoundTouch 20  
-**API Compliance**: Full compliance with SoundTouch Web API specification
+**API Compliance**: Full compliance with SoundTouch Web API specification
@@ -0,0 +1,73 @@
+# Bose SoundTouch Cloud API Emulation (Marge/BMX/Stats)
+
+This document describes the cloud-emulation APIs provided by the SoundTouch service. These APIs mimic the Bose cloud services (Marge, BMX, Stats) that SoundTouch devices and the SoundTouch controller application (Stockholm) interact with.
+
+## Marge API (Account & Configuration)
+
+Base path: `/marge`
+
+### GET /streaming/sourceproviders
+Retrieves a list of available streaming source providers.
+
+### GET /accounts/{accountId}/full
+Retrieves the full account configuration including sources, presets, and devices.
+
+### GET /streaming/account/{accountId}/emailaddress
+Retrieves the email address associated with the account.
+
+### GET /streaming/device_setting/account/{accountId}/device/{deviceId}/device_settings
+Retrieves settings for a specific device (e.g., clock format).
+
+### POST /streaming/device_setting/account/{accountId}/device/{deviceId}/device_settings
+Updates settings for a specific device.
+
+### POST /accounts/{accountId}/devices/{deviceId}/presets/{presetNumber}
+Updates a preset for a device.
+
+### POST /accounts/{accountId}/devices/{deviceId}/recents
+Adds an item to the device's recently played history.
+
+### POST /accounts/{accountId}/devices
+Adds a device to the account.
+
+### DELETE /accounts/{accountId}/devices/{deviceId}
+Removes a device from the account.
+
+## Customer API (Profile & Password)
+
+Base path: `/customer`
+
+### GET /account/{accountId}
+Retrieves the customer account profile.
+
+### POST /account/{accountId}
+Updates the customer account profile.
+
+### POST /account/{accountId}/password
+Changes the account password.
+
+## Analytics & Stats API
+
+Base path: `/v1` (App Events) or `/streaming/stats` (Device Stats)
+
+### POST /v1/stapp/{deviceId}
+Endpoint called by Bose SoundTouch mobile and web applications (Stockholm) to submit event data.
+
+### POST /v1/scmudc/{deviceId}
+Endpoint equivalent to `/v1/stapp/{deviceId}` sometimes used by apps or devices.
+
+### POST /streaming/stats/usage
+Endpoint used by physical devices to report usage statistics.
+
+### POST /streaming/stats/error
+Endpoint used by physical devices to report error statistics.
+
+## BMX API (Streaming & Registry)
+
+Base path: `/bmx`
+
+### GET /registry/v1/services
+Retrieves the registry of available streaming services.
+
+### GET /tunein/v1/playback/station/{stationID}
+Retrieves playback information for a TuneIn station.
@@ -366,7 +366,7 @@ This implementation now provides the full preset management lifecycle:

 ## Related Documentation

- [API Endpoints Overview](API-Endpoints-Overview.md) - Complete API reference
+- [API Endpoints Overview](API-ENDPOINTS.md) - Complete API reference
 - [Volume Controls](VOLUME-CONTROLS.md) - Volume management
 - [Key Controls](KEY-CONTROLS.md) - Media control commands
 - [Source Selection](SOURCE-SELECTION.md) - Audio source management
@@ -375,4 +375,4 @@ This implementation now provides the full preset management lifecycle:

 Preset management in the Bose SoundTouch API is **intentionally read-only** by design. The API provides excellent capabilities for analyzing and understanding preset configurations, but preset creation must be done through official channels (app or device). This is a deliberate design decision that respects user control over their personal preset configurations.

-For most use cases, reading preset information is sufficient for building applications that work with existing user configurations. For preset creation, guide users to use the official app or device controls, which provide the proper user experience and validation.
+For most use cases, reading preset information is sufficient for building applications that work with existing user configurations. For preset creation, guide users to use the official app or device controls, which provide the proper user experience and validation.
@@ -345,13 +345,13 @@ The implementation follows the official SoundTouch API:

 ## Related Documentation

- **[API Endpoints Overview](API-Endpoints-Overview.md)** - Complete API reference
- **[Sources](../pkg/models/sources.go)** - Source model implementation  
- **[Now Playing](../pkg/models/nowplaying.go)** - ContentItem model
- **[Client Usage Examples](../cmd/soundtouch-cli/main.go)** - CLI implementation reference
+- **[API Endpoints Overview](API-ENDPOINTS.md)** - Complete API reference
+- **[Sources](../../pkg/models/sources.go)** - Source model implementation  
+- **[Now Playing](../../pkg/models/nowplaying.go)** - ContentItem model
+- **[Client Usage Examples](../../cmd/soundtouch-cli/main.go)** - CLI implementation reference

 ---

 **Implementation Date**: 2026-01-09  
 **Status**: ✅ Complete and tested  
-**Real Device Validation**: SoundTouch 10, SoundTouch 20
+**Real Device Validation**: SoundTouch 10, SoundTouch 20
@@ -149,4 +149,4 @@ After configuring accounts:
 3. Use `browse` commands to explore content
 4. Use `play` commands to start playback

-See the [CLI Reference](../../docs/CLI-REFERENCE.md) for complete documentation.
+See the [CLI Reference](../../docs/guides/CLI-REFERENCE.md) for complete documentation.
@@ -176,5 +176,5 @@ The example gracefully handles missing services:
 ## Related Documentation

 - [SoundTouch WebServices API Wiki](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API)
- [CLI Reference](../../docs/CLI-REFERENCE.md)
- [Navigation Guide](../../docs/NAVIGATION-GUIDE.md)
+- [CLI Reference](../../docs/guides/CLI-REFERENCE.md)
+- [Navigation Guide](../../docs/guides/SURVIVAL-GUIDE.md)
@@ -177,11 +177,11 @@ if err != nil {

 This introspect data is useful before:
 - [Preset Management](../preset-management/) - Verify service state before storing presets
- [Content Selection](../../docs/SOURCE-SELECTION.md) - Check capabilities before switching sources
- [Zone Management](../../docs/zone-management.md) - Ensure all devices support the service
+- [Content Selection](../../docs/reference/SOURCE-SELECTION.md) - Check capabilities before switching sources
+- [Zone Management](../../docs/reference/ZONE-MANAGEMENT.md) - Ensure all devices support the service

 ## API Documentation

 For complete API documentation, see:
- [API Reference](../../docs/API-Endpoints-Overview.md)
- [Service Availability Implementation](../../docs/SERVICE-AVAILABILITY-IMPLEMENTATION.md)
+- [API Reference](../../docs/reference/API-ENDPOINTS.md)
+- [Service Availability Implementation](../../docs/SERVICE-AVAILABILITY-IMPLEMENTATION.md)
@@ -275,10 +275,10 @@ go run ./cmd/soundtouch-cli --host 192.168.1.100 info

 ## Related Documentation

- [CLI Reference](../../docs/CLI-REFERENCE.md) - Browse and station commands
- [Navigation Guide](../../docs/NAVIGATION-GUIDE.md) - Comprehensive navigation documentation
+- [CLI Reference](../../docs/guides/CLI-REFERENCE.md) - Browse and station commands
+- [Navigation Guide](../../docs/guides/SURVIVAL-GUIDE.md) - Comprehensive navigation documentation
 - [Navigation API Reference](../../docs/API-NAVIGATION-REFERENCE.md) - Technical API details
- [WebSocket Events](../../docs/websocket-events.md) - Real-time event handling
+- [WebSocket Events](../../docs/reference/WEBSOCKET-EVENTS.md) - Real-time event handling

 ## Use Cases

@@ -288,4 +288,4 @@ This example demonstrates patterns for:
 - **Direct Playback**: Play content without storing as presets first
 - **Content Exploration**: Browse large music libraries efficiently
 - **Smart Home Integration**: Programmatically start specific content
- **Personalized Experiences**: Access account-specific content from streaming services
+- **Personalized Experiences**: Access account-specific content from streaming services
@@ -256,10 +256,10 @@ Error: All preset slots are occupied

 ## Related Documentation

- [CLI Reference](../../docs/CLI-REFERENCE.md) - Command-line usage
+- [CLI Reference](../../docs/guides/CLI-REFERENCE.md) - Command-line usage
 - [Preset Implementation Guide](../../docs/preset-store.md) - Technical details
- [WebSocket Events](../../docs/websocket-events.md) - Real-time event handling
- [API Reference](../../docs/API-Endpoints-Overview.md) - Complete API documentation
+- [WebSocket Events](../../docs/reference/WEBSOCKET-EVENTS.md) - Real-time event handling
+- [API Reference](../../docs/reference/API-ENDPOINTS.md) - Complete API documentation

 ## Use Cases

@@ -269,4 +269,4 @@ This example demonstrates patterns for:
 - **Music Management**: Organize favorite content into quick-access presets
 - **Family Scenarios**: Each person gets their own preset slots
 - **Party Mode**: Pre-configure playlists for different moods
- **Radio Favorites**: Save frequently listened radio stations
+- **Radio Favorites**: Save frequently listened radio stations
@@ -252,8 +252,8 @@ go run main.go -host 192.168.1.100 -type unknown

 This recents data is useful for:
 - [Preset Management](../preset-management/) - Finding presetable content to save
- [Content Selection](../../docs/SOURCE-SELECTION.md) - Understanding usage patterns
- [Navigation](../../docs/NAVIGATION-GUIDE.md) - Quickly accessing recently played content
+- [Content Selection](../../docs/reference/SOURCE-SELECTION.md) - Understanding usage patterns
+- [Navigation](../../docs/guides/SURVIVAL-GUIDE.md) - Quickly accessing recently played content

 ## Related CLI Commands

@@ -274,6 +274,6 @@ soundtouch-cli --host 192.168.1.100 recents latest
 ## API Documentation

 For complete API documentation, see:
- [API Reference](../../docs/API-Endpoints-Overview.md)
- [CLI Reference](../../docs/CLI-REFERENCE.md)
- [Recents Models](../../pkg/models/recents.go)
+- [API Reference](../../docs/reference/API-ENDPOINTS.md)
+- [CLI Reference](../../docs/guides/CLI-REFERENCE.md)
+- [Recents Models](../../pkg/models/recents.go)
@@ -6,18 +6,18 @@ require (
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/gorilla/websocket v1.5.3
 	github.com/hashicorp/mdns v1.0.6
+	github.com/miekg/dns v1.1.72
+	github.com/russross/blackfriday/v2 v2.1.0
 	github.com/urfave/cli/v2 v2.27.7
-	golang.org/x/crypto v0.47.0
+	golang.org/x/crypto v0.48.0
 )

 require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
-	golang.org/x/mod v0.32.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 )
@@ -24,16 +24,16 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -44,8 +44,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -79,8 +79,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -98,6 +98,6 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -0,0 +1,342 @@
+// Package discovery provides DNS-based discovery and interception for Bose SoundTouch devices.
+package discovery
+
+import (
+	"fmt"
+	"log"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// DNSDiscovery handles DNS queries and records discovered hosts.
+type DNSDiscovery struct {
+	// Configuration
+	upstreamDNS string
+	serviceIP   string
+
+	// State
+	discovered map[string]*DiscoveredHost
+	mu         sync.RWMutex
+
+	// Callbacks
+	onNewDiscovery func(hostname string)
+
+	// Servers for Shutdown
+	udpServer *dns.Server
+	tcpServer *dns.Server
+}
+
+// DiscoveredHost represents a host discovered via DNS queries.
+type DiscoveredHost struct {
+	Hostname      string    `json:"hostname"`
+	FirstSeen     time.Time `json:"first_seen"`
+	LastSeen      time.Time `json:"last_seen"`
+	QueryCount    int       `json:"query_count"`
+	IsBoseService bool      `json:"is_bose_service"`
+	IsIntercepted bool      `json:"is_intercepted"`
+	RemoteAddr    string    `json:"remote_addr,omitempty"`
+}
+
+// NewDNSDiscovery creates a new DNSDiscovery instance.
+func NewDNSDiscovery(upstreamDNS, serviceIP string) *DNSDiscovery {
+	return &DNSDiscovery{
+		upstreamDNS: upstreamDNS,
+		serviceIP:   serviceIP,
+		discovered:  make(map[string]*DiscoveredHost),
+	}
+}
+
+// ServeDNS implements the dns.Handler interface.
+func (d *DNSDiscovery) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	if len(r.Question) == 0 {
+		return
+	}
+
+	q := r.Question[0]
+	hostname := strings.TrimSuffix(q.Name, ".")
+
+	remoteAddr := ""
+	if w.RemoteAddr() != nil {
+		remoteAddr = w.RemoteAddr().String()
+	}
+
+	// Decide how to respond
+	isIntercepted := d.shouldIntercept(hostname) || hostname == "aftertouch.test"
+
+	// Record discovery
+	d.recordQuery(hostname, isIntercepted, remoteAddr)
+
+	if isIntercepted {
+		// Return your service IP
+		d.respondWithIP(w, r, d.serviceIP)
+		log.Printf("[DNS] Intercepting %s (type %d) -> %s", hostname, q.Qtype, d.serviceIP)
+	} else {
+		// Forward to real DNS
+		log.Printf("[DNS] Forwarding %s (type %d) to %s", hostname, q.Qtype, d.upstreamDNS)
+		d.forward(w, r)
+	}
+}
+
+// recordQuery logs a DNS query and updates the internal state.
+func (d *DNSDiscovery) recordQuery(hostname string, isIntercepted bool, remoteAddr string) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	host, exists := d.discovered[hostname]
+	if !exists {
+		// New discovery!
+		host = &DiscoveredHost{
+			Hostname:      hostname,
+			FirstSeen:     time.Now(),
+			LastSeen:      time.Now(),
+			QueryCount:    1,
+			IsBoseService: d.isBoseRelated(hostname),
+			IsIntercepted: isIntercepted,
+			RemoteAddr:    remoteAddr,
+		}
+		d.discovered[hostname] = host
+
+		log.Printf("[NEW DISCOVERY] %s (Bose: %v, Intercepted: %v)",
+			hostname, host.IsBoseService, host.IsIntercepted)
+
+		if d.onNewDiscovery != nil {
+			go d.onNewDiscovery(hostname)
+		}
+	} else {
+		host.LastSeen = time.Now()
+		host.QueryCount++
+
+		host.IsIntercepted = isIntercepted
+		if remoteAddr != "" {
+			host.RemoteAddr = remoteAddr
+		}
+	}
+}
+
+func (d *DNSDiscovery) shouldIntercept(hostname string) bool {
+	// Intercept known Bose cloud services
+	interceptList := []string{
+		"api.bose.com",
+		"marge.bose.com",
+		"bmx.bose.com",
+		"streaming.bose.com",
+		"updates.bose.com",
+		"stats.bose.com",
+		"content.api.bose.io",
+		"events.api.bosecm.com",
+		"bose-prod.apigee.net",
+		"worldwide.bose.com",
+		"music.api.bose.com",
+	}
+
+	for _, service := range interceptList {
+		if strings.Contains(hostname, service) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (d *DNSDiscovery) isBoseRelated(hostname string) bool {
+	return strings.Contains(hostname, "bose") ||
+		strings.Contains(hostname, "soundtouch")
+}
+
+func (d *DNSDiscovery) respondWithIP(w dns.ResponseWriter, r *dns.Msg, ip string) {
+	m := new(dns.Msg)
+	m.SetReply(r)
+	m.Compress = false // Embedded clients sometimes don't like compression
+	m.Authoritative = true
+	m.RecursionAvailable = true
+
+	q := r.Question[0]
+	log.Printf("[DNS] Intercepted query for %s (type %d) from %s", q.Name, q.Qtype, w.RemoteAddr())
+
+	switch q.Qtype {
+	case dns.TypeA, dns.TypeANY:
+		rr, err := dns.NewRR(fmt.Sprintf("%s 60 IN A %s", q.Name, ip))
+		if err == nil {
+			m.Answer = append(m.Answer, rr)
+
+			log.Printf("[DNS] Returning A record %s -> %s", q.Name, ip)
+		} else {
+			log.Printf("[DNS] Error creating A record: %v", err)
+		}
+	case dns.TypeAAAA:
+		// Explicitly return SUCCESS with no data for AAAA to prevent fallback issues
+		log.Printf("[DNS] Returning empty AAAA success (NODATA) for %s", q.Name)
+	default:
+		log.Printf("[DNS] Returning empty success for type %d", q.Qtype)
+	}
+
+	if err := w.WriteMsg(m); err != nil {
+		log.Printf("[DNS ERROR] Failed to write response: %v", err)
+	}
+}
+
+func (d *DNSDiscovery) forward(w dns.ResponseWriter, r *dns.Msg) {
+	if len(r.Question) == 0 {
+		return
+	}
+
+	// Don't forward PTR queries for our own service IP to avoid loops or slow timeouts
+	if r.Question[0].Qtype == dns.TypePTR {
+		m := new(dns.Msg)
+		m.SetReply(r)
+
+		m.Rcode = dns.RcodeNameError
+		if err := w.WriteMsg(m); err != nil {
+			log.Printf("[DNS ERROR] Failed to write NXDOMAIN: %v", err)
+		}
+
+		return
+	}
+
+	c := new(dns.Client)
+	// Add port 53 if not present
+	upstream := d.upstreamDNS
+	if !strings.Contains(upstream, ":") {
+		upstream += ":53"
+	}
+
+	in, _, err := c.Exchange(r, upstream)
+	if err != nil {
+		log.Printf("[DNS ERROR] Forward failed for %s (type %d): %v", r.Question[0].Name, r.Question[0].Qtype, err)
+		// Return a failure response instead of just dropping
+		m := new(dns.Msg)
+		m.SetReply(r)
+
+		m.Rcode = dns.RcodeServerFailure
+		if err := w.WriteMsg(m); err != nil {
+			log.Printf("[DNS ERROR] Failed to write failure response: %v", err)
+		}
+
+		return
+	}
+
+	if err := w.WriteMsg(in); err != nil {
+		log.Printf("[DNS ERROR] Failed to write forwarded response: %v", err)
+	}
+}
+
+// GetDiscovered returns a map of all discovered hosts.
+func (d *DNSDiscovery) GetDiscovered() map[string]*DiscoveredHost {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	// Return copy
+	result := make(map[string]*DiscoveredHost)
+	for k, v := range d.discovered {
+		result[k] = v
+	}
+
+	return result
+}
+
+// GetBoseHosts returns a slice of all discovered Bose-related hosts.
+func (d *DNSDiscovery) GetBoseHosts() []*DiscoveredHost {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var result []*DiscoveredHost
+
+	for _, host := range d.discovered {
+		if host.IsBoseService {
+			result = append(result, host)
+		}
+	}
+
+	return result
+}
+
+// SetDiscovered sets the map of discovered hosts.
+func (d *DNSDiscovery) SetDiscovered(discovered map[string]*DiscoveredHost) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	d.discovered = discovered
+}
+
+// Start DNS server starts both UDP and TCP listeners
+func (d *DNSDiscovery) Start(addr string) error {
+	mux := dns.NewServeMux()
+	mux.HandleFunc(".", d.ServeDNS)
+
+	d.mu.Lock()
+	d.udpServer = &dns.Server{
+		Addr:    addr,
+		Net:     "udp",
+		Handler: mux,
+	}
+
+	d.tcpServer = &dns.Server{
+		Addr:    addr,
+		Net:     "tcp",
+		Handler: mux,
+	}
+	d.mu.Unlock()
+
+	errChan := make(chan error, 2)
+
+	go func() {
+		log.Printf("[DNS] UDP Discovery server starting on %s", addr)
+
+		if err := d.udpServer.ListenAndServe(); err != nil {
+			errChan <- fmt.Errorf("UDP server failed: %w", err)
+		}
+	}()
+
+	go func() {
+		log.Printf("[DNS] TCP Discovery server starting on %s", addr)
+
+		if err := d.tcpServer.ListenAndServe(); err != nil {
+			errChan <- fmt.Errorf("TCP server failed: %w", err)
+		}
+	}()
+
+	log.Printf("[DNS] Discovery servers starting on %s (upstream: %s, intercept IP: %s)", addr, d.upstreamDNS, d.serviceIP)
+
+	// Wait for first error
+	return <-errChan
+}
+
+// IsRunning returns true if the DNS server is active and bound to the specified address.
+func (d *DNSDiscovery) IsRunning(addr string) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	if d.udpServer == nil || d.tcpServer == nil {
+		return false
+	}
+
+	// We check if the address matches what we expect
+	return d.udpServer.Addr == addr && d.tcpServer.Addr == addr
+}
+
+// Shutdown stops the DNS server listeners
+func (d *DNSDiscovery) Shutdown() error {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if d.udpServer != nil {
+		if err := d.udpServer.Shutdown(); err != nil {
+			log.Printf("[DNS] Error shutting down UDP server: %v", err)
+		}
+
+		d.udpServer = nil
+	}
+
+	if d.tcpServer != nil {
+		if err := d.tcpServer.Shutdown(); err != nil {
+			log.Printf("[DNS] Error shutting down TCP server: %v", err)
+		}
+
+		d.tcpServer = nil
+	}
+
+	return nil
+}
@@ -0,0 +1,194 @@
+package discovery
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+func TestDNSDiscovery_Interception(t *testing.T) {
+	serviceIP := "192.168.1.100"
+	upstreamDNS := "8.8.8.8"
+	d := NewDNSDiscovery(upstreamDNS, serviceIP)
+
+	// Test intercepting Bose service
+	m := new(dns.Msg)
+	m.SetQuestion("api.bose.com.", dns.TypeA)
+
+	rw := &mockResponseWriter{}
+	d.ServeDNS(rw, m)
+
+	if rw.msg == nil {
+		t.Fatal("Expected a response message, got nil")
+	}
+
+	if len(rw.msg.Answer) == 0 {
+		t.Fatal("Expected an answer in the response")
+	}
+
+	if a, ok := rw.msg.Answer[0].(*dns.A); ok {
+		if a.A.String() != serviceIP {
+			t.Errorf("Expected intercepted IP %s, got %s", serviceIP, a.A.String())
+		}
+	} else {
+		t.Errorf("Expected A record, got %T", rw.msg.Answer[0])
+	}
+
+	// Test aftertouch.test
+	m2 := new(dns.Msg)
+	m2.SetQuestion("aftertouch.test.", dns.TypeA)
+	rw2 := &mockResponseWriter{}
+	d.ServeDNS(rw2, m2)
+
+	if rw2.msg == nil || len(rw2.msg.Answer) == 0 {
+		t.Fatal("Expected response for aftertouch.test")
+	}
+
+	if a, ok := rw2.msg.Answer[0].(*dns.A); ok {
+		if a.A.String() != serviceIP {
+			t.Errorf("Expected intercepted IP %s for aftertouch.test, got %s", serviceIP, a.A.String())
+		}
+	} else {
+		t.Errorf("Expected A record for aftertouch.test, got %T", rw2.msg.Answer[0])
+	}
+}
+
+func TestDNSDiscovery_Forwarding(t *testing.T) {
+	// This test is harder because it needs a real upstream or a mock.
+	// For now, let's just test that it calls forward and record.
+	serviceIP := "192.168.1.100"
+	upstreamDNS := "127.0.0.1:5353" // Use a port that is likely closed or we can mock
+	d := NewDNSDiscovery(upstreamDNS, serviceIP)
+
+	m := new(dns.Msg)
+	m.SetQuestion("google.com.", dns.TypeA)
+
+	rw := &mockResponseWriter{}
+
+	// Start a mock upstream DNS server
+	mux := dns.NewServeMux()
+	mux.HandleFunc("google.com.", func(w dns.ResponseWriter, r *dns.Msg) {
+		m := new(dns.Msg)
+		m.SetReply(r)
+		_ = w.WriteMsg(m)
+	})
+	ts := &dns.Server{Addr: "127.0.0.1:5353", Net: "udp", Handler: mux, ReadTimeout: 100 * time.Millisecond, WriteTimeout: 100 * time.Millisecond}
+	go func() {
+		_ = ts.ListenAndServe()
+	}()
+	defer func() { _ = ts.Shutdown() }()
+
+	// Give it a moment to start
+	time.Sleep(100 * time.Millisecond)
+
+	// We expect forward to succeed
+	d.ServeDNS(rw, m)
+
+	d.mu.RLock()
+	host, exists := d.discovered["google.com"]
+	d.mu.RUnlock()
+
+	if !exists {
+		t.Error("Expected google.com to be recorded in discovery")
+	}
+	if host.IsBoseService {
+		t.Error("google.com should not be identified as a Bose service")
+	}
+}
+
+func TestDNSDiscovery_StartTCP(t *testing.T) {
+	serviceIP := "192.168.1.100"
+	upstreamDNS := "8.8.8.8"
+	d := NewDNSDiscovery(upstreamDNS, serviceIP)
+
+	addr := "127.0.0.1:5354"
+	go func() {
+		_ = d.Start(addr)
+	}()
+
+	// Give it a moment to start
+	time.Sleep(200 * time.Millisecond)
+
+	// Test TCP resolution
+	m := new(dns.Msg)
+	m.SetQuestion("api.bose.com.", dns.TypeA)
+
+	c := new(dns.Client)
+	c.Net = "tcp"
+	in, _, err := c.Exchange(m, addr)
+	if err != nil {
+		t.Fatalf("Failed to exchange via TCP: %v", err)
+	}
+
+	if len(in.Answer) == 0 {
+		t.Fatal("Expected answer in TCP response")
+	}
+
+	if a, ok := in.Answer[0].(*dns.A); ok {
+		if a.A.String() != serviceIP {
+			t.Errorf("Expected intercepted IP %s via TCP, got %s", serviceIP, a.A.String())
+		}
+	} else {
+		t.Errorf("Expected A record via TCP, got %T", in.Answer[0])
+	}
+
+	// Test Shutdown
+	err = d.Shutdown()
+	if err != nil {
+		t.Errorf("Shutdown failed: %v", err)
+	}
+
+	// Verify it's really shut down by trying to connect
+	_, _, err = c.Exchange(m, addr)
+	if err == nil {
+		t.Error("Expected error after shutdown, but could still exchange")
+	}
+}
+
+func TestDNSDiscovery_IsRunning(t *testing.T) {
+	serviceIP := "192.168.1.100"
+	upstreamDNS := "8.8.8.8"
+	d := NewDNSDiscovery(upstreamDNS, serviceIP)
+
+	addr := "127.0.0.1:5355"
+
+	if d.IsRunning(addr) {
+		t.Error("Expected IsRunning to be false before Start")
+	}
+
+	go func() {
+		_ = d.Start(addr)
+	}()
+
+	// Give it a moment to start
+	time.Sleep(200 * time.Millisecond)
+
+	if !d.IsRunning(addr) {
+		t.Error("Expected IsRunning to be true after Start")
+	}
+
+	if d.IsRunning("127.0.0.1:9999") {
+		t.Error("Expected IsRunning to be false for wrong address")
+	}
+
+	_ = d.Shutdown()
+
+	if d.IsRunning(addr) {
+		t.Error("Expected IsRunning to be false after Shutdown")
+	}
+}
+
+type mockResponseWriter struct {
+	msg *dns.Msg
+}
+
+func (m *mockResponseWriter) LocalAddr() net.Addr         { return nil }
+func (m *mockResponseWriter) RemoteAddr() net.Addr        { return nil }
+func (m *mockResponseWriter) WriteMsg(msg *dns.Msg) error { m.msg = msg; return nil }
+func (m *mockResponseWriter) Write([]byte) (int, error)   { return 0, nil }
+func (m *mockResponseWriter) Close() error                { return nil }
+func (m *mockResponseWriter) TsigStatus() error           { return nil }
+func (m *mockResponseWriter) TsigTimersOnly(bool)         {}
+func (m *mockResponseWriter) Hijack()                     {}
@@ -185,6 +185,7 @@ type ServiceDeviceInfo struct {
 	IPAddress           string `json:"ip_address" xml:"ipAddress"`
 	Name                string `json:"name" xml:"name"`
 	DiscoveryMethod     string `json:"discovery_method,omitempty"`
+	AccountID           string `json:"account_id,omitempty"`
 }

 // CustomerSupportDevice represents device information for customer support purposes.
@@ -239,3 +240,70 @@ type DeviceEvent struct {
 	MonoTime int64                  `json:"monoTime"`
 	Data     map[string]interface{} `json:"data"`
 }
+
+// DeviceEventsRequest represents a request containing multiple device events (stapp/scmudc).
+type DeviceEventsRequest struct {
+	Envelope struct {
+		MonoTime               int64  `json:"monoTime"`
+		PayloadProtocolVersion string `json:"payloadProtocolVersion"`
+		PayloadType            string `json:"payloadType"`
+		ProtocolVersion        string `json:"protocolVersion"`
+		Time                   string `json:"time"`
+		UniqueID               string `json:"uniqueId"`
+	} `json:"envelope"`
+	Payload struct {
+		DeviceInfo struct {
+			BoseID          string `json:"boseID"`
+			DeviceID        string `json:"deviceID"`
+			DeviceType      string `json:"deviceType"`
+			SoftwareVersion string `json:"softwareVersion"`
+		} `json:"deviceInfo"`
+		Events []struct {
+			Data map[string]interface{} `json:"data"`
+			Time string                 `json:"time"`
+			Type string                 `json:"type"`
+		} `json:"events"`
+	} `json:"payload"`
+}
+
+// DeviceSettingsResponse represents device settings.
+type DeviceSettingsResponse struct {
+	XMLName  xml.Name        `xml:"deviceSettings"`
+	Settings []DeviceSetting `xml:"deviceSetting"`
+}
+
+// DeviceSetting represents a single device setting.
+type DeviceSetting struct {
+	Name  string `xml:"name"`
+	Value string `xml:"value"`
+}
+
+// AccountProfileResponse represents a customer account profile.
+type AccountProfileResponse struct {
+	XMLName        xml.Name `xml:"customer"`
+	AccountID      string   `xml:"accountID"`
+	Email          string   `xml:"email"`
+	FirstName      string   `xml:"firstName"`
+	LastName       string   `xml:"lastName"`
+	CountryCode    string   `xml:"countryCode"`
+	LanguageCode   string   `xml:"languageCode"`
+	Street         string   `xml:"street"`
+	City           string   `xml:"city"`
+	PostalCode     string   `xml:"postalCode"`
+	State          string   `xml:"state"`
+	Phone          string   `xml:"phone"`
+	MarketingOptIn bool     `xml:"marketingOptIn"`
+}
+
+// ChangePasswordRequest represents a request to change the account password.
+type ChangePasswordRequest struct {
+	XMLName     xml.Name `xml:"passwordChange"`
+	OldPassword string   `xml:"oldPassword"`
+	NewPassword string   `xml:"newPassword"`
+}
+
+// EmailAddressResponse represents the account email address.
+type EmailAddressResponse struct {
+	XMLName xml.Name `xml:"emailAddress"`
+	Email   string   `xml:",chardata"`
+}
@@ -148,8 +148,8 @@ func (cm *CertificateManager) GenerateCA() error {
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
 		Subject: pkix.Name{
-			Organization: []string{"SoundTouch Local Service"},
-			CommonName:   "SoundTouch Local Root CA",
+			Organization: []string{"AfterTouch"},
+			CommonName:   "AfterTouch Local Root CA",
 		},
 		NotBefore:             notBefore,
 		NotAfter:              notAfter,
@@ -240,7 +240,7 @@ func (cm *CertificateManager) GenerateCertificate(domains []string) ([]byte, []b
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
 		Subject: pkix.Name{
-			Organization: []string{"SoundTouch Local Service"},
+			Organization: []string{"AfterTouch"},
 			CommonName:   domains[0],
 		},
 		NotBefore:   notBefore,
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"sync"
 	"time"
@@ -42,12 +43,12 @@ func NewDataStore(dataDir string) *DataStore {

 // AccountDir returns the directory path for a specific account.
 func (ds *DataStore) AccountDir(account string) string {
-	return filepath.Join(ds.DataDir, account)
+	return filepath.Join(ds.DataDir, "accounts", account)
 }

 // AccountDevicesDir returns the devices directory path for a specific account.
 func (ds *DataStore) AccountDevicesDir(account string) string {
-	return filepath.Join(ds.DataDir, account, constants.DevicesDir)
+	return filepath.Join(ds.AccountDir(account), constants.DevicesDir)
 }

 // AccountDeviceDir returns the directory path for a specific device within an account.
@@ -134,6 +135,7 @@ func (ds *DataStore) ListAllDevices() ([]models.ServiceDeviceInfo, error) {
 			accDevices := ds.listDevicesInAccount(dir, acc.Name())
 			for i := range accDevices {
 				info := accDevices[i]
+				info.AccountID = acc.Name()

 				key := info.DeviceID
 				if key == "" {
@@ -153,13 +155,13 @@ func (ds *DataStore) ListAllDevices() ([]models.ServiceDeviceInfo, error) {

 func (ds *DataStore) getPossibleDataDirs() []string {
 	dirs := []string{}
-	if exists(ds.DataDir) {
-		dirs = append(dirs, ds.DataDir)
+	if exists(filepath.Join(ds.DataDir, "accounts")) {
+		dirs = append(dirs, filepath.Join(ds.DataDir, "accounts"))
 	}

-	// Also check soundcork-go/data if it's different and exists
-	altDir := "soundcork-go/data"
-	if ds.DataDir != altDir && exists(altDir) {
+	// Also check st-go/data/accounts if it's different and exists
+	altDir := "st-go/data/accounts"
+	if filepath.Join(ds.DataDir, "accounts") != altDir && exists(altDir) {
 		dirs = append(dirs, altDir)
 	}

@@ -638,17 +640,6 @@ func (ds *DataStore) Initialize() error {
 		return fmt.Errorf("failed to create data directory: %w", err)
 	}

-	// Ensure default account exists
-	defaultDir := ds.AccountDir("default")
-	if err := os.MkdirAll(defaultDir, 0755); err != nil {
-		return fmt.Errorf("failed to create default account directory: %w", err)
-	}
-
-	// Ensure devices subdirectory for default account
-	if err := os.MkdirAll(ds.AccountDevicesDir("default"), 0755); err != nil {
-		return fmt.Errorf("failed to create default devices directory: %w", err)
-	}
-
 	return nil
 }

@@ -706,6 +697,67 @@ func (ds *DataStore) GetETagForAccount(account, device string) int64 {
 	return maxETag
 }

+// Settings represents the global service settings.
+type Settings struct {
+	ServerURL            string         `json:"server_url"`
+	SoundcorkURL         string         `json:"soundcork_url"`
+	HTTPServerURL        string         `json:"https_server_url,omitempty"`
+	RedactLogs           bool           `json:"redact_logs"`
+	LogBodies            bool           `json:"log_bodies"`
+	RecordInteractions   bool           `json:"record_interactions"`
+	DiscoveryInterval    string         `json:"discovery_interval,omitempty"`
+	DiscoveryEnabled     bool           `json:"discovery_enabled"`
+	EnableSoundcorkProxy bool           `json:"enable_soundcork_proxy"`
+	DNSEnabled           bool           `json:"dns_enabled"`
+	DNSUpstream          string         `json:"dns_upstream,omitempty"`
+	DNSBindAddr          string         `json:"dns_bind_addr,omitempty"`
+	Shortcuts            map[string]int `json:"shortcuts,omitempty"`
+}
+
+// GetSettings retrieves the global service settings.
+func (ds *DataStore) GetSettings() (Settings, error) {
+	if ds == nil || ds.DataDir == "" {
+		return Settings{}, nil
+	}
+
+	path := filepath.Join(ds.DataDir, "settings.json")
+	if !exists(path) {
+		return Settings{}, nil
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return Settings{}, err
+	}
+
+	var settings Settings
+	if err := json.Unmarshal(data, &settings); err != nil {
+		return Settings{}, err
+	}
+
+	return settings, nil
+}
+
+// SaveSettings saves the global service settings.
+func (ds *DataStore) SaveSettings(settings Settings) error {
+	if ds == nil || ds.DataDir == "" {
+		return nil
+	}
+
+	if err := os.MkdirAll(ds.DataDir, 0755); err != nil {
+		return fmt.Errorf("failed to create data directory: %w", err)
+	}
+
+	path := filepath.Join(ds.DataDir, "settings.json")
+
+	data, err := json.MarshalIndent(settings, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(path, data, 0644)
+}
+
 // SaveUsageStats saves usage statistics to the datastore.
 func (ds *DataStore) SaveUsageStats(stats models.UsageStats) error {
 	dir := filepath.Join(ds.DataDir, "stats", "usage")
@@ -774,3 +826,78 @@ func (ds *DataStore) GetDeviceEvents(deviceID string) []models.DeviceEvent {

 	return copiedEvents
 }
+
+// DNSDiscoveryEntry represents a persisted DNS discovery.
+type DNSDiscoveryEntry struct {
+	Hostname      string    `json:"hostname"`
+	FirstSeen     time.Time `json:"first_seen"`
+	LastSeen      time.Time `json:"last_seen"`
+	QueryCount    int       `json:"query_count"`
+	IsBoseService bool      `json:"is_bose_service"`
+	IsIntercepted bool      `json:"is_intercepted"`
+	RemoteAddr    string    `json:"remote_addr,omitempty"`
+}
+
+// SaveDNSDiscoveries saves DNS discoveries to the datastore.
+func (ds *DataStore) SaveDNSDiscoveries(discoveries []DNSDiscoveryEntry) error {
+	if ds == nil || ds.DataDir == "" {
+		return nil
+	}
+
+	dir := filepath.Join(ds.DataDir, "dns")
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return fmt.Errorf("failed to create dns directory: %w", err)
+	}
+
+	path := filepath.Join(dir, "discoveries.json")
+
+	// Sort by last seen descending
+	sort.Slice(discoveries, func(i, j int) bool {
+		return discoveries[i].LastSeen.After(discoveries[j].LastSeen)
+	})
+
+	data, err := json.MarshalIndent(discoveries, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(path, data, 0644)
+}
+
+// LoadDNSDiscoveries loads DNS discoveries from the datastore.
+func (ds *DataStore) LoadDNSDiscoveries() ([]DNSDiscoveryEntry, error) {
+	if ds == nil || ds.DataDir == "" {
+		return []DNSDiscoveryEntry{}, nil
+	}
+
+	path := filepath.Join(ds.DataDir, "dns", "discoveries.json")
+	if !exists(path) {
+		return []DNSDiscoveryEntry{}, nil
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var discoveries []DNSDiscoveryEntry
+	if err := json.Unmarshal(data, &discoveries); err != nil {
+		return nil, err
+	}
+
+	return discoveries, nil
+}
+
+// ClearDNSDiscoveries removes all DNS discoveries from the datastore.
+func (ds *DataStore) ClearDNSDiscoveries() error {
+	if ds == nil || ds.DataDir == "" {
+		return nil
+	}
+
+	path := filepath.Join(ds.DataDir, "dns", "discoveries.json")
+	if !exists(path) {
+		return nil
+	}
+
+	return os.Remove(path)
+}
@@ -9,7 +9,7 @@ import (
 )

 func TestDataStore(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -22,8 +22,9 @@ func TestDataStore(t *testing.T) {

 	// Test Save/Get DeviceInfo
 	info := &models.ServiceDeviceInfo{
-		DeviceID: device,
-		Name:     "Test Speaker",
+		DeviceID:  device,
+		Name:      "Test Speaker",
+		AccountID: account,
 	}

 	err = ds.SaveDeviceInfo(account, device, info)
@@ -87,14 +88,14 @@ func TestDataStore(t *testing.T) {
 	}

 	// Test path helpers
-	expectedAccountDir := filepath.Join(tempDir, account)
+	expectedAccountDir := filepath.Join(tempDir, "accounts", account)
 	if ds.AccountDir(account) != expectedAccountDir {
 		t.Errorf("Expected account dir %s, got %s", expectedAccountDir, ds.AccountDir(account))
 	}
 }

 func TestListAllDevices_Empty(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-empty-test-*")
+	tempDir, err := os.MkdirTemp("", "st-empty-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -133,7 +134,7 @@ func TestListAllDevices_Empty(t *testing.T) {
 }

 func TestListAllDevices(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-list-test-*")
+	tempDir, err := os.MkdirTemp("", "st-list-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -151,6 +152,7 @@ func TestListAllDevices(t *testing.T) {
 		DeviceSerialNumber: deviceID,
 		ProductCode:        "SoundTouch 10",
 		FirmwareVersion:    "1.2.3",
+		AccountID:          account,
 	}

 	err = ds.SaveDeviceInfo(account, deviceID, info)
@@ -173,7 +175,7 @@ func TestListAllDevices(t *testing.T) {
 }

 func TestListAllDevices_EmptyDeviceID(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-empty-id-test-*")
+	tempDir, err := os.MkdirTemp("", "st-empty-id-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -185,8 +187,9 @@ func TestListAllDevices_EmptyDeviceID(t *testing.T) {
 	deviceID := ""

 	info := &models.ServiceDeviceInfo{
-		DeviceID: deviceID,
-		Name:     "Empty ID Speaker",
+		DeviceID:  deviceID,
+		Name:      "Empty ID Speaker",
+		AccountID: account,
 	}

 	// Use IP as fallback for device ID if it is empty
@@ -215,7 +218,7 @@ func TestListAllDevices_EmptyDeviceID(t *testing.T) {
 }

 func TestListAllDevices_MultipleEmptyIDs(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-multi-empty-test-*")
+	tempDir, err := os.MkdirTemp("", "st-multi-empty-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -230,11 +233,13 @@ func TestListAllDevices_MultipleEmptyIDs(t *testing.T) {
 		DeviceID:  "",
 		Name:      "Speaker 1",
 		IPAddress: "192.168.1.1",
+		AccountID: account,
 	}
 	info2 := &models.ServiceDeviceInfo{
 		DeviceID:  "",
 		Name:      "Speaker 2",
 		IPAddress: "192.168.1.2",
+		AccountID: account,
 	}

 	// We use the same logic as in main.go: use IP as fallback for directory name
@@ -259,7 +264,7 @@ func TestListAllDevices_MultipleEmptyIDs(t *testing.T) {
 }

 func TestListAllDevices_MalformedXML(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-malformed-test-*")
+	tempDir, err := os.MkdirTemp("", "st-malformed-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -365,3 +370,44 @@ func TestConfiguredSources(t *testing.T) {
 		t.Error("Expected auto-assigned ID for source with empty ID")
 	}
 }
+
+func TestSettingsPersistence(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "settings-test-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := NewDataStore(tempDir)
+
+	settings := Settings{
+		ServerURL:         "http://myserver:8000",
+		SoundcorkURL:      "http://myproxy:8001",
+		LogBodies:         true,
+		DiscoveryInterval: "10m",
+		DiscoveryEnabled:  true,
+	}
+
+	err = ds.SaveSettings(settings)
+	if err != nil {
+		t.Fatalf("SaveSettings failed: %v", err)
+	}
+
+	loaded, err := ds.GetSettings()
+	if err != nil {
+		t.Fatalf("GetSettings failed: %v", err)
+	}
+
+	if loaded.ServerURL != settings.ServerURL {
+		t.Errorf("Expected ServerURL %s, got %s", settings.ServerURL, loaded.ServerURL)
+	}
+	if loaded.LogBodies != settings.LogBodies {
+		t.Errorf("Expected LogBodies %v, got %v", settings.LogBodies, loaded.LogBodies)
+	}
+	if loaded.DiscoveryInterval != settings.DiscoveryInterval {
+		t.Errorf("Expected DiscoveryInterval %s, got %s", settings.DiscoveryInterval, loaded.DiscoveryInterval)
+	}
+	if loaded.DiscoveryEnabled != settings.DiscoveryEnabled {
+		t.Errorf("Expected DiscoveryEnabled %v, got %v", settings.DiscoveryEnabled, loaded.DiscoveryEnabled)
+	}
+}
@@ -0,0 +1,75 @@
+package datastore
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+func TestDNSDiscoveryPersistence(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "datastore-dns-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := NewDataStore(tempDir)
+
+	now := time.Now().Round(time.Second)
+	discoveries := []DNSDiscoveryEntry{
+		{
+			Hostname:      "api.bose.com",
+			FirstSeen:     now.Add(-1 * time.Hour),
+			LastSeen:      now,
+			QueryCount:    10,
+			IsBoseService: true,
+			IsIntercepted: true,
+			RemoteAddr:    "192.168.1.100",
+		},
+		{
+			Hostname:      "google.com",
+			FirstSeen:     now.Add(-2 * time.Hour),
+			LastSeen:      now.Add(-1 * time.Hour),
+			QueryCount:    5,
+			IsBoseService: false,
+			IsIntercepted: false,
+			RemoteAddr:    "192.168.1.101",
+		},
+	}
+
+	// Test Save
+	err = ds.SaveDNSDiscoveries(discoveries)
+	if err != nil {
+		t.Fatalf("SaveDNSDiscoveries failed: %v", err)
+	}
+
+	// Test Load
+	loaded, err := ds.LoadDNSDiscoveries()
+	if err != nil {
+		t.Fatalf("LoadDNSDiscoveries failed: %v", err)
+	}
+
+	if len(loaded) != 2 {
+		t.Errorf("Expected 2 discoveries, got %d", len(loaded))
+	}
+
+	// Check if sorted by LastSeen (SaveDNSDiscoveries sorts them)
+	if loaded[0].Hostname != "api.bose.com" {
+		t.Errorf("Expected api.bose.com to be first, got %s", loaded[0].Hostname)
+	}
+
+	// Test Clear
+	err = ds.ClearDNSDiscoveries()
+	if err != nil {
+		t.Fatalf("ClearDNSDiscoveries failed: %v", err)
+	}
+
+	loadedAfterClear, err := ds.LoadDNSDiscoveries()
+	if err != nil {
+		t.Fatalf("LoadDNSDiscoveries after clear failed: %v", err)
+	}
+
+	if len(loadedAfterClear) != 0 {
+		t.Errorf("Expected 0 discoveries after clear, got %d", len(loadedAfterClear))
+	}
+}
@@ -0,0 +1,71 @@
+package handlers
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestDocsConsistency(t *testing.T) {
+	// Root of the project relative to this test file
+	// The test runs in the directory of the package
+	projectRoot := "../../.."
+	docsDir := filepath.Join(projectRoot, "docs")
+	summaryPath := filepath.Join(docsDir, "SUMMARY.md")
+
+	summaryContent, err := os.ReadFile(summaryPath)
+	if err != nil {
+		t.Fatalf("Failed to read SUMMARY.md: %v", err)
+	}
+
+	summaryText := string(summaryContent)
+
+	// List of directories to check
+	dirsToCheck := []string{".", "guides", "reference", "analysis"}
+
+	for _, dir := range dirsToCheck {
+		dirPath := filepath.Join(docsDir, dir)
+		err := filepath.WalkDir(dirPath, func(path string, d fs.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() {
+				// Don't recurse into subdirectories if we are checking the root,
+				// as they are handled separately or ignored (like archive)
+				if dir == "." && path != dirPath {
+					return filepath.SkipDir
+				}
+				return nil
+			}
+			if !strings.HasSuffix(d.Name(), ".md") {
+				return nil
+			}
+
+			// Skip SUMMARY.md itself
+			if d.Name() == "SUMMARY.md" {
+				return nil
+			}
+
+			// Get relative path from docs/
+			relPath, err := filepath.Rel(docsDir, path)
+			if err != nil {
+				return err
+			}
+
+			// Check if this file is linked in SUMMARY.md
+			// We look for [Label](relPath)
+			linkPattern := "(" + relPath + ")"
+			if !strings.Contains(summaryText, linkPattern) {
+				t.Errorf("Documentation file %s is not linked in docs/SUMMARY.md", relPath)
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			t.Errorf("Error walking directory %s: %v", dir, err)
+		}
+	}
+}
@@ -0,0 +1,127 @@
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/russross/blackfriday/v2"
+)
+
+// HandleDocs returns a handler for serving documentation files as HTML.
+func (s *Server) HandleDocs(w http.ResponseWriter, r *http.Request) {
+	path := strings.TrimPrefix(r.URL.Path, "/docs")
+
+	path = strings.TrimPrefix(path, "/")
+	if path == "" {
+		path = "guides/SURVIVAL-GUIDE.md"
+	}
+
+	// Ensure we only serve files from the docs directory
+	filePath := filepath.Join("docs", path)
+	if !strings.HasPrefix(filepath.Clean(filePath), "docs") {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
+	content, err := os.ReadFile(filePath)
+	if err != nil {
+		http.Error(w, "File not found", http.StatusNotFound)
+		return
+	}
+
+	// Load sidebar (SUMMARY.md)
+	summaryContent, _ := os.ReadFile(filepath.Join("docs", "SUMMARY.md"))
+
+	sidebar := ""
+	if len(summaryContent) > 0 {
+		// Render summary to HTML
+		sidebar = string(blackfriday.Run(summaryContent))
+		// Adjust links in sidebar to be relative to /docs/
+		sidebar = strings.ReplaceAll(sidebar, "href=\"guides/", "href=\"/docs/guides/")
+		sidebar = strings.ReplaceAll(sidebar, "href=\"reference/", "href=\"/docs/reference/")
+		sidebar = strings.ReplaceAll(sidebar, "href=\"analysis/", "href=\"/docs/analysis/")
+		// Fix relative links that don't have a directory prefix (root docs)
+		// We look for href="filename.md" and replace with href="/docs/filename.md"
+		// This avoids manual listing of every file.
+		sidebar = s.fixSidebarLinks(sidebar)
+	}
+
+	// Render markdown to HTML
+	output := blackfriday.Run(content)
+
+	// Wrap in a documentation template with sidebar
+	w.Header().Set("Content-Type", "text/html")
+	_, _ = fmt.Fprintf(w, `<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>%s - Bose SoundTouch Toolkit Docs</title>
+    <link rel="icon" href="/media/favicon-braille.svg" type="image/svg+xml">
+    <link rel="stylesheet" href="/web/css/style.css">
+    <style>
+        body { margin: 0; padding: 0; display: flex; font-family: sans-serif; height: 100vh; overflow: hidden; }
+        .sidebar { width: 300px; background: #f8f9fa; border-right: 1px solid #dee2e6; padding: 20px; overflow-y: auto; flex-shrink: 0; }
+        .content-area { flex-grow: 1; overflow-y: auto; padding: 40px; }
+        .markdown-body { max-width: 800px; margin: 0 auto; line-height: 1.6; color: #333; }
+        h1, h2, h3 { color: #2196F3; }
+        pre { background: #f4f4f4; padding: 15px; border-radius: 5px; overflow-x: auto; }
+        code { font-family: monospace; background: #eee; padding: 2px 4px; border-radius: 3px; }
+        pre code { background: none; padding: 0; }
+        a { color: #2196F3; text-decoration: none; }
+        a:hover { text-decoration: underline; }
+        .back-link { margin-bottom: 20px; display: block; font-weight: bold; }
+        .sidebar h2 { font-size: 1.1em; margin-top: 20px; color: #666; text-transform: uppercase; letter-spacing: 1px; }
+        .sidebar ul { list-style: none; padding: 0; }
+        .sidebar li { margin-bottom: 8px; }
+        .sidebar a { color: #444; font-size: 0.95em; }
+        .sidebar a:hover { color: #2196F3; }
+    </style>
+</head>
+<body>
+    <div class="sidebar">
+        <a href="/" class="back-link">&larr; Back to Toolkit</a>
+        %s
+    </div>
+    <div class="content-area">
+        <div class="markdown-body">
+            %s
+        </div>
+   	</div>
+</body>
+</html>`, path, sidebar, output)
+}
+
+// fixSidebarLinks ensures that relative links in the SUMMARY.md (sidebar)
+// are correctly prefixed with /docs/ for the web UI.
+func (s *Server) fixSidebarLinks(sidebar string) string {
+	// Root links like [Label](file.md) become href="file.md"
+	// We want href="/docs/file.md", but only if it doesn't already start with /docs/
+	// and isn't an external link.
+	// Since blackfriday renders [Label](file.md) as <a href="file.md">
+
+	// A simple but effective way is to use a regex or just check for common patterns.
+	// We already handled subdirectories. Now we handle files in the root of docs/
+
+	// We'll look for href="filename.md" where filename doesn't contain a slash
+	// and isn't already prefixed.
+
+	// Since we know our doc files always end in .md, we can look for that.
+	lines := strings.Split(sidebar, "\n")
+	for i, line := range lines {
+		if strings.Contains(line, "href=\"") && !strings.Contains(line, "href=\"/docs/") && !strings.Contains(line, "://") {
+			// Extract filename
+			start := strings.Index(line, "href=\"") + 6
+			end := strings.Index(line[start:], "\"") + start
+			filename := line[start:end]
+
+			if strings.HasSuffix(filename, ".md") && !strings.Contains(filename, "/") {
+				lines[i] = strings.ReplaceAll(line, "href=\""+filename+"\"", "href=\"/docs/"+filename+"\"")
+			}
+		}
+	}
+
+	return strings.Join(lines, "\n")
+}
@@ -16,7 +16,7 @@ const normalizedEtag = "Etag"
 const caseSensitiveETag = "ETag"

 func TestMargeETags(t *testing.T) {
-	tempDir, _ := os.MkdirTemp("", "soundcork-etag-test-*")
+	tempDir, _ := os.MkdirTemp("", "st-etag-test-*")

 	defer func() { _ = os.RemoveAll(tempDir) }()

@@ -24,7 +24,7 @@ func TestMargeETags(t *testing.T) {

 	account := "12345"
 	deviceID := "DEV1"
-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)
 	deviceDir := filepath.Join(accountDir, "devices", deviceID)
 	_ = os.MkdirAll(deviceDir, 0755)

@@ -60,6 +60,85 @@ func (s *Server) HandleMargePowerOn(w http.ResponseWriter, _ *http.Request) {
 	w.WriteHeader(http.StatusOK)
 }

+// HandleMargeAccountProfile returns the account profile.
+func (s *Server) HandleMargeAccountProfile(w http.ResponseWriter, r *http.Request) {
+	accountID := chi.URLParam(r, "account")
+
+	// Mock profile data
+	profile := models.AccountProfileResponse{
+		AccountID:    accountID,
+		Email:        "user@example.com",
+		FirstName:    "SoundTouch",
+		LastName:     "User",
+		CountryCode:  "US",
+		LanguageCode: "en",
+	}
+
+	data, err := xml.MarshalIndent(profile, "", "  ")
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/xml")
+	_, _ = w.Write([]byte(xml.Header))
+	_, _ = w.Write(data)
+}
+
+// HandleMargeUpdateAccountProfile updates the account profile.
+func (s *Server) HandleMargeUpdateAccountProfile(w http.ResponseWriter, _ *http.Request) {
+	// Stub implementation
+	w.WriteHeader(http.StatusOK)
+}
+
+// HandleMargeChangePassword changes the account password.
+func (s *Server) HandleMargeChangePassword(w http.ResponseWriter, _ *http.Request) {
+	// Stub implementation
+	w.WriteHeader(http.StatusOK)
+}
+
+// HandleMargeGetEmailAddress returns the account email address.
+func (s *Server) HandleMargeGetEmailAddress(w http.ResponseWriter, _ *http.Request) {
+	resp := models.EmailAddressResponse{
+		Email: "user@example.com",
+	}
+
+	data, err := xml.MarshalIndent(resp, "", "  ")
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/xml")
+	_, _ = w.Write([]byte(xml.Header))
+	_, _ = w.Write(data)
+}
+
+// HandleMargeGetDeviceSettings returns device settings.
+func (s *Server) HandleMargeGetDeviceSettings(w http.ResponseWriter, _ *http.Request) {
+	resp := models.DeviceSettingsResponse{
+		Settings: []models.DeviceSetting{
+			{Name: "CLOCK_FORMAT", Value: "24HR"},
+		},
+	}
+
+	data, err := xml.MarshalIndent(resp, "", "  ")
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/xml")
+	_, _ = w.Write([]byte(xml.Header))
+	_, _ = w.Write(data)
+}
+
+// HandleMargeUpdateDeviceSettings updates device settings.
+func (s *Server) HandleMargeUpdateDeviceSettings(w http.ResponseWriter, _ *http.Request) {
+	// Stub implementation
+	w.WriteHeader(http.StatusOK)
+}
+
 // HandleMargeSoftwareUpdate returns the Marge software update information.
 func (s *Server) HandleMargeSoftwareUpdate(w http.ResponseWriter, r *http.Request) {
 	etag := "default-embedded"
@@ -202,11 +281,22 @@ func (s *Server) HandleMargeProviderSettings(w http.ResponseWriter, r *http.Requ
 func (s *Server) HandleMargeStreamingToken(w http.ResponseWriter, _ *http.Request) {
 	// Simple mock token for offline use.
 	// In a real production environment, this would be a JWT or similar signed token.
-	// Some speakers might expect a specific format; soundcork uses a distinctive prefix
+	// Some speakers might expect a specific format; we use a distinctive prefix
 	// to indicate it's a locally generated token.
-	token := "soundcork-local-token-" + strconv.FormatInt(time.Now().Unix(), 10)
-	w.Header().Set("Authorization", "Bearer "+token)
+	tokenValue := "st-local-token-" + strconv.FormatInt(time.Now().Unix(), 10)
+	bearerToken := models.NewBearerToken(tokenValue)
+
+	data, err := xml.Marshal(bearerToken)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/vnd.bose.streaming-v1.2+xml")
+	w.Header().Set("Authorization", bearerToken.GetAuthHeader())
 	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte(xml.Header))
+	_, _ = w.Write(data)
 }

 // HandleMargeCustomerSupport handles Marge customer support uploads.
@@ -0,0 +1,102 @@
+package handlers
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestMargeStockholmHandlers(t *testing.T) {
+	r, _ := setupRouter("http://localhost:8001", nil)
+	ts := httptest.NewServer(r)
+	defer ts.Close()
+
+	t.Run("HandleMargeAccountProfile GET", func(t *testing.T) {
+		res, err := http.Get(ts.URL + "/customer/account/12345")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+
+		body, _ := io.ReadAll(res.Body)
+		if !strings.Contains(string(body), "<accountID>12345</accountID>") {
+			t.Errorf("Response missing account ID: %s", string(body))
+		}
+	})
+
+	t.Run("HandleMargeUpdateAccountProfile POST", func(t *testing.T) {
+		res, err := http.Post(ts.URL+"/customer/account/12345", "application/xml", strings.NewReader("<profile/>"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+	})
+
+	t.Run("HandleMargeChangePassword POST", func(t *testing.T) {
+		res, err := http.Post(ts.URL+"/customer/account/12345/password", "application/xml", strings.NewReader("<password/>"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+	})
+
+	t.Run("HandleMargeGetEmailAddress GET", func(t *testing.T) {
+		res, err := http.Get(ts.URL + "/marge/streaming/account/12345/emailaddress")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+
+		body, _ := io.ReadAll(res.Body)
+		if !strings.Contains(string(body), "user@example.com") {
+			t.Errorf("Response missing email: %s", string(body))
+		}
+	})
+
+	t.Run("HandleMargeGetDeviceSettings GET", func(t *testing.T) {
+		res, err := http.Get(ts.URL + "/marge/streaming/device_setting/account/123/device/DEV1/device_settings")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+
+		body, _ := io.ReadAll(res.Body)
+		if !strings.Contains(string(body), "CLOCK_FORMAT") {
+			t.Errorf("Response missing settings: %s", string(body))
+		}
+	})
+
+	t.Run("HandleMargeUpdateDeviceSettings POST", func(t *testing.T) {
+		res, err := http.Post(ts.URL+"/marge/streaming/device_setting/account/123/device/DEV1/device_settings", "application/xml", strings.NewReader("<settings/>"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK {
+			t.Errorf("Expected status OK, got %v", res.Status)
+		}
+	})
+}
@@ -61,7 +61,7 @@ func TestMargeSoftwareUpdate(t *testing.T) {
 }

 func TestMargeAccountFull(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -72,7 +72,7 @@ func TestMargeAccountFull(t *testing.T) {

 	account := "12345"
 	deviceID := "ABCDE"
-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)

 	deviceDir := filepath.Join(accountDir, "devices", deviceID)
 	err = os.MkdirAll(deviceDir, 0755)
@@ -125,7 +125,7 @@ func TestMargeAccountFull(t *testing.T) {
 }

 func TestMargePresets(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -137,7 +137,7 @@ func TestMargePresets(t *testing.T) {
 	account := "12345"
 	deviceID := "any"

-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)
 	deviceDir := filepath.Join(accountDir, "devices", deviceID)
 	err = os.MkdirAll(deviceDir, 0755)

@@ -196,7 +196,7 @@ func TestMargePresets(t *testing.T) {
 }

 func TestMargeUpdatePreset(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -208,7 +208,7 @@ func TestMargeUpdatePreset(t *testing.T) {
 	account := "12345"
 	deviceID := "DEV1"

-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)
 	deviceDir := filepath.Join(accountDir, "devices", deviceID)
 	err = os.MkdirAll(deviceDir, 0755)

@@ -265,7 +265,7 @@ func TestMargeUpdatePreset(t *testing.T) {
 }

 func TestMargeDeviceInfo(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -277,7 +277,7 @@ func TestMargeDeviceInfo(t *testing.T) {
 	account := "12345"
 	deviceID := "DEV1"

-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)
 	deviceDir := filepath.Join(accountDir, "devices", deviceID)
 	err = os.MkdirAll(deviceDir, 0755)

@@ -332,7 +332,7 @@ func TestMargeDeviceInfo(t *testing.T) {
 }

 func TestMargeAddRemoveDevice(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -343,7 +343,7 @@ func TestMargeAddRemoveDevice(t *testing.T) {

 	account := "12345"

-	accountDir := filepath.Join(tempDir, account)
+	accountDir := filepath.Join(tempDir, "accounts", account)
 	err = os.MkdirAll(accountDir, 0755)

 	if err != nil {
@@ -427,7 +427,7 @@ func TestMargePowerOn(t *testing.T) {
 }

 func TestMargeAdvancedFeatures(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
@@ -471,10 +471,23 @@ func TestMargeAdvancedFeatures(t *testing.T) {
 			t.Errorf("Expected status OK, got %v", res.Status)
 		}

+		contentType := res.Header.Get("Content-Type")
+		if contentType != "application/vnd.bose.streaming-v1.2+xml" {
+			t.Errorf("Invalid content type: %s", contentType)
+		}
+
 		token := res.Header.Get("Authorization")
-		if !strings.HasPrefix(token, "Bearer soundcork-local-token-") {
+		if !strings.HasPrefix(token, "Bearer st-local-token-") {
 			t.Errorf("Invalid token header: %s", token)
 		}
+
+		body, _ := io.ReadAll(res.Body)
+		if !strings.Contains(string(body), "<bearertoken") {
+			t.Errorf("Response body missing <bearertoken: %s", body)
+		}
+		if !strings.Contains(string(body), token) {
+			t.Errorf("Response body missing token value: %s", body)
+		}
 	})

 	t.Run("CustomerSupport", func(t *testing.T) {
@@ -14,13 +14,13 @@ var indexHTML []byte
 //go:embed web/css/* web/js/*
 var webFS embed.FS

-//go:embed soundcork/media/*
+//go:embed static/media/*
 var mediaFS embed.FS

-//go:embed soundcork/bmx_services.json
+//go:embed static/bmx_services.json
 var bmxServicesJSON []byte

-//go:embed soundcork/swupdate.xml
+//go:embed static/swupdate.xml
 var swUpdateXML []byte

 // HandleRoot returns the root endpoint response.
@@ -28,7 +28,7 @@ func (s *Server) HandleRoot(w http.ResponseWriter, r *http.Request) {
 	accept := r.Header.Get("Accept")
 	if !strings.Contains(accept, "text/html") && (strings.Contains(accept, "application/json") || accept == "*/*" || accept == "") {
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = fmt.Fprintf(w, `{"Bose": "Can't Brick Us", "service": "Go/Chi"}`)
+		_, _ = fmt.Fprintf(w, `{"Bose": "AfterTouch", "service": "Go/Chi", "docs": "https://gesellix.github.io/Bose-SoundTouch/"}`)

 		return
 	}
@@ -47,7 +47,7 @@ func (s *Server) HandleWeb() http.HandlerFunc {

 // HandleMedia returns a handler for serving media files.
 func (s *Server) HandleMedia() http.HandlerFunc {
-	subFS, _ := fs.Sub(mediaFS, "soundcork/media")
+	subFS, _ := fs.Sub(mediaFS, "static/media")

 	return func(w http.ResponseWriter, r *http.Request) {
 		fs := http.StripPrefix("/media/", http.FileServer(http.FS(subFS)))
@@ -35,8 +35,8 @@ func TestRootEndpoint(t *testing.T) {
 	}

 	body, _ := io.ReadAll(res.Body)
-	if !strings.Contains(string(body), "Soundcork Management") {
-		t.Errorf("Expected body to contain 'Soundcork Management', got %s", string(body))
+	if !strings.Contains(string(body), "AfterTouch") {
+		t.Errorf("Expected body to contain 'AfterTouch', got %s", string(body))
 	}
 }

@@ -67,8 +67,7 @@ func TestRootEndpointJSON(t *testing.T) {
 	}

 	body, _ := io.ReadAll(res.Body)
-
-	expected := `{"Bose": "Can't Brick Us", "service": "Go/Chi"}`
+	expected := `{"Bose": "AfterTouch", "service": "Go/Chi", "docs": "https://gesellix.github.io/Bose-SoundTouch/"}`
 	if strings.TrimSpace(string(body)) != expected {
 		t.Errorf("Expected body %s, got %s", expected, string(body))
 	}
@@ -80,7 +79,7 @@ func TestStaticMedia(t *testing.T) {
 	ts := httptest.NewServer(r)
 	defer ts.Close()

-	// Use a known file from soundcork/media
+	// Use a known file from static/media
 	res, err := http.Get(ts.URL + "/media/SiriusXM_Logo_Color.svg")
 	if err != nil {
 		t.Fatal(err)
@@ -1,6 +1,10 @@
 package handlers

 import (
+	"bytes"
+	"crypto/tls"
+	"io"
+	"log"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
@@ -33,33 +37,167 @@ func (s *Server) HandleProxyRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	lp := proxy.NewLoggingProxy(target.String(), s.proxyRedact)
-	lp.LogBody = s.proxyLogBody
-	lp.RecordEnabled = s.recordEnabled
-	lp.SetRecorder(s.recorder)
+	s.ServeProxy(target)(w, r)
+}

-	proxy := httputil.NewSingleHostReverseProxy(target)
-	// Update director to set the correct host and path
-	originalDirector := proxy.Director
-	proxy.Director = func(req *http.Request) {
-		originalDirector(req)
-		req.Host = target.Host
-		req.URL.Path = target.Path
-		req.URL.RawQuery = r.URL.RawQuery
-		lp.LogRequest(req)
-	}
+// ServeProxy returns a handler that proxies to the given target.
+func (s *Server) ServeProxy(target *url.URL) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		lp := proxy.NewLoggingProxy(target.String(), s.proxyRedact)
+		lp.LogBody = s.proxyLogBody
+		lp.RecordEnabled = s.recordEnabled
+		lp.SetRecorder(s.recorder)

-	proxy.ModifyResponse = func(res *http.Response) error {
-		// Generic Header Preservation
-		if etags, ok := res.Header["Etag"]; ok {
-			delete(res.Header, "Etag")
-			res.Header["ETag"] = etags
+		// Capture request body for recording, as it will be consumed by the proxy
+		var reqBody []byte
+		if r.Body != nil {
+			reqBody, _ = io.ReadAll(r.Body)
+			r.Body = io.NopCloser(bytes.NewBuffer(reqBody))
 		}

-		lp.LogResponse(res)
+		rp := httputil.NewSingleHostReverseProxy(target)
+		rp.Transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		}

-		return nil
+		// Update director to set the correct host and path
+		originalDirector := rp.Director
+		rp.Director = func(req *http.Request) {
+			originalDirector(req)
+			req.Host = target.Host
+			// If target has a path, we should probably append or replace.
+			// For Bose upstream, it's usually just the domain.
+			if target.Path != "" && target.Path != "/" {
+				req.URL.Path = target.Path
+			}
+
+			lp.LogRequest(req)
+		}
+
+		rp.ModifyResponse = func(res *http.Response) error {
+			res.Header.Set("X-Proxy-Origin", "upstream")
+			// Generic Header Preservation
+			if etags, ok := res.Header["Etag"]; ok {
+				delete(res.Header, "Etag")
+				res.Header["ETag"] = etags
+			}
+
+			// Restore captured request body for the recorder
+			if reqBody != nil {
+				res.Request.Body = io.NopCloser(bytes.NewBuffer(reqBody))
+			}
+
+			lp.LogResponse(res)
+
+			return nil
+		}
+
+		rp.ServeHTTP(w, r)
+	}
+}
+
+// HandleNotFound handles requests that don't match any route.
+func (s *Server) HandleNotFound(w http.ResponseWriter, r *http.Request) {
+	if s.enableSoundcorkProxy {
+		s.HandleSoundcorkWithFallback(w, r)
+		return
 	}

-	proxy.ServeHTTP(w, r)
+	s.HandleBoseProxy(w, r)
+}
+
+// HandleSoundcorkWithFallback tries Soundcork first, then Bose if Soundcork returns 404 or fails.
+func (s *Server) HandleSoundcorkWithFallback(w http.ResponseWriter, r *http.Request) {
+	target, _ := url.Parse(s.soundcorkURL)
+
+	// Buffer request body if any, to allow multiple proxy attempts
+	var bodyBytes []byte
+	if r.Body != nil {
+		bodyBytes, _ = io.ReadAll(r.Body)
+		_ = r.Body.Close()
+	}
+
+	// We use a custom response writer to catch 404s
+	rw := &fallbackResponseWriter{
+		ResponseWriter: w,
+		statusCode:     http.StatusOK,
+		buffer:         &bytes.Buffer{},
+	}
+
+	// Create a shallow copy of the request to avoid side effects between attempts
+	r2 := r.Clone(r.Context())
+	if bodyBytes != nil {
+		r2.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
+	} else {
+		r2.Body = nil
+	}
+
+	// Remove RequestURI as it's not allowed in client requests
+	r2.RequestURI = ""
+
+	s.ServeProxy(target)(rw, r2)
+
+	if rw.statusCode == http.StatusNotFound || rw.statusCode == http.StatusBadGateway || rw.statusCode == http.StatusServiceUnavailable {
+		log.Printf("[PROXY] Soundcork returned %d for %s, falling back to Bose", rw.statusCode, r.URL.Path)
+
+		if !rw.wroteHeader {
+			// Restore original body if any
+			if bodyBytes != nil {
+				r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
+			}
+
+			s.HandleBoseProxy(w, r)
+		}
+	}
+}
+
+type fallbackResponseWriter struct {
+	http.ResponseWriter
+	statusCode  int
+	wroteHeader bool
+	buffer      *bytes.Buffer
+}
+
+func (rw *fallbackResponseWriter) WriteHeader(code int) {
+	rw.statusCode = code
+	if code != http.StatusNotFound && code != http.StatusBadGateway && code != http.StatusServiceUnavailable {
+		rw.wroteHeader = true
+		rw.ResponseWriter.WriteHeader(code)
+	}
+}
+
+func (rw *fallbackResponseWriter) Write(b []byte) (int, error) {
+	if rw.statusCode == http.StatusNotFound || rw.statusCode == http.StatusBadGateway || rw.statusCode == http.StatusServiceUnavailable {
+		return len(b), nil // Drop the body
+	}
+
+	rw.wroteHeader = true
+
+	return rw.ResponseWriter.Write(b)
+}
+
+// HandleBoseProxy proxies the request to the Bose upstream.
+func (s *Server) HandleBoseProxy(w http.ResponseWriter, r *http.Request) {
+	host := r.Host
+	if host == "" {
+		host = "streaming.bose.com"
+	}
+
+	// Default to HTTPS for Bose services
+	scheme := "https"
+	if strings.HasPrefix(host, "localhost") || strings.HasPrefix(host, "127.0.0.1") || strings.HasPrefix(host, "::1") {
+		scheme = "http"
+	}
+
+	targetURL := scheme + "://" + host
+
+	target, err := url.Parse(targetURL)
+	if err != nil {
+		log.Printf("[PROXY_ERR] Failed to parse target URL %s: %v", targetURL, err)
+		http.Error(w, "Invalid upstream host", http.StatusBadGateway)
+
+		return
+	}
+
+	s.ServeProxy(target)(w, r)
 }
@@ -0,0 +1,96 @@
+package handlers
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
+	"github.com/gesellix/bose-soundtouch/pkg/service/proxy"
+)
+
+func TestHandleProxyRequest_RequestBodyRecording(t *testing.T) {
+	t.Setenv("RECORDER_ASYNC", "false")
+	tmpDir, err := os.MkdirTemp("", "proxy-request-body-test")
+	if err != nil {
+		t.Fatalf("failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Start a backend server to receive the proxied request
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Read the body to ensure it's consumed
+		_, _ = io.ReadAll(r.Body)
+		w.Header().Set("Content-Type", "application/xml")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("<response>ok</response>"))
+	}))
+	defer backend.Close()
+
+	ds := datastore.NewDataStore(filepath.Join(tmpDir, "test.db"))
+	server := NewServer(ds, nil, "http://localhost:8000", false, false, false, false)
+	server.recordEnabled = true
+	server.proxyLogBody = true
+	recorder := proxy.NewRecorder(tmpDir)
+	server.SetRecorder(recorder)
+
+	// Create a proxy request to the backend
+	requestBody := "<request>data</request>"
+	targetURL := backend.URL
+	proxyPath := "/proxy/" + targetURL
+	req := httptest.NewRequest("POST", proxyPath, bytes.NewBufferString(requestBody))
+	req.Header.Set("Content-Type", "application/xml")
+
+	w := httptest.NewRecorder()
+	server.HandleProxyRequest(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d", w.Code)
+	}
+
+	// Verify that the interaction was recorded and contains the request body
+	sessionID := recorder.SessionID
+
+	// The recorder uses sanitized segments for the directory.
+	// Since the target URL is http://127.0.0.1:PORT, the path is empty,
+	// so it should be in the "root" directory under the category.
+
+	// We'll search recursively to be sure
+	foundBody := false
+	err = filepath.Walk(filepath.Join(tmpDir, "interactions", sessionID), func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() && strings.HasSuffix(path, ".http") {
+			content, err := os.ReadFile(path)
+			if err != nil {
+				return err
+			}
+			if strings.Contains(string(content), requestBody) {
+				foundBody = true
+			}
+		}
+		return nil
+	})
+
+	if err != nil {
+		t.Fatalf("failed to walk interactions dir: %v", err)
+	}
+
+	if !foundBody {
+		t.Errorf("request body %q not found in any recorded interaction file", requestBody)
+		// List all files found for debugging
+		_ = filepath.Walk(filepath.Join(tmpDir, "interactions", sessionID), func(path string, info os.FileInfo, err error) error {
+			if !info.IsDir() {
+				content, _ := os.ReadFile(path)
+				t.Logf("Found file %s with content:\n%s", path, string(content))
+			}
+			return nil
+		})
+	}
+}
@@ -3,10 +3,18 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"log"
 	"net/http"
 	"os"
+	"sort"
+	"strconv"
+	"time"

+	"fmt"
+
+	"github.com/gesellix/bose-soundtouch/pkg/discovery"
 	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
 	"github.com/go-chi/chi/v5"
 )
@@ -61,6 +69,7 @@ func (s *Server) HandleAddManualDevice(w http.ResponseWriter, r *http.Request) {
 	}

 	s.handleDiscoveredDevice(d)
+	s.mergeOverlappingDevices()

 	w.Header().Set("Content-Type", "application/json")

@@ -89,19 +98,174 @@ func (s *Server) HandleGetDiscoveryStatus(w http.ResponseWriter, _ *http.Request
 	}
 }

+// HandleRemoveDevice removes a device from the datastore.
+func (s *Server) HandleRemoveDevice(w http.ResponseWriter, r *http.Request) {
+	deviceId := chi.URLParam(r, "deviceId")
+	if deviceId == "" {
+		http.Error(w, "Device ID is required", http.StatusBadRequest)
+		return
+	}
+
+	// Find which account this device belongs to.
+	devices, err := s.ds.ListAllDevices()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	var found bool
+
+	for i := range devices {
+		if devices[i].DeviceID == deviceId {
+			err = s.ds.RemoveDevice(devices[i].AccountID, devices[i].DeviceID)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+
+			found = true
+
+			break
+		}
+	}
+
+	if !found {
+		http.Error(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]bool{"ok": true}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
 // HandleGetSettings returns the current service settings.
 func (s *Server) HandleGetSettings(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]string{
-		"server_url": s.serverURL,
-		"proxy_url":  s.proxyURL,
+	s.mu.RLock()
+	serverURL, soundcorkURL, httpsServerURL := s.serverURL, s.soundcorkURL, s.httpsServerURL
+	discoveryInterval := s.discoveryInterval.String()
+	discoveryEnabled := s.discoveryEnabled
+	dnsEnabled := s.dnsEnabled
+	dnsUpstream := s.dnsUpstream
+	dnsBindAddr := s.dnsBindAddr
+	enableSoundcorkProxy := s.enableSoundcorkProxy
+	redact, logBody, record := s.proxyRedact, s.proxyLogBody, s.recordEnabled
+	shortcuts := s.shortcuts
+	s.mu.RUnlock()
+
+	dnsRunning, actualBind := s.GetDNSRunning()
+
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{
+		"server_url":             serverURL,
+		"soundcork_url":          soundcorkURL,
+		"https_server_url":       httpsServerURL,
+		"discovery_interval":     discoveryInterval,
+		"discovery_enabled":      discoveryEnabled,
+		"dns_enabled":            dnsEnabled,
+		"dns_running":            dnsRunning,
+		"dns_actual_bind":        actualBind,
+		"dns_upstream":           dnsUpstream,
+		"dns_bind_addr":          dnsBindAddr,
+		"enable_soundcork_proxy": enableSoundcorkProxy,
+		"redact_logs":            redact,
+		"log_bodies":             logBody,
+		"record_interactions":    record,
+		"shortcuts":              shortcuts,
 	}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
 }

+// HandleUpdateSettings updates the service settings.
+func (s *Server) HandleUpdateSettings(w http.ResponseWriter, r *http.Request) {
+	var settings struct {
+		ServerURL            string         `json:"server_url"`
+		SoundcorkURL         string         `json:"soundcork_url"`
+		DiscoveryInterval    string         `json:"discovery_interval"`
+		DiscoveryEnabled     bool           `json:"discovery_enabled"`
+		DNSEnabled           bool           `json:"dns_enabled"`
+		DNSUpstream          string         `json:"dns_upstream"`
+		DNSBindAddr          string         `json:"dns_bind_addr"`
+		EnableSoundcorkProxy bool           `json:"enable_soundcork_proxy"`
+		Shortcuts            map[string]int `json:"shortcuts"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&settings); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	interval, err := time.ParseDuration(settings.DiscoveryInterval)
+	if err != nil && settings.DiscoveryInterval != "" {
+		http.Error(w, "Invalid discovery interval: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	s.mu.Lock()
+	s.serverURL = settings.ServerURL
+
+	s.soundcorkURL = settings.SoundcorkURL
+	if settings.DiscoveryInterval != "" {
+		s.discoveryInterval = interval
+	}
+
+	s.discoveryEnabled = settings.DiscoveryEnabled
+	s.dnsEnabled = settings.DNSEnabled
+	s.dnsUpstream = settings.DNSUpstream
+	s.dnsBindAddr = settings.DNSBindAddr
+
+	s.enableSoundcorkProxy = settings.EnableSoundcorkProxy
+	if settings.Shortcuts != nil {
+		s.shortcuts = settings.Shortcuts
+	}
+
+	if s.sm != nil {
+		s.sm.ServerURL = settings.ServerURL
+	}
+
+	// Persist to datastore
+	// Access fields directly since we already hold the lock
+	currentRedact := s.proxyRedact
+	currentLogBody := s.proxyLogBody
+	currentRecord := s.recordEnabled
+	currentHTTPS := s.httpsServerURL
+
+	log.Printf("Saving updated settings to %s/settings.json", s.ds.DataDir)
+	err = s.ds.SaveSettings(datastore.Settings{
+		ServerURL:            s.serverURL,
+		SoundcorkURL:         s.soundcorkURL,
+		HTTPServerURL:        currentHTTPS,
+		RedactLogs:           currentRedact,
+		LogBodies:            currentLogBody,
+		RecordInteractions:   currentRecord,
+		DiscoveryInterval:    s.discoveryInterval.String(),
+		DiscoveryEnabled:     s.discoveryEnabled,
+		DNSEnabled:           s.dnsEnabled,
+		DNSUpstream:          s.dnsUpstream,
+		DNSBindAddr:          s.dnsBindAddr,
+		EnableSoundcorkProxy: s.enableSoundcorkProxy,
+		Shortcuts:            s.shortcuts,
+	})
+	s.mu.Unlock()
+
+	if err != nil {
+		http.Error(w, "Failed to save settings: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Settings updated"}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
 // HandleGetDeviceInfo returns live information for a device.
 func (s *Server) HandleGetDeviceInfo(w http.ResponseWriter, r *http.Request) {
 	deviceIP := chi.URLParam(r, "deviceIP")
@@ -184,11 +348,12 @@ func (s *Server) HandleMigrateDevice(w http.ResponseWriter, r *http.Request) {
 		}
 	}

-	if err := s.sm.MigrateSpeaker(deviceIP, targetURL, proxyURL, options, method); err != nil {
+	output, err := s.sm.MigrateSpeaker(deviceIP, targetURL, proxyURL, options, method)
+	if err != nil {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)

-		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error()}); encodeErr != nil {
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
 			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 			return
 		}
@@ -198,7 +363,122 @@ func (s *Server) HandleMigrateDevice(w http.ResponseWriter, r *http.Request) {

 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Migration started"}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Migration started", "output": output}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleRevertMigration reverts the migration for a device.
+func (s *Server) HandleRevertMigration(w http.ResponseWriter, r *http.Request) {
+	deviceIP := chi.URLParam(r, "deviceIP")
+	if deviceIP == "" {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+
+		if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": "Device IP is required"}); err != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+			return
+		}
+
+		return
+	}
+
+	output, err := s.sm.RevertMigration(deviceIP)
+	if err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+			return
+		}
+
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Revert started", "output": output}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleGetDNSDiscoveries returns recorded DNS discoveries.
+func (s *Server) HandleGetDNSDiscoveries(w http.ResponseWriter, _ *http.Request) {
+	// 1. Get current in-memory discoveries
+	inMemory := s.GetDNSDiscovery()
+
+	// 2. Load persisted discoveries
+	persisted, err := s.ds.LoadDNSDiscoveries()
+	if err != nil {
+		log.Printf("Warning: Failed to load DNS discoveries: %v", err)
+	}
+
+	// 3. Merge them
+	merged := make(map[string]datastore.DNSDiscoveryEntry)
+	for _, p := range persisted {
+		merged[p.Hostname] = p
+	}
+
+	for hostname, h := range inMemory {
+		m, exists := merged[hostname]
+		if !exists || h.LastSeen.After(m.LastSeen) {
+			merged[hostname] = datastore.DNSDiscoveryEntry{
+				Hostname:      h.Hostname,
+				FirstSeen:     h.FirstSeen,
+				LastSeen:      h.LastSeen,
+				QueryCount:    h.QueryCount,
+				IsBoseService: h.IsBoseService,
+				IsIntercepted: h.IsIntercepted,
+				RemoteAddr:    h.RemoteAddr,
+			}
+		} else if h.QueryCount > m.QueryCount {
+			// If exists and persisted is newer (rare but possible), update query count if higher
+			m.QueryCount = h.QueryCount
+			merged[hostname] = m
+		}
+	}
+
+	// Convert to slice
+	result := make([]datastore.DNSDiscoveryEntry, 0, len(merged))
+	for _, entry := range merged {
+		result = append(result, entry)
+	}
+
+	// Sort by last seen descending
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].LastSeen.After(result[j].LastSeen)
+	})
+
+	// 4. Update persistence with merged results
+	if err := s.ds.SaveDNSDiscoveries(result); err != nil {
+		log.Printf("Warning: Failed to persist merged DNS discoveries: %v", err)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(result); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleClearDNSDiscoveries clears recorded DNS discoveries.
+func (s *Server) HandleClearDNSDiscoveries(w http.ResponseWriter, _ *http.Request) {
+	// 1. Clear in-memory
+	s.SetDNSDiscoveries(make(map[string]*discovery.DiscoveredHost))
+
+	// 2. Clear persistence
+	if err := s.ds.ClearDNSDiscoveries(); err != nil {
+		http.Error(w, "Failed to clear DNS discoveries: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]bool{"ok": true}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
@@ -219,11 +499,12 @@ func (s *Server) HandleTrustCACert(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if err := s.sm.TrustCACert(deviceIP); err != nil {
+	output, err := s.sm.TrustCACert(deviceIP)
+	if err != nil {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)

-		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error()}); encodeErr != nil {
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
 			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 			return
 		}
@@ -233,7 +514,7 @@ func (s *Server) HandleTrustCACert(w http.ResponseWriter, r *http.Request) {

 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Root CA trusted"}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Root CA trusted", "output": output}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
@@ -254,11 +535,12 @@ func (s *Server) HandleEnsureRemoteServices(w http.ResponseWriter, r *http.Reque
 		return
 	}

-	if err := s.sm.EnsureRemoteServices(deviceIP); err != nil {
+	output, err := s.sm.EnsureRemoteServices(deviceIP)
+	if err != nil {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)

-		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error()}); encodeErr != nil {
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
 			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 			return
 		}
@@ -268,7 +550,7 @@ func (s *Server) HandleEnsureRemoteServices(w http.ResponseWriter, r *http.Reque

 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Remote services ensured"}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Remote services enabled", "output": output}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
@@ -289,11 +571,12 @@ func (s *Server) HandleRemoveRemoteServices(w http.ResponseWriter, r *http.Reque
 		return
 	}

-	if err := s.sm.RemoveRemoteServices(deviceIP); err != nil {
+	output, err := s.sm.RemoveRemoteServices(deviceIP)
+	if err != nil {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)

-		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error()}); encodeErr != nil {
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
 			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 			return
 		}
@@ -303,7 +586,7 @@ func (s *Server) HandleRemoveRemoteServices(w http.ResponseWriter, r *http.Reque

 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Remote services removed"}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Remote services removed", "output": output}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
@@ -324,11 +607,12 @@ func (s *Server) HandleBackupConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if err := s.sm.BackupConfig(deviceIP); err != nil {
+	output, err := s.sm.BackupConfig(deviceIP)
+	if err != nil {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)

-		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error()}); encodeErr != nil {
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
 			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 			return
 		}
@@ -338,7 +622,7 @@ func (s *Server) HandleBackupConfig(w http.ResponseWriter, r *http.Request) {

 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Backup created"}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Config backed up", "output": output}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
@@ -348,10 +632,13 @@ func (s *Server) HandleBackupConfig(w http.ResponseWriter, r *http.Request) {
 func (s *Server) HandleGetProxySettings(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "application/json")

-	if err := json.NewEncoder(w).Encode(map[string]bool{
-		"redact":   s.proxyRedact,
-		"log_body": s.proxyLogBody,
-		"record":   s.recordEnabled,
+	redact, logBody, record, enableSoundcorkProxy := s.GetProxySettings()
+
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{
+		"redact":                 redact,
+		"log_body":               logBody,
+		"record":                 record,
+		"enable_soundcork_proxy": enableSoundcorkProxy,
 	}); err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
@@ -376,18 +663,51 @@ func (s *Server) HandleGetCACert(w http.ResponseWriter, _ *http.Request) {
 // HandleUpdateProxySettings updates the proxy settings.
 func (s *Server) HandleUpdateProxySettings(w http.ResponseWriter, r *http.Request) {
 	var settings struct {
-		Redact  bool `json:"redact"`
-		LogBody bool `json:"log_body"`
-		Record  bool `json:"record"`
+		Redact               bool `json:"redact"`
+		LogBody              bool `json:"log_body"`
+		Record               bool `json:"record"`
+		EnableSoundcorkProxy bool `json:"enable_soundcork_proxy"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&settings); err != nil {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}

+	s.mu.Lock()
 	s.proxyRedact = settings.Redact
 	s.proxyLogBody = settings.LogBody
 	s.recordEnabled = settings.Record
+	s.enableSoundcorkProxy = settings.EnableSoundcorkProxy
+
+	if s.recorder != nil {
+		s.recorder.Redact = settings.Redact
+	}
+
+	// Persist to datastore
+	// Access fields directly since we already hold the lock
+	serverURL, soundcorkURL, httpsServerURL := s.serverURL, s.soundcorkURL, s.httpsServerURL
+	discoveryInterval := s.discoveryInterval.String()
+	discoveryEnabled := s.discoveryEnabled
+
+	log.Printf("Saving updated proxy settings to %s/settings.json", s.ds.DataDir)
+	err := s.ds.SaveSettings(datastore.Settings{
+		ServerURL:            serverURL,
+		SoundcorkURL:         soundcorkURL,
+		HTTPServerURL:        httpsServerURL,
+		RedactLogs:           s.proxyRedact,
+		LogBodies:            s.proxyLogBody,
+		RecordInteractions:   s.recordEnabled,
+		DiscoveryInterval:    discoveryInterval,
+		DiscoveryEnabled:     discoveryEnabled,
+		EnableSoundcorkProxy: s.enableSoundcorkProxy,
+		Shortcuts:            s.shortcuts,
+	})
+	s.mu.Unlock()
+
+	if err != nil {
+		http.Error(w, "Failed to save settings: "+err.Error(), http.StatusInternalServerError)
+		return
+	}

 	w.Header().Set("Content-Type", "application/json")

@@ -437,6 +757,46 @@ func (s *Server) HandleTestHostsRedirection(w http.ResponseWriter, r *http.Reque
 	}
 }

+// HandleTestDNSRedirection performs a check for DNS redirection to the AfterTouch service.
+func (s *Server) HandleTestDNSRedirection(w http.ResponseWriter, r *http.Request) {
+	deviceIP := chi.URLParam(r, "deviceIP")
+	if deviceIP == "" {
+		http.Error(w, "Device IP is required", http.StatusBadRequest)
+		return
+	}
+
+	targetURL := r.URL.Query().Get("target_url")
+	if targetURL == "" {
+		targetURL = s.serverURL
+	}
+
+	output, err := s.sm.TestDNSRedirection(deviceIP, targetURL)
+	if err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK) // Return 200 but ok: false so UI can show the output
+
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{
+			"ok":      false,
+			"message": err.Error(),
+			"output":  output,
+		}); encodeErr != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		}
+
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{
+		"ok":      true,
+		"message": "DNS redirection test successful",
+		"output":  output,
+	}); encodeErr != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
 // HandleInitialSync fetches presets, recents and sources from the device and saves them to the datastore.
 func (s *Server) HandleInitialSync(w http.ResponseWriter, r *http.Request) {
 	deviceIP := chi.URLParam(r, "deviceIP")
@@ -454,6 +814,42 @@ func (s *Server) HandleInitialSync(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write([]byte(`{"ok": true}`))
 }

+// HandleRebootDevice reboots a device.
+func (s *Server) HandleRebootDevice(w http.ResponseWriter, r *http.Request) {
+	deviceIP := chi.URLParam(r, "deviceIP")
+	if deviceIP == "" {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+
+		if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": "Device IP is required"}); err != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+			return
+		}
+
+		return
+	}
+
+	output, err := s.sm.Reboot(deviceIP)
+	if err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+
+		if encodeErr := json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "message": err.Error(), "output": output}); encodeErr != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+			return
+		}
+
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Reboot started", "output": output}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
 // HandleTestConnection performs a connection check from the device to the server.
 func (s *Server) HandleTestConnection(w http.ResponseWriter, r *http.Request) {
 	deviceIP := chi.URLParam(r, "deviceIP")
@@ -496,3 +892,160 @@ func (s *Server) HandleTestConnection(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 	}
 }
+
+// HandleGetVersionInfo returns version information for the service.
+func (s *Server) HandleGetVersionInfo(w http.ResponseWriter, _ *http.Request) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(map[string]string{
+		"version": s.Version,
+		"commit":  s.Commit,
+		"date":    s.Date,
+	}); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleGetInteractionStats returns statistics about recorded interactions.
+func (s *Server) HandleGetInteractionStats(w http.ResponseWriter, _ *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	stats, err := s.recorder.GetInteractionStats()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(stats); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleListInteractions returns a list of recorded interactions.
+func (s *Server) HandleListInteractions(w http.ResponseWriter, r *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	session := r.URL.Query().Get("session")
+	category := r.URL.Query().Get("category")
+	since := r.URL.Query().Get("since")
+
+	interactions, err := s.recorder.ListInteractions(session, category, since)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if err := json.NewEncoder(w).Encode(interactions); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+}
+
+// HandleGetInteractionContent returns the raw content of a recorded interaction.
+func (s *Server) HandleGetInteractionContent(w http.ResponseWriter, r *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	file := r.URL.Query().Get("file")
+	if file == "" {
+		http.Error(w, "File parameter is required", http.StatusBadRequest)
+		return
+	}
+
+	content, err := s.recorder.GetInteractionContent(file)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+	_, _ = w.Write(content)
+}
+
+// HandleDeleteSession deletes a recorded interaction session.
+func (s *Server) HandleDeleteSession(w http.ResponseWriter, r *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	session := chi.URLParam(r, "session")
+	if session == "" {
+		http.Error(w, "Session ID is required", http.StatusBadRequest)
+		return
+	}
+
+	if err := s.recorder.DeleteSession(session); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(`{"ok": true}`))
+}
+
+// HandleCleanupSessions deletes all but the most recent N sessions.
+func (s *Server) HandleCleanupSessions(w http.ResponseWriter, r *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	keep := 10
+
+	keepStr := r.URL.Query().Get("keep")
+	if keepStr != "" {
+		if k, err := strconv.Atoi(keepStr); err == nil {
+			keep = k
+		}
+	}
+
+	if err := s.recorder.CleanupSessions(keep); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(`{"ok": true}`))
+}
+
+// HandleDownloadSession returns a .tar.gz archive of a recorded interaction session.
+func (s *Server) HandleDownloadSession(w http.ResponseWriter, r *http.Request) {
+	if s.recorder == nil {
+		http.Error(w, "Recorder not initialized", http.StatusServiceUnavailable)
+		return
+	}
+
+	session := chi.URLParam(r, "session")
+	if session == "" {
+		http.Error(w, "Session ID is required", http.StatusBadRequest)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/gzip")
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.tar.gz\"", session))
+
+	if err := s.recorder.ArchiveSession(session, w); err != nil {
+		log.Printf("Error archiving session %s: %v", session, err)
+		// Since we already set headers, if we have an error here it might be partially written.
+		// But for now, simple error handling.
+		return
+	}
+}
@@ -15,7 +15,16 @@ import (
 )

 func TestProxySettingsAPI(t *testing.T) {
-	r, server := setupRouter("http://localhost:8001", nil)
+	tempDir, err := os.MkdirTemp("", "proxy-settings-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := datastore.NewDataStore(tempDir)
+	_ = ds.Initialize()
+
+	r, server := setupRouter("http://localhost:8001", ds)

 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -86,6 +95,34 @@ func TestProxySettingsAPI(t *testing.T) {
 	if settings["redact"] != false || settings["log_body"] != true {
 		t.Errorf("GET (after update): Unexpected settings: %+v", settings)
 	}
+
+	// 3. Test System Settings POST
+	sysUpdate := map[string]string{
+		"server_url":    "http://new-server:8000",
+		"soundcork_url": "http://new-proxy:8001",
+	}
+
+	sysBody, err := json.Marshal(sysUpdate)
+	if err != nil {
+		t.Fatalf("Failed to marshal system settings data: %v", err)
+	}
+
+	res, err = http.Post(ts.URL+"/setup/settings", "application/json", bytes.NewBuffer(sysBody))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = res.Body.Close() }()
+
+	if res.StatusCode != http.StatusOK {
+		t.Errorf("POST /setup/settings: Expected status OK, got %v", res.Status)
+	}
+
+	// Verify server state
+	sURL, pURL, _ := server.GetSettings()
+	if sURL != "http://new-server:8000" || pURL != "http://new-proxy:8001" {
+		t.Errorf("POST /setup/settings: Server state did not update: serverURL=%s, soundcorkURL=%s", sURL, pURL)
+	}
 }

 func TestMigrationAndCA(t *testing.T) {
@@ -144,6 +181,9 @@ func TestMigrationAndCA(t *testing.T) {
 	if result["ok"] != true {
 		t.Errorf("Migrate: Expected ok=true, got %v", result["ok"])
 	}
+	if _, ok := result["output"]; !ok {
+		t.Errorf("Migrate: Expected output field in response")
+	}

 	// 3. Test POST /setup/trust-ca/{deviceIP}
 	res, err = http.Post(ts.URL+"/setup/trust-ca/192.168.1.10", "application/json", nil)
@@ -162,6 +202,140 @@ func TestMigrationAndCA(t *testing.T) {
 	if result["ok"] != true {
 		t.Errorf("TrustCA: Expected ok=true, got %v", result["ok"])
 	}
+	if _, ok := result["output"]; !ok {
+		t.Errorf("TrustCA: Expected output field in response")
+	}
+
+	// 4. Test POST /setup/reboot/{deviceIP}
+	res, err = http.Post(ts.URL+"/setup/reboot/192.168.1.10", "application/json", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		t.Errorf("Reboot: Expected status OK, got %v", res.Status)
+	}
+
+	if err := json.NewDecoder(res.Body).Decode(&result); err != nil {
+		t.Fatalf("Reboot: Failed to decode response: %v", err)
+	}
+	if result["ok"] != true {
+		t.Errorf("Reboot: Expected ok=true, got %v", result["ok"])
+	}
+	if _, ok := result["output"]; !ok {
+		t.Errorf("Reboot: Expected output field in response")
+	}
+
+	// 5. Test POST /setup/remove-remote-services/{deviceIP}
+	res, err = http.Post(ts.URL+"/setup/remove-remote-services/192.168.1.10", "application/json", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		t.Errorf("RemoveRemote: Expected status OK, got %v", res.Status)
+	}
+
+	if err := json.NewDecoder(res.Body).Decode(&result); err != nil {
+		t.Fatalf("RemoveRemote: Failed to decode response: %v", err)
+	}
+	if result["ok"] != true {
+		t.Errorf("RemoveRemote: Expected ok=true, got %v", result["ok"])
+	}
+	if _, ok := result["output"]; !ok {
+		t.Errorf("RemoveRemote: Expected output field in response")
+	}
+}
+
+func TestRemoveDevice(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "remove-device-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := datastore.NewDataStore(tempDir)
+	_ = ds.Initialize()
+
+	// Setup a dummy device in the datastore
+	account := "test-account"
+	deviceID := "TEST-DEVICE-ID"
+	deviceDir := filepath.Join(tempDir, "accounts", account, "devices", deviceID)
+	if err := os.MkdirAll(deviceDir, 0755); err != nil {
+		t.Fatalf("Failed to create device dir: %v", err)
+	}
+
+	infoFile := filepath.Join(deviceDir, "DeviceInfo.xml")
+	infoXML := `<?xml version="1.0" encoding="UTF-8" ?><info deviceID="TEST-DEVICE-ID"><name>Test Device</name><type>SoundTouch 10</type></info>`
+	if err := os.WriteFile(infoFile, []byte(infoXML), 0644); err != nil {
+		t.Fatalf("Failed to create device info file: %v", err)
+	}
+
+	r, _ := setupRouter("http://localhost:8001", ds)
+	ts := httptest.NewServer(r)
+	defer ts.Close()
+
+	// 1. Verify device exists
+	res, err := http.Get(ts.URL + "/setup/devices")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+
+	var devices []map[string]interface{}
+	if err := json.NewDecoder(res.Body).Decode(&devices); err != nil {
+		t.Fatalf("Failed to decode devices: %v", err)
+	}
+
+	found := false
+	for _, d := range devices {
+		if d["device_id"] == deviceID {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("Device not found in list before removal")
+	}
+
+	// 2. Remove device
+	req, err := http.NewRequest(http.MethodDelete, ts.URL+"/setup/devices/"+deviceID, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	res, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		t.Errorf("Expected status OK, got %v", res.Status)
+	}
+
+	// 3. Verify device is gone
+	res, err = http.Get(ts.URL + "/setup/devices")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+
+	if err := json.NewDecoder(res.Body).Decode(&devices); err != nil {
+		t.Fatalf("Failed to decode devices after removal: %v", err)
+	}
+
+	for _, d := range devices {
+		if d["device_id"] == deviceID {
+			t.Errorf("Device still exists in list after removal")
+		}
+	}
+
+	// 4. Verify directory is gone
+	if _, err := os.Stat(deviceDir); !os.IsNotExist(err) {
+		t.Errorf("Device directory still exists after removal")
+	}
 }

 type mockSSH struct{}
@@ -8,6 +8,7 @@ import (
 	"time"

 	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/go-chi/chi/v5"
 )

 // HandleUsageStats handles Marge usage stats uploads.
@@ -49,6 +50,42 @@ func (s *Server) HandleUsageStats(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusOK)
 }

+// HandleAppEvents handles events from the Bose SoundTouch app (stapp/scmudc).
+func (s *Server) HandleAppEvents(w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		http.Error(w, "Failed to read body", http.StatusBadRequest)
+		return
+	}
+
+	var req models.DeviceEventsRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		http.Error(w, "Invalid app events format", http.StatusBadRequest)
+		return
+	}
+
+	deviceID := req.Envelope.UniqueID
+	if deviceID == "" {
+		deviceID = chi.URLParam(r, "deviceId")
+	}
+
+	for _, e := range req.Payload.Events {
+		event := models.DeviceEvent{
+			Type:     e.Type,
+			Time:     e.Time,
+			MonoTime: req.Envelope.MonoTime,
+			Data:     e.Data,
+		}
+		if event.Time == "" {
+			event.Time = time.Now().Format(time.RFC3339)
+		}
+
+		s.ds.AddDeviceEvent(deviceID, event)
+	}
+
+	w.WriteHeader(http.StatusOK)
+}
+
 // HandleErrorStats handles Marge error stats uploads.
 func (s *Server) HandleErrorStats(w http.ResponseWriter, r *http.Request) {
 	body, err := io.ReadAll(r.Body)
@@ -12,7 +12,7 @@ import (
 )

 func TestStatsHandlers(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "soundcork-test-*")
+	tempDir, err := os.MkdirTemp("", "st-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -63,4 +63,44 @@ func TestStatsHandlers(t *testing.T) {
 			t.Error("Error stats file was not created")
 		}
 	})
+
+	t.Run("HandleAppEvents", func(t *testing.T) {
+		jsonData := `{
+			"envelope": {
+				"monoTime": 12345,
+				"payloadProtocolVersion": "3.1",
+				"payloadType": "stapp",
+				"protocolVersion": "1.0",
+				"time": "2023-10-27T10:00:00Z",
+				"uniqueId": "device789"
+			},
+			"payload": {
+				"deviceInfo": {
+					"deviceID": "device789"
+				},
+				"events": [
+					{
+						"type": "APP_OPEN",
+						"time": "2023-10-27T10:00:01Z",
+						"data": {"foo": "bar"}
+					}
+				]
+			}
+		}`
+		req := httptest.NewRequest("POST", "/v1/stapp/device789", bytes.NewBufferString(jsonData))
+		w := httptest.NewRecorder()
+
+		s.HandleAppEvents(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("Expected status OK, got %d", w.Code)
+		}
+
+		events := ds.GetDeviceEvents("device789")
+		if len(events) == 0 {
+			t.Error("App events were not recorded")
+		} else if events[0].Type != "APP_OPEN" {
+			t.Errorf("Expected event type APP_OPEN, got %s", events[0].Type)
+		}
+	})
 }
@@ -0,0 +1,161 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
+	"github.com/gesellix/bose-soundtouch/pkg/service/proxy"
+	"github.com/go-chi/chi/v5"
+)
+
+func TestInteractionHandlers(t *testing.T) {
+	t.Setenv("RECORDER_ASYNC", "false")
+	tmpDir, err := os.MkdirTemp("", "interaction-handlers-test")
+	if err != nil {
+		t.Fatalf("failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	ds := datastore.NewDataStore(filepath.Join(tmpDir, "test.db"))
+	server := &Server{ds: ds}
+
+	t.Run("HandleGetInteractionStats_NoRecorder", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/setup/interaction-stats", nil)
+		w := httptest.NewRecorder()
+		server.HandleGetInteractionStats(w, req)
+		if w.Code != http.StatusServiceUnavailable {
+			t.Errorf("Expected status 503, got %d", w.Code)
+		}
+	})
+
+	recorder := proxy.NewRecorder(tmpDir)
+	server.SetRecorder(recorder)
+
+	// Create a dummy interaction file
+	sessionID := recorder.SessionID
+	relPath := filepath.Join(sessionID, "self", "test", "0001-12-00-00.000-GET.http")
+	fullPath := filepath.Join(tmpDir, "interactions", relPath)
+	os.MkdirAll(filepath.Dir(fullPath), 0755)
+	os.WriteFile(fullPath, []byte("### GET /test\n\n> {% \n    // Response: 200 OK\n%}\n"), 0644)
+
+	r := chi.NewRouter()
+	r.Route("/setup", func(r chi.Router) {
+		r.Get("/interaction-stats", server.HandleGetInteractionStats)
+		r.Get("/interactions", server.HandleListInteractions)
+		r.Get("/interaction-content", server.HandleGetInteractionContent)
+	})
+
+	t.Run("HandleGetInteractionStats", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/setup/interaction-stats", nil)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("Expected status 200, got %d", w.Code)
+		}
+
+		var stats proxy.InteractionStats
+		if err := json.NewDecoder(w.Body).Decode(&stats); err != nil {
+			t.Fatalf("Failed to decode stats: %v", err)
+		}
+
+		if stats.TotalRequests != 1 {
+			t.Errorf("Expected 1 total request, got %d", stats.TotalRequests)
+		}
+	})
+
+	t.Run("HandleListInteractions", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/setup/interactions?category=self", nil)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("Expected status 200, got %d", w.Code)
+		}
+
+		var interactions []proxy.Interaction
+		if err := json.NewDecoder(w.Body).Decode(&interactions); err != nil {
+			t.Fatalf("Failed to decode interactions: %v", err)
+		}
+
+		if len(interactions) != 1 {
+			t.Errorf("Expected 1 interaction, got %d", len(interactions))
+		}
+	})
+
+	t.Run("HandleGetInteractionContent", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/setup/interaction-content?file="+relPath, nil)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Errorf("Expected status 200, got %d", w.Code)
+		}
+
+		if !strings.Contains(w.Body.String(), "### GET /test") {
+			t.Errorf("Unexpected content: %s", w.Body.String())
+		}
+	})
+
+	t.Run("HandleGetInteractionContent_MissingFile", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/setup/interaction-content", nil)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("Expected status 400, got %d", w.Code)
+		}
+	})
+}
+
+func TestRecordMiddleware(t *testing.T) {
+	t.Setenv("RECORDER_ASYNC", "false")
+	tmpDir, err := os.MkdirTemp("", "record-middleware-test")
+	if err != nil {
+		t.Fatalf("failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	ds := datastore.NewDataStore(filepath.Join(tmpDir, "test.db"))
+	server := &Server{
+		ds:            ds,
+		recordEnabled: true,
+	}
+	recorder := proxy.NewRecorder(tmpDir)
+	server.SetRecorder(recorder)
+
+	r := chi.NewRouter()
+	r.Use(server.RecordMiddleware)
+	r.Get("/test-middleware", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Test", "Value")
+		w.WriteHeader(http.StatusCreated)
+		w.Write([]byte("created"))
+
+		if f, ok := w.(http.Flusher); ok {
+			f.Flush()
+		}
+	})
+
+	req := httptest.NewRequest("GET", "/test-middleware", nil)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusCreated {
+		t.Errorf("Expected status 201, got %d", w.Code)
+	}
+
+	t.Run("HandleRecordMiddleware_Disabled", func(t *testing.T) {
+		server.recordEnabled = false
+		req := httptest.NewRequest("GET", "/test-middleware", nil)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+		if w.Code != http.StatusCreated {
+			t.Errorf("Expected status 201, got %d", w.Code)
+		}
+	})
+}
@@ -1,19 +1,19 @@
 package handlers

 import (
-	"net/http"
-	"net/url"
-
 	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/go-chi/chi/v5"
 )

 func setupRouter(targetURL string, ds *datastore.DataStore) (*chi.Mux, *Server) {
-	target, _ := url.Parse(targetURL)
-	proxy := &reverseProxy{target: target}
-	server := &Server{ds: ds}
+	server := NewServer(ds, nil, "http://localhost:8000", false, false, false, false)
+	server.SetSoundcorkURL(targetURL)

 	r := chi.NewRouter()
+	r.Use(server.OriginMiddleware)
+	r.Use(server.ShortcutMiddleware)
+	r.Use(server.RecordMiddleware)
+
 	r.Get("/", server.HandleRoot)

 	// Setup media and web directories for tests
@@ -29,6 +29,13 @@ func setupRouter(targetURL string, ds *datastore.DataStore) (*chi.Mux, *Server)
 		r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
 	})

+	// Legacy or direct domain calls without /bmx prefix
+	r.Get("/registry/v1/services", server.HandleBMXRegistry)
+	r.Get("/tunein/v1/playback/station/{stationID}", server.HandleTuneInPlayback)
+	r.Get("/tunein/v1/playback/episodes/{podcastID}", server.HandleTuneInPodcastInfo)
+	r.Get("/tunein/v1/playback/episode/{podcastID}", server.HandleTuneInPlaybackPodcast)
+	r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
+
 	// Setup Marge for tests
 	r.Route("/marge", func(r chi.Router) {
 		r.Get("/streaming/sourceproviders", server.HandleMargeSourceProviders)
@@ -43,34 +50,60 @@ func setupRouter(targetURL string, ds *datastore.DataStore) (*chi.Mux, *Server)
 		r.Get("/streaming/account/{account}/provider_settings", server.HandleMargeProviderSettings)
 		r.Get("/streaming/device/{device}/streaming_token", server.HandleMargeStreamingToken)
 		r.Post("/streaming/support/customersupport", server.HandleMargeCustomerSupport)
+		r.Get("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeGetDeviceSettings)
+		r.Post("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeUpdateDeviceSettings)
+		r.Get("/streaming/account/{account}/emailaddress", server.HandleMargeGetEmailAddress)
+	})
+
+	// Legacy or direct domain calls without /marge prefix
+	r.Get("/streaming/sourceproviders", server.HandleMargeSourceProviders)
+	r.Get("/accounts/{account}/full", server.HandleMargeAccountFull)
+	r.Post("/streaming/support/power_on", server.HandleMargePowerOn)
+	r.Get("/updates/soundtouch", server.HandleMargeSoftwareUpdate)
+	r.Get("/accounts/{account}/devices/{device}/presets", server.HandleMargePresets)
+	r.Post("/accounts/{account}/devices/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
+	r.Post("/accounts/{account}/devices/{device}/recents", server.HandleMargeAddRecent)
+	r.Post("/accounts/{account}/devices", server.HandleMargeAddDevice)
+	r.Delete("/accounts/{account}/devices/{device}", server.HandleMargeRemoveDevice)
+	r.Get("/streaming/account/{account}/provider_settings", server.HandleMargeProviderSettings)
+	r.Get("/streaming/device/{device}/streaming_token", server.HandleMargeStreamingToken)
+	r.Post("/streaming/support/customersupport", server.HandleMargeCustomerSupport)
+	r.Get("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeGetDeviceSettings)
+	r.Post("/streaming/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeUpdateDeviceSettings)
+	r.Get("/streaming/account/{account}/emailaddress", server.HandleMargeGetEmailAddress)
+
+	// Setup Customer for tests
+	r.Route("/customer", func(r chi.Router) {
+		r.Get("/account/{account}", server.HandleMargeAccountProfile)
+		r.Post("/account/{account}", server.HandleMargeUpdateAccountProfile)
+		r.Post("/account/{account}/password", server.HandleMargeChangePassword)
 	})

 	// Setup Setup for tests
 	r.Route("/setup", func(r chi.Router) {
+		r.Get("/devices", server.HandleListDiscoveredDevices)
+		r.Delete("/devices/{deviceId}", server.HandleRemoveDevice)
+		r.Get("/settings", server.HandleGetSettings)
+		r.Post("/settings", server.HandleUpdateSettings)
 		r.Get("/proxy-settings", server.HandleGetProxySettings)
 		r.Post("/proxy-settings", server.HandleUpdateProxySettings)
 		r.Post("/ensure-remote-services/{deviceIP}", server.HandleEnsureRemoteServices)
 		r.Post("/remove-remote-services/{deviceIP}", server.HandleRemoveRemoteServices)
 		r.Post("/migrate/{deviceIP}", server.HandleMigrateDevice)
+		r.Post("/revert/{deviceIP}", server.HandleRevertMigration)
+		r.Post("/reboot/{deviceIP}", server.HandleRebootDevice)
 		r.Post("/trust-ca/{deviceIP}", server.HandleTrustCACert)
 		r.Post("/test-connection/{deviceIP}", server.HandleTestConnection)
 		r.Post("/test-hosts/{deviceIP}", server.HandleTestHostsRedirection)
 		r.Get("/ca.crt", server.HandleGetCACert)
 	})

-	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
-		proxy.ServeHTTP(w, r)
-	})
+	r.NotFound(server.HandleNotFound)

 	return r, server
 }

-type reverseProxy struct {
-	target *url.URL
-}
-
-func (p *reverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Simplified proxy for testing
-	w.WriteHeader(http.StatusAccepted) // Custom status to identify proxy hit in tests
-	_, _ = w.Write([]byte("Proxied to " + p.target.String()))
+func init() {
+	// Silence logger for tests
+	// log.SetOutput(io.Discard)
 }
@@ -0,0 +1,27 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5/middleware"
+)
+
+// OriginMiddleware returns a middleware that logs whether the request was handled "self" or "upstream".
+func (s *Server) OriginMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+
+		ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
+
+		next.ServeHTTP(ww, r)
+
+		origin := "self"
+		if ww.Header().Get("X-Proxy-Origin") != "" {
+			origin = "upstream"
+		}
+
+		log.Printf("[LOG] %s %s | %d | %s | %v", r.Method, r.URL.Path, ww.Status(), origin, time.Since(start))
+	})
+}
@@ -3,6 +3,9 @@ package handlers
 import (
 	"context"
 	"log"
+	"net/http"
+	"net/url"
+	"sync"
 	"time"

 	"github.com/gesellix/bose-soundtouch/pkg/discovery"
@@ -14,40 +17,220 @@ import (

 // Server handles HTTP requests for the SoundTouch service.
 type Server struct {
-	ds            *datastore.DataStore
-	sm            *setup.Manager
-	serverURL     string
-	proxyURL      string
-	discovering   bool
-	proxyRedact   bool
-	proxyLogBody  bool
-	recordEnabled bool
-	recorder      *proxy.Recorder
+	ds                   *datastore.DataStore
+	sm                   *setup.Manager
+	mu                   sync.RWMutex
+	serverURL            string
+	soundcorkURL         string
+	httpsServerURL       string
+	discovering          bool
+	proxyRedact          bool
+	proxyLogBody         bool
+	recordEnabled        bool
+	discoveryInterval    time.Duration
+	discoveryEnabled     bool
+	dnsEnabled           bool
+	dnsUpstream          string
+	dnsBindAddr          string
+	enableSoundcorkProxy bool
+	shortcuts            map[string]int
+	recorder             *proxy.Recorder
+	dnsDiscovery         *discovery.DNSDiscovery
+	UpstreamProxy        http.Handler
+	Version              string
+	Commit               string
+	Date                 string
 }

 // NewServer creates a new SoundTouch service server.
-func NewServer(ds *datastore.DataStore, sm *setup.Manager, serverURL string, proxyRedact, proxyLogBody, recordEnabled bool) *Server {
-	return &Server{
-		ds:            ds,
-		sm:            sm,
-		serverURL:     serverURL,
-		proxyURL:      serverURL,
-		proxyRedact:   proxyRedact,
-		proxyLogBody:  proxyLogBody,
-		recordEnabled: recordEnabled,
+func NewServer(ds *datastore.DataStore, sm *setup.Manager, serverURL string, proxyRedact, proxyLogBody, recordEnabled, enableSoundcorkProxy bool) *Server {
+	s := &Server{
+		ds:                   ds,
+		sm:                   sm,
+		serverURL:            serverURL,
+		soundcorkURL:         "http://localhost:8001",
+		proxyRedact:          proxyRedact,
+		proxyLogBody:         proxyLogBody,
+		recordEnabled:        recordEnabled,
+		enableSoundcorkProxy: enableSoundcorkProxy,
+		discoveryInterval:    5 * time.Minute,
 	}
+
+	return s
+}
+
+// SetVersionInfo sets the version information for the server.
+func (s *Server) SetVersionInfo(version, commit, date string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.Version = version
+	s.Commit = commit
+	s.Date = date
+}
+
+// SetDiscoverySettings sets the discovery settings for the server.
+func (s *Server) SetDiscoverySettings(interval time.Duration, enabled bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.discoveryInterval = interval
+	s.discoveryEnabled = enabled
+}
+
+// SetDNSSettings sets the DNS discovery settings for the server.
+func (s *Server) SetDNSSettings(enabled bool, upstream, bind string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	oldBind := s.dnsBindAddr
+	oldUpstream := s.dnsUpstream
+
+	s.dnsEnabled = enabled
+	s.dnsUpstream = upstream
+	s.dnsBindAddr = bind
+
+	if s.dnsDiscovery != nil {
+		if !enabled || bind != oldBind || upstream != oldUpstream {
+			log.Printf("[DNS] Settings changed, stopping DNS discovery server")
+
+			_ = s.dnsDiscovery.Shutdown()
+			s.dnsDiscovery = nil
+		}
+	}
+
+	if enabled && s.dnsDiscovery == nil {
+		log.Printf("[DNS] Starting DNS discovery server on %s", bind)
+
+		u, _ := url.Parse(s.serverURL)
+
+		serviceIP := u.Hostname()
+		if serviceIP == "localhost" || serviceIP == "" {
+			serviceIP = "127.0.0.1"
+		}
+
+		if s.sm != nil {
+			serviceIP = s.sm.GetResolvedIP(serviceIP)
+		}
+
+		s.dnsDiscovery = discovery.NewDNSDiscovery(upstream, serviceIP)
+		go func(d *discovery.DNSDiscovery, addr string) {
+			if err := d.Start(addr); err != nil {
+				log.Printf("Warning: DNS discovery server error: %v", err)
+			}
+		}(s.dnsDiscovery, bind)
+	}
+}
+
+// GetDNSRunning returns whether DNS discovery is active and its bind address.
+func (s *Server) GetDNSRunning() (bool, string) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if s.dnsDiscovery == nil {
+		return false, ""
+	}
+
+	return s.dnsDiscovery.IsRunning(s.dnsBindAddr), s.dnsBindAddr
+}
+
+// SetDNSDiscoveries sets the initial DNS discoveries for the server.
+func (s *Server) SetDNSDiscoveries(discoveries map[string]*discovery.DiscoveredHost) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.dnsDiscovery != nil {
+		s.dnsDiscovery.SetDiscovered(discoveries)
+	}
+}
+
+// GetDNSDiscovery returns the current DNS discoveries.
+func (s *Server) GetDNSDiscovery() map[string]*discovery.DiscoveredHost {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if s.dnsDiscovery == nil {
+		return nil
+	}
+
+	return s.dnsDiscovery.GetDiscovered()
+}
+
+// SetShortcuts sets the request shortcuts for the server.
+func (s *Server) SetShortcuts(shortcuts map[string]int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.shortcuts = shortcuts
+}
+
+// GetShortcuts returns the current request shortcuts.
+func (s *Server) GetShortcuts() map[string]int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.shortcuts
+}
+
+// GetDiscoverySettings returns the current discovery settings.
+func (s *Server) GetDiscoverySettings() (time.Duration, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.discoveryInterval, s.discoveryEnabled
+}
+
+// SetHTTPServerURL sets the external HTTPS URL of the service.
+func (s *Server) SetHTTPServerURL(url string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.httpsServerURL = url
+}
+
+// SetSoundcorkURL sets the URL for the Soundcork backend.
+func (s *Server) SetSoundcorkURL(url string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.soundcorkURL = url
 }

 // SetRecorder sets the recorder for the server.
 func (s *Server) SetRecorder(r *proxy.Recorder) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	s.recorder = r
+	if r != nil {
+		r.Redact = s.proxyRedact
+	}
 }

 // GetRecordEnabled returns whether recording is enabled.
 func (s *Server) GetRecordEnabled() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
 	return s.recordEnabled
 }

+// GetSettings returns the current server settings.
+func (s *Server) GetSettings() (string, string, string) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.serverURL, s.soundcorkURL, s.httpsServerURL
+}
+
+// GetProxySettings returns the current proxy settings.
+func (s *Server) GetProxySettings() (bool, bool, bool, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.proxyRedact, s.proxyLogBody, s.recordEnabled, s.enableSoundcorkProxy
+}
+
 // DiscoverDevices starts a background device discovery process.
 //
 //nolint:contextcheck
@@ -78,12 +261,15 @@ func (s *Server) DiscoverDevices(ctx context.Context) {
 	for _, d := range devices {
 		s.handleDiscoveredDevice(*d)
 	}
+
+	// Post-discovery cleanup: merge overlapping IP/Serial entries
+	s.mergeOverlappingDevices()
 }

 func (s *Server) handleDiscoveredDevice(d models.DiscoveredDevice) {
 	log.Printf("Discovered Bose device: %s at %s (Serial: %s)", d.Name, d.Host, d.SerialNo)

-	// 1. Check if we already have this device by serial number (best identifier)
+	// 1. Check if we already have this device
 	existingID := s.findExistingDeviceID(d)

 	// Use SerialNo if available, otherwise fallback to IP for the datastore directory name
@@ -103,8 +289,33 @@ func (s *Server) handleDiscoveredDevice(d models.DiscoveredDevice) {
 		deviceID = d.Host
 	}

+	accountID := ""
+
+	if liveInfo, err := s.sm.GetLiveDeviceInfo(d.Host); err == nil {
+		if liveInfo.MargeAccountUUID != "" {
+			accountID = liveInfo.MargeAccountUUID
+		}
+
+		if liveInfo.SerialNumber != "" {
+			d.SerialNo = liveInfo.SerialNumber
+			deviceID = d.SerialNo
+		}
+	}
+
+	if accountID == "" {
+		// Try to find account ID from existing device entries if live info failed
+		if existing := s.findExistingDeviceInfo(d); existing != nil {
+			accountID = existing.AccountID
+		}
+	}
+
+	if accountID == "" {
+		accountID = "default"
+	}
+
 	info := &models.ServiceDeviceInfo{
-		DeviceID:           d.SerialNo,
+		DeviceID:           deviceID,
+		AccountID:          accountID,
 		Name:               d.Name,
 		IPAddress:          d.Host,
 		DeviceSerialNumber: d.SerialNo,
@@ -116,26 +327,104 @@ func (s *Server) handleDiscoveredDevice(d models.DiscoveredDevice) {
 	// If we had an IP-based entry and now have a Serial, clean up the IP-based entry
 	if d.SerialNo != "" && existingID != "" && existingID != d.SerialNo {
 		log.Printf("Device %s previously known as %s, migrating to serial-based ID %s", d.Name, existingID, d.SerialNo)
-		_ = s.ds.RemoveDevice("default", existingID)
+		_ = s.ds.RemoveDevice(accountID, existingID)
 	}

-	if err := s.ds.SaveDeviceInfo("default", deviceID, info); err != nil {
+	if err := s.ds.SaveDeviceInfo(accountID, deviceID, info); err != nil {
 		log.Printf("Failed to save device info: %v", err)
 	}
 }

-func (s *Server) findExistingDeviceID(d models.DiscoveredDevice) string {
-	allDevices, _ := s.ds.ListAllDevices()
+func (s *Server) mergeOverlappingDevices() {
+	allDevices, err := s.ds.ListAllDevices()
+	if err != nil {
+		return
+	}
+
+	// Group devices by IP
+	byIP := make(map[string][]models.ServiceDeviceInfo)
+
 	for i := range allDevices {
-		known := allDevices[i]
-		if d.SerialNo != "" && (known.DeviceID == d.SerialNo || known.DeviceSerialNumber == d.SerialNo) {
-			if known.DeviceID != "" {
-				return known.DeviceID
+		dev := allDevices[i]
+		if dev.IPAddress != "" {
+			byIP[dev.IPAddress] = append(byIP[dev.IPAddress], dev)
+		}
+	}
+
+	for ip, devices := range byIP {
+		if len(devices) <= 1 {
+			continue
+		}
+
+		// We have multiple entries for the same IP.
+		// Try to find one with a Serial Number to be the master.
+		var master *models.ServiceDeviceInfo
+
+		for i := range devices {
+			if devices[i].DeviceSerialNumber != "" {
+				master = &devices[i]
+				break
+			}
+		}
+
+		if master == nil {
+			// Fallback: look for one with DeviceID that isn't the IP
+			for i := range devices {
+				if devices[i].DeviceID != "" && devices[i].DeviceID != devices[i].IPAddress {
+					master = &devices[i]
+					break
+				}
+			}
+		}
+
+		if master == nil {
+			// None have serials, just keep the first one
+			continue
+		}
+
+		masterID := master.DeviceID
+		if masterID == "" {
+			masterID = master.DeviceSerialNumber
+		}
+
+		for i := range devices {
+			dev := devices[i]
+			devID := dev.DeviceID
+
+			if devID == "" {
+				devID = dev.IPAddress
 			}

-			return known.IPAddress
+			if devID != masterID && dev.IPAddress == ip {
+				log.Printf("Merging overlapping device entry %s into %s (IP: %s)", devID, masterID, ip)
+				_ = s.ds.RemoveDevice(dev.AccountID, devID)
+			}
 		}
 	}
+}
+
+func (s *Server) findExistingDeviceID(d models.DiscoveredDevice) string {
+	info := s.findExistingDeviceInfo(d)
+	if info != nil {
+		return info.DeviceID
+	}

 	return ""
 }
+
+func (s *Server) findExistingDeviceInfo(d models.DiscoveredDevice) *models.ServiceDeviceInfo {
+	allDevices, _ := s.ds.ListAllDevices()
+	for i := range allDevices {
+		known := allDevices[i]
+		// Match by Serial
+		if d.SerialNo != "" && (known.DeviceID == d.SerialNo || known.DeviceSerialNumber == d.SerialNo) {
+			return &known
+		}
+		// Match by IP
+		if d.Host != "" && known.IPAddress == d.Host {
+			return &known
+		}
+	}
+
+	return nil
+}
@@ -0,0 +1,130 @@
+package handlers
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
+)
+
+func TestMergeOverlappingDevices(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "merge-test-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := datastore.NewDataStore(tempDir)
+	s := &Server{ds: ds}
+
+	// Case 1: IP-only entry and Serial-based entry for the same IP
+	ip := "192.168.1.100"
+	serial := "SERIAL123"
+
+	// 1. Save IP-based entry
+	infoIP := &models.ServiceDeviceInfo{
+		DeviceID:    ip,
+		Name:        "Speaker IP",
+		IPAddress:   ip,
+		AccountID:   "default",
+		ProductCode: "ST10",
+	}
+	err = ds.SaveDeviceInfo("default", ip, infoIP)
+	if err != nil {
+		t.Fatalf("Failed to save IP info: %v", err)
+	}
+
+	// 2. Save Serial-based entry
+	infoSerial := &models.ServiceDeviceInfo{
+		DeviceID:           serial,
+		DeviceSerialNumber: serial,
+		Name:               "Speaker Serial",
+		IPAddress:          ip,
+		AccountID:          "default",
+		ProductCode:        "ST10",
+	}
+	err = ds.SaveDeviceInfo("default", serial, infoSerial)
+	if err != nil {
+		t.Fatalf("Failed to save Serial info: %v", err)
+	}
+
+	// Verify both exist
+	devices, _ := ds.ListAllDevices()
+	if len(devices) != 2 {
+		t.Fatalf("Expected 2 devices before merge, got %d", len(devices))
+	}
+
+	// Run merge
+	s.mergeOverlappingDevices()
+
+	// Verify merge
+	devices, _ = ds.ListAllDevices()
+	if len(devices) != 1 {
+		t.Fatalf("Expected 1 device after merge, got %d", len(devices))
+	}
+
+	if devices[0].DeviceID != serial {
+		t.Errorf("Expected remaining device to be Serial-based (%s), got %s", serial, devices[0].DeviceID)
+	}
+}
+
+func TestFindExistingDeviceID(t *testing.T) {
+	tempDir, _ := os.MkdirTemp("", "find-test-*")
+	defer os.RemoveAll(tempDir)
+
+	ds := datastore.NewDataStore(tempDir)
+	s := &Server{ds: ds}
+
+	ip := "192.168.1.101"
+	serial := "SERIAL456"
+
+	// Save IP-based
+	ds.SaveDeviceInfo("default", ip, &models.ServiceDeviceInfo{
+		DeviceID:    ip,
+		IPAddress:   ip,
+		Name:        "IP Speaker",
+		AccountID:   "default",
+		ProductCode: "ST10",
+	})
+
+	// Test finding by IP
+	foundID := s.findExistingDeviceID(models.DiscoveredDevice{
+		Host: ip,
+	})
+	if foundID != ip {
+		t.Errorf("Expected to find by IP, got %s", foundID)
+	}
+
+	// Save Serial-based for SAME IP
+	ds.SaveDeviceInfo("default", serial, &models.ServiceDeviceInfo{
+		DeviceID:           serial,
+		DeviceSerialNumber: serial,
+		IPAddress:          ip,
+		Name:               "Serial Speaker",
+		AccountID:          "default",
+		ProductCode:        "ST10",
+	})
+
+	// Test finding by IP should now return Serial (if Serial is known)
+	// Actually findExistingDeviceID returns the first match it finds in allDevices.
+	// Since we haven't merged yet, it could be either.
+
+	// Test finding by Serial
+	foundID = s.findExistingDeviceID(models.DiscoveredDevice{
+		Host:     ip,
+		SerialNo: serial,
+	})
+	if foundID != serial && foundID != ip {
+		t.Errorf("Expected to find by Serial or IP, got %s", foundID)
+	}
+
+	// Merge and check again
+	s.mergeOverlappingDevices()
+	foundID = s.findExistingDeviceID(models.DiscoveredDevice{
+		Host: ip,
+	})
+	if foundID != serial {
+		t.Errorf("After merge, expected to find Serial ID for IP, got %s", foundID)
+	}
+}
@@ -0,0 +1,23 @@
+package handlers
+
+import (
+	"net/http"
+)
+
+// ShortcutMiddleware returns a middleware that shortcuts requests to specific paths.
+func (s *Server) ShortcutMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		s.mu.RLock()
+		shortcuts := s.shortcuts
+		s.mu.RUnlock()
+
+		if shortcuts != nil {
+			if status, ok := shortcuts[r.URL.Path]; ok {
+				w.WriteHeader(status)
+				return
+			}
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tobias Gesellchen	6aef2b807d	Enhance ResolvConf migration to support multiple DHCP script variants This update allows the service to correctly patch both /etc/udhcpc.d/50default and /opt/Bose/udhcpc.script (used in SoundTouch 10 firmware) for DNS redirection. It also improves robustness by adding file existence checks in rc.local and ensures clean state by reverting to .original backups during migration.	2026-02-16 18:52:25 +01:00
Tobias Gesellchen	95f5e9c831	fix(setup): prevent and clean up corrupted rc.local with cat error message	2026-02-16 18:20:16 +01:00
Tobias Gesellchen	7337296ae9	refactor(setup): reduce cyclomatic complexity of RevertMigration	2026-02-16 18:04:28 +01:00
Tobias Gesellchen	92a5d3592c	feat(setup): replace obsolete resolv method with persistent DHCP-aware DNS hook	2026-02-16 18:04:28 +01:00
Tobias Gesellchen	2f04af872b	feat(setup): implement Aftertouch Hook (DHCP-aware DNS redirection); update UI and tests; docs now use aftertouch.resolv.conf	2026-02-16 18:04:28 +01:00
Tobias Gesellchen	9479d6d11d	Fix missing request body in recorded proxy interactions	2026-02-16 16:30:41 +01:00
Tobias Gesellchen	f687ba0d82	go mod tidy	2026-02-16 12:45:04 +01:00
Tobias Gesellchen	ab2bf0731a	Add DNS-based discovery and migration via /etc/resolv.conf	2026-02-16 12:18:06 +01:00
Tobias Gesellchen	cafaba1be0	Update SOUNDTOUCH-SERVICE.md with recent features (Soundcork proxy, session archiving, enhanced redaction)	2026-02-15 23:54:14 +01:00
Tobias Gesellchen	93082d2cdc	Update root endpoint JSON response with AfterTouch and docs link	2026-02-15 23:47:10 +01:00
Tobias Gesellchen	087006c483	Add regression test for settings persistence	2026-02-15 23:28:45 +01:00
Tobias Gesellchen	b7013a5ec8	Apply 'Redact Sensitive Headers' to recordings	2026-02-15 23:12:19 +01:00
Tobias Gesellchen	7d76b3fab2	Implement dynamic Bose proxy with detailed origin logging and Soundcork fallback	2026-02-15 22:50:13 +01:00
Tobias Gesellchen	6ca206053f	Add session download feature to web UI	2026-02-15 22:20:16 +01:00
Tobias Gesellchen	090eb162fb	Fix TypeError in Web UI by renaming proxy-domain to soundcork-url This commit fixes a JS error in showSummary and migrate functions where they were still trying to access the UI element by its old ID 'proxy-domain' instead of the new 'soundcork-url'.	2026-02-15 22:01:58 +01:00
dependabot[bot]	972824e07f	ci(deps): bump the actions-core group with 3 updates Bumps the actions-core group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/configure-pages](https://github.com/actions/configure-pages) and [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact). Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v6) Updates `actions/configure-pages` from 4 to 5 - [Release notes](https://github.com/actions/configure-pages/releases) - [Commits](https://github.com/actions/configure-pages/compare/v4...v5) Updates `actions/upload-pages-artifact` from 3 to 4 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](https://github.com/actions/upload-pages-artifact/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core - dependency-name: actions/configure-pages dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core - dependency-name: actions/upload-pages-artifact dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core ... Signed-off-by: dependabot[bot] <support@github.com>	2026-02-15 21:57:12 +01:00
dependabot[bot]	1e2148d53b	deps(deps): bump the golang group with 4 updates Bumps the golang group with 4 updates: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/mod](https://github.com/golang/mod), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/crypto` from 0.47.0 to 0.48.0 - [Commits](https://github.com/golang/crypto/compare/v0.47.0...v0.48.0) Updates `golang.org/x/mod` from 0.32.0 to 0.33.0 - [Commits](https://github.com/golang/mod/compare/v0.32.0...v0.33.0) Updates `golang.org/x/net` from 0.49.0 to 0.50.0 - [Commits](https://github.com/golang/net/compare/v0.49.0...v0.50.0) Updates `golang.org/x/tools` from 0.41.0 to 0.42.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/mod dependency-version: 0.33.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/net dependency-version: 0.50.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/tools dependency-version: 0.42.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang ... Signed-off-by: dependabot[bot] <support@github.com>	2026-02-15 21:56:17 +01:00
Tobias Gesellchen	9a070da1ef	Fix data race in RecordMiddleware and improve recorder robustness This commit addresses the data race detected in TestRecordMiddleware: - Updated Recorder.Record to clone Request and Response objects (including bodies) before background processing. - Ensures background workers can safely access data after the main request handler has finished. - Enabled synchronous recording in handler tests to ensure deterministic results and avoid race conditions.	2026-02-15 21:51:55 +01:00
Tobias Gesellchen	d4b518da23	Fix proxy and recorder tests by ensuring synchronous recording during testing This commit addresses the test failures in pkg/service/proxy: - Ensures synchronous recording in tests by setting RECORDER_ASYNC=false. - Adds a Close() method to the Recorder for proper cleanup. - Fixes a panic in TestRecorder_Record_Redaction caused by race conditions.	2026-02-15 21:51:55 +01:00
Tobias Gesellchen	89bafd97b6	Optimize recording performance and add Soundcork proxy toggle This commit introduces several key improvements: Performance Optimization (asynchronous recording), Legacy Proxy Control (Soundcork proxy toggle), X-Forwarded-For Sanitization, consistent Soundcork naming across the stack, and various code quality improvements.	2026-02-15 21:51:55 +01:00
Tobias Gesellchen	d616bc09fd	fix unbound variable (tmp)	2026-02-15 20:48:26 +01:00
Tobias Gesellchen	8af60c7e4b	fix linter issues	2026-02-15 20:20:47 +01:00
Tobias Gesellchen	8a21db3517	Capture additional redirect methods and improve recorder functionality	2026-02-15 20:20:47 +01:00
Tobias Gesellchen	742484568e	feat: implement Stockholm-related cloud API emulation - Added handlers for Stockholm app events (/v1/stapp, /v1/scmudc) - Implemented account profile, password management, and device settings endpoints - Added Go models for new API responses and requests - Created docs/reference/CLOUD-API.md and updated SUMMARY.md - Added comprehensive unit tests for all new handlers - Updated ueberboese-api.yaml with new endpoints and schemas	2026-02-15 20:20:47 +01:00
Tobias Gesellchen	ed2d8680e4	fix: align streaming_token with Bose protocol to avoid 502 errors	2026-02-15 18:58:35 +01:00
Tobias Gesellchen	6dc8c23f04	feat: detect migrated devices and prompt for reboot after migration	2026-02-15 18:58:35 +01:00
Tobias Gesellchen	fa57ee9574	Rebrand to AfterTouch and cleanup SoundCork references	2026-02-15 18:09:49 +01:00
Tobias Gesellchen	e438db05d9	Fix release workflow to avoid +dirty version suffix by building in isolated directory	2026-02-15 17:27:41 +01:00
Tobias Gesellchen	8c02a009dc	Update documentation for interaction session management	2026-02-15 16:52:44 +01:00
Tobias Gesellchen	f20cfcb319	Enhance interaction session management and cleanup UI	2026-02-15 16:52:44 +01:00
Tobias Gesellchen	a453059d6d	Enhance interaction recording and analysis features	2026-02-15 16:52:44 +01:00
Tobias Gesellchen	505e6dd760	Refactor data storage to use account-based hierarchy and update Web UI	2026-02-15 15:36:01 +01:00
Tobias Gesellchen	735187cae8	docs: link README.md in SUMMARY.md to fix TestDocsConsistency	2026-02-15 00:50:29 +01:00
Tobias Gesellchen	e8622cc382	docs: add Jekyll build step to workflow	2026-02-15 00:38:04 +01:00
Tobias Gesellchen	c59052bdb4	docs: improve Jekyll configuration with minimal theme and relative links plugin	2026-02-15 00:35:32 +01:00
Tobias Gesellchen	15a6c4b0a0	docs: add Jekyll configuration with Cayman theme	2026-02-15 00:35:19 +01:00
Tobias Gesellchen	ae3a3765db	docs: add landing page for GitHub Pages	2026-02-15 00:32:32 +01:00
Tobias Gesellchen	59019cf55c	docs: deploy documentation to GitHub Pages and update links in Web UI and README	2026-02-15 00:30:28 +01:00
Tobias Gesellchen	5e612e57ec	Fix golangci-lint issues in main.go	2026-02-15 00:27:25 +01:00
Tobias Gesellchen	02026a9f3a	Add configurable shortcuts and log them on startup	2026-02-15 00:27:25 +01:00
Tobias Gesellchen	aaf067088a	Auto-create missing configuration files with default values	2026-02-15 00:27:25 +01:00
Tobias Gesellchen	358ea18138	Implement device merging logic and web-based device removal	2026-02-15 00:15:09 +01:00
Tobias Gesellchen	0c5c1803a5	docs: fix broken documentation links across multiple files	2026-02-14 23:03:53 +01:00
Tobias Gesellchen	cdf80a793e	docs: fix broken documentation links across multiple files	2026-02-14 23:03:53 +01:00
Tobias Gesellchen	b511e052e2	docs: fix broken documentation links and update CI workflow paths	2026-02-14 23:03:53 +01:00
Tobias Gesellchen	b7197a8679	Add version visibility and discovery controls to Web UI and API	2026-02-14 23:03:53 +01:00
Tobias Gesellchen	5bfc24b7fb	Use v0.18.1 version as default	2026-02-14 22:21:43 +01:00
Tobias Gesellchen	1e61adbb46	Integrate self-update logic into Raspberry Pi installer and simplify update workflow	2026-02-14 22:21:43 +01:00
Tobias Gesellchen	b8ab4b5723	Enhance Raspberry Pi installer and modernize systemd deployment documentation	2026-02-14 21:53:24 +01:00
Tobias Gesellchen	5da7e001b2	Add a Systemd install script	2026-02-14 21:53:24 +01:00
Tobias Gesellchen	5269c05e56	Enhance settings management with persistence and explicit saving, including SAN updates and unit tests	2026-02-14 21:50:36 +01:00
Tobias Gesellchen	d7a15c4dbe	Minor cleanup and formatting fixes in docs handler and setup manager	2026-02-14 18:26:52 +01:00
Tobias Gesellchen	701889076d	Refactor documentation structure, add SUMMARY.md sidebar, and automated consistency checks	2026-02-14 18:26:52 +01:00
Tobias Gesellchen	3acc983183	Cleanup the web ui/flow	2026-02-14 18:26:52 +01:00
Tobias Gesellchen	7d40c61cad	Fix variable shadowing in setup methods Renamed shadowed 'err' and 'out' variables in MigrateSpeaker and TrustCACert to comply with linting rules.	2026-02-14 14:24:46 +01:00
Tobias Gesellchen	93cfd9dbbc	Implement safe migration revert with backup validation - Added strict guardrails for RevertMigration: now fails if .original backup is missing. - Revert now uses copy (cp) instead of move (mv) to preserve original backups on the device. - Decoupled reboot from migration/revert processes, making it a manual operation. - Added standalone Reboot API and manual 'Reboot Speaker' button in the Web UI. - Separated 'Remove Remote Services' from the revert process to allow independent management. - Implemented command output capture and display in the Web UI for all setup actions (Migrate, Revert, Trust CA, Backup, Reboot, Remove Remote Services). - Updated doc.go with a modern overview of the library and SoundTouch service features. - Fixed several tests to align with new method signatures and behavior changes.	2026-02-14 14:24:46 +01:00
Tobias Gesellchen	e084f8db1f	Enhance Docker configuration for Swarm and consolidate environment templates	2026-02-14 13:09:52 +01:00
Tobias Gesellchen	a19d34b55e	Align soundtouch-service CLI with soundtouch-cli	2026-02-14 12:55:14 +01:00