SongSpotlight: Show off songs on your profile

package.json

@@ -36,6 +36,7 @@
     },
     "dependencies": {
         "@intrnl/xxhash64": "^0.1.2",
+        "@song-spotlight/api": "^2.1.3",
         "@vap/core": "0.0.12",
         "@vap/shiki": "0.10.5",
         "fflate": "^0.8.2",

src/main/csp/index.ts

@@ -11,6 +11,7 @@ type PolicyMap = Record<string, string[]>;
 
 export const ConnectSrc = ["connect-src"];
 export const ImageSrc = [...ConnectSrc, "img-src"];
+export const MediaSrc = [...ImageSrc, "media-src"];
 export const CssSrc = ["style-src", "font-src"];
 export const ImageAndCssSrc = [...ImageSrc, ...CssSrc];
 export const ImageScriptsAndCssSrc = [...ImageAndCssSrc, "script-src", "worker-src"];
@@ -63,6 +64,12 @@ export const CspPolicies: PolicyMap = {
     "dearrow-thumb.ajay.app": ImageSrc, // Dearrow Thumbnail CDN
     "usrbg.is-hardly.online": ImageSrc, // USRBG API
     "icons.duckduckgo.com": ImageSrc, // DuckDuckGo Favicon API (Reverse Image Search)
+    "dc.songspotlight.nexpid.xyz": ConnectSrc, // Song Spotlight API
+    "*.scdn.co": MediaSrc, // Spotify cover art/audio preview CDN
+    "*.sndcdn.com": MediaSrc, // Soundcloud cover art/audio preview CDN
+    "*.mzstatic.com": ImageSrc, // Apple Music cover art CDN
+    "audio-ssl.itunes.apple.com": MediaSrc, // Apple Music audio preview CDN
+    "*.tidal.com": MediaSrc, // Tidal cover art/audio preview CDN
 };
 
 const findHeader = (headers: PolicyMap, headerName: Lowercase<string>) => {

src/plugins/songSpotlight.desktop/index.tsx

@@ -0,0 +1,85 @@
+/*
+ * Vencord, a Discord client mod
+ * Copyright (c) 2026 Vendicated and contributors
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+import "./style.css";
+
+import ErrorBoundary from "@components/ErrorBoundary";
+import { Devs } from "@utils/constants";
+import definePlugin from "@utils/types";
+
+import { useAuthorizationStore } from "./lib/stores/AuthorizationStore";
+import { useSongStore } from "./lib/stores/SongStore";
+import { Native } from "./service";
+import settings from "./settings";
+import ProfileSongs from "./ui/songs/ProfileSongs";
+import WidgetSongs from "./ui/songs/WidgetSongs";
+
+export default definePlugin({
+    name: "SongSpotlight",
+    description: "Show off songs on your profile",
+    authors: [Devs.nexpid],
+    settings,
+    patches: [
+        // Personal profile popout
+        {
+            find: '"UserProfileAccountPopout"',
+            replacement: {
+                match: /user:(\i),bio:.{0,60}}\)/,
+                replace: "$&,$self.renderProfileSongs({user:$1})",
+            },
+        },
+        // Message user popout
+        {
+            find: ".isProvisional?(",
+            replacement: {
+                match: /user:(\i),bio:.{0,60}}\)/,
+                replace: "$&,$self.renderProfileSongs({user:$1})",
+            },
+        },
+        // DM sidebar profile
+        {
+            find: ".SIDEBAR}),nicknameIcons:",
+            replacement: {
+                match: /{userId:(\i)\.id}\)}\).{0,100}]}\)(?=\]\}\))/,
+                replace: "$&,$self.renderProfileSongs({user:$1,isSideBar:true})",
+            },
+        },
+        // Full profile modal sections (lazy loaded)
+        {
+            find: ".MUTUAL_GUILDS})),",
+            replacement: {
+                match: /(\i).push\({text.{0,50}}\);/,
+                replace: '$&$1.push({text:"Song Spotlight",section:"SONG_SPOTLIGHT"});',
+            },
+        },
+        {
+            find: ".hasUnsavedChanges()&&",
+            replacement: {
+                match: /({user:(\i),.{0,80}return (\i===))/,
+                replace: '$1"SONG_SPOTLIGHT"?$self.renderWidgetSongs({user:$2}):$3',
+            },
+        },
+    ],
+
+    flux: {
+        CONNECTION_OPEN: () => {
+            useSongStore.getState().$refresh();
+        },
+    },
+    start() {
+        // the cache lives in native.ts so it persists between reloads and
+        // only gets cleared on full restart. we don't want that since
+        // audio preview URLs expire very fast, so we just clear it on
+        // plugin restart instead
+        Native.clearCache();
+
+        useSongStore.getState().$refresh();
+        useAuthorizationStore.persist.rehydrate();
+    },
+
+    renderProfileSongs: ErrorBoundary.wrap(ProfileSongs, { noop: true }),
+    renderWidgetSongs: ErrorBoundary.wrap(WidgetSongs, { noop: true }),
+});