# Software Bill of Materials (SBOM)

**Product:** MBXHub Shell
**Version:** 0.5.4.5
**Generated:** 2026-05-30
**Last updated:** 2026-07-29
**Supplier:** Halrad LLC

---

## Summary

| Category | Count |
|----------|-------|
| Project Assemblies | 3 |
| NuGet Packages (Runtime) | 0 |
| First-party Libraries | 4 |
| .NET Runtime | 1 |

---

## Project Structure

MBXHub Shell is a framework-dependent .NET 8.0 WinExe published as a single-file EXE.
Managed assemblies (MBXHub.dll, MBXC.dll, MBXR.dll, Firebug.dll, SsdpCore.dll) are embedded in the EXE.

| File | Type | Description |
|------|------|-------------|
| **MBXHub.exe** | Single-file EXE | Shell entry point + all managed assemblies + runtime config embedded |
| SBOM-MBXHub.exe.md | Documentation | This file |

### Embedded Assemblies

```
MBXHub.exe (single-file)
├── MBXHub.dll (application logic, embedded)
│   ├── MBXC.dll (first-party, embedded)
│   ├── MBXR.dll (first-party, embedded)
│   ├── SsdpCore.dll (first-party, embedded)
│   └── Firebug.dll (first-party, embedded)
└── .NET 8.0 Desktop Runtime (framework-dependent)
```

---

## First-party Libraries

### MBXC

| Attribute | Value |
|-----------|-------|
| **Component** | MBXC |
| **Author** | Halrad LLC |
| **Version** | 0.1.0 |
| **Usage** | Path normalization, settings-schema reflection, and the plugin↔Shell notify contract (`NotifyPayload`) |
| **Description** | Shared multi-targeted (net48;net8.0) library. The Shell uses its **net8.0** facet, where System.Text.Json is in-box (no NuGet package). Provides path handling, `ConfigSettingAttribute` schema reflection, OOBE helpers (firewall-arg + LAN-URL builders, ping-identity, port ladder), and the `NotifyPayload` DTO consumed by the `POST /meta/notify` route. |

### MBXR

| Attribute | Value |
|-----------|-------|
| **Component** | MBXR |
| **Author** | Halrad LLC |
| **Version** | 0.1.0 |
| **Usage** | RemoteApp registry configuration, RDP file generation |
| **Description** | Windows RemoteApp setup for publishing MusicBee via RDP |

### SsdpCore

| Attribute | Value |
|-----------|-------|
| **Component** | SsdpCore |
| **Author** | Halrad LLC |
| **Version** | 0.5.0.1 |
| **Usage** | Local-network MBXHub endpoint discovery for the tray "Retarget SMTC" submenu |
| **Description** | SSDP / WS-Discovery / mDNS-DNS-SD library. SsdpCore implements the discovery **wire protocols on UDP multicast** via its own `UdpClient` — it does not use `System.Net.Http`. The single overlap with HTTP: SSDP `M-SEARCH` responses carry a `LOCATION` URL pointing at the responder's HTTP description endpoint; the consumer (Shell here) follows that URL with a plain `HttpClient.GetAsync` to fetch peer description / version. Everything past that point is plain REST against the peer's MBXHub plugin. |

### Firebug

| Attribute | Value |
|-----------|-------|
| **Component** | Firebug |
| **Author** | Halrad LLC |
| **Version** | 0.5.0.1 |
| **Usage** | Windows Firewall and URL ACL configuration (`MBXHub.exe firewall` subcommand) |
| **Description** | Library for programmatic Windows Firewall rule management via netsh |

---

## NuGet Package Dependencies

None at runtime. JSON serialization (including the shared `NotifyPayload` DTO) uses `System.Text.Json` from the .NET 8.0 runtime — in-box, no package; SMTC interop is hand-crafted COM.

---

## .NET Runtime

Target framework: **net8.0-windows**

| Requirement | Detail |
|-------------|--------|
| Runtime | .NET 8.0 Desktop Runtime |
| Deployment | Framework-dependent (runtime must be installed) |
| Platform | Windows x64 |
| WinForms | Required (system tray host + hidden SMTC bridge form + toast notifications) |

---

## Native Interop

MBXHub Shell uses P/Invoke for Windows media transport controls:

| DLL | Purpose |
|-----|---------|
| api-ms-win-media-smtc-l1-1-0.dll | System Media Transport Controls (SMTC) |

**Note:** Hand-crafted COM interop for SMTC. No WinRT projection or Windows SDK dependency. No native binaries bundled.

---

## Proprietary Components

The following components are proprietary Halrad LLC code:

| Component | Files | Description |
|-----------|-------|-------------|
| MBXHub.Shell | `MBXHub.exe` (embedded: MBXHub.dll) | SMTC bridge, system tray, Windows app identity (AUMID), auto-reconnect, firewall CLI, RemoteApp CLI, minimal SMTC HTTP listener (SMTC port = REST port + 1) with CORS for browser-side `/meta/smtc/*` calls plus a `POST /meta/notify` route for plugin-pushed port-conflict warnings |
| MBXC | Embedded in `MBXHub.exe` | Path normalization and comparison |
| MBXR | Embedded in `MBXHub.exe` | RemoteApp configuration |

---

## License Summary

| License | Components |
|---------|------------|
| **Microsoft EULA** | .NET 8.0 Desktop Runtime |
| **Halrad LLC (proprietary)** | MBXHub.Shell, MBXC, MBXR, SsdpCore, Firebug |

**Note on SsdpCore and Firebug.** Both are first-party Halrad LLC libraries (sourced from the `fireants` repo). OSS publication was considered but they have never been released under an OSS license, so they're proprietary Halrad code for licensing purposes — same posture as MBXC/MBXR.

---

## Dependency Graph

```
MBXHub.exe (single-file, all managed assemblies embedded)
├── MBXHub Plugin REST/WS API (talks to mb_MBXHub.dll via REST + WebSocket — Shell is a client of the plugin)
├── MBXHub.dll (Halrad LLC, embedded)
│   ├── MBXC.dll (first-party, embedded)
│   ├── MBXR.dll (first-party, embedded)
│   ├── SsdpCore.dll (first-party, embedded — SSDP/WS-Discovery/mDNS for "Retarget SMTC" peer discovery)
│   └── Firebug.dll (Halrad LLC, first-party, embedded)
└── .NET 8.0 Desktop Runtime (Microsoft)
    └── Windows Desktop (WinForms)
```

---

## Features

- Windows app identity (AUMID: `HALRAD.MBXHub`)
- System Media Transport Controls (SMTC) integration — taskbar overlay, lock screen, Bluetooth AVRCP
- Auto-reconnect to MBXHub plugin with state machine (subscribes to plugin's WS for now-playing/play-state events)
- Artwork streaming to Windows media overlay
- Minimal SMTC HTTP listener on `smtc.port` (derived as the plugin's REST port + 1 on `--port` launch) — serves the four `/meta/smtc/*` routes (`GET/PUT /meta/smtc/target`, `GET /meta/smtc/endpoints`, `POST /meta/smtc/endpoints/refresh`) plus `POST /meta/notify` (plugin-pushed port-conflict warnings surfaced as a toast), with CORS + OPTIONS preflight so any cross-origin browser client can call the Shell directly
- Windows Firewall configuration CLI (`MBXHub.exe firewall`)
- Windows RemoteApp configuration CLI (`MBXHub.exe remoteapp`)
- UI-mode dispatcher — no-args launch puts MBXHub in a system tray (GUI); subcommands route to CMD with parent-console stdout; `-cli`/`--cli` runs the bridge with a console attached
- System tray menu — Open MusicBee, Show Status, Reconnect, Settings, Retarget SMTC submenu (lists discovered MBXHub endpoints), Enable/Disable SMTC toggle (writes `smtc.enabled` to `mbxhub-shell.json`), Start with Windows (checkable, round-trips with Windows Settings > Apps > Startup via the StartupApproved shadow byte), Quit
- Toast notifications — DPI-aware layout (every pixel constant scaled by `g.DpiY / 96f` so multi-line content renders correctly at 150-250% scaling)
- Auto-launch MusicBee on GUI startup — clicking `MBXHub.exe` from the Start menu launches MusicBee if not running, focuses the existing window if it is. The launch + registry checks happen off the UI thread (`Task.Run`) so the tray message pump stays responsive.
- Store-installed MusicBee activation — derives the Package Family Name from the AppX folder and launches via `explorer.exe shell:appsFolder\<PFN>!App`
- Operator opt-outs (`tray.*`): `disableTrayIcon`, `disableAutoLaunchMusicBee`, `disableBalloon`, `disableMusicBeeFocusOnOpen`

---

## Architecture Note

The Shell is a client of the plugin's REST/WebSocket surface — anything that speaks the same protocol could do what the Shell does (translate now-playing to Windows SMTC). The plugin doesn't reach into Shell config; SMTC enable/disable, throttle, and target selection all live in `mbxhub-shell.json` and are managed via the Shell's tray menu and `/meta/smtc/*` routes.

---

## Vulnerability Tracking

For security vulnerability information:

- **.NET 8.0:** Check https://msrc.microsoft.com/update-guide

---

## Contact

For licensing questions or SBOM inquiries:

**Email:** mbxhub@halrad.com
**Web:** https://mbxhub.com/
