diff --git a/app.js b/app.js
index 820c635..bbb677a 100644
--- a/app.js
+++ b/app.js
@@ -125,6 +125,22 @@ window.addEventListener('load',()=>{
   // Now Playing: click player-art to open
   const pa=document.getElementById('player-art');
   if(pa)pa.addEventListener('click', openNowPlaying);
+  // Swipe-up on player bar to open Now Playing
+  const playerBar=document.querySelector('.player');
+  if(playerBar){
+    let _sy=0,_st=0;
+    playerBar.addEventListener('touchstart',e=>{
+      if(e.target.closest('button')||e.target.closest('.progress-bar')||e.target.closest('.volume-wrap'))return;
+      _sy=e.touches[0].clientY;_st=Date.now();
+    },{passive:true});
+    playerBar.addEventListener('touchend',e=>{
+      if(!_sy)return;
+      const dy=_sy-e.changedTouches[0].clientY;
+      const dt=Date.now()-_st;
+      if(dy>40||(dt<300&&dy>15))openNowPlaying();
+      _sy=0;
+    },{passive:true});
+  }
 });
 
 async function startApp(){
diff --git a/backend/novasonic-server.js b/backend/novasonic-server.js
index 26bac90..803a17f 100644
--- a/backend/novasonic-server.js
+++ b/backend/novasonic-server.js
@@ -15,7 +15,6 @@
  */
 
 const express = require('express');
-const cors    = require('cors');
 const { spawn, execSync } = require('child_process');
 const path    = require('path');
 const fs      = require('fs');
@@ -33,7 +32,14 @@ const CONFIG = {
 
 // ─── INIT ─────────────────────────────────────────────────────────────────────
 const app = express();
-app.use(cors());
+app.use((req,res,next)=>{
+  res.setHeader('Access-Control-Allow-Origin','*');
+  res.setHeader('Access-Control-Allow-Methods','GET,POST,OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers','Content-Type,Authorization');
+  res.setHeader('Access-Control-Allow-Private-Network','true');
+  if(req.method==='OPTIONS'){res.sendStatus(204);return;}
+  next();
+});
 app.use(express.json());
 
 // In-memory job store
diff --git a/sw.js b/sw.js
index 3ffb357..deedf0f 100644
--- a/sw.js
+++ b/sw.js
@@ -1,4 +1,4 @@
-const CACHE = 'ns-v19';
+const CACHE = 'ns-v20';
 const PRECACHE = ['/', 'index.html', 'styles.css', 'app.js', 'sw.js', 'manifest.json', 'icon.svg'];
 const SKIP_URLS = ['/rest/stream', '/rest/download', '/config.js'];