v0.44.2

What's Changed

• chore(docs): make Linear the single source of truth for todos/bugs/roadmap by @tomaslau in #159
• feat: automate desktop release pipeline by @tomaslau in #160
• chore(deps): audited dependency refresh — safe batch + Next.js security patch by @tomaslau in #161
• chore(deps): update glimm, biome, and ultracite by @tomaslau in #162
• chore(release): prepare v0.44.2 by @tomaslau in #163
• fix(release): avoid false signature verification failures by @tomaslau in #164
• fix(release): use hdiutil-compatible temporary DMG path by @tomaslau in #165

Full Changelog: v0.44.1...v0.44.2

v0.44.1: direct-DMG download button + reliable bundle signing

Docs/marketing patch: the "Download for Mac" button now downloads the DMG directly, and the desktop sign script retries throttled codesign calls (PRs #154, #156, #157). No app-binary change from v0.44.0.

Highlights

• Direct DMG download (#154, #157): the marketing hero and bottom CTA now lead with a Download for Mac button linking straight to the notarized DMG via the stable, version-less OpenKlip-macos-arm64.dmg asset on the latest release (releases/latest/download/…, served as an attachment). The old "Get started" buttons were dropped now that download is the primary action. Every release must publish that version-less alias or the button 404s — docs/desktop-packaging-runbook.md now documents the required publish step.
• Reliable bundle signing (#156): scripts/sign-desktop-bundle.sh now retries throttled codesign calls (5 attempts, linear backoff, exit-code check) instead of silently shipping unsigned binaries. --timestamp hits Apple's timestamp server, which throttles the ~13-binary signing burst; this was the second half of the #153 sign-script bug. Takes effect on the next real DMG rebuild.
• App binary: unchanged from v0.44.0. This release re-attaches v0.44.0's DMG (versioned + version-less alias); no new signed/notarized build was produced.
• Verification: bun test --isolate (2743 tests: 2729 pass, 14 skip); 98 MCP tools; 54 capabilities; 46 registry actions; bun run typecheck and bun run check clean.

Known gaps

See TODO.md. Notably: the version-less DMG alias is not enforced by CI, so a future release that forgets it silently breaks the download button; still Apple-Silicon-only, no Intel/universal build; no published latest.json updater feed.

Full changelog: CHANGELOG.md

v0.44.0: signed & notarized macOS app, auto-update, disk compact, logging

The macOS app is signed, notarized, and downloadable, with in-app auto-update, project disk compaction, and Job Center polish (PRs #144-#153, CRAFT-6261/6262/6263/6264/6265/6266).

Highlights

• Signed, notarized, downloadable macOS app (CRAFT-6262, #147, #153): the app is now Developer ID-signed (Craftled, MB), Apple-notarized, and stapled, completing Stage C. scripts/sign-desktop-bundle.sh deep-signs every native binary bundled in node_modules (ffmpeg, ffprobe, onnxruntime, sharp, next-swc, esbuild, and more) since tauri build --deep never reaches them; a follow-up fix (#153) closed a stdin bug that had silently left 12 of 13 nested binaries unsigned on every real rebuild since #147. The DMG is downloadable from the Releases page, with a new Download & install docs page (CRAFT-6266, #149) covering install, first-run, data locations, and uninstall.
• In-app auto-update (CRAFT-6266, #151, #152): a Rust-driven updater checks a GitHub Releases latest.json feed on launch and prompts to download, install, and relaunch on a newer signed version. Dormant and best-effort by default: no published feed, offline, or a malformed manifest are all logged and ignored, never a crash or blocked launch. The production passphrase-protected signing key now backs the committed public key (#152).
• Project disk management (CRAFT-6265, #150): a new Compact action reclaims disk by deleting regenerable derived media (proxy, transcript, frames, moment index, audio analysis, exports) while keeping the edit itself, assets, and history; a paired Rebuild action re-runs ingest as a Job Center job to restore playback. Config → Project Disk section surfaces both, with a "needs rebuild" banner.
• Engine log file + crash retention (CRAFT-6266, #148): the bundled sidecar's stdout and stderr now tee to a rotating log file (~/Library/Logs/com.craftled.openklip/openklip-engine.log on macOS) with bounded crash-log retention, giving a Finder-launched app findable diagnostics with no telemetry.
• Job Center fixes (#144, #145): cam ingest jobs now report phase progress like take and whole-project ingest jobs (CRAFT-6263); Job Center's Open action on take/cam jobs now navigates to the parent project instead of a dead composite-slug route (CRAFT-6264).
• Reliable release build (CRAFT-6261, #146): the release macOS build now compiles non-sandboxed with a [profile.release.build-override] that keeps host build tools (proc-macro dylibs) plainly compiled, fixing intermittent E0463 proc-macro load failures that made the release build unreliable.
• Verification: bun test --isolate (2743 tests: 2729 pass, 14 skip); 98 MCP tools; 54 capabilities; 46 registry actions; bun run typecheck and bun run check clean.

Known gaps

See TODO.md for the current gaps and known issues. Notably: no Intel/x86_64 build is produced yet, only Apple Silicon; the in-app updater's install/relaunch path is compile-verified and structurally correct but not yet exercised end to end against a real published feed; project Compact does not check for an in-flight job on the same project before deleting derived media.

Full changelog: CHANGELOG.md

---

v0.43.0: macOS desktop app, production launcher, Job Center, security hardening

A macOS desktop app, a production launcher, durable and cancellable background jobs, and a batch of reliability/security hardening across ingest, uploads, saves, and the local trust boundary (PRs #121-#142, CRAFT-6175/6176/6177/6178/6179/6180/6181/6182/6183/6184/6185/6186/6187/6243/6253).

Highlights

• macOS desktop app (Tauri v2, CRAFT-6187, #135/#137/#138): a native shell against system WebKit spawns openklip serve as a self-contained Bun sidecar behind a splash screen, with the full runtime (.next, pruned node_modules, ffmpeg) bundled into the .app so it runs with no repo checkout, writable state relocated to Application Support, and a real quit that kills the whole sidecar process group instead of orphaning next start. The real OpenKlip icon replaces the placeholder. Signing/notarization scaffolding is ready; the actual Developer ID signing pass is human-only and not done yet (Stage C).
• Production launcher (CRAFT-6185, #133): openklip serve now runs a production next start build instead of next dev (no HMR/dev overlay in a shipped launch), resolving bundled assets against a distribution-relative appRoot() instead of a hardcoded checkout path. A follow-up (#140) lets serve/dev boot against a completely empty workspace instead of refusing to start, and surfaces engine startup failures on the desktop splash instead of hanging silently.
• Job Center: durable, cancellable, retryable background jobs (CRAFT-6183/6253, #132/#139/#141/#142): ingest and silences jobs now persist to disk and survive an app restart with an honest "interrupted" status instead of a lost 404. Jobs can be cancelled mid-run (including, as of #142, take and cam ingest jobs), retried exactly once, and cleaned up from a new Jobs tab in the Config sidebar, with live status badges and progress.
• Deterministic media acceptance gate (CRAFT-6186, #134): five reproducible ffmpeg-lavfi fixtures (1080p, 4K HEVC 10-bit, VFR, portrait, long-sparse) run through real ingest → cut → export → ffprobe structural verification in a new CI acceptance job, gating releases on deterministic facts rather than flaky perceptual thresholds.
• Security and reliability hardening: project.json writes are now atomic and crash-safe (CRAFT-6176, #121); serve/dev binds to loopback only with a trustGuard rejecting off-device mutation requests on all mutating routes (CRAFT-6175, #122); force re-ingest is transactional with an active-edit refusal instead of deleting the live project first (CRAFT-6181, #126); large asset uploads stream to disk instead of buffering in memory (CRAFT-6179, #127); the GUI can no longer silently overwrite a concurrent CLI/MCP overlay edit (CRAFT-6177, #129); a failed optimistic editor save now shows a persistent recovery banner with retry and reload-from-disk instead of silently dropping the edit (CRAFT-6182, #130); large CLI --json output (the ~92KB tool manifest) no longer truncates when piped (CRAFT-6180, #131); mobile Config access is restored and the mobile browser test now actually runs in CI (CRAFT-6178, #128); a required golden-path browser test now gates edit-to-verified-export end to end (CRAFT-6184, #125); CI no longer depends on live HuggingFace downloads for Whisper/CLIP (CRAFT-6243, #124).
• Marketing site + docs (#136): redesigned landing page and a new Fumadocs /docs surface so the nav Docs link resolves to real content.
• Verification: bun test --isolate (2710 tests: 2696 pass, 14 skip); 98 MCP tools; 54 capabilities; 46 registry actions; bun run typecheck and bun run check clean on every PR in this batch.

Known gaps

See TODO.md for the current gaps and known issues. Notably: desktop Stage C (Developer ID signing/notarization) is human-only and not done; Job Center clean-up removes only the job record, never the project directory; cam ingest jobs don't report phase progress yet.

Full changelog: CHANGELOG.md

---

v0.42.0.4: segment export b-roll, editor code-split, gzip history, install footprint

Export, editor bundle, history, and install footprint (PRs #115–#119).

Highlights

• Segment export + b-roll (CRAFT-6171, #116): sparse short cuts with b-roll (and music/stills) can use per-range seeking; only rich/json-render graphics force full-source decode.
• Editor code-splitting (CRAFT-6172, #115/#119): Paper shaders, map-motion, template previews, and media visualizers load on demand so the initial editor graph stays lighter.
• Gzipped history snapshots (CRAFT-6174, #117): revert snapshots write working/history/rev-<n>.json.gz; legacy plain .json still loads.
• Trimmed install footprint (CRAFT-6173, #118): platform @ffprobe-installer/ffprobe replaces multi-arch ffprobe-static; browser onnxruntime-web is a local stub so Transformers.js keeps onnxruntime-node only.
• Verification: bun test --isolate (2473 tests: 2467 pass, 6 skip); segment and install-footprint unit coverage from the feature PRs.

Known gaps

See TODO.md for the current gaps and known issues.

Full changelog: CHANGELOG.md

v0.42.0.3: live sync, deferred MCP, schema CLI, parallel ingest

Agent loop and ingest performance (PRs #107–#113).

Highlights

• Live sync (CRAFT-6167, #107): external CLI/MCP edits to project.json refresh the open editor via a 2s revision poll (and focus). External advances toast Edit updated; local save-drain reseeds stay silent.
• Deferred MCP surface (CRAFT-6169, #108/#109): connect pays schemas for a core edit-loop set plus tools_catalog / tools_load / tools_invoke (~74% smaller payload). Full surface with OPENKLIP_MCP_SURFACE=all (in-app agent default).
• Schema-driven CLI (CRAFT-6168, #112): registry Zod schemas drive flag and positional parsing for most mutations (including nested audio and export-set).
• Parallel ingest (CRAFT-6170, #113): after probe, proxy→frames→index runs in parallel with audio→Whisper; multi-take ingest parallels proxy ∥ audio.
• Verification: unit tests for live-sync, MCP surface, CLI flag parser, and parallel ingest orchestration.

Known gaps

See TODO.md for the current gaps and known issues.

Full changelog: CHANGELOG.md

v0.42.0.2: Grok Voice settings integration

Grok Voice settings integration (PR #104).

Highlights

• Settings → Integrations → Grok Voice: save, test, clear, and refresh an xAI API key alongside existing ElevenLabs and Reve rows.
• Local key storage: repo-local .openklip/integrations.json (mode 0600); masked preview only in the browser.
• Free validation: test uses GET /v1/tts/voices; refresh details lists built-in and custom voices plus key metadata.
• Verification: 21 integration tests (tests/integrations-config.test.ts, tests/integrations-route.test.ts).

Known gaps

Settings integrations store and validate keys only. No in-app TTS generation or edit-loop consumption yet. See TODO.md.

Full changelog: CHANGELOG.md

v0.42.0.1: multicam GUI parity and cleanup hardening

Multicam GUI parity and cleanup hardening (PR #101).

Highlights

• Multicam GUI parity: Config → Project Cameras ingests cams, edits offset/guardrails, locks manual shot spans, and shows the mix timeline in follow and auto modes (CLI/MCP parity unchanged).
• Cleanup hardening: chunked PCM silence analysis (120s chunks with seam overlap) and silences-job progress on the Remove silence card.
• Verification: bun run cam-devex-smoke, tests/cam-devex-smoke.test.ts, seam regression in tests/audio-analysis.test.ts; bun test --isolate (2360 tests: 2354 pass, 6 skip).

Known gaps

See TODO.md for the current gaps and known issues. Optional human review on real per-speaker multicam recordings remains deferred.

Full changelog: CHANGELOG.md

v0.42.0.0: multicam, moment search, and categorized cleanup

Highlights

• Contextual cam switch (multicam): ingest per-speaker cam files (openklip cam-add, up to 8 cams, speaker/wide roles, manual --offset), automatic speaker ID from per-track audio energy (no ML or cloud diarization), and mix down to a switched program with follow-speaker or LLM auto scene modes (openklip cam-mix), a synthetic wide shot when no physical wide cam exists, and locked manual overrides (openklip cam-override) that survive re-mix. CLI cam-add / cams / cam-set / cam-mix / cam-override; MCP cam_add / list_cams / cam_set / cam_mix / cam_override; GUI Config → Project Cameras section; templates/cam-mix/skill.md. Transcript words gain an optional speaker field (the attributed cam id) once a project has been through cam-mix.
• Moment search: text + scene: find moments in the source footage by transcript text or visual content. Ingest indexes sample frames with a local CLIP model into working/moment-index.json (lazy backfill on older projects, or openklip index); a fourth left-rail Search tab (Mod+Shift+F) shows text and scene results as thumbnail cards, click seeks, and dragging a card (or its hover Keep button) restores any cut words in that span. Same engine on openklip search <slug> "query" and the MCP moment_search tool.
• Categorized cleanup (Cutback parity): cleanup candidates now carry a category (hesitation, hedging, repeat, dead-air) via a new deterministic repeated-n-gram detector for immediate repeats and false starts; cleanup-config persists category toggles and thresholds to project.cuts.cleanup; cleanup-apply (CLI --apply-enabled) applies enabled categories at any risk plus all dead-air at the configured threshold. A dedicated Cleanup tab in the Config panel adds a real waveform silence card, per-category cards with bulk apply and undo, and an "AI false-start pass" through the subscription agent CLI.
• Verification: bun run typecheck, bun run check, bun test --isolate (2342 pass, 8 skip); 98 MCP tools; 54 capabilities; 46 registry actions; bun run multicam-acceptance.

Known gaps

See TODO.md for the current gaps and known issues. Multicam programmatic acceptance (tests/multicam-acceptance.test.ts) satisfies the v0.42 machinery gate; optional human review on real per-speaker recordings remains deferred.

Full changelog: see CHANGELOG.md

v0.41.1.3: simpler editor chrome, asset bin, Next dev fixes

Highlights

• Editor chrome follow-up: PR #83 simplified the transcript/editor surface, moved transcript search into a compact dialog trigger, added transcript minute markers, and kept the bottom timeline entry point close to the preview.
• Asset bin refresh: the Assets sidebar is now a compact searchable grid with media thumbnails, duration badges, audio waveform tiles, hover previews, type filters, upload, and quieter must-use / avoid / delete controls.
• Timeline drawer refresh: the timeline drawer uses smaller labels, compact toolbar controls, full-width lane backgrounds on very short projects, and simpler track colors that stay closer to the app's shadcn token system.
• Next dev fixes: ffmpeg-static / ffprobe-static resolve at runtime with createRequire, and the transcript diff renderer loads client-side so Turbopack no longer trips over hashed ffmpeg-static-* or shiki-* externals.
• Verification: bun run typecheck, targeted bun run check, full bun test (1901 pass, 3 skip), and browser checks for the local asset/timeline surfaces.

Known gaps

See TODO.md for the current gaps and known issues.

Full changelog: see CHANGELOG.md