Yap 0.5.1
Security + reliability release.
Security
- Pin SHA-256 for the Kokoro model and all 35 CMU ARCTIC starter voice clips; verify every download (and pre-existing files) before use. festvox serves no HTTPS, so the pinned digests make the transport untrusted. Bounded reads + atomic same-filesystem installs.
Fixes
- Repair Kokoro re-download: deleting then re-downloading the model now actually fetches it again.
- Dictation HUD no longer clips the top of a single-line transcript.
- Read guard: re-reading text in a window you haven't clicked into now warns instead of replaying the previous window's selection (press again to override).
Install: brew install --cask latent-variable/tap/yap (or grab the DMG + xattr -cr /Applications/Yap.app).