Uoink v3.7.0

A hardening and polish release. The Library and Sources surfaces got quieter and easier to scan, video extraction picked up current site fixes, and a focused security pass tightened every place Uoink accepts a URL or hands one to another product in the suite.

Install

Download Uoink-Setup-3.7.0.exe below and run it. Windows 10/11.

The installer is unsigned, so SmartScreen may warn — choose More info → Run anyway. There is no macOS build; see docs/mac-install.md for the honest status.

For Claude Desktop, also grab uoink-3.7.0.mcpb and drag it into Settings → Extensions. Install the helper first — the bundle connects to it.

Verify what you downloaded

Since the installer is unsigned, check it against these before running it:

Uoink-Setup-3.7.0.exe   338,746,647 bytes
  SHA256  7671AD4D57F0F7D558543EFF5EA164A34071CF1F152307F6DCC9C3069C177592

uoink-3.7.0.mcpb             38,978 bytes
  SHA256  6C91064D2D0177C72847D836EAD44382947A5C71EA12DC3A6BFD524F8F14D26E

PowerShell: Get-FileHash .\Uoink-Setup-3.7.0.exe -Algorithm SHA256

This build is reproducible. Its entire dependency graph is pinned to 142 exact versions, and its input timestamps are bound to the source commit, so rebuilding from the same commit produces the same bytes — verified by building it twice and comparing.

Changed

• Refreshed video extraction. Bundled yt-dlp moved from 2026.03.17 to 2026.07.04, picking up current Instagram and YouTube extractor fixes.
• Quieter Library health. Healthy cards no longer carry five status dots. A card shows a labeled "Still working" or "Needs attention" exception only when extraction has unfinished or missing sections.
• Capture-ready Sources first. The Sources page leads with source types Uoink can save today. Planned integrations sit in a collapsed reference list instead of getting equal card weight.
• One clear detail action. A saved uoink keeps "Write from this" primary and moves folder, transcript, retry, transcription, and evidence controls into a More actions menu.
• Reading stays primary on Library cards. "Write from this" is a compact secondary action instead of filling the card width.
• A shorter Library filter row. Search, source, author, topic, and sort stay visible. Video-analysis and date controls moved behind Filters, and every applied filter shows as a removable chip.
• The stdio MCP surface is exactly 14 canonical tools. The six deprecated yoink_* aliases reached their announced v3 removal point and are no longer listed or accepted. Use the corresponding uoink_* names.

Fixed

• OpenAPI calls enforce their published input schemas. Missing required fields, unknown fields, wrong types, and out-of-range values return HTTP 400 before a tool runs. Human-readable errors now say "uoink"; the legacy response keys yoinks and yoinked_at are unchanged for compatibility.
• Engagement from Writer and Zing ages correctly. Their RFC 3339 UTC timestamps follow the same 30-day half-life as Uoink's native engagement events instead of staying at full weight forever.
• Cross-product source links enforce the suite contract. Corpus and kept-media responses reject file URLs, filesystem paths, and non-HTTP schemes instead of passing them to Writer or Zing.
• Capture URLs are checked against their real authority. Generic page, article, and podcast-feed captures reject malformed or ambiguous URL authorities instead of trusting the string they were handed — closing a class of requests that could point a capture somewhere other than where it looked.
• Peer UI paths must be same-origin. Writer UI paths offered by a peer are rejected when they cross origin, so a misconfigured or hostile peer cannot steer Uoink's UI at another host.
• MCP slug handling no longer accepts traversal. Corpus slugs that try to escape their directory are refused at the boundary.
• The health surface stops over-sharing. Public health output and the docs describing it now agree, and the response no longer discloses more about the local environment than the endpoint is meant to expose.
• MCP clients can see what they're talking to. The stdio server reports the Uoink version in its initialize response.
• Setup points at the published installer. The extension's setup page resolves the installer version that actually exists publicly, separated from the in-repo source version, so it can never link at a draft or missing asset.

Documentation

• macOS status is stated honestly. The fictional macOS install guide and the imaginary macOS security posture are gone. mac-install.md records the real status — there is no working macOS build or .dmg — and MAC-BUILD-PLAN.md records the verified gaps and remaining work.

Full changelog: v3.4.0...v3.7.0