🎬 Local Video Tools v0.1.2 — Early Preview

Public-preview hardening release

This Early Preview release hardens Local Video Tools ahead of its public repository launch and includes a stable cross-platform regression suite.

Security and reliability

• Canonicalize input paths so symlinks cannot bypass the default LM Studio working-directory boundary.
• Reject symlinked path segments in attachment staging, output and background-job directories.
• Strictly validate restored job records and UUIDs before using them to build persistence paths.
• Serialize atomic job-record writes so stale progress updates cannot replace final job state.
• Refuse to overwrite existing output files, including output symlinks.

Developer experience

• Report processed and total duration in background-job status results.
• Ignore LM Studio development output, staged media, generated videos and job records.
• Use reproducible CI installs, lockfile-based caching and read-only workflow permissions.
• Add grouped minor/patch Dependabot updates while leaving major upgrades for explicit review.
• Document Node.js 22 as the minimum development runtime.
• Stabilize the persisted-job regression test across local and GitHub Actions environments.

Validation

• Clean npm ci installation
• TypeScript typecheck and build
• 10 passing tests, including path-boundary and persisted-job regression coverage
• 20 consecutive local regression runs
• Green GitHub Actions run on Node.js 22
• npm audit with zero known vulnerabilities

🎬 Local Video Tools v0.1.1 — Early Preview

Superseded by v0.1.2. v0.1.1 contains the runtime security fixes described below; v0.1.2 additionally stabilizes the persisted-job regression test across CI environments.

Security and reliability patch

• Canonical path checks prevent symlinks from bypassing the default working-directory boundary.
• Runtime attachment, output and job directories reject symlinked path segments.
• Restored job records and UUIDs are validated before persistence paths are built.
• Job records use serialized atomic writes.
• Existing video outputs and output symlinks are never overwritten.
• Background-job status includes processed and total duration.

🎬 Local Video Tools v0.1.0 — Early Preview

Superseded by v0.1.2. Use v0.1.2 or newer for canonical path checks, symlink-safe runtime directories, validated job records, no-overwrite output handling and the stable regression suite.

Original Early Preview

v0.1.0 established the first Local Video Tools preview with:

• video inspection through ffprobe;
• fast stream-copy and accurate background clipping;
• H.264 and HEVC conversion with optional resizing;
• VideoToolbox, NVENC and Quick Sync encoder detection;
• background progress, status and cancellation;
• LM Studio video attachment staging.

The release was validated with a real 3840×2160 HEVC/H.265 MOV workflow on Apple Silicon. It remains available for historical reference, but it should not be used instead of the v0.1.2 security and reliability release.