Highlight: a reliability and architecture cleanup release, including live-tested fixes for OpenAI image inputs, podcast feed routing, and missing slide frames.
Fixes
- Slides: measure frame timestamps after the requested seek point, preventing later scenes from being assigned earlier timestamps and discarded as duplicates; regenerate older extraction caches with the corrected timing.
- Podcasts: route RSS and Atom feed URLs through content/transcript extraction instead of treating feed XML as a raw file, while preserving ordinary XML asset handling.
- Images: preserve image attachments in OpenAI Responses and Chat Completions requests, including streaming, instead of silently sending only the text prompt.
- Slides: stop direct-video response streams after download failures and remove downloaded temporary files if the media-cache handoff fails; preserve the original failure when cleanup also fails.
- Browser AI: give overlapping Prompt API requests separate sessions and destroy sessions that finish loading after cancellation, so a stale request cannot tear down its replacement.
- Slides: parse ordinary yt-dlp percentage lines correctly and remove partial download directories after process or output-inspection failures.
- Transcription: skip probing the local Whisper executable when no usable model is installed, avoiding unnecessary process startup and delays on cloud-only or unconfigured systems.
- Browser settings: retain a dismissed local-companion hint when saving other Options preferences.
- Browser chat: normalize partial or malformed saved usage metadata and unknown stop reasons when restoring assistant history.
- Slides: drain ignored subprocess output so a verbose media tool cannot stall on a full stdout pipe.
- Transcript cache: preserve embedded-caption and native YouTube media source metadata across cache hits instead of losing it to duplicated source lists.
- Browser media: support MP4 files carrying Annex B AVC/HEVC and clarify missing WebCodecs errors in insecure contexts with MediaBunny 1.55.3.
- FAL transcription: clear settled deadlines and stop local queue polling and retries after timeout (#392, thanks @vincent-peng).
- Content extraction: decode HTML entities once so deliberately escaped markup remains literal text (#394, thanks @devYRPauli).
- Content extraction: avoid splitting UTF-16 surrogate pairs when clipping to a character budget (#391, thanks @devYRPauli).
Security
- Pin patched nanoid transitives to fix GHSA-2v37-7h3g-55p8 while preserving the tested local image-size security fixes.
Dependencies and maintenance
- Consolidate model execution, provider metadata, request construction, retries, streaming, and token usage while preserving protocol-specific behavior and output-failure boundaries.
- Share asset conversion, podcast resolution, transcription, media download, slide extraction, and cache metadata ownership; remove duplicated pipelines and unused adapters.
- Simplify side-panel state, Options wiring, model discovery, pickers, component mounting, and shared styles without changing layouts or supported settings.
- Type-check the entire extension in the root gate and CI; centralize test streams and browser lifecycles while preserving isolated profiles and runtime-error checks.
- Repair browser-local speech validation with public audio and real decoding/inference; make Firefox smoke wait for installation and clean up its own runner and profile.
- Remove the abandoned Homebrew-tap writer, keep formula updates with Homebrew/core, and correct pnpm release commands.
- Refresh stabilized DOM, Markdown, browser media, image, protobuf, and pnpm dependencies; repair the Node 24 test container and preserve local security patches (#403, thanks @dependabot).
- Refresh Pi AI and Oxc while keeping Node typings aligned with the supported Node 24 runtime (#399, thanks @dependabot).
- Refresh the remaining runtime/test tooling and Bun builder, pin CI actions, and align Dependabot with pnpm's seven-day stabilization policy.
Packages and verification
- CLI 0.21.12 on npm · registry tarball
- Integrity:
sha512-V04DrA3WJuyL+P7Tn60PJbNnHhEF06PeiXnpgGQWH6oFLa6EkQfgM/YBmU/oi6xfiUprydYkZLRO9cgGJ01ujA==
- Integrity:
- Core 0.21.12 on npm · registry tarball
- Integrity:
sha512-PPVgMBuPsLgTJVBAJpUXyVp8yzuL8dCEiBACTHgh1Vn/wCJulZQlMkmgOkMv1jKGmIq1qiKYKguAxhN0kAbuuw==
- Integrity:
Both packages are published under latest. Registry tarball bytes and lockstep package metadata were verified; exact-version CLI help/version smoke passed with dependency install hooks disabled.
Source CI passed the Node 24 gate, Chrome E2E, and Firefox smoke. The full local gate passed 3,219 tests (43 skipped). Release CI builds the frozen tag, signs and notarizes the macOS binaries, independently verifies both native architectures without signing credentials, and publishes the exact verified archives with SHA256SUMS.