Loki Studio v1.3.0

← All updates

Your stored credentials

• YouTube tokens, LLM API keys and the OAuth client secret are now encrypted with Windows DPAPI, which ties the key to your Windows user account. A copy of those files taken to another machine can't be decrypted there, and the stored blobs are tamper-evident.
• Nothing to re-do. Data written by the previous version is still read normally and quietly re-encrypted with the new scheme the next time it's saved. You don't need to sign in again or re-enter your keys.
• One caveat, and it's the point of the change: because the key is tied to your Windows account, copying your Loki settings folder to a different machine or a different Windows user won't carry your saved logins with it. You'd add the channel again there.

YouTube sign-in

• Adding a channel now sends a random state value and verifies it on the way back, and uses PKCE (RFC 7636). Together these close a theoretical window where another web page open during sign-in could interfere with the exchange.
• The callback rejects any response whose state doesn't match the request that started it.

What was going into the logs

• Removed the verbose request logging that wrote full LLM prompts and transcript content into your local log file at DEBUG level.
• The resumable-upload session token is stripped from upload log lines.
• Error text coming back from an upstream service is length-capped and scrubbed of anything shaped like a key before it's shown to you.
• Assorted crypto hygiene: malformed padding is rejected rather than tolerated, and the upload initiation request has a consistent redirect policy.

The upload bug behind "it said it uploaded"

If your videos share a name prefix - "Episode 1", "Episode 10", "Episode 11" - uploading one of them could sweep the others into done/ without uploading them.

• A video's companion files were matched by prefix with no name boundary, so "Episode 1" also captured "Episode 10" and everything past it.
• This is the actual cause of the "uploaded but never showed up on the channel" reports. The ghost-drop verification added in 1.2.1 was catching some of it after the fact; this fixes it at the source.

Reliability

• "No Tags" and "Top Summary" on the Metadata tab persist across restarts. They were never being written to the profile file, so they reverted every launch.
• Fixed two crashes from dividing by zero on a 0-byte video file, during upload progress and thumbnail progress. Empty files are now rejected up front with a message that says so.
• A failed tag-generation step no longer throws away an otherwise finished video. It ships with the title, description and chapters it already has.
• Fixed a "generation failed" dialog that appeared even when metadata had succeeded through the automatic English-fallback path.
• A blank or refused response from OpenAI is treated as an error so the retry kicks in, instead of silently writing empty metadata.
• "Improve" on the Metadata tab can't apply its result to the wrong video any more if you click a different one before it finishes. The result is discarded with a note.
• Upload batches no longer hang when a playlist lookup fails or matches nothing - they carry on without a playlist.
• Transcription batches no longer stall on an unexpected worker result.
• Fixed a leak where every processed job stayed in memory for the whole session.

Cleanup

• About 10,000 lines of dead code removed - the retired Localize tab, superseded transcription-engine wrappers, unused helpers, and backup files from before the QML migration. No behavior change; there's just less of it to get wrong next time.

← Newer: v1.3.1·Older: v1.2.2 →·All releases