v0.4.0

**Highlights**

- Audiobooks, end to end — a real **Stop** with live per-chapter progress, a **multi-voice cast**, expressive controls, a markup toolbar, live stats, and a one-click sample
- Pick a designed voice from the **Gallery** anywhere you choose a voice — audiobook, Stories, and Dubbing
- Dub **Paste Translation** — drop in a translation or `.srt` and it maps straight onto your segments, timings intact
- Downloading a finished audiobook no longer hijacks the app — it just saves
- First run is ~2.4 GB, not ~5 GB — only the TTS model is required; ASR picks are curated per platform
- Guided mic + Accessibility permissions with Open Settings deep-links; **Parakeet TDT v3** on Apple Silicon
- Opens in your system language, with a one-tap switch back to English
- Security: server-mode admin routes can't be reached by a trusted-network client without the API key
- A render error shows a recoverable card instead of a blank window; queued and long generations stop failing with a bogus "too heavy for your hardware"

### Changed

- Settings → Models: grouped catalog (TTS / ASR / Dictation / Diarisation), "recommended for this machine" chips, incompatible models collapsed behind a toggle
- Only the TTS model (~2.4 GB) is required on first run; ASR picks are curated per platform via `curated_on` in `models.yaml` (MLX on Apple Silicon, CT2+Turbo on CUDA, PyTorch on ROCm, int8 on CPU)
- Audiobook tab tidied up: the settings column is now grouped into compact collapsible sections (Output / Book details / Pronunciation / Markup), so script + voice + Create sit up top instead of a long scroll — same controls, denser layout (#1214)

### Removed

- The Dubbing per-segment picker's hardcoded design-presets group — superseded by the richer designed-voice Gallery; already-saved `preset:` picks still generate identically (#1220)

### Added

- Voice picker: the designed-voice **Gallery** is now selectable anywhere a voice is chosen — the audiobook default voice and each Cast row can pick a gallery archetype (searchable, favourites first), and it's materialised into a real profile on pick so it just works everywhere (#1219)
- The Stories editor and the Dubbing per-segment voice pickers now use the same gallery-enabled picker, so designed-voice archetypes are selectable there too; the dub picker drops its redundant hardcoded presets group in favour of the richer Gallery (existing picks unchanged) (#1220)
- Audiobook tab: a Cast panel maps each `[voice:NAME]` in the script to a profile so multi-voice renders correctly (it previously fell back to a single voice), plus a markup insert toolbar, live stats (chapters · words · est. runtime), and pre-flight validation for unknown voices and empty chapters (#1217)
- Audiobook tab: a **Stop** button that truly cancels a running generation (not just the UI) and live per-chapter progress — a bar, elapsed + ETA, and each chapter's status (rendering / done / cached / failed); finished chapters stay cached so Create again resumes. `Cmd/Ctrl+Enter` starts a render (#1216)
- Settings → Permissions + wizard System Check: live mic/Accessibility grant state, per-OS guidance, Open Settings deep-links; dictation pre-flights the mic grant (#1175)
- `parakeet-mlx` engine: Parakeet TDT v3 on Apple Silicon — 25 EU languages, word timestamps, ~2 GB, opt-in from Settings → Models, never auto-downloads (#1175)
- First-run downloads race the direct GitHub path against the mirror and use whichever answers fastest (#1179)
- First-run consent question for the existing opt-in analytics (two equal buttons, skip = no)
- First run: when the app auto-opens in a non-English system language, a one-time, dismissible banner offers to switch the UI to English — shown only until you pick a language, never for English systems (#1215)
- Source builds carry the publishable analytics token and get the same first-run consent ask as installers; opt-in events now note the install channel (installer / docker / source) — thanks agudmund! (#1193)
- Official Google Colab notebook (`notebooks/OmniVoice_Studio_Colab.ipynb`) — full app + API feature tour on a free T4
- ROCm Docker image `ghcr.io/debpalash/omnivoice-studio:rocm` (+ `:stable-rocm`, `:X.Y.Z-rocm`) (#1165)
- `OMNIVOICE_TRUSTED_NETWORKS` — comma-separated CIDRs exempted from the consumption auth gates (share PIN / API key / dictation WS); admin routes stay loopback-only (#1170)
- Info/warn system notifications are dismissible and stay dismissed across restarts; error-level notices can't be dismissed, and the unclean-shutdown notice is now acknowledged server-side — thanks agudmund! (#1192)
- `clone_voice` MCP tool — AI agents can clone a new voice from a base64 reference audio sample; returns a `profile_id` immediately usable with `generate_speech` — thanks paoloantinori! (#1194)
- Dub tab: **Paste Translation** — paste a translation made elsewhere (ChatGPT, DeepL, a human) as subtitles, numbered lines, or plain lines; it maps onto the existing segments with a before→after preview, keeping timings and the source transcript intact (#1203)
- Audiobook tab: **Production Overrides** (position/class temperature, steps, guidance, postprocess, seed) for expressive narration, plus IndexTTS2 emotion controls and a "vary repeated lines" toggle — defaults reproduce today's renders exactly (#1208)
- Audiobook tab: a **Load sample** button that fills the editor with a demo story — chapters, per-character `[voice:]`, `[pause]`, `[slow]`/`[fast]`/`[emphasis]`/`[spell]`, and reaction tags — so first-timers can hit Create and hear every capability before their real work (#1214)

### CI

- The quiet changelog style and 21-locale key/placeholder parity are now enforced by plain pytest checks; CodeRabbit/Greptile carry the house rules via `.coderabbit.yaml`/`greptile.json` (#1198)

### Docs

- `docs/expressive-speech.md`: per-engine breaths/laughter/emotion control, incl. the default engine's 13 native reaction tags
- Flush caches / Unload documented in the performance guide, incl. `POST /system/flush-memory` for scripts
- README FAQ: why a longer reference clip doesn't clone better (zero-shot 15 s cap; fine-tuning is the audiobook-grade path)
- `docs/expressive-speech.md` corrected so every recipe it names (breaths, temperature) is reachable in the surface it points to, including the Audiobook tab (#1208)
- New `docs/api-auth.md` — one place for authenticating the local API: share PIN, API key, dictation WebSocket, and trusted networks, with curl/SDK examples and what `401`/`403`/`429` mean (#1212)

### Fixed

- Downloading a finished audiobook (or story mix) no longer hijacks the app: in the desktop WebView a plain download link to the media file made WebKit navigate the whole window to it and play it fullscreen (then the blank-window guard misfired) — downloads now go through the native Save dialog + a server-side copy instead (#1218)
- The blank-window guard's fallback page is shown by injection rather than a `data:` URL the desktop WebViews refuse to navigate to, and its Reload button now returns to the app even if the window had navigated away (#1218)
- Security (server mode): the admin routes (`/system/*`, `/api/settings/*` — RCE-class) now require the API key or genuine loopback — with an API key set and `OMNIVOICE_TRUSTED_NETWORKS` configured, a trusted-network client could previously reach them with no credential; the short share PIN no longer gates admin either (#1213)
- A render error no longer blanks the whole window — a recoverable error card (Reload / Report) appears instead, and CI now builds the real production bundle so a pre-mount crash can't ship (#1209)
- Voice-clone trimmer: the preview now plays exactly the selected region on variable-bitrate clips (it had drifted off on VBR/mis-reported-duration files by playing the original file on a different timeline) (#1210)
- Screen readers now announce the hidden file-picker buttons (batch add, gallery import, stories import) (#1211)
- Audiobook language selection now reaches the backend — the client had dropped the `language` field, and the tab's Markup reference now lists the reaction tags (`[laughter]`, `[sigh]`, …) that already work there (#1208)
- A backend that fails to start now says why — exit code and error output, with actionable hints and a one-click report — instead of the evidence-free "Can't reach the local OmniVoice backend" (#1177)
- Generation no longer crawls on CPU after a cancelled or failed dub: the TTS model is moved back to the GPU on every exit path, and each generation now verifies its own placement (#1191)
- A generation queued behind a busy one no longer spends its timeout waiting: the budget starts when a GPU worker picks the job up, so a queued request can't be failed as "too heavy for the available compute" without having run (#1190)
- One request's timeout no longer cancels unrelated jobs already waiting in the GPU queue (#1190)
- Timeout messages stopped claiming capacity was restored automatically — the abandoned job keeps the device until it finishes, and the guidance now says to let it drain (#1190)
- The length-scaled generate budget now covers every path — streaming previews, batch dubbing, `/v1/audio/speech`, dub and archetype previews — instead of only the two classic call sites, so long inputs stop failing at a flat 300s (#1190)
- Provenance watermarking moved off the GPU worker pool: on 1-worker machines each embed was serializing ahead of the next generation (#1190)
- A batch segment that times out fails the job with a reason instead of shipping a finished-looking dub with silent gaps (#1190)
- `/v1/audio/speech` refuses work up front with 429 + `Retry-After` when the pool is saturated, and returns a retryable 503 rather than a 500 on timeout (#1190)
- Subtitle parsing no longer stalls on a blank-line-heavy `.srt`: the timing-line regex backtracked across newlines, so a mis-saved export could pin an import for hours (#1203)
- A broken ASR engine's fallback could silently auto-download multi-GB weights — every fallback now passes the same no-download preflight and shows the download CTA instead (#1189)
- Dub transcription releases the ASR model from VRAM on every exit — crashes, early errors, and client disconnects included (#1175)
- An invalid dictation model override could bypass the missing-model check for the Whisper fallback (#1175)
- The OpenAI-compatible transcription route's 409 now carries the same typed download-CTA payload as every other route (#1175)
- Cross-drive installs with a user-pinned `UV_CACHE_DIR` still keep uv's managed Python off the system drive (#1189)
- MCP `clone_voice` accepts data-URI base64, stores the clip under its real container extension, and returns backend validation errors as structured JSON (#1195)
- Sidecar launch errors no longer embed the user's home directory in logs or error messages (#1189)
- KittenTTS degrades gracefully if a future upstream update moves its text chunker (#1189)
- Restored 151 broken locale strings: mangled `{{placeholders}}` (vi/ar showed literal `_V_0__`) and gallery errors that dropped their detail in all 20 translations (#1198)
- Voice cloning no longer fails on quiet recordings — silence removal retries with gentler thresholds (then skips), and a truly silent clip gets a localized, actionable message instead of a dead-end 400 (#1188)
- Custom install folders on another drive are honored end-to-end — uv's wheel cache and Python download now follow the chosen environment folder instead of filling C: (#1186)
- Dubbing no longer fails outright when an ASR engine's dependencies are broken ("No module named 'lightning_fabric'") — the engine is marked unavailable with a repair hint and the next one is used automatically (#1185)
- `/v1/audio/speech` no longer 500s with a raw "Exec format error" when `bin/` holds a zero-byte GGUF placeholder — managed binaries are validated before exec and broken ones return an actionable 400/503 naming the repair (#1172)
- KittenTTS no longer aborts with "invalid expand shape" on digit-heavy input and no longer 500s on empty input — chunks are split to the ONNX 512-token cap and unspeakable text returns a clear 400 (#1173)
- Quitting the app while a model is still loading now shuts down clean — no "cannot schedule new futures" traceback, no crash-shaped exit or phantom crash record, and first-run/upgrade boots keep their backend log (#1174)
- Dictation falls back to the main ASR engine when a model transcribes real speech to nothing (sherpa NeMo-TDT decoder defect, upstream k2-fsa/sherpa-onnx#3767), remembers the demotion, and names the model that failed (#1175)
- A failed dictation session with no transcript clears the floating pill instead of parking it on screen forever (#1175)
- A TTS-only first run gets a one-click ASR download prompt instead of a silent 1.6–3 GB Whisper pull (dub, batch, dictation, clone-ref, `/v1` STT, boot warm-up) (#1175)
- App boot makes no Hugging Face calls and never silently downloads the TTS model — warm-up is local-cache-only (#1175)
- Quitting with a batch dub in flight no longer hangs shutdown (#1175)
- Dubbing's vocal-separation step no longer crashes on Windows dev runs (`SelectorEventLoop` sync-pipe fallback) (#1184)
- Closing the app while the model is loading is logged as a shutdown, not a phantom "Model loading failed" crash (#1183)
- The backend-crash banner sits below the navbar and stays clickable (#1182)
- Windows source builds: `bun desktop` no longer dies on a `UnicodeEncodeError` from piped status glyphs (#1181)
- The Windows app no longer boots to a black screen (production-minifier variable reorder in the splash; now gated by a real minified-bundle e2e) (#1178)
- No more storms of black console windows on Windows — every subprocess, incl. third-party spawns, runs windowless (#1178)
- `bun desktop` self-heals a stale terminal `PATH` without `~/.cargo/bin` and hints when Rust is genuinely missing (#1180)
- FunASR/SenseVoice: no more crash or speaker-identity swaps across 30 s chunks with inline diarization (#182)
- Provenance watermark now applied on every synthetic-audio route via one chokepoint (#1169)
- "Can't reach the local backend" reports unclean backend deaths with evidence in dev/Docker/LAN too (#1164)
- "Setup failed" screen renders instead of crashing — thanks bultodepapas! (#1159)
- Backend error logs keep stack traces (swept across 20 sites) — thanks bultodepapas! (#1160)
- Reference-clip uploads can't hang on a stuck audio probe (10 s timeout) — thanks bultodepapas! (#1162)
- Malformed EPUB chapters import partially instead of vanishing — thanks bultodepapas! (#1161)
- Failed sidebar fetches are logged instead of silently showing stale/empty lists — thanks bultodepapas! (#1158)
- A missing/broken `mcp` package degrades to "/mcp disabled" instead of killing the backend at startup (#1156)
- "Setup failed" auto-dismisses when the backend recovers; relaunching retries instead of refocusing a dead window (#1156)
- Ended the `forrtl: error (200)` mid-session Windows crashes (math-runtime console handler) (#1153)
- Non-Latin text can't crash synthesis on Windows (backend forced to UTF-8) (#1155)
- Video-export errors diagnose the real cause (Windows 32k command-line limit; big filter graphs go via a script file) with per-mode advice (#1152)
- Remote backends with an API key get an API-key prompt (durable per-browser, one-shot `#api_key=` link) instead of an unpassable PIN form — thanks paoloantinori! (#1154)
### macOS Apple Silicon artifacts

```
36aae1bf0b16772c6c4f8ff1be06c3368b5d28b4f424ba133e554d7a062ac76b  OmniVoice Studio_0.4.0_aarch64.dmg
1868ca47bf4a9659d2b36b658b96e7febdb8a419b2802b918752ae452066ddca  OmniVoice Studio.app.tar.gz
e157fcbf06af0c81847430bf76ff158cf64f39c23c240707df106ccf80657331  OmniVoice Studio.app.tar.gz.sig
```


### macOS Intel artifacts

```
e194dcdab30f913a08ff9487e96d5f550e50dc2c5917928768a896d3a494f799  OmniVoice Studio_0.4.0_x64.dmg
5272f36a7b657b1e6d68b51e379cd2332abb8274eb85db857716f199f74d91ec  OmniVoice Studio.app.tar.gz
b2e3e5e30fb2dd1bc1a1fb76f3cead0e55edfea755d9bc9b451f0f05484273ee  OmniVoice Studio.app.tar.gz.sig
```


### Windows x64 artifacts

```
0d7358c2ad48a6a84cbf18af89a3a33aa835fff211e82a96b54f5cbcdd85d729 *OmniVoice Studio_0.4.0_x64_en-US.msi
d67bf947f0fad7038b3a3d3e1eef1f9ba2fdcb48ca10aed84cd7f33d427da9de *OmniVoice Studio_0.4.0_x64_en-US.msi.sig
```





## Contributors

Thank you all 💜

<a href="https://github.com/debpalash" title="@debpalash"><img src="https://github.com/debpalash.png?size=64" width="48" alt="@debpalash"/></a> <a href="https://github.com/bultodepapas" title="@bultodepapas"><img src="https://github.com/bultodepapas.png?size=64" width="48" alt="@bultodepapas"/></a> <a href="https://github.com/paoloantinori" title="@paoloantinori"><img src="https://github.com/paoloantinori.png?size=64" width="48" alt="@paoloantinori"/></a> <a href="https://github.com/agudmund" title="@agudmund"><img src="https://github.com/agudmund.png?size=64" width="48" alt="@agudmund"/></a> <a href="https://github.com/LauraGPT" title="@LauraGPT"><img src="https://github.com/LauraGPT.png?size=64" width="48" alt="@LauraGPT"/></a>