3dtours/KGStudio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add option to persist API keys on non-localhost (opt-in security feature)

Browse Source
This commit is contained in:
Xiaohan-Tian
2026-01-17 13:54:15 -08:00
parent 2a0d128d0f
commit e8b79efde7
5 changed files with 54 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/USER_GUIDE.md
+3 -3
View File
@@ -36,7 +36,7 @@ A lightweight, browser‑based DAW with an AI Agent "K.G.Studio Musician Assista
- K.G.Studio is fully client‑side. It connects to the network only to:
- Download instrument soundfonts from the configured CDN
- Communicate with your chosen LLM provider (OpenAI or OpenAI‑compatible)
- API keys are not persisted when running from a non‑local host (to reduce XSS risk). You’ll be prompted to re‑enter them on each start in that scenario.
- API keys are not persisted when running from a non‑local host (to reduce XSS risk). You'll be prompted to re‑enter them on each start in that scenario. To opt‑in to persistence on non‑local hosts, enable "Persist API Keys on Non-Localhost" in Settings > General (not recommended for shared/production environments).
- Important: While K.G.Studio does not collect your data, different LLM providers may have different data‑retention policies. Review the policy of the provider you select before use.
## 5. User Interface Tour
@@ -125,10 +125,10 @@ A lightweight, browser‑based DAW with an AI Agent "K.G.Studio Musician Assista
- If loading stalls, the overlay will time out; refresh to retry downloading.
## 13. Settings
- General: LLM provider (OpenAI or OpenAI‑compatible), API key, model, soundfont base URL.
- General: LLM provider (OpenAI or OpenAI‑compatible), API key, model, soundfont base URL, Persist API Keys on Non-Localhost.
- Behavior: chatbox default open at startup.
- Templates: custom instructions for the AI.
- Settings persist in IndexedDB (local); API keys are not persisted on non‑local hosts.
- Settings persist in IndexedDB (local); API keys are not persisted on non‑local hosts unless you opt‑in via the "Persist API Keys on Non-Localhost" setting (not recommended for shared/production environments).
## 14. AI Agent "K.G.Studio Musician Assistant"
- Open the chat (toolbar). Describe goals in natural language (e.g., “Can you help me write a 4‑bar chord progression for the melody?”).