Skip to content

v0.1.13

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Jul 18:04
v0.1.13
b9b4a29

更新日志

第三轮加固：审计触角伸到最后一块未覆盖的层——命令行前端、自更新器、安装脚本、部署与 CI——外加一轮双语 README 校对和真实浏览器的交互走查。所有发现（包括对抗复核对修复本身提出的 5 个反例）全部修复。1452 项后端 + 243 项前端测试全绿。

修复（供应链——发布管线的校验承诺现在端到端成立）

  • install.sh 在默认公开安装路径上其实什么都没校验：SHA256SUMS 校验块被一个只在私有下载路径才赋值的变量短路——CI 精心生成的校验清单从未被查阅,curl | bash 装进来的 wheel 完全未经验证。现在无论哪条路径都是:下载到本地 → 对发布清单验证 sha256 → 从验证过的本地文件安装;不匹配大声拒绝;清单缺失或机器上没有 sha 工具会得到诚实的 NOTE,绝不静默跳过;临时文件在所有退出路径上由 trap 清理。(53b9180)
  • lunamoth update 同样不校验：自更新过去直接把 wheel URL 交给安装器。现在同样下载 → 验证 → 本地安装,校验不匹配或清单无哈希一律拒绝;下载与安装共享同一个墙钟预算,不会撑爆桌面端的 RPC 上限。

修复（命令行 / 守护进程）

  • wheel 渠道下首次运行向导的角色菜单是空的：它扫描的是源码仓库的 cards/ 目录(只在 dev checkout 存在),而不是打进 wheel 的内置卡。所有八张内置角色卡现在在向导里可选。
  • 守护进程 PID 卫生：重启电脑后残留的 daemon.pid 可能让 start-all 静默跳过一个角色,或让 stop 向一个复用了该 PID 的无关进程组发信号。现在:存活检查附带身份验证(每个角色的守护进程 argv 携带 --session 标记,兄弟角色互不误认,升级前的无标记进程仍然识账);启动前以 O_EXCL 原子占位杜绝双重拉起;stop 不再误删正在启动中的占位。

修复（文档,中英同步）

  • 消息平台表修正为真实的五个平台(WeChat iLink / QQ / Telegram / Discord / Slack——移除了早已砍掉的 WeChatPadPro 行);首启流程按现状重写(选语言 + 描述角色,模型在设置里配,预设列表与代码一致);已删除的"愿望"概念替换为现行的 理想 → 任务 模型;卡片市场与 SillyTavern 导入从"未来计划"移入已上线;补充了生图、视觉资产管线、个人网站模块、聊天背景/立绘偏好的说明。

修复（UI）

  • 首次运行的欢迎层现在响应 Escape 关闭,与其他所有弹层一致。交互走查确认:建卡流程、脏改动守卫、生成失败的可见错误路径全部行为正确。

Changelog

The third hardening round: the audit reached the last uncovered layer — the CLI front end, the self-updater, the install script, deploy and CI — plus a bilingual README accuracy pass and an interactive real-browser walk. Every finding (including the five counter-findings the adversarial review raised against the fixes themselves) is resolved. 1452 backend + 243 frontend tests green.

Fixes (supply chain — the release pipeline's verification promise now holds end to end)

  • install.sh verified NOTHING on the default public path: the SHA256SUMS block was short-circuited by a variable only set on the authenticated download path — the manifest CI carefully publishes was never consulted, and a curl | bash install shipped an unverified wheel. Every path now downloads locally → verifies sha256 against the release manifest → installs from the verified file; a mismatch refuses loudly; a missing manifest or missing sha tool gets an honest NOTE, never a silent skip; temp files are trap-cleaned on every exit. (53b9180)
  • lunamoth update didn't verify either: self-update used to hand the wheel URL straight to the installer. It now downloads → verifies → installs locally, refuses on a mismatch or a hashless manifest, and shares one wall-clock budget across download + install so the desktop RPC ceiling holds.

Fixes (CLI / daemon)

  • The first-run wizard's character menu was empty on the wheel channel: it scanned the repo-root cards/ directory (which only exists in a dev checkout) instead of the bundled cards baked into the wheel. All eight bundled characters are now selectable.
  • Daemon PID hygiene: a stale daemon.pid surviving a reboot could make start-all silently skip a character, or stop signal an unrelated process group that reused the PID. Liveness now includes an identity check (each daemon's argv carries a per-session --session marker — sibling characters can't be mistaken for each other; pre-upgrade markerless daemons still pass); starts claim the pid file atomically (O_EXCL) before spawning; stop no longer deletes an in-flight start claim.

Fixes (docs, EN + zh in lockstep)

  • The messaging table now shows the real five platforms (WeChat iLink / QQ / Telegram / Discord / Slack — the long-dropped WeChatPadPro row is gone); the first-run flow matches reality (language + describe-a-character; the model is configured in Settings, with the preset list matching the code); the removed "wishes" concept is replaced by the current Aspiration → task model; the card Market and SillyTavern import moved from "future roadmap" to shipped; image generation, the visuals pipeline, the personal-website module, and chat backdrop/sprite prefs are documented.

Fixes (UI)

  • The first-run welcome now closes on Escape, like every other layer. The interactive walk confirmed the create flow, the dirty-change guard, and the visible generate-failure path all behave correctly.
Assets 4
Loading