SwanSong 0.7.0 — Safer Without the Fuss

SwanSong 0.7.0 — Safer Without the Fuss

SwanSong 0.7 is the release where the safety net becomes part of the fun. Games
still open in a click. Translation Lab still follows the evidence. Studio and
Story Forge still turn the Mac into a WonderSwan workshop. Underneath, the
pieces now trust each other much less—and protect your work much more.

Expected app identity: SwanSong 0.7.0 (13).

The short version

• The game engine now runs in its own locked-down service.
• Local automation talks through a private socket and accepts only fresh,
  one-use requests from SwanSong's signed helper.
• Safe Mode can rescue a launch without touching your library or saves.
• A one-click Support Bundle helps diagnose problems without collecting your
  games, saves, screenshots, projects, manuscripts, or private paths.
• Privacy & Trust puts every connection and local-control switch in one clear
  place.
• Releases now include an SPDX software bill of materials, exact source,
  checksums, and GitHub artifact attestations.

A tougher player, hidden behind the same Play button

The packaged emulator lives in a sandboxed XPC service with no network access.
SwanSong passes only typed, size-limited messages across that boundary. If a
game, state, persistence file, frame, or reply is malformed or too large, the
request stops there instead of wandering through the rest of the app.

This is deliberately invisible during normal play. Your library, Open IPL,
controllers, Time Ribbon, screenshots, and visual save states work the same
way. The isolation is there for the day something goes wrong.

Local automation that proves who is asking

The live MCP bridge no longer broadcasts through macOS notifications or keeps
a bearer secret. It uses a private owner-only Unix socket. SwanSong checks the
caller's macOS user, signed helper identity, Apple team, protocol version,
message size, timestamp, and one-use nonce before accepting a request.

Developer Tools and local control remain off by default. Turn either off and
the socket disappears immediately. Public tool responses remain intentionally
small and source-free.

Safe Mode and support that respect your privacy

Two interrupted launches trigger a Safe Mode offer. Safe Mode skips restored
projects, controllers, local automation, background update work, and an initial
game, giving you a clean way back into the app without moving or deleting your
library.

The new Support Bundle contains app and Mac versions, relevant settings,
component hashes, and recent source-free diagnostics. It does not include ROMs,
saves, states, screenshots, manuscripts, Translation Lab evidence, private
paths, or account data. You still get to review and choose where the ZIP goes.

Translation Lab follows the source farther

Component-selective rectangle probing can isolate map, raster, palette, or
sprite ownership while still finding every outside consumer that shares a
source range. Private lineage can now retain the executed cartridge-read
context: immediate caller, code and operand location, mapper window and bank,
and resolved cartridge operand.

Those exact ranges, addresses, callers, writers, and consumer coordinates stay
inside the linked private project. MCP sees only geometry, counts, hashes, and
an honest completeness result. Mixed-case capture names are also canonicalized
before authorization, with both unit and real-toolkit end-to-end coverage.

ABI 10 can now carry that verified lineage into a private static-analysis
seed-v2. SwanSong replays the exact frame, seals the consumed-prefetch context,
and stores the fetched cartridge bytes only inside the project for the required
decoder check. Automation receives counts and hashes—not opcodes, addresses, or
source ranges. Exact ABI 9 seed-v1 projects remain supported.

A release you can inspect

Every 0.7 download is Developer ID signed, notarized, stapled, and checked by
Gatekeeper. The release set contains:

• the universal app archive;
• the exact corresponding-source archive;
• a deterministic SPDX 2.3 SBOM;
• a machine-readable manifest; and
• SHA-256 checksums covering the binary, source, and SBOM.

The release pipeline re-downloads and verifies those files before signing the
Sparkle appcast. GitHub then publishes artifact and SBOM attestations. Critical
security releases can reach everyone immediately; ordinary updates can be
rolled out gradually across seven days.

More hardening behind the curtain

SwanSong 0.7 adds CodeQL, dependency review, Dependabot security updates,
pinned GitHub Actions, AddressSanitizer, UndefinedBehaviorSanitizer, and a
coverage-guided engine fuzzer. Translation projects use security-scoped
bookmarks, and Homebrew Catalog anti-rollback trust now lives in a locked,
owner-only file rather than the login Keychain—so it stays monotonic without
asking for your password.

Install or update

Existing users can choose SwanSong > Check for Updates…. Because 0.7
hardens local automation, this release is published as a critical Sparkle
update and bypasses staged rollout. A manual install can download
SwanSong-0.7.0-macOS-universal.zip from the GitHub Release and verify it with
SHA256SUMS.txt and SwanSong-0.7.0-release.json.

SwanSong requires macOS 14 or newer. It includes no games or original system
firmware. Use only software and hardware you own or are authorized to use.

If anything feels wrong, open Help > SwanSong Support, create a Support
Bundle, and tell us what you expected to happen. The
support guide, privacy policy, and
complete changelog have the deeper details.