Skip to content

LingShu v0.1.0-alpha.7

Pre-release
Pre-release

Choose a tag to compare

View all tags
@RoyZhao1991 RoyZhao1991 released this 19 Jul 09:08
v0.1.0-alpha.7
36fa7ce

LingShu v0.1.0-alpha.7

English | 简体中文

English

This alpha aligns the downloadable app with LingShu's public end-to-end deliverables demo. It fixes a real artifact-ledger gap: when a successful delivery reply mentions only filenames instead of exposing absolute local paths, trusted task outputs are now registered without pulling in unrelated historical files.

What changed

  • Reconciles filename-only delivery replies against record-specific trusted task directories.
  • Excludes user-authored filename mentions from automatic artifact registration, preventing an old requested file from being misclassified as a new deliverable.
  • Rejects symbolic links and canonicalizes paths before trust-boundary and duplicate checks.
  • Adds regression coverage for filename-only PPTX/DOCX delivery, duplicate suppression, user-message isolation, trusted-directory boundaries, and symlink escape attempts.
  • Publishes a 71.2-second privacy-safe demo of a synthetic task producing editable PPTX and DOCX files, an independent checker result, and the final artifact ledger.

Inspect before installing

The demo shows real LingShu UI and synthetic data. Waiting segments are accelerated 12x. The final GoalSpec, completed plan, checker result, and artifact ledger come from a second verified synthetic-data run, so the video is not presented as one uninterrupted take.

Verification and release integrity

  • GitHub CI passed on release source commit 36fa7ce15ee917cdd2066f87b7dac23ffe8515db: 1,584 tests executed, 4 environment-dependent tests skipped, 0 failures.
  • The targeted artifact-delta suite passed locally: 6 tests, 0 failures.
  • Build 10 was compiled from a clean source tree for both Apple silicon and Intel.
  • The app and DMG were separately accepted by Apple notarization and carry stapled tickets.
  • The release script remounted the DMG and revalidated the installed app, bundled CLI, signature, notarization, embedded source revision, and absence of private runtime credentials.
  • DMG SHA-256: ed8fc1fe17c82c15f8fba9d8703490f15653164aaa37341033550f3ad27bdfeb.
  • The release asset release-manifest.json records the source archive, app binary, CLI binary, signing certificate, and notarization identifiers.

Install

brew install --cask RoyZhao1991/tap/lingshu

Or download the Universal DMG and verify it:

shasum -a 256 -c LingShu-0.1.0-10-macOS-universal.dmg.sha256

Requires macOS 14 or later and a supported model token or compatible custom endpoint. LingShu remains alpha software; keep backups and review high-impact actions and generated deliverables.

简体中文

本次 Alpha 让公开下载包与灵枢的端到端产物演示保持一致，并修复一个真实的产物台账缺口：当成功交付回复只提到文件名、没有暴露本地绝对路径时，灵枢现在可以从本任务的可信目录补登产物，同时不会把无关历史文件带入当前任务。

本次改动

  • 将仅含文件名的交付回复与任务记录专属的可信目录进行核对并补登产物。
  • 自动补登时排除用户消息，避免用户请求读取的旧文件被误判为本轮新产物。
  • 在信任边界和去重判断前解析规范路径，并拒绝符号链接。
  • 增加仅文件名 PPTX/DOCX 交付、重复抑制、用户消息隔离、可信目录边界和符号链接逃逸的回归测试。
  • 发布一段 71.2 秒的隐私安全演示：使用合成数据生成可编辑 PPTX 与 DOCX，经过独立 checker 验收，并进入最终产物台账。

安装前先看

演示使用真实灵枢界面和合成数据，等待片段按 12 倍加速；最终 GoalSpec、完成计划、checker 结果和产物台账来自第二次经验证的合成数据运行，因此不会将视频描述为一次不间断录制。

验证与发布完整性

  • 发布源码提交 36fa7ce15ee917cdd2066f87b7dac23ffe8515db 的 GitHub CI 已通过：执行 1,584 项测试，4 项环境相关测试按设计跳过，0 失败。
  • 本地产物差异专项测试通过：6 项测试，0 失败。
  • Build 10 从干净工作区构建，同时覆盖 Apple 芯片与 Intel。
  • App 与 DMG 分别通过 Apple 公证并装订公证票据。
  • 发布脚本重新挂载 DMG，再次校验其中 App、内置 CLI、签名、公证、内嵌源码提交号，并确认没有私密运行时凭据。
  • DMG SHA-256：ed8fc1fe17c82c15f8fba9d8703490f15653164aaa37341033550f3ad27bdfeb。
  • 发布资产 release-manifest.json 记录源码归档、App 二进制、CLI 二进制、签名证书和公证标识。

安装

brew install --cask RoyZhao1991/tap/lingshu

也可以下载 Universal DMG 并校验：

shasum -a 256 -c LingShu-0.1.0-10-macOS-universal.dmg.sha256

需要 macOS 14 或更高版本，以及受支持模型服务商的 Token 或兼容自定义端点。灵枢仍处 Alpha 阶段，请保留重要文件备份，并检查高影响操作与生成产物。

Assets 5
Loading