Skip to content

sysm 1.26.3.2 — Q3 2026 Apple Intelligence and Hardening Release

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Sep 12:50
· 21 commits to main since this release
v1.26.3.2
b49ac19
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This revision restores sysm ai in release builds and fixes two input-handling vulnerabilities. It also fixes the API documentation build and the Intel source build.

Fixes

  • Restores sysm ai in release builds. Releases 1.26.3.0 and 1.26.3.1 were built with Xcode 16.2, which compiled out the Foundation Models integration. Every sysm ai command in those releases reported "Apple Intelligence not available: FoundationModels framework requires macOS 26+", even on macOS 26. Releases are now built with Xcode 26.6 on macOS 26, and the release build fails if the binary does not link Foundation Models.
  • Fixes the Intel (x86_64) source build. VM save and restore exist only on Apple silicon, so the build now excludes them on Intel. On Intel, sysm vm save and sysm vm restore report that save and restore require macOS 14 or later on Apple silicon.
  • Fixes the API documentation build. The documentation workflow could not find the SysmCore scheme and failed before it compiled anything.

Security fixes

  • Escapes the Focus mode name before it reaches AppleScript. A name that contained a quotation mark could end the script's string and run its own AppleScript, including shell commands, through sysm focus activate.
  • Validates scheduled job names. sysm schedule commands accept names of 1 to 128 ASCII letters, digits, dots, underscores, and hyphens that start with a letter or digit, and check the name before they touch the file system or launchctl. A name with path separators could previously read log files, or direct job output, outside ~/.sysm/logs.
  • Generates launchd property lists with Foundation instead of string templates. A working directory or environment variable that contained XML characters previously produced an invalid job without an error.
  • Restricts self-update downloads to HTTPS for the request and every redirect, stops on HTTP errors from the GitHub API, and stages downloads in the per-user temporary directory. Self-update already verified each archive against the release SHA-256 digest.

Compatibility

  • sysm schedule now rejects job names that contain spaces, slashes, or other characters outside the allowed set, or that start with a dot, underscore, or hyphen. Existing jobs with such names still run and still appear in sysm schedule list, but other schedule commands reject them. To remove one, run launchctl unload on its plist in ~/Library/LaunchAgents, then delete the file.
  • The minimum macOS version remains 13. An upcoming release raises it to macOS 26.

Validation

The Focus and schedule fixes include exploit regressions and legitimate-behavior coverage. The changes passed debug and release builds, 721 unit tests, and DocC validation on macOS 26 with Xcode 26.6, and the same build and tests on the Xcode 27 preview runner.

Changes since the previous release

  • WZ-911: Release 1.26.3.2 (#10) (b49ac19)
  • WZ-911: Guard VM save and restore to Apple silicon (fc16c90)
  • WZ-911: Harden self-update downloads (2b37df7)
  • WZ-911: Declare package products (9882466)
  • WZ-911: Validate launchd job names and plists (d8d9ab8)
  • WZ-911: Escape Focus mode names in AppleScript (072dd74)
  • WZ-911: Build CI and releases on Xcode 26.6 (c41ab5e)
  • Point task tracking at Linear (1a7874a)
  • Add structured Markdown note creation (44550e2)

Installation

Homebrew

brew tap brndnsvr/tap
brew install sysm

Direct Download

curl -L -o sysm.tar.gz https://github.com/brndnsvr/sysm/releases/download/v1.26.3.2/sysm-1.26.3.2-macos-arm64.tar.gz
tar -xzf sysm.tar.gz
sudo mv sysm /usr/local/bin/

SHA256: 5fceffa9ad71417f67e8ac78de746801c1915914d2240c9c7fa586333bf1ece2

Assets 4
Loading