desktop-v0.1.0

Desktop v0.1.0

简体中文

新增

• 长对话中模型获得 compact 工具：可查看上下文压力与压缩块、读回被压缩的原文和溢出文件，并自行选择范围撰写摘要完成压缩。达到软阈值时注入一次临时提醒引导，硬阈值仍由自动压缩兜底。
• 设置工具页新增 MCP Server 配置表单：增删改使用者默认层的服务器（环境变量仅接受 ${NAME} 引用），配置变更后需在信任面板重新确认。
• 设置工具页的扩展条目新增停用/启用开关，登记在下次启动 Host 时生效。
• 在用户数据根 tools/ 目录放置 TOML 文件即可声明命令工具：占位符整位替换模型参数、不进入 shell 语法，执行沿用 Shell 的权限与审批链路；工具需在模式中列出才会提供给模型。

改进

• 压缩结果保存为逐块校验的块序列，多次压缩各自成块、互不覆盖；分支会携带已压缩块，摘要不再丢失。
• 压缩压力阈值预留输出预算（上限为窗口的四分之一），长输出请求更早压缩；每次压缩的原因（手动、自动、超限恢复、模型主动）写入会话记录。
• 会话列表使用可重建的目录索引缓存，未变化的记录不再每次完整解析，长会话目录下列表与恢复浏览明显变快。
• 扩展安装目录支持一目录一包（含 index.js 入口）；已安装扩展可停用并登记在数据根，下次启动生效，配置层显式声明的路径不受影响。

兼容性

• 工作区信任记录改存数据根的 trust.json：旧版 tui-trust.json 仍自动读取并在下次写入时合并进新文件，旧文件保留不删除。

修复

• 模型请求的凭据绑定用户或命令行声明的服务地址与接口，项目覆盖地址或密钥引用时拒绝发送；对话、压缩和内部子代理沿用同一轮次的绑定快照。
• 自定义搜索后端仅由用户配置或命令行选择，项目配置不能借只读搜索启动指定程序；受管理回收目录拒绝越界路径与指向文件边界外的链接。
• MCP 工具保留服务器配置身份，身份限定的参数规则和审批记忆按实际登记路径生效。
• 并发创建同名文件时仅一个请求成功，其他请求保留已有内容并返回冲突；搜索流式输出完整保留中文与多字节字符。
• 会话恢复与模型请求校验按记录顺序配对工具调用和结果，复用调用 ID 的新轮次仍会识别未完成调用并记录未知结果。
• Markdown 代码块的复制按钮及成功、失败反馈跟随桌面界面语言显示；复制的代码内容保持原文。

下载

Linux AppImage 适合直接运行；deb 适合 Debian/Ubuntu 系发行版安装。桌面包包含自己的 Node Host，无需额外安装 Node.js。

操作系统	格式	用途	下载
Windows x64	NSIS (.exe)	安装向导	下载
Linux x64	AppImage	免安装运行	下载
Linux x64	deb (.deb)	Debian/Ubuntu 系发行版	下载

校验下载

• SHA256SUMS — 安装包 SHA-256 校验值
• desktop-release-manifest.json — 版本、来源提交和资产清单

本版本未提供发布者数字签名；SHA-256 校验值用于检查文件完整性。

English

Added

• In long conversations the model gains the compact tool: it can inspect context pressure and compaction blocks, read back the summarized originals and overflow files, and compact a chosen range with a summary it writes itself. A one-time reminder appears at the soft threshold; the hard threshold still compacts automatically.
• The settings tools page gains an MCP server configuration form: add, edit, and remove servers in the user defaults layer (environment entries only accept ${NAME} references); a changed configuration needs trust again in the trust panel.
• Extension entries on the settings tools page gain disable/enable toggles; the registry takes effect the next time the Host starts.
• Declaring a command tool takes a TOML file in the data root's tools/ directory: placeholders replace whole argument entries so model input never enters shell syntax, and execution follows the Shell permission and approval chain; a tool reaches the model only when a mode lists it.

Improved

• Compaction is stored as individually validated blocks, so successive passes form separate blocks instead of overwriting one summary, and branches carry their blocks instead of losing the summaries.
• The compaction threshold reserves the output budget (capped at a quarter of the window), so long-output requests compact earlier; every compaction records its reason (manual, automatic, overflow recovery, or model-initiated) in the session record.
• Session listing uses a rebuildable directory index, so unchanged records are no longer fully re-parsed on every list, making listing and resume browsing faster for long session directories.
• The extension install directory supports one-directory packages with an index.js entry; installed extensions can be disabled through a registry in the data root that takes effect on the next start, while paths declared by configuration layers stay unaffected.

Compatibility

• The workspace trust record now lives in trust.json under the data root. The earlier tui-trust.json is still read and merged into the new file on the next write; the old file is kept untouched.

Fixed

• Model requests bind credentials to the service URL and API declared by the user or command-line flags. Project overrides of the URL or key reference cannot send existing credentials; conversation, compaction, and internal subagents share the turn's binding snapshot.
• Custom search backends can only be selected through user configuration or command-line flags; project configuration cannot launch its own program through read-only search. Managed trash rejects paths and links outside the workspace boundary.
• Registered MCP tools retain their server configuration identity so identity-bound argument rules and approval memory apply correctly.
• Concurrent file creation has one winner and reports conflicts without overwriting content. Streaming search output preserves Chinese and other multibyte characters.
• Recovery and model-request validation pair tool calls with results in record order. A later turn reusing a call ID still detects its pending call and records an unknown outcome.
• The Markdown code block copy button and its success or failure feedback follow the Desktop interface language; copied code remains unchanged.

Downloads

The Linux AppImage runs as a portable app; the deb package is for Debian/Ubuntu-based distributions. The desktop package includes its Node Host and does not require a separate Node.js installation.

OS	Package	Use	Download
Windows x64	NSIS (.exe)	Installer wizard	Download
Linux x64	AppImage	Portable app	Download
Linux x64	deb (.deb)	Debian/Ubuntu-based distributions	Download

Verify downloads

• SHA256SUMS — SHA-256 checksums for the installers
• desktop-release-manifest.json — Version, source commit, and asset manifest

This release does not include publisher signatures; SHA-256 checksums verify file integrity.

CLI/TUI v0.1.0

CLI / TUI v0.1.0

简体中文

新增

• 长对话中模型获得 compact 工具：可查看上下文压力与压缩块、读回被压缩的原文和溢出文件，并自行选择范围撰写摘要完成压缩。达到软阈值时注入一次临时提醒引导，硬阈值仍由自动压缩兜底。
• /mcp add <名称> <程序> [参数…] 与 /mcp remove <名称> 把 MCP Server 写入使用者默认配置（环境变量引用与工作目录在配置文件中补充，配置变更后需重新信任）。
• /extensions [on|off <名称>] 列出用户扩展并支持停用与启用，登记在下次启动 Host 时生效。
• 在用户数据根 tools/ 目录放置 TOML 文件即可声明命令工具：占位符整位替换模型参数、不进入 shell 语法，执行沿用 Shell 的权限与审批链路；工具需在模式中列出才会提供给模型。

改进

• 压缩结果保存为逐块校验的块序列，多次压缩各自成块、互不覆盖；分支会携带已压缩块，摘要不再丢失。
• 压缩压力阈值预留输出预算（上限为窗口的四分之一），长输出请求更早压缩；每次压缩的原因（手动、自动、超限恢复、模型主动）写入会话记录。
• 会话列表使用可重建的目录索引缓存，未变化的记录不再每次完整解析，长会话目录下列表与恢复浏览明显变快。
• 扩展安装目录支持一目录一包（含 index.js 入口）；已安装扩展可停用并登记在数据根，下次启动生效，配置层显式声明的路径不受影响。

兼容性

• 工作区信任记录改存数据根的 trust.json：旧版 tui-trust.json 仍自动读取并在下次写入时合并进新文件，旧文件保留不删除。

修复

• 模型请求的凭据绑定用户或命令行声明的服务地址与接口，项目覆盖地址或密钥引用时拒绝发送；对话、压缩和内部子代理沿用同一轮次的绑定快照。
• 自定义搜索后端仅由用户配置或命令行选择，项目配置不能借只读搜索启动指定程序；受管理回收目录拒绝越界路径与指向文件边界外的链接。
• MCP 工具保留服务器配置身份，身份限定的参数规则和审批记忆按实际登记路径生效。
• 并发创建同名文件时仅一个请求成功，其他请求保留已有内容并返回冲突；搜索流式输出完整保留中文与多字节字符。
• 会话恢复与模型请求校验按记录顺序配对工具调用和结果，复用调用 ID 的新轮次仍会识别未完成调用并记录未知结果。

安装与启动

需要 Node.js 24 或更新版本。运行 npm install -g ligule@0.1.0 安装；在交互式终端运行 ligule 打开 TUI，或运行 ligule run "任务内容" 执行单轮任务。

在 npm 查看此版本

English

Added

• In long conversations the model gains the compact tool: it can inspect context pressure and compaction blocks, read back the summarized originals and overflow files, and compact a chosen range with a summary it writes itself. A one-time reminder appears at the soft threshold; the hard threshold still compacts automatically.
• /mcp add <name> <executable> [args…] and /mcp remove <name> write MCP servers into the user defaults (add environment references and a working directory in the config file; a changed configuration needs trust again).
• /extensions [on|off <name>] lists user extensions and disables or enables them; the registry takes effect the next time the Host starts.
• Declaring a command tool takes a TOML file in the data root's tools/ directory: placeholders replace whole argument entries so model input never enters shell syntax, and execution follows the Shell permission and approval chain; a tool reaches the model only when a mode lists it.

Improved

• Compaction is stored as individually validated blocks, so successive passes form separate blocks instead of overwriting one summary, and branches carry their blocks instead of losing the summaries.
• The compaction threshold reserves the output budget (capped at a quarter of the window), so long-output requests compact earlier; every compaction records its reason (manual, automatic, overflow recovery, or model-initiated) in the session record.
• Session listing uses a rebuildable directory index, so unchanged records are no longer fully re-parsed on every list, making listing and resume browsing faster for long session directories.
• The extension install directory supports one-directory packages with an index.js entry; installed extensions can be disabled through a registry in the data root that takes effect on the next start, while paths declared by configuration layers stay unaffected.

Compatibility

• The workspace trust record now lives in trust.json under the data root. The earlier tui-trust.json is still read and merged into the new file on the next write; the old file is kept untouched.

Fixed

• Model requests bind credentials to the service URL and API declared by the user or command-line flags. Project overrides of the URL or key reference cannot send existing credentials; conversation, compaction, and internal subagents share the turn's binding snapshot.
• Custom search backends can only be selected through user configuration or command-line flags; project configuration cannot launch its own program through read-only search. Managed trash rejects paths and links outside the workspace boundary.
• Registered MCP tools retain their server configuration identity so identity-bound argument rules and approval memory apply correctly.
• Concurrent file creation has one winner and reports conflicts without overwriting content. Streaming search output preserves Chinese and other multibyte characters.
• Recovery and model-request validation pair tool calls with results in record order. A later turn reusing a call ID still detects its pending call and records an unknown outcome.

Install and run

Requires Node.js 24 or newer. Install with npm install -g ligule@0.1.0. Run ligule in an interactive terminal to open the TUI, or run ligule run "task" for a one-shot request.

View this version on npm

CLI/TUI v0.0.8

CLI / TUI v0.0.8

简体中文

修复

• CLI 安装包仅内置私有 Core 的代码与资源，外部运行依赖由 npm 为当前系统安装，确保同一发行包在 Windows 和 Linux 加载对应的搜索与原生绑定。

安装与启动

需要 Node.js 24 或更新版本。运行 npm install -g ligule@0.0.8 安装；在交互式终端运行 ligule 打开 TUI，或运行 ligule run "任务内容" 执行单轮任务。

在 npm 查看此版本

English

Fixed

• The CLI tarball bundles the private Core code and resources, while npm installs external runtime dependencies for the consumer's system. The same release artifact loads the matching search backend and native bindings on Windows and Linux.

Install and run

Requires Node.js 24 or newer. Install with npm install -g ligule@0.0.8. Run ligule in an interactive terminal to open the TUI, or run ligule run "task" for a one-shot request.

View this version on npm

CLI/TUI v0.0.7

CLI / TUI v0.0.7

简体中文

改进

• 终端界面输入 / 即可浏览全部命令，按名称或说明筛选并滚动选择；固定命令参数支持 Tab 补全，补全仅修改草稿，权限升级仍需确认。
• /sessions 和不带参数的 /resume 支持按名称、编号或工具模式筛选；列表优先显示会话名称，筛选文字与聊天草稿分别管理。
• 欢迎区改为左对齐；运行阶段使用 Host 确认的状态，输入区限制显示高度。选择菜单、会话列表、历史和审批面板打开时让普通编辑区让位；工具调用先显示目标摘要，完整内容可从 Ctrl+O 查看。颜色使用继承终端调色板的 ANSI 角色，空间不足时禁用审批操作。
• /queue list 可查看待发送消息及队列状态。
• 长问题与选项可分页阅读，回答输入区保持可见；审批和历史详情中的粘贴不会修改隐藏草稿。

修复

• Delete 向前删除完整字符，Backspace 向后删除；多行输入的上下移动按显示列定位，避免拆开中文、组合字符和表情。
• 会话切换在目标会话成功打开后才释放原会话锁；切换失败时继续保留当前会话。
• 草稿和外部编辑器内容中的 CRLF 在编辑前统一为 LF，避免光标移动或删除时留下孤立的回车符。
• 未设置 FORCE_COLOR 时，终端启动遵守非空的 NO_COLOR；窄窗口保留当前会话状态提示。
• 工具审批和提问会临时收起授权设置向导；问题回答只发送给当前问题，不会被用作授权参数。
• 问题回答独立于普通草稿，回答或取消后恢复原文字和光标；退出时保存普通草稿与队列，问题期间收回队列也保留原输入。

安装与启动

需要 Node.js 24 或更新版本。运行 npm install -g ligule@0.0.7 安装；在交互式终端运行 ligule 打开 TUI，或运行 ligule run "任务内容" 执行单轮任务。

在 npm 查看此版本

English

Improved

• Typing / in the terminal UI browses all commands with name or description filtering and scrollable selection. Fixed command arguments support Tab completion, which only edits the draft; permission upgrades still require confirmation.
• /sessions and /resume without arguments filter by session name, ID, or tool mode. Names appear first, and search text stays separate from the chat draft.
• The welcome area is left-aligned; run phases use Host-confirmed status, and the composer has a bounded display height. Selection menus, session lists, history, and approvals take the place of ordinary editing while open. Tool calls lead with a target summary, with full details available through Ctrl+O. ANSI color roles follow the terminal palette, and approvals are disabled when the window cannot show the required information.
• /queue list shows pending messages and queue status.
• Long questions and options can be paged while the answer editor stays visible; pasting in approvals or transcript details preserves the hidden draft.

Fixed

• Delete removes the next whole character and Backspace the previous one. Vertical movement in multiline drafts follows display columns without splitting Chinese text, combining characters, or emoji.
• Session navigation releases the previous session lock only after the target opens successfully; a failed switch keeps the current session active.
• CRLF in saved drafts and external-editor content is normalized to LF before editing, so movement and deletion do not leave a stray carriage return.
• Terminal startup honors a nonempty NO_COLOR when FORCE_COLOR is unset, and narrow windows retain the active-session status hint.
• Tool approvals and questions temporarily hide grant setup; question answers go only to the active question and cannot become grant parameters.
• Answers use a separate draft. Answering or cancelling restores the original text and caret; exit saves the ordinary draft and queue, and queue recovery during a question preserves existing input.

Install and run

Requires Node.js 24 or newer. Install with npm install -g ligule@0.0.7. Run ligule in an interactive terminal to open the TUI, or run ligule run "task" for a one-shot request.

View this version on npm

desktop-v0.0.7

Desktop v0.0.7

简体中文

新增

• 默认 minimal 模式增加 managed_process，可在同一 Session 中启动受 Guardian 管理的本地开发服务器，查看就绪状态、端口与有界日志，并显式停止进程；启动命令沿用 exec 的 Permission、Policy、工作区信任与脚本审批。
• 增加外控会话输入栏，可查看当前会话的模型、工具模式、Policy、Permission 与 Grant 上限，并向同一 Host Session 发送消息；会话菜单可查看内部子代理记录。
• 增加 MCP 信任设置面板，可查看本机 Server 启动详情、按会话/项目/用户范围信任或撤销；信任仅允许启动进程，工具调用仍逐次经过 Policy。

改进

• 审批卡对大型参数先显示字节数、摘要和短预览，可信界面可在待决期间按需展开详情。审批记忆支持本次、会话、项目和用户范围；文件许可默认限定在当前文件。
• Policy 使用 ask、auto、none 三档，旧版 never 保持拒绝语义。硬拒绝、审批不可用与取消保持各自结果，不显示为用户拒绝。
• 设置重组为八个独立入口，常规页整合外观设置；工具模式和 Grant 选择只用于查看，不会改变运行中的会话。权限、MCP Server 和 Grant 的低频细节按需展开，保留原有创建、信任、审批和撤销操作。
• MCP 信任面板读取 Server 工具清单设有有界超时；无响应的 Server 不会无限期占用临时连接。

安全

• 撤销工作区信任会停止基于该信任启动的受管进程；其他 Host 定期检查共享信任状态。
• 子代理只能使用父会话当前可见的工具；显式子 Mode 不能恢复父 Mode 隐藏或 Permission 不可用的工具。

下载

Linux AppImage 适合直接运行；deb 适合 Debian/Ubuntu 系发行版安装。桌面包包含自己的 Node Host，无需额外安装 Node.js。

操作系统	格式	用途	下载
Windows x64	NSIS (.exe)	安装向导	下载
Linux x64	AppImage	免安装运行	下载
Linux x64	deb (.deb)	Debian/Ubuntu 系发行版	下载

校验下载

• SHA256SUMS — 安装包 SHA-256 校验值
• desktop-release-manifest.json — 版本、来源提交和资产清单

本版本未提供发布者数字签名；SHA-256 校验值用于检查文件完整性。

English

Added

• Added managed_process to the default minimal mode. It starts local development servers under Guardian ownership, reports readiness and port, provides bounded logs, and supports explicit stop within the same Session. Start commands keep exec Permission, Policy, workspace trust, and script approval checks.
• Added an external-session composer that shows the active session's model, tool mode, Policy, Permission, and Grant ceilings, and routes messages to the same Host Session. The conversation menu also exposes internal subagent records.
• Added MCP trust settings to inspect local server launch details and trust or revoke servers at session, project, or user scope. Trust permits process startup only; every tool call still passes through Policy.

Improved

• Approval cards show a byte count, digest, and short preview for large parameters; trusted interfaces can retrieve full details while the request is pending. Remembered approvals support one-call, session, project, and user scopes; file approvals default to the selected file.
• Policy now distinguishes ask, auto, and none, while legacy never retains its refusal behavior. Hard denials, unavailable approval channels, and cancellation keep distinct outcomes instead of appearing as user refusals.
• Settings now has eight separate sections, with appearance controls in General. Mode and Grant selections only change what is inspected; they do not change a running session. Less-frequent Permission, MCP server, and Grant details expand on demand while existing create, trust, approval, and revoke actions remain available.
• MCP server tool discovery in the trust panel has a bounded timeout, so an unresponsive server cannot hold a temporary connection indefinitely.

Security

• Revoking workspace trust stops managed processes started from that trust; other Hosts periodically check the shared trust state.
• Subagents are limited to tools visible to the parent session; an explicit child Mode cannot restore tools hidden by the parent Mode or unavailable under its Permission.

Downloads

The Linux AppImage runs as a portable app; the deb package is for Debian/Ubuntu-based distributions. The desktop package includes its Node Host and does not require a separate Node.js installation.

OS	Package	Use	Download
Windows x64	NSIS (.exe)	Installer wizard	Download
Linux x64	AppImage	Portable app	Download
Linux x64	deb (.deb)	Debian/Ubuntu-based distributions	Download

Verify downloads

• SHA256SUMS — SHA-256 checksums for the installers
• desktop-release-manifest.json — Version, source commit, and asset manifest

This release does not include publisher signatures; SHA-256 checksums verify file integrity.

CLI/TUI v0.0.6

CLI / TUI v0.0.6

简体中文

新增

• 默认 minimal 模式增加 managed_process，可在同一 Session 中启动受 Guardian 管理的本地开发服务器，查看就绪状态、端口与有界日志，并显式停止进程；启动命令沿用 exec 的 Permission、Policy、工作区信任与脚本审批。
• full 工具模式包含内部 subagent，可并行委派最多三个独立子任务；子任务保留独立会话记录，可用 /sub <序号> 检查。MCP ligule_run 与 ligule_run_start 也支持单轮模式收窄和经 schema 验证的结构化结果。
• 本地 MCP 控制新增 ligule_run 的有界等待和 ligule_run_await，超时不会取消仍在运行的任务。
• 增加 /mcp list|trust|confirm|revoke|tools 管理本地 MCP Server 信任；信任可按会话、项目或用户范围设置，服务器配置变化后需要重新确认。

改进

• 审批方式明确区分 ask、auto、none 与旧版 never；记住的许可可限定本次、会话、项目或用户，文件许可默认只记当前文件。
• 大型审批先显示字节数、摘要和短预览，再由可信界面按需展开详情；系统拒绝、审批不可用和取消不再记作用户拒绝。

安全

• 撤销工作区信任会停止基于该信任启动的受管进程；其他 Host 会复核共享信任状态并停止相关进程。
• 子代理只能使用父会话当前可见的工具；显式子 Mode 不能恢复父 Mode 隐藏或 Permission 不可用的工具。

安装与启动

需要 Node.js 24 或更新版本。运行 npm install -g ligule@0.0.6 安装；在交互式终端运行 ligule 打开 TUI，或运行 ligule run "任务内容" 执行单轮任务。

在 npm 查看此版本

English

Added

• Added managed_process to the default minimal mode. It starts local development servers under Guardian ownership, reports readiness and port, provides bounded logs, and supports explicit stop within the same Session. Start commands keep exec Permission, Policy, workspace trust, and script approval checks.
• The full tool mode includes the internal subagent tool for up to three concurrent independent child runs; each child keeps a separate Session record that can be inspected with /sub <seq>. MCP ligule_run and ligule_run_start also accept per-run mode narrowing and schema-validated structured results.
• Added bounded waiting with ligule_run and ligule_run_await to the local MCP control tools. A wait timeout does not cancel the active run.
• Added /mcp list|trust|confirm|revoke|tools to manage local MCP server trust by session, project, or user scope. Server configuration changes require trust again.

Improved

• Approval modes now distinguish ask, auto, none, and legacy never. Remembered approvals can be scoped to one call, a session, a project, or the user; file approvals default to the selected file.
• Large approvals show a byte count, digest, and short preview before trusted interfaces retrieve details on demand. System refusals, unavailable approval channels, and cancellation are no longer recorded as user refusals.

Security

• Revoking workspace trust stops managed processes started from that trust; other Hosts recheck the shared trust state and stop affected processes.
• Subagents are limited to tools visible to the parent session; an explicit child Mode cannot restore tools hidden by the parent Mode or unavailable under its Permission.

Install and run

Requires Node.js 24 or newer. Install with npm install -g ligule@0.0.6. Run ligule in an interactive terminal to open the TUI, or run ligule run "task" for a one-shot request.

View this version on npm

desktop-v0.0.6

Desktop v0.0.6

简体中文

新增

• 新会话发送第一条消息前可设置工具模式、审批方式、文件/命令权限与网络模式；完全访问和不受限网络仍需分别确认，并由 Host 记录确认来源。
• 增加会话 Permission 控制面板，可查看平台隔离能力并单独更改文件/命令档位与网络模式；启用 full-access 或不受限网络需要确认，Sandbox 能力不足时 Shell 会拒绝执行。
• 模型服务提供可编辑的模型目录表，支持逐模型名称、上下文窗口和最大输出 token 数；获取可用列表后可选择要加入的模型，并保留已有模型的手动参数，设置实际用于选中模型的请求与压缩。

改进

• 安装包中的 Node 运行树只包含产品清单和生产依赖；构建与运行资源检查会拒绝源码、测试材料和嵌套部署目录。
• 当文件权限边界与项目目录不同时，会话归属、项目设置与重启恢复仍使用实际项目目录。
• 状态栏显示 Host 确认的运行阶段与无进展时长；长标题保留状态和操作按钮的显示空间。
• 共享 Core 区分正常完成、空回复、输出耗尽及断流，安全拒绝非法工具批次，并支持显式输出预算和双 API 非流式 JSON 响应。
• 模型配置在写入前验证共享默认层、项目有效配置和会话显式选择，拒绝时保持文件原文；构建与运行树校验拒绝过时的 Core 内容和越界链接。
• 危险操作分类和自动审批统一使用解析后的 Bash 命令名；引号与字面片段拼接不能绕过硬拒绝或解释器审批。
• Bash 危险命令检查会解码未加引号的转义和可识别的 ANSI-C 字符串；不完整或不支持的转义仍需逐次审批。
• Node/Python 脚本审批卡显示规范路径、SHA-256、解释器、工作区和 Permission；审批等待期间这些内容发生变化会拒绝执行，无法安全绑定的脚本形式也会拒绝运行。

修复

• 修复没有选中会话时重连后断连横幅残留；Linux deb 增加 GBM 和 ALSA 运行依赖声明。
• 授权详情显示可信界面来源；旧授权未记录来源时明确标记，不追认为可信界面创建。
• Permission 变更会保留当前会话的 Policy 覆盖和拒绝状态，并在重新打开会话时恢复；旧格式会话仍可读取，但拒绝写入其不支持的设置事件。

下载

Linux AppImage 适合直接运行；deb 适合 Debian/Ubuntu 系发行版安装。桌面包包含自己的 Node Host，无需额外安装 Node.js。

操作系统	格式	用途	下载
Windows x64	NSIS (.exe)	安装向导	下载
Linux x64	AppImage	免安装运行	下载
Linux x64	deb (.deb)	Debian/Ubuntu 系发行版	下载

校验下载

• SHA256SUMS — 安装包 SHA-256 校验值
• desktop-release-manifest.json — 版本、来源提交和资产清单

本版本未提供发布者数字签名；SHA-256 校验值用于检查文件完整性。

English

Added

• New conversations can select a tool mode, approval mode, file/command permission profile, and network mode before the first message. Full access and unrestricted networking still require separate confirmations, which the Host records with their source.
• Added a per-session Permission panel to inspect platform isolation capabilities and change file/command profiles separately from network mode. Enabling full-access or unrestricted networking requires confirmation; Shell is denied when sandbox capabilities are insufficient.
• Added editable model catalogs with per-model display names, context windows, and maximum output tokens. Fetching shows the available models for selection and preserves existing manual settings; the selected model's limits control actual requests and compaction.

Improved

• Restricted the packaged Node runtime tree to its product manifest and production dependencies; build and runtime-resource checks reject source files, test material, and nested deployment directories.
• Session ownership, project settings, and restart recovery use the actual project directory when it differs from the filesystem permission boundary.
• Status shows Host-confirmed run phases and time without progress; long titles retain space for status and action buttons.
• Shared Core distinguishes normal completion, empty replies, exhausted output, and interrupted bodies, safely rejects invalid tool batches, and supports explicit output budgets and non-streaming JSON responses for both APIs.
• Model configuration validates shared defaults, effective project settings, and explicit session selections before writing; rejected edits preserve the file. Build and runtime-tree checks reject stale Core content and links escaping the runtime.
• Dangerous-operation checks and automatic approval use the same parsed Bash executable name, so quoting or literal concatenation cannot bypass hard denials or interpreter approval.
• Bash dangerous-command checks decode unquoted escapes and recognized ANSI-C strings; incomplete or unsupported escapes remain approval-gated.
• Node/Python script approval cards show the canonical path, SHA-256, interpreter, workspace, and Permission. Changes while approval is pending refuse execution, and script forms that cannot be safely bound are refused.

Fixed

• Fixed the disconnected banner remaining after reconnecting without a selected session; the Linux deb now declares GBM and ALSA runtime dependencies.
• Grant details identify grants created through the trusted UI and label legacy grants whose origin was never recorded.
• Permission changes preserve the current session's Policy override and denial state across reopen. Legacy session records remain readable but refuse unsupported setting events.

Downloads

The Linux AppImage runs as a portable app; the deb package is for Debian/Ubuntu-based distributions. The desktop package includes its Node Host and does not require a separate Node.js installation.

OS	Package	Use	Download
Windows x64	NSIS (.exe)	Installer wizard	Download
Linux x64	AppImage	Portable app	Download
Linux x64	deb (.deb)	Debian/Ubuntu-based distributions	Download

Verify downloads

• SHA256SUMS — SHA-256 checksums for the installers
• desktop-release-manifest.json — Version, source commit, and asset manifest

This release does not include publisher signatures; SHA-256 checksums verify file integrity.

CLI/TUI v0.0.5

CLI / TUI v0.0.5

简体中文

新增

• 增加会话 Permission 控制，可查看平台隔离能力并单独更改文件/命令档位与网络模式；启用 full-access 或不受限网络需要确认，Sandbox 能力不足时 Shell 会拒绝执行。
• 增加 ligule mcp-server --project <绝对目录> 本地 stdio MCP 入口，支持会话管理、任务运行与取消、状态查询和记录分页。显式启用 --operator 后可修改受支持的会话设置，并答复真实待决的审批或提问；operation ID 和消息队列仅在当前进程内有效。
• 增加 model.outputTokens 请求预算与双 API 非流式 JSON 响应支持；模型设置在完整配置校验通过后才保存，拒绝时保留文件原文并保护其他项目的启动。

改进

• /control list 显示授权来源；旧记录没有来源时明确标注未记录，不推断创建渠道。
• 权限变更记录只会在本次操作实际启用完全访问或不受限网络时标记对应确认。
• 共享模型服务配置支持逐模型上下文窗口和输出额度，按当前选择应用于请求与压缩，兼容原有模型标识列表。
• 完整校验模型终止原因，区分空回复、输出耗尽、协议不完整及断流；非法工具批次不执行副作用，诊断不包含原始参数或网关错误正文。
• 危险操作分类和自动审批统一使用解析后的 Bash 命令名；引号与字面片段拼接不能绕过硬拒绝或解释器审批。
• Bash 危险命令检查会解码未加引号的转义和可识别的 ANSI-C 字符串；不完整或不支持的转义仍需逐次审批。
• Node/Python 脚本审批显示规范路径、SHA-256、解释器、工作区和 Permission；审批等待期间这些内容发生变化会拒绝执行，无法安全绑定的脚本形式也会拒绝运行。
• Permission 变更会保留当前会话的 Policy 覆盖和拒绝状态，并在重新打开会话时恢复；旧格式会话仍可读取，但拒绝写入其不支持的设置事件。
• TUI 显示 Host 确认的运行阶段与无进展时长，并提供可操作的 Provider 错误提示。

安装与启动

需要 Node.js 24 或更新版本。运行 npm install -g ligule@0.0.5 安装；在交互式终端运行 ligule 打开 TUI，或运行 ligule run "任务内容" 执行单轮任务。

在 npm 查看此版本

English

Added

• Added per-session Permission controls to inspect platform isolation capabilities and change file/command profiles separately from network mode. Enabling full-access or unrestricted networking requires confirmation; Shell is denied when sandbox capabilities are insufficient.
• Added ligule mcp-server --project <absolute-directory> for local stdio MCP control: manage sessions, run and cancel tasks, query status, and page through records. Explicit --operator mode can change supported session settings and answer real pending approvals or questions; operation IDs and the message queue are process-local.
• Added the model.outputTokens request budget and non-streaming JSON responses for both APIs. Model settings are saved only after complete configuration validation; rejected edits preserve file contents and other projects' startup behavior.

Improved

• /control list shows grant origin; legacy grants with no recorded origin are labeled as unknown instead of inferred.
• Permission records mark a confirmation only when that change grants full access or unrestricted networking.
• Shared service configuration supports per-model context windows and output budgets for requests and compaction, while preserving existing model ID lists.
• Validate model finish reasons and distinguish empty replies, exhausted output, incomplete protocols, and interrupted bodies. Invalid tool batches have no side effects, and diagnostics omit raw arguments and gateway error bodies.
• Dangerous-operation checks and automatic approval use the same parsed Bash executable name, so quoting or literal concatenation cannot bypass hard denials or interpreter approval.
• Bash dangerous-command checks decode unquoted escapes and recognized ANSI-C strings; incomplete or unsupported escapes remain approval-gated.
• Node/Python script approvals show the canonical path, SHA-256, interpreter, workspace, and Permission. Changes while approval is pending refuse execution, and script forms that cannot be safely bound are refused.
• Permission changes preserve the current session's Policy override and denial state across reopen. Legacy session records remain readable but refuse unsupported setting events.
• TUI status shows Host-confirmed run phases and time without progress, with actionable Provider error messages.

Install and run

Requires Node.js 24 or newer. Install with npm install -g ligule@0.0.5. Run ligule in an interactive terminal to open the TUI, or run ligule run "task" for a one-shot request.

View this version on npm

desktop-v0.0.5

Desktop v0.0.5

简体中文

• 改善桌面侧栏搜索焦点、工作区分组和停止本轮操作的可见性；支持折叠其他会话。
• 添加 DeepSeek、OpenAI 与 Anthropic 服务预设，以及 OpenAI 兼容服务的模型发现和多选；凭据使用系统凭据库或环境变量引用。
• 增加需明确确认的「完全不需审批」档位；工作区边界、拒绝规则和安全守卫仍然生效。
• 外观设置增加独立的界面、用户消息和模型回复 px 字号，以及可调会话行距；审批设置内容支持键盘和滚轮滚动。

下载

Linux AppImage 适合直接运行；deb 适合 Debian/Ubuntu 系发行版安装。桌面包包含自己的 Node Host，无需额外安装 Node.js。

操作系统	格式	用途	下载
Windows x64	NSIS (.exe)	安装向导	下载
Linux x64	AppImage	免安装运行	下载
Linux x64	deb (.deb)	Debian/Ubuntu 系发行版	下载

校验下载

• SHA256SUMS — 安装包 SHA-256 校验值
• desktop-release-manifest.json — 版本、来源提交和资产清单

本版本未提供发布者数字签名；SHA-256 校验值用于检查文件完整性。

English

• Improved desktop search focus, workspace grouping, and stop-turn visibility; the Other conversations group can be collapsed.
• Added DeepSeek, OpenAI, and Anthropic service presets plus model discovery and multi-select for OpenAI-compatible endpoints; credentials use the OS credential store or environment-variable references.
• Added a no-approval tier that requires explicit confirmation; workspace boundaries, deny rules, and safety guards remain active.
• Added independent px controls for interface, user-message, and assistant-message fonts, adjustable transcript line spacing, and keyboard/scroll-wheel access to approval settings.

Downloads

The Linux AppImage runs as a portable app; the deb package is for Debian/Ubuntu-based distributions. The desktop package includes its Node Host and does not require a separate Node.js installation.

OS	Package	Use	Download
Windows x64	NSIS (.exe)	Installer wizard	Download
Linux x64	AppImage	Portable app	Download
Linux x64	deb (.deb)	Debian/Ubuntu-based distributions	Download

Verify downloads

• SHA256SUMS — SHA-256 checksums for the installers
• desktop-release-manifest.json — Version, source commit, and asset manifest

This release does not include publisher signatures; SHA-256 checksums verify file integrity.

desktop-v0.0.4

Desktop v0.0.4

简体中文

• Desktop 改用 Electron，新增工作区选择和审批设置，并改进导出与会话切换时的安全处理。
• 提供 Windows x64 安装包和 Linux x64 AppImage、deb。

下载

Linux AppImage 适合直接运行；deb 适合 Debian/Ubuntu 系发行版安装。桌面包包含自己的 Node Host，无需额外安装 Node.js。

操作系统	格式	用途	下载
Windows x64	NSIS (.exe)	安装向导	下载
Linux x64	AppImage	免安装运行	下载
Linux x64	deb (.deb)	Debian/Ubuntu 系发行版	下载

校验下载

• SHA256SUMS — 安装包 SHA-256 校验值
• desktop-release-manifest.json — 版本、来源提交和资产清单

本版本未提供发布者数字签名；SHA-256 校验值用于检查文件完整性。

English

• Desktop now uses Electron, adds workspace selection and approval settings, and improves export safety across session changes.
• Provides a Windows x64 installer and Linux x64 AppImage and deb packages.

Downloads

The Linux AppImage runs as a portable app; the deb package is for Debian/Ubuntu-based distributions. The desktop package includes its Node Host and does not require a separate Node.js installation.

OS	Package	Use	Download
Windows x64	NSIS (.exe)	Installer wizard	Download
Linux x64	AppImage	Portable app	Download
Linux x64	deb (.deb)	Debian/Ubuntu-based distributions	Download

Verify downloads

• SHA256SUMS — SHA-256 checksums for the installers
• desktop-release-manifest.json — Version, source commit, and asset manifest

This release does not include publisher signatures; SHA-256 checksums verify file integrity.