| 1 | # Changelog |
| 2 | |
| 3 | All notable changes to this project will be documented in this file. |
| 4 | |
| 5 | The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), |
| 6 | and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). |
| 7 | |
| 8 | ## [Unreleased] |
| 9 | |
| 10 | ## [0.9.4] - 2026-08-05 |
| 11 | Codewhale v0.9.4 ships the release-train harness work: the familiar Fleet |
| 12 | roster/setup face with a clear operator-leader and user/folder scope, a |
| 13 | work strip that keeps actionable agents instead of a permanent archive, |
| 14 | waiting policy that forbids polling without freezing independent work, |
| 15 | calmer tool output and session recovery, account/Workflow-search/ |
| 16 | automation/handoff surfaces, a shorter translation-ready website, and |
| 17 | release-blocker fixes across permissions, DeepSeek Responses, SQLite, |
| 18 | File edits, terminal width, and Windows installation. |
| 19 | |
| 20 | ### Added |
| 21 | |
| 22 | - Sub-agent checkpoint resume: `agents/followup` resumes an |
| 23 | `interrupted_continuable` child from its checkpoint into a fresh agent loop — |
| 24 | new agent id, original prompt plus the prior conversation tail — when a |
| 25 | runtime is attached, and otherwise keeps queue-only semantics with the |
| 26 | `continuation_handle` returned; a second followup on the same interrupted id |
| 27 | returns the existing resumed target instead of spawning a duplicate (PR #5242). |
| 28 | - MCP Registry discovery with Registry-first tool selection: `registry_sync` |
| 29 | surfaces the eligible local stdio catalog as a complete model-side candidate |
| 30 | set, connect-failure messages classify early-exit and usage-help output and |
| 31 | point recovery at the next Registry candidate, and a bundled `mcp-discovery` |
| 32 | skill documents the flow (PR #5238). |
| 33 | - Progressive fresh-context disclosure: fresh sessions ship a minimal |
| 34 | constitutional kernel — ground truth, user intent and scope, truthful |
| 35 | completion, guarantees in mechanism, and precedence — with procedural |
| 36 | playbooks disclosed on demand, an opt-in project context pack |
| 37 | (`project_context_pack_enabled`) counted in context reports, and `load_skill` |
| 38 | catalogue discovery via `name="list"`; the measured fresh-context budget |
| 39 | drops by roughly 40% (PR #5077). |
| 40 | - Named Fleet store v2: one self-contained TOML Fleet per configuration |
| 41 | (`schema = "fleet"`), with scope-explicit selection (user-global default vs |
| 42 | folder override), migration receipts from legacy role profiles, and atomic |
| 43 | saves that refuse to clobber a different Fleet on the same slug. |
| 44 | - Scout replaces the user-facing "faster" control: catalog-verified fast |
| 45 | siblings only, never a guessed model name; pinned Scout survives operator |
| 46 | changes. |
| 47 | - Truthful model-picker rows: vision/tools/limits chips only when the catalog |
| 48 | knows, with provider → family → exact model grouping. |
| 49 | |
| 50 | - **Opt-in product telemetry, off by default.** A first-run notice asks once, on |
| 51 | a terminal, with declining pre-selected — Enter declines. Nothing is collected |
| 52 | unless both `telemetry = true` and a recorded "Enable" answer are present, so |
| 53 | a `telemetry = true` written before this release stays inert: the key has been |
| 54 | settable and inert for a long time, and setting it was never consent. |
| 55 | |
| 56 | An enabled session sends its batches to the first-party ingest endpoint, |
| 57 | `https://telemetry.codewhale.net/v1/telemetry`, which is the shipped default |
| 58 | for `telemetry_endpoint`. That is a Cloudflare Worker whose complete source is |
| 59 | in this repository under `telemetry-ingest/`; it writes to Workers Analytics |
| 60 | Engine, whose row is exactly `_sample_interval`, `blob1`–`blob20`, `dataset`, |
| 61 | `double1`–`double20`, `index1`, and `timestamp` — **there is no IP, country, |
| 62 | or geo column**, so storing one is structurally impossible rather than merely |
| 63 | disabled. The handler reads two request headers, never touches the request's |
| 64 | geo properties, logs nothing, and validates against a closed field set that |
| 65 | rejects an entire batch carrying any unpublished key. Cloudflare's retention |
| 66 | for that data is a fixed three months. Setting `telemetry_endpoint = ""` |
| 67 | instead writes each batch to `$CODEWHALE_HOME/telemetry/dryrun.jsonl` and |
| 68 | constructs no HTTP client at all, so you can read exactly what would have been |
| 69 | sent. |
| 70 | |
| 71 | Turning it off is an answer, not a flag: it deletes the random install id, |
| 72 | truncates every buffered event, and leaves a permanent tombstone that a |
| 73 | session already running re-checks before it appends and before it sends. A |
| 74 | failed wipe fails closed. `CODEWHALE_TELEMETRY=0` is a hard floor that beats |
| 75 | `--telemetry true` and the config key, and a value the parser cannot read |
| 76 | also resolves to off. Fleet workers are hard-off. A repo-local |
| 77 | `.codewhale/config.toml` can set neither key. |
| 78 | |
| 79 | Never collected: prompts, completions, tool arguments, diffs, file contents, |
| 80 | filenames, paths, git remotes, repo or branch names, memory entries, chat |
| 81 | history, credentials (not even a boolean asserting one exists), model ids, |
| 82 | custom provider table names, MCP server names, error or panic message bodies, |
| 83 | per-event timestamps, keystrokes, clipboard, screenshots, or location. The |
| 84 | full schema is [`docs/TELEMETRY.md`](docs/TELEMETRY.md), and a test parses the |
| 85 | field names out of that file and asserts set equality with the structs the |
| 86 | serializer uses. |
| 87 | |
| 88 | This supersedes the roadmap's previous "no Codewhale product telemetry" entry, |
| 89 | which moves from "Ruled out" to an opt-in framing. What stays ruled out: |
| 90 | always-on or silent telemetry, per-keystroke or per-tool-call phone-home, and |
| 91 | any third-party ad or analytics SDK in the runtime binary. |
| 92 | - Registered `GLM-5.3` (direct Z.ai) and `z-ai/glm-5.3` (OpenRouter) as |
| 93 | selectable GLM routes, with their aliases (`glm-5.3`, `glm-5-3`, |
| 94 | `zai-glm-5.3`, `zai-glm-5-3`). Z.ai had **not released GLM-5.3 as of |
| 95 | 2026-08-03** — the ids are registered so they resolve to the Z.ai/OpenRouter |
| 96 | routes instead of being rewritten to another vendor's model, and they will |
| 97 | fail upstream until Z.ai ships the model. Metadata (context, output, |
| 98 | reasoning controls) is inherited wholesale from `GLM-5.2` pending official |
| 99 | Z.ai release metadata; pricing is intentionally absent, and `GLM-5.2` remains |
| 100 | the default Z.ai model. No third-party gateway roster gained the model: |
| 101 | OpenCode Zen, OpenCode Go, Alibaba Model Studio, and TelecomJS publish no |
| 102 | glm-5.3 entry, so Codewhale advertises none. |
| 103 | |
| 104 | - Managed Codewhale account commands (`account login`, `status`, `logout`, and |
| 105 | `keys`) with browser device flow, profile- and origin-scoped secure sessions, |
| 106 | refresh/revocation, redacted BYOK-vault management, and a token-free Runtime |
| 107 | account receipt. Provider authentication remains separate, and `cloud` |
| 108 | remains a compatibility alias. |
| 109 | - `/automation` operator controls to list, inspect, pause, resume, delete, and |
| 110 | run durable automations. Creation remains on the approval-gated |
| 111 | model-visible `automation` tool. |
| 112 | - A provider-neutral `WorkflowSearchSpec` authoring and freeze boundary, plus |
| 113 | structured 2–16-candidate experimental search in the best-of-N Workflow |
| 114 | starter. It freezes baseline, route, evidence, evaluator, gate, score, budget, |
| 115 | and review policy before admission; it validates gate/scoring commands but |
| 116 | does not execute or certify them itself. |
| 117 | - The bundled generation-9 `handoff` skill for compact, decision-ready |
| 118 | continuation across sessions. |
| 119 | - Expanded terminal LaTeX rendering for aligned and matrix environments, |
| 120 | cases, arrays, text/font/accent commands, brackets, symbols, and |
| 121 | command-aware scripts (PR #4981). |
| 122 | - Exact 40-character build provenance and secure account-session capability |
| 123 | receipts on `/v1/runtime/info`; unknown source provenance continues to fail |
| 124 | closed. |
| 125 | - Acceptance-level Gherkin coverage locking the existing user-command |
| 126 | precedence, alias shadowing, fallback, and invalid-command error contract |
| 127 | (PR #4992). |
| 128 | |
| 129 | ### Changed |
| 130 | |
| 131 | - `/fleet` is the familiar roster/setup face again. The operator row is the |
| 132 | Fleet leader (session model); the header names the selected saved Fleet and |
| 133 | whether it is user-global or folder-scoped. Named-Fleet switching lives under |
| 134 | `/fleet fleets` (Enter selects in the row's own scope). Session route changes |
| 135 | stay temporary until `/fleet save`, `/fleet save-as`, or `/model save-default`. |
| 136 | - Waiting-for-subagents directions forbid peek/status polling and sleep-as-wait, |
| 137 | but allow independent work that does not depend on a child's result — the |
| 138 | parent no longer freezes mid-turn with useful non-conflicting work available. |
| 139 | - `workflow run` no longer requires `--fleet`; a saved Fleet is an optional pin |
| 140 | layer over roles + the session route. |
| 141 | - Homepage and getting-started copy is shorter and scannable across locales, |
| 142 | with dictionary key and `{brand}` token parity preserved. |
| 143 | |
| 144 | - Tool results now render as ordinary bounded previews with real expansion; |
| 145 | storage, retention-ledger, and internal evidence language no longer leak into |
| 146 | normal transcripts. |
| 147 | - Prose wrapping, goal state, modal questions, composer-tail behavior, and |
| 148 | ambient motion now follow one deterministic interface contract across narrow |
| 149 | terminals and fast streams. |
| 150 | - Scout and reviewer Fleet roles gain network access and the bounded |
| 151 | verification surface for real reconnaissance while retaining the no-write, |
| 152 | no-raw-shell security floor. |
| 153 | - Workflow runs may describe up to 1,000 tasks while admitting at most 16 live |
| 154 | tasks at once through the host concurrency gate. Tournament ordering now |
| 155 | supports explicit score-first selection while retaining its cost-first |
| 156 | default. |
| 157 | - Runtime permission compatibility inputs resolve to one live |
| 158 | `permission_posture`. Auto-Review can proceed without approval or structured |
| 159 | question modals, unresolved holds fail closed, and a call planned under stale |
| 160 | authority is retried after a posture change (PR #5025). |
| 161 | - Duplicate and drifting per-turn metadata has been removed in favor of |
| 162 | runtime-owned authority, and large inline account and skill tests now live in |
| 163 | owned test seams. |
| 164 | - Pinned Ratatui to 0.30.0 and ratatui-core to 0.1.0. ratatui-core 0.1.1+ |
| 165 | makes `Terminal::clear()` issue a blocking cursor-position report that |
| 166 | raced the TUI input loop and could kill first launch; both pins are |
| 167 | load-bearing, because 0.30.0 declares `ratatui-core ^0.1` and would |
| 168 | otherwise resolve forward on its own (PR #5192 by @bistack; upstream |
| 169 | ratatui/ratatui#2640). |
| 170 | - Updated globset to 0.4.19, clap-complete to 4.6.8, |
| 171 | futures-util to 0.3.33, libc to 0.2.189, actions/stale to 11.0.0, and |
| 172 | docker/login-action to 4.5.2. The locked graph also includes the |
| 173 | event-listener 5.4.2 fix for RUSTSEC-2026-0221. |
| 174 | |
| 175 | ### Fixed |
| 176 | |
| 177 | - An explicit `type=builder` (or its `implementer` alias) plus |
| 178 | `write_authority=read_only` now fails closed at spawn instead of launching a |
| 179 | labeled write role that silently had only recon tools and then self-BLOCKED |
| 180 | after burning a turn (#5123). The check is deliberately narrow, because two |
| 181 | neighbouring combinations are legitimate and stay legal: |
| 182 | - `type=worker` + `read_only` — worker is the unnamed default (it renders as |
| 183 | `general`) and takes its capability from authority, not from its name, so a |
| 184 | read-only worker is an ordinary general-purpose child. Worker, scout, |
| 185 | reviewer, and verifier remain the four canonical read-only Fleet roles. |
| 186 | - any `role` + `read_only` — `role` is an identity for roster resolution, not |
| 187 | a capability claim, so an acceptance Workflow can still resolve |
| 188 | `implementer` to its saved profile while scoping that child to verification. |
| 189 | |
| 190 | Callers that spelled a read-only narrowing as `type: "implementer"` should |
| 191 | move it to `role: "implementer"`. |
| 192 | - User-global credentials survive an explicit workspace `CODEWHALE_CONFIG_PATH` |
| 193 | that selects a route with no local key — readiness probes the user-global |
| 194 | provider table before concluding a key is missing. |
| 195 | - Sub-agent token figures on the work bar accumulate input+output (the same |
| 196 | total the worker budget uses) instead of completion tokens alone; elapsed |
| 197 | time still freezes when the child settles. |
| 198 | - Live work-bar rows for sub-agents show how many to-dos they still have |
| 199 | left (`N left`) when the child's own ledger has unsettled items — never a |
| 200 | fabricated zero when no list exists. |
| 201 | |
| 202 | - Surfaces no longer claim an OS sandbox on platforms that cannot enforce one. |
| 203 | The policy resolver takes no platform input, so on default Linux (bubblewrap |
| 204 | is opt-in) and on all Windows the header chip read `files: workspace` and |
| 205 | `/status` read `sandbox workspace-write` while nothing was restricted. Both |
| 206 | now resolve the real backend and say `(unenforced)`. |
| 207 | - `tool_category` hook conditions matched only retired tool names, so a |
| 208 | `category = "shell"` **deny** hook — the security control `docs/HOOKS.md` |
| 209 | documents — silently never fired. Categories now use the registered names, |
| 210 | and multi-action tools classify by action. |
| 211 | - A `Retry-After` header of `-5`, `nan`, or `1e300` crashed the request task |
| 212 | (`Duration::from_secs_f64` panics on a negative). Parsing is now guarded and |
| 213 | bounded to one hour. |
| 214 | - Bearer tokens no longer leak into operator-visible receipts. `Authorization: |
| 215 | Bearer <jwt>` split into two tokens and the JWT matched no redaction rule; |
| 216 | prefix matching was also case-sensitive, so `SK-live-…` survived. |
| 217 | - `prune_older_than` destroyed the NEWEST rollback snapshots and kept the old |
| 218 | ones — on every boot, for any workspace with snapshots spanning the retention |
| 219 | window. Both prune paths now share one orphan-chain rebuild and preserve each |
| 220 | survivor's real timestamp. |
| 221 | - An absolute or relative command path no longer defeats every execpolicy deny |
| 222 | rule (`/bin/rm -rf /` did not match a `rm -rf /` rule), and a typed `Allow` |
| 223 | rule no longer auto-approves a chained suffix such as `git log ; curl … | sh`. |
| 224 | - Wrong types on `File` read range params and `Bash` stdin/cwd/task_id are now |
| 225 | errors instead of silent defaults — a `start_line:"1200"` string used to |
| 226 | return the head of the file, and a non-string `stdin` ran the command with no |
| 227 | stdin and reported success. |
| 228 | - Multibyte tool ids no longer panic the context inspector, wide (CJK) text no |
| 229 | longer overflows the decision card, and a hostname like `127.evil.example.com` |
| 230 | is no longer treated as loopback. |
| 231 | - Refusals name calls the model can actually make (`rlm action='open'` rather |
| 232 | than a retired `rlm_open`; `Bash` rather than `exec_shell`). |
| 233 | |
| 234 | - Sub-agent dispatch no longer aborts the process. The Tokio runtime was built |
| 235 | by `#[tokio::main]`, leaving every worker thread on the 2 MiB default while |
| 236 | only the owner thread received the explicit 16 MiB stack — and the engine runs |
| 237 | on a worker. A debug-build `agent` dispatch exceeded that stack and raised |
| 238 | SIGABRT, which is not a panic and so could not be caught; the process died |
| 239 | mid-spawn with no child request ever issued. Release builds were unaffected. |
| 240 | - Fleet profiles that pin a provider no longer leak a bare model id onto the |
| 241 | session route. `model_overrides` exported each role's model while dropping its |
| 242 | provider, so a scout pinned to another provider's model was dispatched against |
| 243 | the active client and denied at the wire — visible as an instant auth failure |
| 244 | on the first sub-agent of a fan-out. |
| 245 | - The rail's Pinned panel no longer spends four rows saying "No active work". |
| 246 | An empty panel now collapses like the Tasks panel always has, and the settings |
| 247 | migration no longer folds the default `sidebar_focus = "auto"` into a pinned |
| 248 | always-on strip, which had silently handed that panel to every user who had a |
| 249 | settings file at all. (An *empty* panel collapses; a panel holding settled |
| 250 | to-dos or finished workers is not empty — see the standing-register entry |
| 251 | below.) |
| 252 | - The work bar keeps settled to-dos and an honest Subagents header, while |
| 253 | completed/cancelled workers collapse out of the Top strip so fan-outs do not |
| 254 | permanently eat the transcript. Failed or interrupted workers stay visible |
| 255 | (they still need attention). Settled agents remain reachable through the |
| 256 | Agents panel and catalog. To-do rows say their state in words (pending / |
| 257 | in progress / completed / cancelled), and sub-agent rows carry type, |
| 258 | objective, elapsed, and input+output tokens. Every work row is a door in |
| 259 | every rail panel and placement: click and Enter open the row's world |
| 260 | (work inspector / agent details — finished agents included) instead of |
| 261 | doing nothing. A click after the detail pager closed itself reopens the |
| 262 | detail rather than being swallowed by a stale toggle. |
| 263 | - The rail strip yields its rows to the transcript when the terminal cannot |
| 264 | seat both, so the idle ocean survives at 24 rows instead of being evicted. |
| 265 | - `code_execution` and `js_execution` no longer describe themselves to the model |
| 266 | as sandboxed. Both are ordinary local subprocesses with no seccomp, jail, or |
| 267 | container (PR #5221 by @h3c-hexin and @asto18089). |
| 268 | - Model Studio reasoning controls now fail closed on the host rather than on the |
| 269 | provider enum, so a custom `base_url` no longer receives Alibaba-specific |
| 270 | `enable_thinking` fields, and `qwen3.8-max` is no longer sent a thinking |
| 271 | switch it does not accept (PR #5233 by @Inference1, closing #5203). |
| 272 | - `config.example.toml` no longer claims Shift+Tab cycles the reasoning tier. |
| 273 | Shift+Tab cycles the permission posture; Ctrl+T cycles reasoning |
| 274 | (found by @vFONGv, PR #5229). |
| 275 | |
| 276 | - Alibaba Model Studio reasoning controls are now route- and model-scoped |
| 277 | instead of provider-wide (#5203, harvested from #5233 by |
| 278 | [@Inference1](https://github.com/Inference1)). Codewhale sends |
| 279 | `enable_thinking` / `preserve_thinking` / `reasoning_effort` only when the |
| 280 | configured `base_url` is a verified Alibaba Chat Completions host, so |
| 281 | pointing a `modelstudio-*` provider ID at a custom gateway no longer injects |
| 282 | DashScope's dialect into it. `qwen3.8-max` and `qwen3.8-max-preview` are |
| 283 | thinking-only and no longer receive an `enable_thinking: false` they cannot |
| 284 | honor; `preserve_thinking` is sent for the models documented to accept it, so |
| 285 | their reasoning trace survives into the next turn; and `deepseek-v4*` / |
| 286 | `glm-5.x` map the reasoning tier onto the documented `high` / `max` ladder. |
| 287 | |
| 288 | - xAI device login now recovers from a config that points at a missing |
| 289 | Codewhale-owned credential generation instead of failing every attempt |
| 290 | with a generic activation error, and finalize failures report the full |
| 291 | error chain (#5032). |
| 292 | - API keys saved to the secret store no longer read as unconfigured for |
| 293 | providers that are not currently active; a configured Kimi/Moonshot key |
| 294 | survives provider switches and restarts without re-entry (#5033). |
| 295 | - Switching to the Codex provider with no saved model now lands on the live |
| 296 | roster's flagship model instead of a stale static default (#5034). |
| 297 | - Worktree-isolated Fleet builders no longer contend on the per-workspace |
| 298 | delegated-coordination lock, and a failed lock acquisition is retried on |
| 299 | use instead of being memoized for the life of the process (#5036). |
| 300 | - Fleet dispatch now rebinds the child client when the resolved profile |
| 301 | model requires a different wire protocol (DeepSeek flash on Responses), |
| 302 | instead of failing deterministically on the worker's first request |
| 303 | (#5042). |
| 304 | - DeepSeek Responses now sends `reasoning.effort: "none"` for the Off tier, |
| 305 | shows a truthful notice instead of silently discarding server-side |
| 306 | `web_search_call` items, and parses cache-hit, cache-miss, cache-write, and |
| 307 | pricing telemetry while retaining the OpenAI-style nested fallback. |
| 308 | - File edits now explain no-op and missing-search failures, reject newly |
| 309 | unbalanced C/C++ preprocessor replacements, handle the reported |
| 310 | CRLF/non-ASCII cases, and safely relocate stale unified-diff hunks only when |
| 311 | whole-file context is unique (PRs #5008 and #5030). |
| 312 | - Circled digits, enclosed alphanumerics, and keycap graphemes use consistent |
| 313 | two-column measurement in Codewhale, Ratatui, and CJK terminals, preventing |
| 314 | missing-character and phantom-space corruption (PR #5001). |
| 315 | - SQLite connections install their busy timeout before locking setup and avoid |
| 316 | rewriting persistent WAL mode on every open, removing the concurrent-open |
| 317 | release-gate failure. |
| 318 | - The Windows installer preserves long current-user `PATH` values, their |
| 319 | registry type, and unrelated entries across install and uninstall (PR #5006). |
| 320 | - Provider configuration no longer contains user-reachable panic paths when |
| 321 | metadata or prior credential state is missing. |
| 322 | - Resuming a session restores composer text only from a same-session persisted |
| 323 | draft; submitted prompts and internal background-runtime envelopes remain in |
| 324 | history instead of appearing in the composer (PR #5029). |
| 325 | - Shared CI now handles bot-authored issue-link checks, provisions cargo-deny's |
| 326 | toolchain, and fetches the locked test graph before offline runtime-budget |
| 327 | validation. |
| 328 | - Re-quote each linker argument in the Windows OpenHarmony clang launcher so a |
| 329 | spaced SDK path (e.g. the default `D:\DevEco Studio\...` install) keeps its |
| 330 | `--sysroot` intact through the final Rust link, and extend the no-SDK release |
| 331 | guard to keep the re-quoting contract (PR #5095). |
| 332 | |
| 333 | - The shell tool reports the real elapsed wait time in its result content |
| 334 | instead of echoing the requested timeout (PR #5240). |
| 335 | - Transcript wheel scrolling under iTerm2: xterm alternate-scroll (DECSET |
| 336 | 1007) now stays off while mouse capture is active, so wheel events arrive as |
| 337 | mouse events instead of being converted into arrow keys (#5223, PR #5234). |
| 338 | |
| 339 | ### Removed |
| 340 | |
| 341 | - The default model-facing SlopLedger implementation, its storage-oriented |
| 342 | transcript language, and the `/debt`, `/cleanup`, `/slop`, and `/canzha` |
| 343 | command surface. |
| 344 | |
| 345 | ### Contributors |
| 346 | |
| 347 | - [Sh1Zuku](https://github.com/SparkofSpike) (`@SparkofSpike`) contributed |
| 348 | LaTeX rendering in PR #4981, completed circled-digit/keycap width handling in |
| 349 | PR #5001, and delivered actionable File-edit recovery in PR #5008; for this |
| 350 | train he resumed interrupted sub-agents from checkpoints in PR #5242, |
| 351 | surfaced real shell wait elapsed time in PR #5240, and kept alternate-scroll |
| 352 | off while mouse capture is active in PR #5234. |
| 353 | - [XhesicaFrost](https://github.com/XhesicaFrost) (`@XhesicaFrost`) fixed long |
| 354 | Windows user-PATH preservation in PR #5006. |
| 355 | - [Paulo Aboim Pinto](https://github.com/aboimpinto) (`@aboimpinto`) added the |
| 356 | user-command dispatch acceptance contract in PR #4992. |
| 357 | - [DracheTek](https://github.com/DracheTek) (`@DracheTek`) provided the |
| 358 | multilingual, CRLF-heavy File-edit failure report in issue #5003. |
| 359 | - [An Ziwu](https://github.com/MuRongMoQing) (`@MuRongMoQing`) reported the |
| 360 | Windows PATH-overwrite defect in issue #4685. |
| 361 | - [shenjackyuanjie](https://github.com/shenjackyuanjie) (`@shenjackyuanjie`) |
| 362 | fixed the Windows OpenHarmony linker re-quoting for spaced SDK paths in |
| 363 | PR #5095. |
| 364 | - [bistack](https://github.com/bistack) (`@bistack`) contributed MCP Registry |
| 365 | discovery with Registry-first tool selection in PR #5238. |
| 366 | - [vFONGv](https://github.com/vFONGv) (`@vFONGv`) wrote the zh-CN Windows |
| 367 | beginner guide with screenshots in PR #5229, harvested after its base branch |
| 368 | was accidentally deleted during maintainer cleanup. |
| 369 | |
| 370 | ## [0.9.3] - 2026-07-31 |
| 371 | |
| 372 | This is the Codewhale v0.9.3 source candidate. It is not a published release |
| 373 | until the matching tag, packages, checksums, and release assets exist. |
| 374 | |
| 375 | DeepSeek V4 Flash is now a first-class Codewhale route, and the agent-facing |
| 376 | tool surface has been reduced to the canonical action tools that current |
| 377 | models actually need. This release also hardens credential, authorization, |
| 378 | durability, compaction, and macOS File Provider boundaries while deleting |
| 379 | stale runtime and dependency surface. |
| 380 | |
| 381 | ### Added |
| 382 | |
| 383 | - Native `deepseek-v4-flash` support over DeepSeek's Responses API, including |
| 384 | stateless reasoning-item replay, semantic SSE terminal events, structured |
| 385 | function calls and outputs, `apply_patch`, and model-aware wire-format |
| 386 | selection. Exact current Flash IDs use Responses; future direct |
| 387 | `deepseek-vN-*` model IDs inherit that route conservatively, while custom |
| 388 | DeepSeek-compatible endpoints retain Chat Completions unless configured |
| 389 | otherwise. |
| 390 | - A pipe-only `codewhale auth print-api-key` handoff for explicitly selected |
| 391 | providers. It shares Codewhale's home-scoped credential authority, refuses |
| 392 | terminal output, and prevents sentinel placeholders from becoming live |
| 393 | credentials. |
| 394 | - Per-turn `max_tool_calls` enforcement at the engine admission gate, plus a |
| 395 | named-file write scope with a separate read seam. The runtime now rejects |
| 396 | over-budget calls before execution and keeps the operator's write boundary |
| 397 | explicit (#4415). |
| 398 | - Runtime-contract, source-structure, and persistence-backlog ratchets that |
| 399 | name drift instead of allowing large ownership surfaces to grow silently |
| 400 | (#3921, #4785). |
| 401 | |
| 402 | ### Changed |
| 403 | |
| 404 | - Model-visible built-ins now use the canonical `Bash`, `File`, and `Run` |
| 405 | action schemas. `apply_patch` remains available as the one direct custom |
| 406 | edit tool supported by DeepSeek Responses. The bundled stop-ship workflow, |
| 407 | Fleet fixtures, shell shortcut, and engine tests use the same canonical |
| 408 | vocabulary. |
| 409 | - Canonical `File { action: "write" }` requests now pass through the same |
| 410 | semantic repo-law checks as the former write path. Approval, Full Access, |
| 411 | and workflow execution cannot bypass the repository safety floor by choosing |
| 412 | the canonical schema. |
| 413 | - Codewhale home resolution is shared across the CLI, TUI, state, and secret |
| 414 | stores. `doctor` is offline by default, distinguishes credential source from |
| 415 | availability, and reports one consistent path snapshot. |
| 416 | - Durable runtime event writes are serialized across simultaneous processes, |
| 417 | blocking history waits move off async workers, and provider quota exhaustion |
| 418 | remains typed and retryable through compaction (#4522). |
| 419 | - Skill discovery caches the merged catalog behind watched-mtime validation; |
| 420 | large skill, engine, subagent, UI, and ambient-ocean test blocks now live in |
| 421 | owned test seams. |
| 422 | - Reasoning summaries stay in the user's language, complete jellyfish |
| 423 | silhouettes relocate around transcript text, and cached ocean frames include |
| 424 | their palette identity (#4807). |
| 425 | - The authorization-order contract now documents and tests how modes, hooks, |
| 426 | permission rules, safety floors, repo law, approvals, and sandboxing compose |
| 427 | (PR #4980). |
| 428 | |
| 429 | ### Fixed |
| 430 | |
| 431 | - macOS sandbox extensions cover CloudStorage/File Provider workspaces without |
| 432 | broadening unrelated paths; thanks @Watcher24 for the #4085 report and |
| 433 | reproduction. |
| 434 | - Foreground shell state detaches before steering, so an interrupted command |
| 435 | cannot keep owning the composer (PR #4979). |
| 436 | - MCP application-level failures and malformed error envelopes fail closed |
| 437 | instead of looking like successful tool output. |
| 438 | - Optional PDF failures are truthful and PDF classification no longer misses |
| 439 | supported inputs. |
| 440 | - Bracketed-paste contents are redacted from traces, and credential diagnostics |
| 441 | never treat placeholder sentinels as usable keys. |
| 442 | |
| 443 | ### Removed |
| 444 | |
| 445 | - The legacy callable aliases `exec_shell`, `run_shell_command`, `read_file`, |
| 446 | `write_file`, `list_dir`, `grep_files`, `file_search`, and the duplicate |
| 447 | Work/RLM registrations. Historical transcript and policy semantics remain |
| 448 | readable, but new model turns receive only the canonical action surface. |
| 449 | - The bundled PDF parser dependency chain, replacing it with the smaller |
| 450 | optional extraction boundary tracked by #4382. |
| 451 | |
| 452 | ### Contributors |
| 453 | |
| 454 | - [Turisla](https://github.com/greyfreedom) (`@greyfreedom`) documented and |
| 455 | locked the authorization-order contract in PR #4980. |
| 456 | - [Nightt](https://github.com/nightt5879) (`@nightt5879`) fixed foreground |
| 457 | shell detachment before steering in PR #4979. |
| 458 | - [Watcher24](https://github.com/Watcher24) (`@Watcher24`) provided the macOS |
| 459 | File Provider report and reproduction for #4085. |
| 460 | - [Fred Leitz](https://github.com/fleitz) (`@fleitz`) retains required |
| 461 | source-candidate credit for the canonical `Bash` workspace fix from PR #4673 |
| 462 | and issue #4674. |
| 463 | |
| 464 | ## [0.9.2] - 2026-07-29 |
| 465 | |
| 466 | This is the Codewhale v0.9.2 source candidate. It is not a published release |
| 467 | until the matching tag, packages, checksums, and release assets exist. |
| 468 | |
| 469 | ### Changed — behavior |
| 470 | |
| 471 | - **Legacy `model = auto` no longer elects a network classifier on its own.** |
| 472 | Holding a DeepSeek API key used to silently select `deepseek-v4-flash` as the |
| 473 | classifier for every Auto turn — a per-turn cost on a route nobody asked for, |
| 474 | and one provider privileged over the rest. Auto now stays local and free |
| 475 | unless an explicit `[auto.router]` block names a provider and model. |
| 476 | |
| 477 | **If you relied on the implicit default**, restore it explicitly: |
| 478 | |
| 479 | ```toml |
| 480 | [auto.router] |
| 481 | provider = "deepseek" |
| 482 | model = "deepseek-v4-flash" |
| 483 | ``` |
| 484 | |
| 485 | `[auto.router]` remains legacy `model = auto` configuration. It is unrelated |
| 486 | to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by |
| 487 | name from a Fleet file and decides only how hard an already-frozen route |
| 488 | thinks. |
| 489 | |
| 490 | Landed since v0.9.1, not yet released. A cluster of defects found by a |
| 491 | read-through audit of the policy engine, the MCP proxy, the session index, |
| 492 | and the app-server bridge — several of them cases where the wrong outcome |
| 493 | was reached silently, behind a response or a log line that looked fine. The |
| 494 | release also adds opt-in session, reasoning, localization, and inspectability |
| 495 | surfaces; existing defaults remain stable unless an entry below explicitly |
| 496 | says otherwise. |
| 497 | |
| 498 | ### Added |
| 499 | |
| 500 | - `/permissions` now lists the active user permission-rule source, each rule's |
| 501 | effective matcher and global/repository scope, and whether that scope applies |
| 502 | in the current workspace. `/permissions remove <number>` previews deletion |
| 503 | and requires a snapshot-bound confirmation token, so a concurrent edit |
| 504 | cannot move a different rule under the confirmed index. Appends and removals |
| 505 | share one adjacent lock, preserve unrelated TOML formatting and comments, |
| 506 | atomically replace `permissions.toml`, and reload the live user ruleset |
| 507 | without clearing session-only approvals. `/config ask-rules` remains a |
| 508 | compatibility entry; rule creation, glob/directory rules, and deny |
| 509 | persistence remain out of scope (#1186, PR #4960 by @greyfreedom). |
| 510 | |
| 511 | - `/preview-request` (aliases `/dryrun` and `/preview_request`) is a human-only, |
| 512 | provider-free inspection of the next primary turn. Production dispatch and |
| 513 | preview share one prepared-request seam across Chat Completions, Anthropic |
| 514 | Messages, and OpenAI Responses, so the manifest reads the final wire model, |
| 515 | reasoning controls, tool choice, tool schemas, and body hash from the same |
| 516 | value production sends. Route, tool, or body facts that require Auto's |
| 517 | provider classifier, an MCP connection, mutable hooks, compaction, or queued |
| 518 | runtime injections remain typed unavailable. The manifest reports exact |
| 519 | primary role/lane identity, upstream route-source provenance, requested and |
| 520 | effective reasoning, canonical JSON sizes, conservative offline estimates, |
| 521 | and provider-reported usage as unavailable because no request ran. It never |
| 522 | adds a model-visible tool, sends a provider call, or prints prompt, message, |
| 523 | credential, endpoint-path, or workspace-path content. The explicit |
| 524 | `/preview-request base-prompt` mode prints only the exact effective base |
| 525 | prompt; effective system text remains protected behind its final hash. The |
| 526 | exact body includes the same authoritative transient Work/To-do tail used by |
| 527 | production, including graph-backed state newer than the legacy projection. |
| 528 | Preflight preserves production's separately framed base-plus-Work estimate, |
| 529 | and fails closed when the authoritative projection is unavailable. An |
| 530 | exhausted active goal token budget also produces a typed unavailable result |
| 531 | before any outbound request is built. |
| 532 | (#1004, #3928; dry-run concept harvested from PR #1099 by @GTC2080 / TaoMu.) |
| 533 | |
| 534 | - Slash commands, hotbar actions, and CLI entrypoints for the same Lane/Fleet |
| 535 | lifecycle operation now share one typed control-plane contract |
| 536 | (`codewhale-lane::control`): a stable `<domain>.<verb>` id, read-vs-write |
| 537 | authority, persistence scope, exact-identity target selection, retryability, |
| 538 | lifecycle outcome, and one bounded, sanitized receipt. `docs/COMMAND_CONTROL_PLANE.md` |
| 539 | documents it (#1888). |
| 540 | |
| 541 | - `/lane [list|status|interrupt|restart|resume]` — durable Lane control from the |
| 542 | composer, backed by the same executor `codewhale lane …` calls. `codewhale |
| 543 | lane interrupt|restart|resume` are the matching CLI verbs; `lane stop` stays as |
| 544 | a compatibility spelling of `lane interrupt`. Appending `@<lifecycle-seq>` to a |
| 545 | lane id fences a write to the exact durable generation you observed, so a |
| 546 | concurrent transition is rejected as a conflict rather than acted on (#1888). |
| 547 | |
| 548 | - `codewhale fleet list` and `/fleet [list|status|interrupt|resume]` — durable |
| 549 | Fleet run inspection and control from either surface, through shared DTOs that |
| 550 | carry the exact provider, provider-table id, model, effective reasoning tier, |
| 551 | and route source when the ledger records them, and a typed `not_recorded` / |
| 552 | `not_applicable` / `redacted` reason when it does not. Requested-vs-effective |
| 553 | reasoning is never back-filled: the ledger persists the effective tier only, so |
| 554 | the requested tier reports `not_recorded` (#4022). |
| 555 | |
| 556 | - The bundled skill pack now ships a `help` skill (catalog generation 7). It is |
| 557 | `invocation: explicit-only`, so it never enters the model's ambient catalogue |
| 558 | and costs no prompt budget. Its body is a routing card that points at the |
| 559 | surfaces this build actually exposes — `/help` and `/help <command>`, |
| 560 | `/skills` and `/skills inspect`, `/config`, `doctor`, and the `docs/` tree |
| 561 | when the workspace is a Codewhale checkout — and explicitly forbids pasting a |
| 562 | command list or settings table into context (#4698). |
| 563 | |
| 564 | - `crates/tui/assets/skills-catalog-matrix.json`: an authored, provider-free |
| 565 | expectation matrix covering every bundled skill (tier, invocation, aliases, |
| 566 | ambient-catalogue eligibility, shadowed aliases). Contract tests in |
| 567 | `crates/tui/src/skills/catalog_matrix.rs` assert a bijection between the |
| 568 | fixture and the shipped bundle, so the starter pack cannot change without an |
| 569 | explicit fixture update. The matrix covers positive eligibility and explicit |
| 570 | load, non-activation negatives, alias resolution, explicit-only exclusion, |
| 571 | alias-vs-canonical collision precedence, and prompt-budget invariants (no |
| 572 | duplicate catalogue entries, no aliases as extra entries, and the shipped |
| 573 | pack fitting inside the 12 000-char budget with no omitted-skills line). These |
| 574 | are deterministic registry/catalog/resolver assertions and make no claim about |
| 575 | semantic model routing (#4698). |
| 576 | |
| 577 | - Locale-routing coverage for the complete bundled catalog across every shipped |
| 578 | locale (`en`, `ja`, `zh-Hans`, `zh-Hant`, `pt-BR`, `es-419`, `vi`, `ko`). No |
| 579 | bundled skill ships a localized routing description and none was invented; |
| 580 | the tested contract is deterministic fallback to the canonical English |
| 581 | description, with the rendered catalogue byte-identical across locales. |
| 582 | Exact-tag match, primary-subtag fallback, and English fallback are covered |
| 583 | against a synthetic authored fixture, and the parity test fails if a bundled |
| 584 | skill ever gains localized metadata without source-backed coverage (#4698). |
| 585 | |
| 586 | - `docs/LIVE_SMOKE.md`: copy-pasteable, opt-in live-smoke instructions for Kimi |
| 587 | K3 and a second provider/model (DeepSeek). The runs are manual only — nothing |
| 588 | in CI, tests, or skills invokes them. They use `env -i` plus a throwaway |
| 589 | `CODEWHALE_HOME`; `HOME` is left unset rather than repurposed, and ambient |
| 590 | provider variables are not forwarded. The operator names the credential |
| 591 | variable explicitly, and the isolated child reads its value with echo off, |
| 592 | restores the prior terminal state on exit or interruption, and never persists |
| 593 | the value or puts it in a command argument. The page states the expected |
| 594 | route/model/reasoning/tool receipt fields while treating provider errors as |
| 595 | unclassified until provider configuration, authentication/entitlement, and |
| 596 | harness behavior have been corroborated independently (#4698). |
| 597 | |
| 598 | - Approval cards can now remember eligible safe shell and file-write approvals |
| 599 | as exact `allow` rules scoped to the current repository. Remembered shell |
| 600 | commands use complete-command matching, validated file and patch paths remain |
| 601 | workspace-relative, and dangerous, critical, or repo-law-held requests stay |
| 602 | ineligible and continue to require review. |
| 603 | |
| 604 | - `tui.header_items` (array of strings, optional, default `[]`): an opt-in |
| 605 | header chip showing cumulative session token usage as input / cache-hit / |
| 606 | output. Set `header_items = ["tokens"]` under `[tui]` to enable it. The |
| 607 | chip is the only elidable element of the header — the git label, context |
| 608 | meter, and version stamp keep their space, and narrow terminals drop the |
| 609 | chip rather than the baseline chrome. Unknown entries are warned about and |
| 610 | skipped so configs written by newer builds stay loadable by older ones |
| 611 | (#4520 requested by @eugenicum; PR #4610 by @XhesicaFrost, harvested with |
| 612 | co-authorship). |
| 613 | |
| 614 | - `thinking_default_expanded` lets reasoning blocks start open while keeping |
| 615 | Space as the per-block toggle. The setting is persisted, available through |
| 616 | native and runtime configuration, and documented for SSH/tmux accessibility |
| 617 | (issue #4925 and PR #4928 by @M-Maciej). |
| 618 | |
| 619 | - The transcript renders a conservative subset of LaTeX math as readable |
| 620 | Unicode without rewriting fenced/inline code, ordinary currency, escaped |
| 621 | dollars, or unknown commands. The contribution from PR #4973 by |
| 622 | @SparkofSpike was hardened and landed through PR #4974; reported by |
| 623 | @antarikshraya in #4957. |
| 624 | |
| 625 | - Session control now includes a sessions rail, shared archive projection, |
| 626 | picker archive controls, and opt-in interactive auto-resume with explicit |
| 627 | handoff behavior. The work closes the remaining session-browsing direction |
| 628 | from #2934; thanks @cy2311 for the original report. |
| 629 | |
| 630 | - The bundled contributor-onboarding skill can sync contribution context, |
| 631 | select the appropriate gate, and prepare a digest without inflating the |
| 632 | ambient skill catalog. It follows the contributor-navigation request in |
| 633 | #4227 by @JayBeest. |
| 634 | |
| 635 | - Bahasa Indonesia now has a complete repository documentation suite and a |
| 636 | registered website dictionary alongside the shipped TUI locale (PRs #4962 |
| 637 | and #4972 by @atmosuwiryo, closing #4789). |
| 638 | |
| 639 | - Reasoning content can keep its rail, italics, cursor, and expansion controls |
| 640 | while disabling only the warm background highlight. The independent setting |
| 641 | is persisted and localized (#4089; reported by @elijahchan2019). |
| 642 | |
| 643 | - StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the |
| 644 | two endpoint/billing routes distinct, and localizes the choice across the |
| 645 | complete packs (#4526; reported by @whp233). |
| 646 | |
| 647 | - OpenCode Zen is a separate model-aware API-key provider. Its curated catalog |
| 648 | selects Responses, Anthropic Messages, or Chat Completions per model; |
| 649 | unsupported Gemini and unknown models fail closed, and missing Zen |
| 650 | credentials never fall through to ChatGPT/Codex OAuth guidance. The |
| 651 | implementation from closed PR #4467 by @snail-vs (snailoniu) is preserved in |
| 652 | the candidate. |
| 653 | |
| 654 | - Markdown exports correlate prompts with stable workspace restore-point ids |
| 655 | and say when correlation is unavailable or ambiguous, completing the |
| 656 | remaining restoration/export direction from #2494 by @wywsoor. |
| 657 | |
| 658 | ### Fixed |
| 659 | |
| 660 | - Permission setup now consistently presents the product postures Ask, |
| 661 | Auto-Review, and Full Access instead of leaking the internal `never` token. |
| 662 | The same resolved sandbox policy now drives execution and UI receipts: Plan |
| 663 | stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access |
| 664 | is actually unsandboxed unless a stricter effective configuration wins. |
| 665 | |
| 666 | - Fleet setup no longer stalls when a user explicitly selects a configured |
| 667 | Codex or Grok external-consent route. The selected route is activated and |
| 668 | validated before saving, roster roles open directly on their Model step, |
| 669 | Review saves on the first Enter, and new profiles default to the personal |
| 670 | profile directory that the roster loads on the next session. |
| 671 | |
| 672 | - Provider credential dialogs now share one wrapping, secret-safe API-key |
| 673 | surface across every non-OAuth provider. A key already present in durable |
| 674 | storage is reported as configured without rendering it, typing or pasting is |
| 675 | clearly framed as replacement, narrow help text remains visible, and Codex |
| 676 | and Grok OAuth flows remain token-free in this modal. |
| 677 | |
| 678 | - Ctrl+O again opens the complete recorded reasoning detail for the selected, |
| 679 | active, or latest reasoning block. The whole-turn Turn Inspector moved to |
| 680 | Ctrl+Alt+O and `/turn inspect`, removing the shortcut collision while keeping |
| 681 | raw leaf detail and post-flush reasoning discoverable. |
| 682 | |
| 683 | - Failed child agents now deliver a distinct high-priority failure receipt to |
| 684 | their owning parent with a sanitized failure class, elapsed work, and a full |
| 685 | transcript handle. Parent-to-child message, follow-up, and interrupt tools |
| 686 | now use one hierarchy-checked mailbox path, and persisted nested completion |
| 687 | envelopes remain safely restorable across instruction-text revisions. |
| 688 | |
| 689 | - Background-shell completion events now carry only bounded tails plus a |
| 690 | retrievable exact-evidence handle. Terminal foreground Bash results are |
| 691 | acknowledged at the direct tool-result boundary and are no longer emitted a |
| 692 | second time as background completion artifacts. |
| 693 | |
| 694 | - Providerless Fleet and child-agent fixed-model routes now reject only |
| 695 | high-confidence foreign-provider model ids before creating a worktree, while |
| 696 | explicit provider/model pairs, custom and local endpoints, unknown ids, and |
| 697 | aggregator wire-id resolution retain their intended behavior. |
| 698 | |
| 699 | - Manual compaction now preserves and reports the supplied provider failure |
| 700 | class instead of replacing it with an opaque generic error. This does not |
| 701 | infer quota exhaustion when the recorded failure does not prove it. |
| 702 | |
| 703 | - The ambient jellyfish keep complete, readable silhouettes while animating, |
| 704 | and the website favicon now uses the Signal Current desktop tile instead of |
| 705 | the legacy whale mark. |
| 706 | |
| 707 | - ACP JSON-RPC responses preserve numeric request ids for avante.nvim while |
| 708 | retaining the negotiated string-id exception for Zed (PR #4929 by |
| 709 | @atmosuwiryo). |
| 710 | |
| 711 | - Restored shell cells whose job no longer exists stop displaying live |
| 712 | spinners and settle into a truthful stale/no-output state across transcript, |
| 713 | phase strip, and sidebar (PR #4937 by @LI-Jialu, closing #4547). |
| 714 | |
| 715 | - Interrupted checkpoints and timed recovery snapshots remain checkpoints |
| 716 | instead of being promoted into orphan session files, preventing duplicate |
| 717 | `/resume` entries (PR #4963 by @SparkofSpike). |
| 718 | |
| 719 | - Every shipped locale is admitted by the typed settings schema and native |
| 720 | chooser, with complete/partial status kept independent and tested (PR #4856 |
| 721 | by @nightt5879, closing #4786). Context-menu hover hit-testing also accounts |
| 722 | for its title row (PR #4897 by @XhesicaFrost; reported by @SparkofSpike in |
| 723 | #4803). |
| 724 | |
| 725 | - OSC 52 and SSH/tmux clipboard transport run on one bounded background worker |
| 726 | rather than blocking input and rendering on the TUI loop; late transport |
| 727 | failures still surface through the status path (PR #4896 by @nightt5879, |
| 728 | closing #4159). |
| 729 | |
| 730 | - Non-streaming model calls receive a generation-length response budget rather |
| 731 | than the SSE header-open timeout, while actual SSE opens share the bounded |
| 732 | cross-provider transport seam. The equivalent fix direction came from |
| 733 | closed PR #4743 by @vibecoding-skills. |
| 734 | |
| 735 | - Resumed sessions diagnose a deleted inherited workspace before shell launch |
| 736 | instead of failing as an opaque Windows process error (report #4100 by |
| 737 | @redjade75723). DeepSeek native tool-call wrapper tokens are also scrubbed |
| 738 | from visible streaming and completed output as a grounded fail-soft follow-up |
| 739 | to report #3880 by @hardy922; that report's exact emitted marker remained |
| 740 | unconfirmed. |
| 741 | |
| 742 | - Auto model routing now preserves the user's requested reasoning effort |
| 743 | through startup, provider/model changes, session restore, the picker, |
| 744 | Ctrl+T, and Hotbar actions. The tier is normalized only after the concrete |
| 745 | provider route is known instead of being silently replaced by Auto |
| 746 | (#4941, PR #4961 by @nightt5879). |
| 747 | |
| 748 | - Auto-compaction now defaults on for every known model context window, |
| 749 | including Kimi K3's 1,048,576-token routes. Persisting only an |
| 750 | `auto_compact_threshold` or `auto_compact_threshold_percent` now counts as |
| 751 | opt-in intent, while an explicit `auto_compact = false` remains authoritative. |
| 752 | `/config` reports the effective state, percentage, and computed token trigger. |
| 753 | |
| 754 | - Per-provider `context_window` overrides are now documented and visible in |
| 755 | `/config`, provider setup help, diagnostics, and the example configuration. |
| 756 | The effective override consistently drives preflight budgeting, the context |
| 757 | meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their |
| 758 | Coding Plan tier has the smaller window. |
| 759 | |
| 760 | - Agent Details now projects status, model, elapsed time, and step counts from |
| 761 | the same row snapshot as the primary agents list, eliminating contradictory |
| 762 | worker state between the two surfaces. |
| 763 | |
| 764 | - Composer submission and its hints now share one state machine. Portable |
| 765 | terminals use Enter to queue during a running turn and Enter again to steer; |
| 766 | Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is |
| 767 | no longer advertised as universally available. |
| 768 | |
| 769 | - `edit_file` now matches LF-only model search text against CRLF files, |
| 770 | preserves the file's line-ending style for replacement text, and still |
| 771 | rejects newline-normalized duplicate matches as non-unique (#4764). |
| 772 | Implemented in PR #4942 by @nightt5879; reported and root-caused by |
| 773 | @LmeSzinc. |
| 774 | |
| 775 | - `/fleet status` read the current TUI session's sub-agents while `codewhale |
| 776 | fleet status` read the durable `.codewhale/fleet.jsonl` ledger — two different |
| 777 | things wearing one name, so a run started by `codewhale fleet run` never |
| 778 | appeared in the TUI. `/fleet status` now reads the durable ledger through the |
| 779 | same code path as the CLI; the session view keeps its own name as |
| 780 | `/fleet workers` (`/subagents` and `n` still work). When a workspace has no |
| 781 | ledger, both surfaces report a typed `no_fleet_ledger` reason instead of an |
| 782 | empty-looking "all clear", and neither creates the ledger as a side effect of |
| 783 | reading it (#4022). |
| 784 | |
| 785 | - `codewhale fleet status` (and `list`/`interrupt`/`resume`) created |
| 786 | `.codewhale/fleet.jsonl` as a side effect of opening the manager, then |
| 787 | reported `no_fleet_ledger` for the file it had just made — so the second |
| 788 | invocation showed an empty Fleet where none existed. The CLI now refuses |
| 789 | those verbs before the manager is constructed, matching `/fleet` (#4022). |
| 790 | |
| 791 | - `fleet resume <run-id>` accepted any string. An id absent from the ledger |
| 792 | reconciled nothing but still wrote a run-status record keyed by whatever was |
| 793 | typed, and reported `no_change`. Unknown ids are now refused as `not_found` |
| 794 | before any durable write (#4022). |
| 795 | |
| 796 | - `lane interrupt` reported `transitioned` even when it changed nothing — |
| 797 | another process's stop looked like our own. The Runtime backend now reports |
| 798 | whether *this* call performed the transition, and a no-op is `no_change`. |
| 799 | The `@<lifecycle-seq>` fence is also evaluated inside the registry's per-Lane |
| 800 | lock rather than before it, so a stale fence refuses without running Runtime |
| 801 | teardown instead of racing between the check and the stop (#1888). |
| 802 | |
| 803 | - `/lane` no longer runs Runtime teardown on the TUI composer thread. Reads on |
| 804 | the slash surface skip reconciliation (which probes tmux and takes a lock) |
| 805 | and say so on the receipt instead of implying freshness; `lane interrupt` is |
| 806 | CLI-only until that work runs off-thread, and reports |
| 807 | `surface_not_supported` naming `codewhale lane interrupt` (#4022). |
| 808 | |
| 809 | - The hotbar is no longer modelled as a third control surface. A slot binds a |
| 810 | slash command and fires it with no argument, so it runs *as* the slash |
| 811 | surface; the contract now declares which verb a bare press actually reaches |
| 812 | (`hotbar_bare_dispatch`, true only for `lane.list`) instead of advertising |
| 813 | target-taking verbs as hotbar-reachable (#1888). |
| 814 | |
| 815 | - `codewhale lane list --json` and `lane status --json` keep emitting the |
| 816 | `LaneRecord` shape they always have — the receipt did not replace it. The |
| 817 | human `lane status` output also regained `branch`, `session`, `socket`, |
| 818 | `attach`, and `log`, which the first cut of the shared DTO had dropped |
| 819 | (#1888). |
| 820 | |
| 821 | - No surface advertises a backend it does not have. `lane restart` and |
| 822 | `lane resume` have no implementation — a Lane is re-created by |
| 823 | `codewhale lane start`, and a stopped Lane's Runtime session is gone — so all |
| 824 | three surfaces refuse them with `backend_not_implemented` and say why. |
| 825 | `fleet restart` drives the manager loop to completion, which only the CLI |
| 826 | runs, so `/fleet restart` reports `surface_not_supported` and names the CLI |
| 827 | command rather than quietly doing a smaller thing (#1888). |
| 828 | |
| 829 | - Deny rules in `permissions.toml` no longer miss a command because of an |
| 830 | intervening flag: deny matching is token-based with flag-skipping and |
| 831 | backtracking, so a `git push` rule still catches |
| 832 | `git -c foo=bar push`. Path matching folds case only on platforms whose |
| 833 | filesystems are case-insensitive, and the default approval branch no |
| 834 | longer proposes the working directory as a network host. |
| 835 | |
| 836 | - MCP tool calls run once. A failed call is no longer retried as if it |
| 837 | were a failed lookup, qualified-name resolution collects every match and |
| 838 | reports an ambiguity instead of taking whichever the hash map yielded |
| 839 | first, and registering a server whose name collides with an existing one |
| 840 | after sanitization is now an error rather than a silent overwrite. |
| 841 | The equivalent call-once fix direction came from closed PR #4756 by |
| 842 | @adity982. |
| 843 | |
| 844 | - The session index survives a torn line: an unparseable entry is skipped |
| 845 | rather than aborting the whole read, appends carry their data through to |
| 846 | disk, and appends and compaction share a lock so a compaction can no |
| 847 | longer race an append into a lost record. |
| 848 | |
| 849 | - `Edit` counts as a write tool for workflow elevation, and the TUI's |
| 850 | write/shell classification now delegates to one shared allowlist rather |
| 851 | than keeping a second copy that could drift. |
| 852 | |
| 853 | - A rejected `app/config/set` stays a no-op. Previously an invalid value |
| 854 | still tore down the cached runtime bridge, killing the child runtime and |
| 855 | orphaning every other in-flight stdio thread behind a response that |
| 856 | correctly reported failure. |
| 857 | |
| 858 | - A malformed project `config.toml` is no longer indistinguishable from |
| 859 | having no project config. Because a project config may only *tighten* |
| 860 | approval and sandbox policy, silently discarding a broken one dropped a |
| 861 | repository's restrictions back to the looser user defaults; the setup |
| 862 | wizard now says so, naming the file but never quoting its contents. |
| 863 | |
| 864 | - An expired lane worktree no longer leaves its branch behind, which made |
| 865 | reusing the same lane name fail with "branch already exists". A branch |
| 866 | still carrying unmerged commits is kept — a TTL lapsing is not consent |
| 867 | to delete someone's work. |
| 868 | |
| 869 | - An in-flight `thread/message` turn can be stopped. The stdio loop keeps |
| 870 | reading while a turn streams, so the new `thread/interrupt` request (and |
| 871 | `shutdown`) can reach a runaway turn instead of waiting on the very turn |
| 872 | they were meant to stop. |
| 873 | |
| 874 | - Precedence is stated only in the constitution's "Whose word wins" section. |
| 875 | Memory hygiene no longer ships an inverted Tier list that put the |
| 876 | constitution above the user's current request; approval, compaction, and |
| 877 | personality overlays describe behavior without rank vocabulary; and the |
| 878 | authority recap points at the single source rather than restating a second |
| 879 | ladder. |
| 880 | |
| 881 | - `<turn_meta>` carries facts (mode, posture, model, workspace), not mode |
| 882 | doctrine or permission-question essays re-asserted every user message. |
| 883 | |
| 884 | - The project context pack (pretty-printed workspace tree) is off by default |
| 885 | and opt-in via `[context] project_pack = true`. Language law is compressed |
| 886 | while keeping the English-constitution / user-language-reply contract. |
| 887 | |
| 888 | - Modal lists and config pickers wrap selection at both ends (Down past the |
| 889 | last row returns to the top). Home-directory resolution prefers |
| 890 | `HOME`/`USERPROFILE` via `effective_home_dir` across remaining call sites so |
| 891 | Windows tests that fake the home env vars match production paths. The |
| 892 | equivalent home-directory sweep came from closed PR #4760 by |
| 893 | @EvanProgramming. |
| 894 | |
| 895 | ### Changed |
| 896 | |
| 897 | - Prefix-cache tool catalog entries store only the SHA-256 digest, not the |
| 898 | joined catalog string. Unused plan-transition validation helpers are removed. |
| 899 | |
| 900 | - Settings sections now hold only what they claim (#4751). Fleet keeps |
| 901 | Fleet/member concerns; `/goal` moved to a **Session** section and Workflow |
| 902 | orchestration to its own **Workflow** section. The inert DeepSeek-only |
| 903 | `default_model` fallback moved out of Model settings into an explicit |
| 904 | **Legacy** section — exact-Fleet users switch Fleets, not fallback models; |
| 905 | the config field is retained because the runtime still reads it. This is |
| 906 | presentation only: the persisted keys (`goal_command`, `workflow`, |
| 907 | `default_model`), their values, scopes, and runtime behavior are unchanged. |
| 908 | |
| 909 | - Auto model routing is scoped to the active provider. The classifier |
| 910 | inventory no longer discloses other providers' runnable routes (or the fact |
| 911 | that their credentials exist), a classifier reply naming another provider is |
| 912 | refused, the local heuristic no longer falls back to a different provider |
| 913 | when the active one is unusable, and the implicit DeepSeek-flash classifier |
| 914 | is skipped for non-DeepSeek sessions. Auto receipts and the model picker |
| 915 | hint report the active-provider-only scope instead of "runnable providers". |
| 916 | Cross-provider Auto is available only through the persisted `[auto] |
| 917 | cross_provider = true` opt-in (an explicit `[auto.router]` route remains its |
| 918 | own opt-in for the classifier call). Same-provider strong/fast selection and |
| 919 | `[auto] cost_saving` are unchanged. |
| 920 | |
| 921 | - The QA pseudo-terminal acceptance harness now parses frames with `rio-vt` |
| 922 | behind its existing neutral frame/color surface, retaining the assertions |
| 923 | while removing the `vt100` dependency (PR #4931 by @raphamorim). |
| 924 | |
| 925 | - Anthropic Messages and OpenAI Responses stream opening now share the |
| 926 | `client/stream_entry.rs` seam already used by Chat Completions: one bounded |
| 927 | response-header wait, shared dual/HTTP-1.1 policy selection, at most one |
| 928 | HTTP/1.1 fallback on a classified HTTP/2 header stall, and common idle-timeout |
| 929 | diagnostics. Wire-specific authentication, headers, endpoints, decoding, and |
| 930 | rate-limit behavior remain at each adapter edge. The timeout-placement |
| 931 | diagnosis and fix direction came from closed PR #4743 by |
| 932 | @vibecoding-skills. |
| 933 | |
| 934 | ### Security |
| 935 | |
| 936 | - Release containers now publish an SBOM attestation and pin maximum-mode |
| 937 | provenance explicitly so supply-chain metadata cannot silently weaken with a |
| 938 | builder-default change (PR #4958 by @kobihikri). |
| 939 | |
| 940 | ### Contributors |
| 941 | |
| 942 | Thank you to the contributors whose code, reports, and reviews shaped v0.9.2: |
| 943 | |
| 944 | - [@greyfreedom](https://github.com/greyfreedom) — exact repository-scoped |
| 945 | allow grants and cross-platform path semantics (PR #4761), plus safe |
| 946 | permission-rule listing and snapshot-bound removal (PR #4960). |
| 947 | - [@nightt5879](https://github.com/nightt5879) — off-event-loop clipboard |
| 948 | writes (PR #4896), complete locale exposure in settings (PR #4856), CRLF-safe |
| 949 | edits (PR #4942), and reasoning-effort preservation across automatic model |
| 950 | routing (PR #4961). |
| 951 | - [@XhesicaFrost](https://github.com/XhesicaFrost) — the configurable |
| 952 | session-token header (PR #4610) and context-menu hover alignment (PR #4897). |
| 953 | - [@cyq1017](https://github.com/cyq1017) — the hooks configuration/executor |
| 954 | split from PR #4087. |
| 955 | - [@snail-vs](https://github.com/snail-vs) (snailoniu) — OpenCode Zen's |
| 956 | model-aware routes, authentication, documentation, and test isolation from |
| 957 | closed PR #4467, whose contributor commits are preserved in the candidate. |
| 958 | - [@SparkofSpike](https://github.com/SparkofSpike) — the zh-Hans translation |
| 959 | quality review harvested from PR #4908, duplicate-session fix in PR #4963, |
| 960 | LaTeX implementation from PR #4973 landed through #4974, and the context-menu |
| 961 | reproduction in #4803. |
| 962 | - [@GTC2080](https://github.com/GTC2080) — the request-preview concept from |
| 963 | PR #1099. |
| 964 | - [@h3c-hexin](https://github.com/h3c-hexin) — non-UTF-8 `fetch_url` |
| 965 | decoding direction from PR #4909. |
| 966 | - [@fleitz](https://github.com/fleitz) — required source-candidate credit for |
| 967 | the canonical `Bash` no-`cwd` workspace fix and regression in PR #4673 |
| 968 | (issue #4674). |
| 969 | - [@LmeSzinc](https://github.com/LmeSzinc) — the Windows CRLF `edit_file` |
| 970 | reproduction, root-cause analysis, and affected-code anchors in issue #4764. |
| 971 | - [@atmosuwiryo](https://github.com/atmosuwiryo) — ACP numeric-id compatibility |
| 972 | (PR #4929) and the Indonesian documentation and website locale (PRs #4962 |
| 973 | and #4972). |
| 974 | - [@M-Maciej](https://github.com/M-Maciej) — the expanded-by-default reasoning |
| 975 | setting and its original report (PR #4928, issue #4925). |
| 976 | - [@raphamorim](https://github.com/raphamorim) — migration of the QA PTY frame |
| 977 | parser to `rio-vt` (PR #4931). |
| 978 | - [@LI-Jialu](https://github.com/LI-Jialu) — truthful finalization of restored |
| 979 | stale shell cells (PR #4937). |
| 980 | - [@kobihikri](https://github.com/kobihikri) — release-container SBOM and |
| 981 | explicit provenance mode (PR #4958). |
| 982 | - [@EvanProgramming](https://github.com/EvanProgramming), |
| 983 | [@adity982](https://github.com/adity982), and |
| 984 | [@vibecoding-skills](https://github.com/vibecoding-skills) — equivalent fix |
| 985 | direction for the effective-home sweep (#4760), MCP call-once behavior |
| 986 | (#4756), and streaming/non-streaming timeout split (#4743). |
| 987 | - [@antarikshraya](https://github.com/antarikshraya) — the LaTeX transcript |
| 988 | rendering report in #4957. |
| 989 | - [@eugenicum](https://github.com/eugenicum) — the token-header request and |
| 990 | output-presentation measurements in #4520 and #4468. |
| 991 | - [@whp233](https://github.com/whp233) — the StepFun/OpenCode subscription-route |
| 992 | request in #4526. |
| 993 | - [@redjade75723](https://github.com/redjade75723), |
| 994 | [@hardy922](https://github.com/hardy922), |
| 995 | [@JayBeest](https://github.com/JayBeest), |
| 996 | [@elijahchan2019](https://github.com/elijahchan2019), |
| 997 | [@cy2311](https://github.com/cy2311), and |
| 998 | [@wywsoor](https://github.com/wywsoor) — reports and product direction behind |
| 999 | the stale-workspace diagnosis (#4100), native-tool-token filtering (#3880), |
| 1000 | contributor onboarding (#4227), optional reasoning highlight (#4089), |
| 1001 | session control (#2934), and export/restore correlation (#2494). |
| 1002 | |
| 1003 | ## [0.9.1] - 2026-07-24 |
| 1004 | |
| 1005 | ### Dogfood follow-ups (2026-07-24) |
| 1006 | |
| 1007 | ### Added |
| 1008 | |
| 1009 | - `/compact [focus]`: the manual compaction command now accepts an |
| 1010 | optional focus argument that is injected into the summary prompt, and |
| 1011 | the compaction summary itself becomes a structured nine-section |
| 1012 | successor briefing (primary intent, key concepts, files and code, |
| 1013 | errors and fixes, problem solving, user messages, pending tasks, |
| 1014 | current work, next step) that carries earlier compaction summaries |
| 1015 | forward and explicitly forbids tool use — replacing the free-form |
| 1016 | "under N words" instruction. Codewhale's pin/working-set and |
| 1017 | V4 prefix-cache-aligned machinery are unchanged. |
| 1018 | |
| 1019 | - Saved workflows become slash commands: `*.workflow.js` files under |
| 1020 | `<workspace>/.codewhale/workflows/` and `~/.codewhale/workflows/` are |
| 1021 | discovered as `/name` commands that accept custom arguments (forwarded |
| 1022 | to the run's `args`), launch through the `workflow` tool in the |
| 1023 | background, and report their run id. Hand-written `.md` commands with |
| 1024 | the same name always win. The workflow tool's `source_path` now also |
| 1025 | accepts the user-global `~/.codewhale/workflows/` store, and every |
| 1026 | settled run leaves a durable synthesized report under |
| 1027 | `.codewhale/reports/<run_id>.md` (status, goal, gates, progress, |
| 1028 | result, verification). |
| 1029 | |
| 1030 | ### Fixed |
| 1031 | |
| 1032 | - Disambiguate the two Kimi K3 model-picker rows, which read as an |
| 1033 | unexplained duplicate: bare `k3` is now labeled "Kimi Code plan route" |
| 1034 | with its default 262K window annotated as the plan-tier floor (raisable |
| 1035 | via the provider `context_window` setting for plans that include 1M), |
| 1036 | and `kimi-k3` is labeled "Moonshot direct route" with its 1M window. |
| 1037 | Both remain distinct, valid routes for the same underlying model. |
| 1038 | - Close the model-facing `agent` tool role schema: the `type` property now |
| 1039 | publishes the canonical JSON Schema enum `["worker", "scout", "planner", |
| 1040 | "reviewer", "builder", "verifier", "custom"]` instead of describing the |
| 1041 | accepted values in prose. Legacy aliases are no longer advertised to |
| 1042 | models; they remain accepted only at replay/deserialization boundaries. |
| 1043 | Provider schema sanitizers (Chat Completions, strict mode, Anthropic |
| 1044 | Messages / OpenAI Responses, Moonshot/Kimi) are pinned by test to |
| 1045 | preserve the closed enum. |
| 1046 | |
| 1047 | ### Changed |
| 1048 | |
| 1049 | - Rework the ambient idle ocean: the water now holds exactly one loose |
| 1050 | wedge school of fish, jellyfish, bubbles, and the rare whale cameo — |
| 1051 | seaweed and bio-dust are removed. Fish swim on a wrap-around path and |
| 1052 | always face the way they move (direction can only change while the |
| 1053 | school is off-screen); the lead fish carries an eye (`><o>`). |
| 1054 | Jellyfish become a pulsing bell with a lagging swaying tentacle. All |
| 1055 | ambient marks now glow via background→ink color lerp: a travelling |
| 1056 | sin² wave through the school, a floor-bounded pulse for jellyfish, |
| 1057 | and occasional raised-cosine glints on bubbles, with deliberately |
| 1058 | non-matching periods so nothing strobes in sync. |
| 1059 | |
| 1060 | - Rename the internal delegated-worker role type from `SubAgentType` to |
| 1061 | `FleetRole` with canonical variants (`Worker`, `Scout`, `Planner`, |
| 1062 | `Reviewer`, `Builder`, `Verifier`, `Custom`) matching the public Fleet |
| 1063 | vocabulary one-to-one. Wire behavior is unchanged: serialization emits |
| 1064 | canonical Fleet values only, and persisted `agent_type` fields plus |
| 1065 | documented legacy spellings (`general`, `explore`, `plan`, `review`, |
| 1066 | `implementer`, …) continue to load at deserialization/parse boundaries; |
| 1067 | unknown role tokens still fail closed with the canonical vocabulary in |
| 1068 | the error. |
| 1069 | |
| 1070 | |
| 1071 | The Codewhale v0.9.1 source candidate includes a first-class local web client over the Runtime API, |
| 1072 | first-class OpenCode Go and TelecomJS TokenHub providers and restored xAI device login, |
| 1073 | calendar-correct hourly automations, a buildable OpenHarmony workflow-js |
| 1074 | target, and hardening for Auto routing, remote-terminal clipboard transport, |
| 1075 | restart recovery, and a coherent TUI, Work, evidence, and public release |
| 1076 | surface. |
| 1077 | |
| 1078 | ### Added |
| 1079 | |
| 1080 | - Add `codewhale web [--port 7878]`, a first-class loopback-only browser |
| 1081 | client over the canonical Runtime API. The dependency-free embedded shell |
| 1082 | supports thread lifecycle, snapshot-then-SSE transcripts, turn start/steer/ |
| 1083 | interrupt, approvals, and user questions, including pending-request recovery |
| 1084 | across tab reloads, while leaving unsupported managed, |
| 1085 | files, PTY, model-selection, and Fleet controls absent. Browser auth uses a |
| 1086 | short-lived one-time loopback capability exchanged for an opaque, bounded, |
| 1087 | process-local HttpOnly, SameSite=Strict session cookie with a same-origin |
| 1088 | mutation guard; Runtime tokens never enter URLs, HTML, browser storage, logs, |
| 1089 | or browser-launch arguments (#4423). |
| 1090 | - Add OpenCode Go as a first-class, subscription-backed Chat Completions |
| 1091 | provider with `[providers.opencode_go]`, `OPENCODE_GO_API_KEY`, and the eight |
| 1092 | models currently documented on its `/v1/chat/completions` endpoint. Models |
| 1093 | served only through OpenCode Go's Anthropic `/messages` endpoint remain out |
| 1094 | of this narrow route until Codewhale supports per-model wire selection |
| 1095 | (#1481 by @seanthefuturegorilla; implementation harvested from PR #773 by |
| 1096 | @zhangweiii and PR #1050 by @sternelee). |
| 1097 | - Add TelecomJS TokenHub as a first-class Chat Completions provider with |
| 1098 | `[providers.telecomjs]`, `TELECOMJS_API_KEY`, and a key-scoped live |
| 1099 | `/v1/models` refresh. Models.dev and provider-specific catalogs remain in |
| 1100 | separate source partitions so either refresh order preserves both; refreshes |
| 1101 | do not delete the other source's rows, matching model ids from unrelated |
| 1102 | providers do not fabricate metadata, and chat requests omit unsupported |
| 1103 | reasoning fields (PR #4370 by @baendlorel; harvested with co-authorship). |
| 1104 | - Prepare native Windows ARM64 `codewhale`, `codew`, and `codewhale-tui` |
| 1105 | binaries, npm selection, updater support, and standard/portable release |
| 1106 | archives. Build and smoke them on GitHub's native Windows 11 ARM runner, |
| 1107 | and move Linux ARM64 release builds to the native Ubuntu ARM runner to |
| 1108 | remove the slower multi-arch cross-link setup (#4267 by @w1w218). |
| 1109 | - `load_skill` tool now supports listing: omit `name` or pass `"list"` to |
| 1110 | see all available skills without loading one (#4651). |
| 1111 | - Add a unified `/skills` manager with one precedence-aware root catalog, |
| 1112 | bounded duplicate/shadow/conflict auditing, package provenance, and |
| 1113 | validated install, update, remove, and trust mutations (PR #4679 by |
| 1114 | @SamhandsomeLee). |
| 1115 | - Add a safe Agent Details view and bounded, structured `current_activity` to |
| 1116 | the single Work projection, sourced from worker events instead of renderer |
| 1117 | string inference. Rows stay compact, exact evidence is opt-in, and raw child |
| 1118 | output never enters the parent transcript (#2889 and #4636; design direction |
| 1119 | by @aboimpinto, preserved from #2694). |
| 1120 | - Make exact results and delegated coordination durable: non-inline tool output |
| 1121 | becomes immutable session-owned evidence behind bounded receipts; File |
| 1122 | mutations add configurable success-only diffs; and decisions and write |
| 1123 | contention survive restart with typed neutral-fan-in records (#4619, #4636, |
| 1124 | #4647). |
| 1125 | - Runtime API provider registry and atomic provider-switch endpoints |
| 1126 | (`GET /v1/providers`, `GET /v1/providers/{id}/models`, |
| 1127 | `POST /v1/providers/{id}/switch`) so the web GUI renders a dynamic |
| 1128 | provider/model picker without the setConfig+reload clobber (#4658). |
| 1129 | - Typed filter (`/`) in the Fleet setup wizard's Model step: substring |
| 1130 | match over provider id, display label, and model id keeps |
| 1131 | OpenRouter-scale catalogs navigable (#4639). |
| 1132 | - `[auto.router]` config: explicit provider/model/thinking for the Auto |
| 1133 | mode classifier route; unset keeps the DeepSeek flash default, and |
| 1134 | missing credentials fall back to the local heuristic. |
| 1135 | |
| 1136 | ### Changed |
| 1137 | |
| 1138 | - Keep the top activity bar literal and actionable: active To-dos appear first, |
| 1139 | followed by Sub-agents, while generic operations and coordination stay in |
| 1140 | the detail surface. Completed-only bars auto-hide, and top/side layouts can |
| 1141 | be resized by dragging their divider and retain the chosen size (#4700, |
| 1142 | #4702). |
| 1143 | - Use each theme's semantic colors for composer mode and permission rails, and |
| 1144 | show a larger inline reasoning preview with clearer local/full expansion |
| 1145 | affordances (#4699, #4701). |
| 1146 | - Simplify the model-facing runtime around stable action tools (`File`, `Git`, |
| 1147 | `Run`, deferred `Web`, and durable task and automation families), with legacy |
| 1148 | spellings hidden for replay. Fresh sessions no longer reserve a Work surface |
| 1149 | before real work exists (PR #4675). |
| 1150 | - Give the terminal shell one deliberate visual language: cool Plan → Act → |
| 1151 | Operate and warm Ask → Auto-Review → Full Access ramps match between header |
| 1152 | and split composer edges; transcript rhythm groups related activity; a |
| 1153 | refined whale keeps the empty state calm; and one-cell live motion with |
| 1154 | truthful labels distinguishes reasoning, reading, tool use, and verification |
| 1155 | without exposing private reasoning text. Reduced-motion and animation-off |
| 1156 | settings freeze it, while ASCII-safe terminals retain the signal (#4676, |
| 1157 | #4677). |
| 1158 | - Unified shell tool: the model now sees a single `Bash` tool with an `action` |
| 1159 | parameter (run/wait/interact/cancel). Legacy `exec_shell*` names remain as |
| 1160 | hidden compat aliases for transcript replay, and the tool-search catalog |
| 1161 | keeps `Bash` active by default (#4625). |
| 1162 | - Tool output inline preview increased from 6 to 12 lines (4 head + 4 tail) |
| 1163 | before the fold indicator; full pager (`v` key) unchanged (#4603). |
| 1164 | - Mode changes (`/mode agent|plan|operate`) now persist to `settings.toml` |
| 1165 | and restore across sessions (#4628). |
| 1166 | - Billing provenance: every outgoing API request carries an |
| 1167 | `x-codewhale-provenance` header with client version and provider (#4324). |
| 1168 | - The `/model` picker's typed search now ranks results: provider-name |
| 1169 | matches first (drill-down), then exact id, then id-prefix, then the |
| 1170 | active provider's rows (#4639). |
| 1171 | - System prompt text consolidated into a single `prompts/text.rs` |
| 1172 | module (byte-exact constants replacing 17 layered files); |
| 1173 | composition order, constitution-first binding, and locale/personality |
| 1174 | variants unchanged. |
| 1175 | - Ask, Auto-Review, Full Access, and Never resolve through one permission |
| 1176 | contract: `resolve_tool_permission` in the engine and |
| 1177 | `resolve_approval_request_disposition` in the UI share one truth table for |
| 1178 | session grants/denials, non-bypassable policy holds, and modal prompts |
| 1179 | (#4412). |
| 1180 | - Collapsed multi-struct tool families into single action-dispatched tools |
| 1181 | (`AutomationTool`, `TasksTool`, `GithubTool`, `RlmTool`) while keeping |
| 1182 | legacy tool names as hidden compatibility aliases for transcript replay. |
| 1183 | - Operate-mode children default to leaf depth (`max_depth=0`) unless the |
| 1184 | caller explicitly grants a deeper budget (#4598). |
| 1185 | |
| 1186 | ### Fixed |
| 1187 | |
| 1188 | - Restore `uwu` theme config round-tripping and keep header permission colors |
| 1189 | and authored idle-whale geometry aligned with the selected theme (#4696). |
| 1190 | - Default canonical `Bash` runs with no explicit `cwd` to the active |
| 1191 | `ToolContext.workspace`, including an isolated sub-agent worktree, instead of |
| 1192 | falling through to the shared shell manager's parent workspace. The regression |
| 1193 | test detects the selected workspace through marker files so it remains |
| 1194 | meaningful across PowerShell path spellings (#4674, PR #4673 by @fleitz). |
| 1195 | - Generate QuickJS bindings for `aarch64-unknown-linux-ohos` with the native |
| 1196 | SDK's libclang and sysroot, carry the OHOS target and sysroot through final |
| 1197 | linking, and keep unsupported persistent PTY dependencies out of the target |
| 1198 | while retaining non-PTY `exec_shell` support (#4470 by @shenjackyuanjie; |
| 1199 | original bindgen approach in #4384 by @shenyongqing). |
| 1200 | - Honor `[auto] cost_saving = true` in provider-aware heuristic and classifier |
| 1201 | routing, using only validated same-provider fast siblings and deriving |
| 1202 | fallback candidates from their actual provider so Auto cannot invent a |
| 1203 | cross-provider model. Providers without a known fast sibling stay on the |
| 1204 | active model (#4486; partial #4405). |
| 1205 | - Make terminal-client clipboard behavior truthful over SSH: use OSC 52 |
| 1206 | outside tmux, stock `tmux load-buffer -w` inside tmux, and bracketed paste |
| 1207 | for client-to-remote text. Graphical text and image access now requires |
| 1208 | credible forwarding or an explicit override, transport failures no longer |
| 1209 | claim success, and help distinguishes terminal text paste from graphical |
| 1210 | image attachment (#4484). |
| 1211 | - Keep a fresh TUI Work surface from rendering prior-session worker snapshots |
| 1212 | or durable-task terminal receipts whose creation or completion predates the |
| 1213 | current app start. Active durable tasks remain visible, and shared history |
| 1214 | stays available through `/tasks` and archived agent views (#4488; partial |
| 1215 | #4416). |
| 1216 | - Make doctor and setup output distinguish static configuration, command |
| 1217 | availability, MCP protocol readiness, and backend health instead of |
| 1218 | presenting configured routes as live-healthy. Ordinary doctor runs no |
| 1219 | longer wake loopback/self-hosted providers unless `--probe-local` is |
| 1220 | explicitly requested (#4485; partial #4406). |
| 1221 | - Serialize test-only configuration-path readers with temporary environment |
| 1222 | redirects so the Windows provider-persistence matrix cannot observe another |
| 1223 | test's transient `CODEWHALE_HOME` or config path (#4483, closing #4463). |
| 1224 | - Restore direct Moonshot `kimi-k3` to its documented 1,048,576-token |
| 1225 | context window and 131,072-token output limit instead of treating the live |
| 1226 | model as an unknown legacy 128K route. The existing Kimi Code tiered `k3` |
| 1227 | route and credential reuse remain unchanged (#4481). |
| 1228 | - Keep read-before-edit snapshots in the engine session so a file read remains |
| 1229 | valid across turns and context compaction, while a new session still starts |
| 1230 | with an empty tracker (#4475 by @Angel-Hair). |
| 1231 | - Make `apply_patch` expose the canonical `replace` operation while continuing |
| 1232 | to accept deprecated `changes` payloads through one validation path. Mixed |
| 1233 | patch, replace, and compatibility modes now fail before any write (#4476 by |
| 1234 | @Angel-Hair). |
| 1235 | - Show the prompt-cache hit rate in the phase strip when the Cache status item |
| 1236 | is enabled, using overflow-safe rounded integer math and leaving compact or |
| 1237 | disabled status layouts unchanged (#4474 by @dmitri-0). |
| 1238 | - Preserve Solarized Light's canonical Base3 (`#fdf6e3`) shell background |
| 1239 | instead of tinting it green-grey through the default underwater Ombre |
| 1240 | treatment, while retaining foreground ambient life (#4457 by |
| 1241 | @AiurArtanis; PR #4471 by @nightt5879). |
| 1242 | - Register `/slop` and `/canzha` as compatibility aliases of `/debt`, while |
| 1243 | keeping user-command ownership truthful across dispatch, help, slash |
| 1244 | completion, alias copy, and typo suggestions (PR #4680 by @nightt5879). |
| 1245 | - Fail closed on legacy Kimi CLI credential imports: remove Codewhale's |
| 1246 | hard-coded first-party-client impersonation and refresh request, never |
| 1247 | auto-enable or rewrite imported credentials, and label the compatibility |
| 1248 | route as a read-only imported token. An explicitly configured, still-valid |
| 1249 | access token remains usable until expiry; missing, malformed, and expired |
| 1250 | imports recover through the supported Kimi Code API-key route while |
| 1251 | first-class OAuth awaits Codewhale's own vendor registration (#4417, |
| 1252 | partially addressed). |
| 1253 | - Restore xAI/Grok device-code OAuth login against the live xAI OIDC |
| 1254 | contract: discovery with issuer/endpoint validation and documented |
| 1255 | fallbacks, user-principal scope set, RFC 8628 `slow_down` backoff capped at |
| 1256 | code expiry, bounded, sanitized error reporting for denial, expiry, and |
| 1257 | malformed responses, and a shared blocking-worker boundary for both CLI and |
| 1258 | TUI login so reqwest's blocking client never creates or drops its private |
| 1259 | runtime inside Codewhale's Tokio runtime (#4410). |
| 1260 | - Anchor `FREQ=HOURLY` automations with `BYHOUR`/`BYMINUTE` to persisted |
| 1261 | local-calendar slots so intervals keep their wall-clock phase across DST, |
| 1262 | restart, resume, RRULE updates, duplicate-slot recovery, and post-run |
| 1263 | advancement. Nonexistent clock slots are skipped and ambiguous slots run at |
| 1264 | their first occurrence (#4381 by @h3c-hexin). |
| 1265 | - Give content-watch drafts canonical identities: the link and semantic-drift |
| 1266 | watchers now write and dedup through one canonical draft-storage key with |
| 1267 | deterministic hash-suffixed IDs, validate and bound model drift output |
| 1268 | before any KV writes, and show truthful admin draft labels, so unchanged |
| 1269 | findings dedup and changed findings re-draft instead of colliding (#4453). |
| 1270 | - Make model-policy JSON repair consider object and array payloads in source |
| 1271 | order, matching nested delimiters across quoted strings and escapes and |
| 1272 | returning the earliest balanced candidate that parses, instead of letting |
| 1273 | an unmatched opening delimiter or object-first preference corrupt array |
| 1274 | payloads (#4430). |
| 1275 | - Convert persisted sub-agent completion and still-running control events into |
| 1276 | concise, non-authoritative resume checkpoints, keeping their raw runtime |
| 1277 | envelopes, sentinels, and retry instructions out of restored model and TUI |
| 1278 | conversation state (#4409). |
| 1279 | - Deliver failed, stopped, and stale sub-agent outcomes exactly once to the |
| 1280 | awaiting parent, lifecycle mailbox, and TUI before closing their runtime |
| 1281 | state. Restart now reconciles orphaned queued/model/tool-wait worker records |
| 1282 | to interrupted while preserving checkpoints, and cancelled workers no |
| 1283 | longer read as completed in the TUI (#4408). |
| 1284 | - Give host applications a cancellation boundary for MCP OAuth login so a |
| 1285 | stalled or abandoned provider login no longer hangs the calling session |
| 1286 | (#4380). |
| 1287 | - Avoid blocked reader joins after Windows process kills so terminated shell |
| 1288 | sessions cannot hang their readers (#4383). |
| 1289 | - Give stdin-less observer hooks immediate EOF and contain timed-out hook |
| 1290 | process trees so descendants and pipe readers cannot leak after the parent |
| 1291 | shell exits (#4489 by @luismateusvargas). |
| 1292 | - Preserve the full unsigned Windows PTY process status instead of collapsing |
| 1293 | every high-bit exception or NTSTATUS to `2147483647`, including decimal and |
| 1294 | hexadecimal diagnostic metadata for device retests (#4100 by |
| 1295 | @redjade75723). |
| 1296 | - Keep the Hotbar Setup action list synchronized with keyboard focus when the |
| 1297 | selection moves beyond the visible rows, including Down past `/export` |
| 1298 | (#4418). |
| 1299 | - Route Windows OpenHarmony Cargo links through the repository's target-aware |
| 1300 | clang launcher so the final Rust link keeps its target, sysroot, and MUSL |
| 1301 | flags, and extend the no-SDK release guard to protect that contract. This |
| 1302 | completes [@shenjackyuanjie](https://github.com/shenjackyuanjie)'s PR #4470 |
| 1303 | setup alongside [@shenyongqing](https://github.com/shenyongqing)'s original |
| 1304 | bindgen approach in PR #4384. |
| 1305 | - Reconcile the website roadmap with reality: the retired share-link |
| 1306 | direction is now an explicit non-goal, Workrooms is the considered |
| 1307 | direction, and the local web client appears as underway, in English and |
| 1308 | Chinese (#3418). |
| 1309 | - System-prompt skills block and skill-load warnings no longer embed absolute |
| 1310 | home/workspace paths; entries render workspace-relative or `~/…` so the |
| 1311 | byte-stable prompt prefix never leaks private paths. A new invariant test |
| 1312 | guards absolute paths, API keys, and workspace paths in the prefix (#4632). |
| 1313 | - Mode/permission baseline unit tests no longer read the developer's live |
| 1314 | `settings.toml`; they isolate config I/O to a temp directory (#4628). |
| 1315 | - Enter no longer freezes the composer on send: dispatch splits into a |
| 1316 | sync prepare phase (instant history + spinner) and a spawned async |
| 1317 | phase (auto-route, preflight, engine send), with submits gated while |
| 1318 | a dispatch is in flight (#4605). |
| 1319 | - Self-hosted routes keep explicit per-model output limits for unknown |
| 1320 | wire aliases instead of the generic 4K fallback (#4655 by @h3c-hexin; |
| 1321 | PR #4656). |
| 1322 | - Chat Completions idle-timeout errors now include received-byte and |
| 1323 | timing telemetry, distinguishing prefill stalls from mid-stream |
| 1324 | stalls with truncated tool-call arguments (#4657 by @h3c-hexin). |
| 1325 | - `set_config` provider writes now keep the in-memory route in step, |
| 1326 | so a following model write lands in the new provider's table instead |
| 1327 | of clobbering the previous provider's root default_text_model (#4658 |
| 1328 | by @gaord, with a follow-up route-sync fix). |
| 1329 | |
| 1330 | ### Security |
| 1331 | |
| 1332 | - Restrict cross-origin Runtime API browser preflights to the documented |
| 1333 | authentication and content headers, explicitly allowing `Authorization` |
| 1334 | instead of relying on a wildcard (#4454). |
| 1335 | |
| 1336 | ### Contributors |
| 1337 | |
| 1338 | Thank you to the contributors whose code, reports, and reviews shaped v0.9.1: |
| 1339 | |
| 1340 | - [@h3c-hexin](https://github.com/h3c-hexin) — calendar-anchored hourly |
| 1341 | automation recurrence (PR #4381), the MCP OAuth cancellation report |
| 1342 | (#4380), explicit limits for unknown local models (PR #4656 / #4655), |
| 1343 | and idle-timeout progress telemetry (PR #4657). |
| 1344 | - [@gaord](https://github.com/gaord) — Runtime API provider registry and |
| 1345 | atomic provider-switch endpoints (PR #4658). |
| 1346 | - [@SamhandsomeLee](https://github.com/SamhandsomeLee) — the unified `/skills` |
| 1347 | root catalog, audit/provenance model, validated mutations, manager UI, and |
| 1348 | acceptance coverage (PR #4679), plus Enter-send lag diagnosis and fix |
| 1349 | direction for #4605 (PR #4654; landed via the release-lane async-dispatch |
| 1350 | split). |
| 1351 | - [@aboimpinto](https://github.com/aboimpinto) — the Layer 5.1 user-command |
| 1352 | registry boundary from PR #3278; the exact authored evidence commit from PR |
| 1353 | #4046, preserved intact in the integration graph; and the #2870 follow-up |
| 1354 | audit whose metadata and malformed-sibling gaps shaped the final corrections. |
| 1355 | Paulo also provided the structured, redacted Agent Details and |
| 1356 | `current_activity` direction preserved from #2694/#2889 and the real-PTY |
| 1357 | lifecycle acceptance direction from #2886. |
| 1358 | - [@baendlorel](https://github.com/baendlorel) — TelecomJS TokenHub provider |
| 1359 | support and key-scoped live-catalog direction from PR #4370, harvested into |
| 1360 | the current provider architecture with co-authorship preserved. |
| 1361 | - [@zhangweiii](https://github.com/zhangweiii) and |
| 1362 | [@sternelee](https://github.com/sternelee) — the original first-class |
| 1363 | OpenCode Go implementations (PRs #773 and #1050), harvested into the |
| 1364 | current provider architecture. |
| 1365 | - [@seanthefuturegorilla](https://github.com/seanthefuturegorilla) — the |
| 1366 | canonical OpenCode Go/Zen provider request and acceptance direction |
| 1367 | (#1481). |
| 1368 | - [@nightt5879](https://github.com/nightt5879) — `/debt` compatibility aliases |
| 1369 | with dispatch-consistent user-command shadowing across discovery surfaces |
| 1370 | (PR #4680), plus the Solarized Light background preservation fix (PR #4471). |
| 1371 | - [@AiurArtanis](https://github.com/AiurArtanis) — the Solarized Light |
| 1372 | regression report and reproduction (#4457). |
| 1373 | - [@shenjackyuanjie](https://github.com/shenjackyuanjie) — the HarmonyOS |
| 1374 | workflow-js bindgen, portable-pty gating, and SDK environment work |
| 1375 | (PR #4470). |
| 1376 | - [@shenyongqing](https://github.com/shenyongqing) — the original HarmonyOS |
| 1377 | bindgen approach (PR #4384), carried into the landed implementation. |
| 1378 | - [@luismateusvargas](https://github.com/luismateusvargas) — the Windows hook |
| 1379 | process-leak reproduction, process-tree analysis, and EOF fix direction |
| 1380 | (#4489). |
| 1381 | - [@redjade75723](https://github.com/redjade75723) — the persistent Windows PTY |
| 1382 | report that exposed lossy high-bit process-status handling (#4100). |
| 1383 | - [@w1w218](https://github.com/w1w218) — the Windows ARM64 release request and |
| 1384 | real-device motivation (#4267). |
| 1385 | - [@Angel-Hair](https://github.com/Angel-Hair) — session-owned read-before-edit |
| 1386 | tracking and the explicit, backwards-compatible `apply_patch` replacement |
| 1387 | contract (PRs #4475 and #4476). |
| 1388 | - [@dmitri-0](https://github.com/dmitri-0) — configurable cache-hit visibility |
| 1389 | in the phase strip (PR #4474). |
| 1390 | - [@fleitz](https://github.com/fleitz) — the canonical `Bash` no-`cwd` |
| 1391 | workspace fix and regression test that keep isolated sub-agent commands in |
| 1392 | their own worktree (PR #4673, closing #4674). |
| 1393 | - [@SparkofSpike](https://github.com/SparkofSpike) — the Windows Ctrl+O |
| 1394 | reproduction that exposed pre-pager result truncation and conflicting composer |
| 1395 | shortcut routing (#4482), and the exact Vim-space regression reproduction |
| 1396 | verifying the v0.9.1 input path already contains the needed global binding |
| 1397 | (PR #4477). |
| 1398 | |
| 1399 | ### Security |
| 1400 | |
| 1401 | - Harden the public community-site boundary: scheduled review drafts now use |
| 1402 | one canonical freshness namespace, admin discard is restricted to validated |
| 1403 | draft objects, public feed requests cannot spend the server-held GitHub |
| 1404 | token, and maintainer login bodies are type- and size-bounded before parsing. |
| 1405 | |
| 1406 | ## [0.9.0] - 2026-07-16 |
| 1407 | |
| 1408 | Codewhale v0.9.0 replaces the default terminal shell with the underwater |
| 1409 | interaction system, makes Operate message-first, and hardens the Fleet, |
| 1410 | Workflow, routing, accounting, and release surfaces that support day-to-day |
| 1411 | agent work. The release also expands localization and gives the public site a |
| 1412 | quieter, docs-first community foundation. Its provider work replaces the old |
| 1413 | hand-maintained picker boundary with live ProviderLake discovery and adds the |
| 1414 | largest curated model-and-pricing expansion in the project so far. |
| 1415 | |
| 1416 | ### Fixed — final integration |
| 1417 | |
| 1418 | - Redact configured, environment, file-backed, and bare active credentials |
| 1419 | from every tool result before it crosses any model-provider wire protocol; |
| 1420 | retrieved spillover content is sanitized again at that boundary. The |
| 1421 | `read_file` tool also refuses CodeWhale configuration, backup, and |
| 1422 | credential-store paths, preventing routine tool use from exposing those |
| 1423 | local files. |
| 1424 | - Keep immediate TUI submit failures inside the shell: custom-provider route |
| 1425 | preflight and closed-mailbox errors now restore the exact composer draft and |
| 1426 | selected skill for retry, with a sticky visible error instead of exiting. |
| 1427 | - Anchor automatic compaction thresholds to the route's spendable input |
| 1428 | budget after output reservation and safety headroom, so large-output and |
| 1429 | tight self-hosted routes compact before provider context rejection. The TUI |
| 1430 | pre-send gate and warning copy now use the same token threshold as the |
| 1431 | engine. Preserve the 262K Kimi route's usable input budget and use the |
| 1432 | documented 32K default generation budget instead of mirroring the context |
| 1433 | window as output (#4293 by @SamhandsomeLee, #4368 by @bruce6135, and #4378 |
| 1434 | by @mvanhorn). |
| 1435 | - Fail closed instead of reporting base-rate dollar estimates for direct OpenAI |
| 1436 | GPT-5.4/5.4 Pro, GPT-5.5 (including dated snapshots), and GPT-5.6 |
| 1437 | Sol/Terra/Luna requests above 272K input tokens. Exact tiered accounting |
| 1438 | remains deferred to the generalized pricing schema; smaller 5.4 variants, |
| 1439 | GPT-5.5 Pro, Codex subscription, and foreign-provider routes are unchanged |
| 1440 | (#4317). |
| 1441 | - Retire `deepseek-chat` and `deepseek-reasoner` before they reach DeepSeek's |
| 1442 | first-party OpenAI or Anthropic wire APIs, migrating both to the documented |
| 1443 | `deepseek-v4-flash` replacement while preserving legacy non-thinking / |
| 1444 | thinking intent when no explicit reasoning tier is set. Aggregator, Wanjie |
| 1445 | Ark, self-hosted, and custom endpoint model ids remain provider-owned (#4320). |
| 1446 | - Make Operate a message-first multitask surface: ordinary prompts work without |
| 1447 | a Workflow, direct parent tools follow the same approval, sandbox, shell, |
| 1448 | ask-rule, and repository protections as Act, and follow-ups can queue while |
| 1449 | work is active. Bounded background workers remain preferred for independent, |
| 1450 | parallel, isolated, or long-running work; child handoffs cannot inherit |
| 1451 | standing Full Access, and each dispatch produces one durable completion |
| 1452 | receipt. |
| 1453 | - Let personal Fleet profiles in `CODEWHALE_HOME/agents` travel across |
| 1454 | repositories while project profiles in `.codewhale/agents` override them. |
| 1455 | Saving refreshes the live roster, and the UI now says explicitly that profile |
| 1456 | availability does not expand workspace, trust, or filesystem authority. |
| 1457 | - Move file-mention discovery onto one bounded, generation-safe background |
| 1458 | worker so a slow filesystem read cannot freeze composer input. Exact paths |
| 1459 | resolve on send; fuzzy matches stay in the completion popup instead of |
| 1460 | silently attaching an arbitrary same-name file (#4365 by @WavesMan, with the |
| 1461 | initial bounded-walk approach from #4367 by @LeoLin990405). |
| 1462 | - Keep the opt-in `remember` tool in the model-visible first-turn catalog so |
| 1463 | durable preference capture works without requiring a model to discover a |
| 1464 | tool it cannot yet know exists (#4373 by @Angel-Hair and #4377 by |
| 1465 | @mvanhorn). |
| 1466 | - Make `review` handle a staged snapshot relative to a base ref by comparing |
| 1467 | the branch merge-base tree with the index. This preserves committed and |
| 1468 | staged branch work, excludes unstaged edits, and avoids the invalid |
| 1469 | `git diff --cached <base>...HEAD` form. |
| 1470 | - Honor each MCP server's advertised discovery capabilities before calling |
| 1471 | optional tools, resources, templates, or prompts; keep optional probes |
| 1472 | independently bounded and fail-soft (#4308 by @nsfoxer). |
| 1473 | - Make offline `scorecard` pricing provider-aware: `turn_end` records carry the |
| 1474 | effective route and a non-secret billing surface, runtime exports and |
| 1475 | supported aliases ingest cleanly, legacy/unknown routes remain explicitly |
| 1476 | unpriced, and route-scoped cache and recorded-time pricing replace model-only |
| 1477 | guesses. Historical runtime aggregates use each turn's recorded time; |
| 1478 | costless catalog routes fail closed while exact provider-owned hand-price |
| 1479 | rows remain available. StepFun PAYG and Step Plan usage now stay distinct |
| 1480 | without persisting raw endpoint URLs, so subscription quota is never reported |
| 1481 | as token spend (#4335). Completion-only shell, manual-compaction, and purge |
| 1482 | events remain visible to `turn_end` observers as explicitly non-model |
| 1483 | lifecycle records. This builds on the scorecard introduced by @findshan in |
| 1484 | #3388. |
| 1485 | - Preserve named custom-provider identity across TUI sessions, `exec --resume`, |
| 1486 | runtime threads, exports, cache and Workflow receipts. Restores resolve the |
| 1487 | saved provider against live configuration before creating a client, never |
| 1488 | infer a provider from the model ID, and fail closed when the named route was |
| 1489 | removed, invalid, or ambiguous (#4334). |
| 1490 | - Bind credentials to the endpoint that owns them. Environment-selected custom |
| 1491 | hosts can no longer inherit saved provider keys, keyring entries, OAuth, or |
| 1492 | ambient provider variables; only an explicitly source-marked CLI key may |
| 1493 | follow an explicit CLI endpoint override. `auth_mode = "none"` also strips |
| 1494 | credential-shaped custom headers consistently in the TUI and app server, |
| 1495 | while keyless loopback routes remain usable as local runtimes. |
| 1496 | - Make hosted runtime threads deterministic and provider-exact: serialize |
| 1497 | thread, turn, and event mutation; keep cancellation ownership with the host; |
| 1498 | preserve the selected provider through every durable turn; terminalize |
| 1499 | exceptional streams once; and prevent the runtime manager from silently |
| 1500 | dispatching unclaimed goal continuations or child turns. |
| 1501 | - Treat required user confirmation as a real goal blocker instead of a failed |
| 1502 | goal, and explain how to recover when a previously cached approval is denied. |
| 1503 | Cached-denial recovery is also committed as a settled transcript receipt, so |
| 1504 | tool completion or a later status update cannot erase it from scrollback or |
| 1505 | accessibility output. The notice now describes matching, process-scoped |
| 1506 | denials truthfully across all shipped locales; approval audits honor |
| 1507 | `CODEWHALE_HOME`, and expired status toasts cannot remain trapped behind a |
| 1508 | persistent entry. Both states remain visible and actionable instead of |
| 1509 | looking like unexplained model or tool failure (#4374 and #4375 by |
| 1510 | @Angel-Hair, with the final hardening in #4385 by @nightt5879). |
| 1511 | - Make Fleet launch and teardown deterministic: route flags are placed before |
| 1512 | `exec`, workers are contained in owned Unix sessions or Windows Job Objects, |
| 1513 | and cancellation reaps surviving descendants with bounded escalation before |
| 1514 | manager state settles. Fence progress, terminal status, verification |
| 1515 | receipts, and evidence by durable attempt generation so a stale process can |
| 1516 | never complete or overwrite a restarted attempt; terminal state and receipt |
| 1517 | now commit atomically, stale-heartbeat decisions use a full lease CAS, |
| 1518 | exhausted-retry alerts are exactly once, and crash-truncated ledger tails are |
| 1519 | quarantined before the next append. Standalone CLI and Runtime API restart |
| 1520 | controls now drive the replacement attempt through a real executor to its |
| 1521 | terminal receipt, while per-run manager ownership prevents concurrent |
| 1522 | controllers from launching the same attempt twice. |
| 1523 | - Keep the stopship Workflow fixture bounded to measured 24k-per-turn role |
| 1524 | budgets and a 360k aggregate. Authored child step and wall-time limits now |
| 1525 | reach the live runtime, including launch-queue wait; promoted evidence stays |
| 1526 | intact between roles, tool-free handoff consumers omit tool fields on the |
| 1527 | provider wire, and a terminal `BLOCK` fails the Workflow instead of producing |
| 1528 | a successful Lane receipt. Free-form descriptions no longer fabricate write, |
| 1529 | shell, or network risk; unknown structured risk remains fail-closed. |
| 1530 | - Keep repository trust affirmative and explicit: only `1`/`Y` are advertised |
| 1531 | as acceptance keys, while Enter remains non-affirmative and explains the |
| 1532 | required choice. |
| 1533 | - Replace literal legal and doctrinal metaphors in Simplified Chinese setup and |
| 1534 | `/constitution` copy with direct collaboration terminology reviewed by a |
| 1535 | native speaker (#4369 by @hmr-BH). |
| 1536 | - Keep the transcript reviewable while an inline approval card is active: |
| 1537 | Page Up/Down, modified arrows, Home/End, and the mouse wheel now move through |
| 1538 | the visible evidence without changing or dismissing the pending decision |
| 1539 | (#4371 by @amuthantamil). |
| 1540 | - Match generated worker names to the active UI language while preserving |
| 1541 | explicit user names, and tighten the 89x50 shell rhythm across Fleet rows, |
| 1542 | choice dialogs, transcript boundaries, and the idle composer. |
| 1543 | - Put docs content and search before the full index on small screens, reduce |
| 1544 | mobile dead space, and keep the public community copy focused on issues, |
| 1545 | pull requests, and international contributors. |
| 1546 | |
| 1547 | ### Changed — the underwater shell |
| 1548 | |
| 1549 | - Replace the default TUI shell with the underwater interaction system: one |
| 1550 | renderer owns the header, top work strip, transcript ledger, composer, and |
| 1551 | footer, with explicit compact/normal/wide tiers and no legacy sidebar or |
| 1552 | dashboard in the default path. The legacy composition survives only behind |
| 1553 | the internal `classic` treatment. |
| 1554 | - Add a distinct pre-session launch screen — new session, new worktree (with |
| 1555 | inline naming and real lane provisioning), scoped resume count, changelog, |
| 1556 | quit — with reliable non-colliding keys and row/keyboard parity. |
| 1557 | - Render turns as a ledger: user message, short narration, settled tool |
| 1558 | receipts, and exactly one live row. Fast tool bursts land directly as |
| 1559 | batch receipts (no spinner churn), completed receipts stay inspectable, |
| 1560 | failures hold a coral receipt with stderr one `v` away, and one shared |
| 1561 | tool rail replaces nested card borders. |
| 1562 | - Make completion a one-shot exhale: `working -> finishing -> done` in the |
| 1563 | footer only, with no transcript repaint, no lingering loop, and no stale |
| 1564 | cancel action in the completed state. |
| 1565 | - Rebuild the secondary rooms on one hairline grammar — config, setup, |
| 1566 | sessions, help, context, theme, model/route, Fleet, file attach — each |
| 1567 | with a title hairline, row objects with focus/selection/mouse parity, |
| 1568 | one panel-owned scroll rail, and wrapped action footers. |
| 1569 | - Make `/model` a model-first atomic route picker across configured |
| 1570 | providers: provider and model switch together on apply, and every row |
| 1571 | prints the resolved model. `/theme` gains a live preview with truthful |
| 1572 | Esc revert across all 12 shipped themes. |
| 1573 | - Add a live context inspector (Alt+C) backed by the current route: exact |
| 1574 | system/messages/free token buckets, a proportional map, drill-down into |
| 1575 | the detail pager, and no frozen session while it is open. |
| 1576 | - Project Workflow runs as an in-stream run map: a collapsed one-line card |
| 1577 | that unfolds into per-lane rows with role, resolved model, worktree, |
| 1578 | elapsed track, and per-member running/waiting/failed/cancelled/done |
| 1579 | states, plus gates and a debrief built only from real run data. Child |
| 1580 | transcripts never flood the parent shell. |
| 1581 | - Unify Fleet into roster/setup/workers rooms: the operator is pinned first |
| 1582 | with the live session route, members show resolved route truth (inherit / |
| 1583 | fast lane / pinned), and the workers tab is a control surface with |
| 1584 | row-local open/stop and real lifecycle counts. |
| 1585 | - Distinguish repository-law approvals from ordinary approvals: the |
| 1586 | constitution prompt names its authority, source, matched rule, and target, |
| 1587 | and Full Access never bypasses it. Ordinary approvals render as a still |
| 1588 | coral band above the visible transcript. |
| 1589 | - Keep streaming honest and cheap: provider-unit deltas replace per-grapheme |
| 1590 | queueing, the transcript is top-anchored so appended lines stop shifting |
| 1591 | settled rows, ambient animation stops during real work, and ordinary |
| 1592 | completion no longer triggers full-screen clears (verified by render-diff |
| 1593 | logs: suffix updates of tens of cells while streaming, zero periodic |
| 1594 | full repaints). |
| 1595 | - Give every underwater treatment ambient life: ombre breathes its water |
| 1596 | column while flat and Terminal-owned keep the idle fish and bubble |
| 1597 | (foreground-only for Terminal), a typed treatment setting replaces string |
| 1598 | comparisons, reduced motion freezes life legibly, `fancy_animations = |
| 1599 | false` stills the chrome, and typing scatters the fish immediately. Fish |
| 1600 | keep a one-cell gap from occupied text; the whale remains the single brand |
| 1601 | mark and returns to stillness between caustic sweeps. |
| 1602 | - Bring the whale mark to life with a soft diagonal caustic sweep, then let it |
| 1603 | genuinely rest. Active markers now share a smoother 8 Hz clock after the |
| 1604 | existing earned-motion delay, while reduced motion, hidden/off-screen views, |
| 1605 | modal ownership, and compact-terminal redraw budgets remain authoritative. |
| 1606 | The motion is adapted from the Apache-2.0 Grok Build interaction language, |
| 1607 | not copied as a global pulse or high-frequency receipt cascade. |
| 1608 | - Keep compact terminals operable: `/config` and `/resume` collapse |
| 1609 | secondary chrome before sacrificing their selectable rows at 40x12 and |
| 1610 | 60x16, bodies budget for the footer's real wrapped height, and the |
| 1611 | selection stays visible through resizes. |
| 1612 | - Route footer notices through the classified toast system so informational |
| 1613 | acknowledgements (for example "Auto-compaction enabled") expire instead of |
| 1614 | becoming permanent idle chrome, while warnings and errors hold as sticky |
| 1615 | notices until their window passes. |
| 1616 | - Complete the `CODEWHALE_ASCII_SAFE=1` decorative tier: the whale mark, |
| 1617 | context meter, braille state markers (mapped by dot density so the working |
| 1618 | bubble still reads as a rising fill), bubbles, rails, and role/lane glyphs |
| 1619 | all narrow to semantic ASCII while user, model, and CJK text passes |
| 1620 | through untouched. Verified by whole-surface rendered-buffer sweeps. |
| 1621 | - Repair the Help catalog to match handler truth (`Alt+G`, `Alt+Shift+G`, |
| 1622 | `Alt+[`, `Alt+]`, `Alt+L`, `Alt+?`), and give theme, Help, model, and |
| 1623 | config rows direct mouse paths with the same activation as Enter. |
| 1624 | |
| 1625 | ### Changed — integrated runtime and TUI |
| 1626 | |
| 1627 | - Make worker delegation route-aware and identity-safe: workers receive a |
| 1628 | small role-scoped system prompt instead of stale parent/model boilerplate, |
| 1629 | faster routes resolve through the configured provider, and opening a worker |
| 1630 | shows its complete available transcript. Remove `token_budget` from the |
| 1631 | ordinary model-facing Agent schema so agents do not micromanage ad-hoc |
| 1632 | launches; explicit legacy calls remain readable for compatibility. |
| 1633 | - Mature `/config` interaction for enumerated and boolean settings with |
| 1634 | pickers/toggles, mouse-wheel scrolling, stable focus, and configured-provider |
| 1635 | selection. Startup mode is now only Agent or Plan; legacy `operate`/`yolo` |
| 1636 | settings migrate to Agent with permission posture represented separately. |
| 1637 | - Show where effective permission policy comes from and keep profile, |
| 1638 | environment, project, managed, and requirements-controlled posture read-only |
| 1639 | in the in-session editor. Runtime presets edit only proven user-owned root |
| 1640 | settings and no longer persist temporary environment overlays. |
| 1641 | - Restore the original four-line whale mark and make ambient ocean motion |
| 1642 | coherent across the full scroll surface: one continuous ombre, eased fish |
| 1643 | that face their direction of travel, fish in otherwise blank scrollback, and |
| 1644 | explicit reduced-motion and animation controls. |
| 1645 | - Keep model reasoning in the transcript rather than the Tasks strip, retain |
| 1646 | the live header status indicator, separate worker and success colors, and use |
| 1647 | the same rail grammar for both work-strip and transcript scrollbars. |
| 1648 | - Present the default Z.AI Coding Plan route, including child routes, as |
| 1649 | subscription quota instead of estimated per-token dollars. No undocumented |
| 1650 | account endpoint is called by this change. |
| 1651 | |
| 1652 | ### Added |
| 1653 | |
| 1654 | - Thinking Machines Lab's Inkling through Together using the exact wire model |
| 1655 | `thinkingmachines/inkling`, with `inkling` and `together-inkling` aliases and |
| 1656 | exact `none` / `minimal` / `low` / `medium` / `high` / `max` reasoning |
| 1657 | values. Codewhale does not invent a context window, price, or offline picker |
| 1658 | claim while the provider's public catalog metadata remains inconsistent. |
| 1659 | - Expand the verified offline catalog with Claude Sonnet 5, Claude Fable 5, |
| 1660 | GPT-5.3 Codex, and Qwen3.7 Plus, including time-aware Sonnet 5 introductory |
| 1661 | pricing and explicit cache rates. Refresh stale GLM-5.1, Kimi K2.6, Trinity, |
| 1662 | Qwen3.6, Nemotron, Anthropic, GLM-5.2, Kimi K2.7 Code, GLM-5 Turbo, and |
| 1663 | GPT-5 Codex price or limit rows; keep Xiaomi MiMo explicitly unpriced where |
| 1664 | the provider's token plan and pay-as-you-go surfaces cannot be distinguished. |
| 1665 | - MiniMax Messages provider support for MiniMax-M3 and MiniMax-M2.7, with |
| 1666 | OpenAI-compatible and Messages routes, regional endpoint guidance, request |
| 1667 | coverage, catalog limits, and tier-aware pricing (PR #4354 by @octo-patch). |
| 1668 | - Dynamic MCP server infrastructure and an approval-gated tool that lets the |
| 1669 | model start a configured MCP server from chat context. Harvested from |
| 1670 | #3869 and #3866 by @bistack with authorship preserved. |
| 1671 | - Parent `--disallowed-tools` restrictions now flow into sub-agents and Fleet |
| 1672 | workers by default, including deny-wins, wildcard, catalog-filtering, and |
| 1673 | multi-generation inheritance coverage. Harvested from #4096 by @JayBeest |
| 1674 | (#4042). |
| 1675 | - Korean (ko) UI locale with full key parity and onboarding/setup wiring |
| 1676 | (PR #4347 by @moduvoice). |
| 1677 | - Localize the entire underwater layer: 104 new UI strings — launch menu, |
| 1678 | phase words, mode/permission chips, footer hints, session picker, context |
| 1679 | inspector, route and theme pickers, Fleet roster, workflow status, sidebar |
| 1680 | work strip, repository-law approval copy, and file-attach titles — wired |
| 1681 | through MessageIds and translated into ja, zh-Hans, es-419, pt-BR, vi, |
| 1682 | and ko. Every complete pack now holds exact raw key parity with English |
| 1683 | (856 keys), enforced by new tests that the old English-fallback gate could |
| 1684 | not perform. The permission chip maps from typed state, so localization |
| 1685 | can never silently collapse it. Machine-authored translations follow each |
| 1686 | pack's existing terminology and are flagged for native review. |
| 1687 | - Anthropic adapter: sanitize top-level `oneOf`/`anyOf`/`allOf` in tool |
| 1688 | input schemas so affected tools no longer fail the whole request with |
| 1689 | HTTP 400 (PR #4346 by @qinlinwang). |
| 1690 | - Anthropic pricing: bill cache-write tokens at published rates |
| 1691 | (PR #4348 by @knqiufan, #4318). |
| 1692 | - NetBSD: generate QuickJS bindings at build time so `codewhale-workflow-js` |
| 1693 | compiles (PR #4349 by @ci4ic4). |
| 1694 | - Real-PTY release gates for six-worker fan-out liveness with Esc cancel, |
| 1695 | multi-terminal route isolation, queued steering via terminal-safe Ctrl+G |
| 1696 | (with Ctrl+S retained where the terminal forwards it), the one-shot |
| 1697 | completion footer, and per-theme ANSI output for every shipped palette. |
| 1698 | |
| 1699 | ### Fixed |
| 1700 | |
| 1701 | - Make release publication complete and source-anchored: every build checks out |
| 1702 | the resolved tag commit, tag movement is rejected before GHCR, GitHub |
| 1703 | Release, Homebrew, Cargo, or npm writes, and registry helpers require a clean |
| 1704 | checkout exactly matching the remote tag. Manual recovery runs are |
| 1705 | exact-tag-only and execute the same parity gate as automatic tag pushes. |
| 1706 | - Publish a coherent distribution set: both checksum manifests now contain |
| 1707 | usable public basenames and cover the full 29-asset matrix; GHCR, Homebrew, |
| 1708 | GitHub archives, and the Linux x64 CNB mirror carry `codewhale`, `codew`, and |
| 1709 | `codewhale-tui`. The CNB shortcut now fails clearly outside Linux/OpenHarmony |
| 1710 | x64 instead of promising assets that the mirror does not build. |
| 1711 | - Preserve task text when a skill is invoked through dollar, unified-slash, or |
| 1712 | explicit skill syntax, while keeping bare skill invocations and management |
| 1713 | subcommands intact (PR #4372 by @nightt5879, co-authored by @CCChisato; |
| 1714 | #3915). |
| 1715 | - Honor MCP server discovery capabilities: require advertised or legacy |
| 1716 | `tools/list`, keep optional resource/template/prompt probes independently |
| 1717 | bounded and fail-soft, and format descriptions Unicode-safely (#4308, |
| 1718 | harvested with co-authorship from @nsfoxer). |
| 1719 | - Age-evict terminal sub-agent worker records from the state ledger so |
| 1720 | long-lived, high-fan-out sessions do not keep rewriting multi-megabyte |
| 1721 | terminal history (#4217; root-cause and fix direction from @yekern). |
| 1722 | - Resolve the sub-agent completion/cancellation race with one terminal-state |
| 1723 | claim: cancellation suppresses late mailbox/parent/UI delivery, while a |
| 1724 | completed result remains publicly running until its notification is safely |
| 1725 | delivered. |
| 1726 | - Keep Workflow panel controls from stealing ordinary composer letters. Enter, |
| 1727 | Delete, Up/Down, and Esc own panel actions; typed characters return focus to |
| 1728 | the composer and start the message normally. |
| 1729 | - Preserve the composer prompt gutter from the first typed character through |
| 1730 | wrapping, scrolling, cursor placement, and mouse hit-testing so the `>` does |
| 1731 | not disappear or make input appear to jump. |
| 1732 | - Emit terminal-native OSC 8 metadata for rendered URLs without placing escape |
| 1733 | payload bytes in the measured text, keeping long links visible, selectable, |
| 1734 | and clickable in supporting terminals. |
| 1735 | |
| 1736 | - Keep headless structured output terminal-clean: `codewhale exec` engines |
| 1737 | no longer emit interactive terminal-title/taskbar OSC sequences, so |
| 1738 | `--output-format stream-json` stdout stays parseable, escape-free JSONL. |
| 1739 | Interactive TUI sessions keep their terminal chrome. |
| 1740 | - Localization honesty: the parity gate was blinded by its own English |
| 1741 | fallback — two keybinding rows (`KbCyclePermissions`, `KbCycleThinking`) |
| 1742 | were missing from all five "complete" packs and now ship translated; the |
| 1743 | Operate-mode copy that drifted in English was retranslated in every pack |
| 1744 | (including zh-Hant's slice); three MessageIds absent from |
| 1745 | ALL_MESSAGE_IDS are visible to tests again; and the `/config` |
| 1746 | theme/locale hints and the invalid-locale error derive from the shipped |
| 1747 | registries instead of stale hand lists that advertised 4 of 12 themes |
| 1748 | and 4 of 8 locales. |
| 1749 | - The setup wizard's constitution step no longer claims a "55-line core" |
| 1750 | in any language (the bundled core is larger today); the guided draft says |
| 1751 | "the bundled core stays active" instead. |
| 1752 | - In-app selection copy is rail-clean and now regression-tested: copied |
| 1753 | transcript text excludes the `▎ ╎ │ ●` decorations via cache metadata |
| 1754 | (#4208 — thanks @eugenicum for the report and code-aware fix direction; |
| 1755 | terminal-native selection with mouse capture off remains a product |
| 1756 | decision on the proposed `rail_style` option). |
| 1757 | |
| 1758 | ### Docs |
| 1759 | |
| 1760 | - Stamp every 0.9-era roadmap document with an explicit status (current, |
| 1761 | historical, superseded, principle-only, or future RFC), correct trackers |
| 1762 | that recorded unshipped work as done, and describe what remains after |
| 1763 | v0.9.0 in `docs/AGENT_RUNTIME.md`. |
| 1764 | - Add `docs/rfcs/UNIFIED_PROVIDER_LOGIN.md`: one `codewhale auth login` |
| 1765 | surface for Anthropic, OpenAI Codex, and xAI, with the Anthropic adapter |
| 1766 | gated on verifying flow permissions before any constants are adopted. |
| 1767 | - Refresh `docs/ACCESSIBILITY.md` for treatment-independent ambient life |
| 1768 | and the completed ASCII tier. |
| 1769 | |
| 1770 | ### Changed — runtime foundations |
| 1771 | |
| 1772 | - Make the advertised Android/Termux release target buildable by generating |
| 1773 | QuickJS bindings against the Android NDK instead of expecting an upstream |
| 1774 | pre-generated `aarch64-linux-android` binding file, and give Android CLI/TUI |
| 1775 | HTTP clients a preconfigured rustls root store (Mozilla WebPKI roots) so |
| 1776 | standalone Termux processes stop panicking inside |
| 1777 | `rustls-platform-verifier`'s JVM expectations (#4236, #4242). |
| 1778 | - Rebalance the bundled Constitution after the v0.8.67 prompt ablation: keep |
| 1779 | the procedural policy tail in mode-specific layers, while restoring concise |
| 1780 | behavioral guidance for momentum, causal investigation, constraint-first |
| 1781 | decisions, mechanism-backed guarantees, and clean continuity. |
| 1782 | - Wire live catalog cache into provider/model pickers without dropping stale or |
| 1783 | prior rows after TTL expiry / refresh failure (#4139). Remove the dead |
| 1784 | `OFFERING_SEEDS` hand table so the bundled Models.dev catalog is the sole |
| 1785 | seed source; pickers show a compact `stale` / `cache failed` chrome chip when |
| 1786 | the Models.dev layer is past TTL or last refresh failed. |
| 1787 | - Make `work_update` the sole model-facing To-do / Work progress tool (#4132). |
| 1788 | `checklist_*` and `todo_*` remain registered as hidden compat aliases for |
| 1789 | transcript replay; `update_plan` stays Strategy metadata/context/route, not |
| 1790 | a second checklist. Mode/approval prompts nudge the single surface. |
| 1791 | - Demote the bundled Models.dev snapshot to an offline/stale fallback after |
| 1792 | live catalog refresh (#4188). ProviderLake precedence is live Models.dev > |
| 1793 | bundled seed > legacy hardcoded completion names; pickers, inventory, and |
| 1794 | subagent validation stay catalog-backed, and Codewhale-only providers keep |
| 1795 | defaults when Models.dev has no rows. |
| 1796 | |
| 1797 | ### Added |
| 1798 | - Wire xAI device-code OAuth into `codewhale auth xai-device`, the TUI |
| 1799 | `/auth xai-device` command, and guided provider setup, with comment-preserving |
| 1800 | auth-mode persistence and loopback exchange coverage (#4257). |
| 1801 | - Add GPT-5.6 Sol, Terra, and Luna to the OpenAI API route, including their |
| 1802 | 1.05M context metadata, 128K output limits, pricing, and `max` reasoning |
| 1803 | effort. Add Meta Model API as a first-class OpenAI-compatible provider for |
| 1804 | Muse Spark 1.1 with 1M context, tool/reasoning metadata, provider aliases, |
| 1805 | and both `META_MODEL_API_KEY` and Meta's `MODEL_API_KEY` credential names. |
| 1806 | - Catalog automation: `scripts/catalog_models_dev.py` refreshes secret-free |
| 1807 | Models.dev / OpenRouter listings and validates the offline seed snapshot |
| 1808 | (`snapshot --check`) without ever persisting API keys (#4117). |
| 1809 | - `/model` picker cycles six catalog views with `A` (Configured → Catalog → |
| 1810 | Recent → Coding → Cheap → Long context) and richer row metadata from the |
| 1811 | live/bundled catalog (context, max output, tools, reasoning, price/M, |
| 1812 | freshness). Discoverability views do not auto-apply a surprising route |
| 1813 | (#4115). |
| 1814 | |
| 1815 | - Workflow runs are now durable: every run appends to a |
| 1816 | `.codewhale/workflow-runs.jsonl` journal and hydrates on startup, so |
| 1817 | `workflow status` survives restarts; runs left `running` by a dead process |
| 1818 | are recovered as failed (#4011). The transcript renders workflow tool |
| 1819 | output as a run card (status, goal, children, progress, verification) |
| 1820 | instead of a generic one-liner (#4038), and `workflow` accepts a `verify` |
| 1821 | flag that runs post-completion verification gates and fails the run when |
| 1822 | gates fail (#4013). |
| 1823 | - Hotbar sources for MCP tools and skills: MCP tool slots prefill the |
| 1824 | composer (execution stays behind the normal tool-approval flow) and skill |
| 1825 | slots activate through the existing `$skill` alias (#2068, #2069). |
| 1826 | - Mode & permission surface: Tab cycles Plan → Act → Operate; Shift+Tab |
| 1827 | cycles the Agent permission posture (Ask / Auto-Review / Full Access) with |
| 1828 | a footer permission chip; Ctrl+T cycles reasoning effort and Ctrl+Shift+T |
| 1829 | opens the live transcript overlay. Operate is the orchestration mode |
| 1830 | (delegate, wait, inspect, dispatch) and raises sub-agent fan-out while |
| 1831 | focusing the Agents sidebar. |
| 1832 | - Provider lake facade: the provider/model pickers, hotbar, and model |
| 1833 | inventory now enumerate configured providers' models from the bundled |
| 1834 | catalog (with an `A` toggle to browse the full catalog), replacing the |
| 1835 | hardcoded per-provider model table (#3830 follow-up). |
| 1836 | - Added Cursor-integrated-terminal dogfood evidence for the published v0.8.67 |
| 1837 | release, covering installed binary provenance, release/publication checks, |
| 1838 | headless runtime smoke, setup QA, and remaining manual visual TUI checks. |
| 1839 | - README and README.zh-CN now point users to the community-maintained |
| 1840 | CodeWhale for VS Code GUI frontend while clarifying that this repository's |
| 1841 | `extensions/vscode/` scaffold remains the read-only Phase 0 viewer (#4035). |
| 1842 | |
| 1843 | ### Fixed |
| 1844 | |
| 1845 | - Sub-agent waiting no longer peek→sleep polls: `agent(action="wait")` joins |
| 1846 | children, unchanged peeks are throttled (~30s) with an anti-polling nudge, |
| 1847 | and mode prompts teach the join primitive (#4097). Harvested from PR #4098 |
| 1848 | by [@Mr-Moon121](https://github.com/Mr-Moon121) (Jeffrey Luna). |
| 1849 | - `/provider` picker remembers catalog/configured view and highlighted row |
| 1850 | across reopen, matching `/model` picker memory. |
| 1851 | - Mode picker roster is exactly Act / Plan / Operate (no Multitask, no |
| 1852 | numeric `4`/`5` gaps). Legacy `yolo`/`4` remain invisible one-way |
| 1853 | permission shorthand for Act + Bypass. |
| 1854 | |
| 1855 | - Fleet setup is a role/profile roster editor, not a provider-scoped model |
| 1856 | picker: the Model step lists routes from every configured provider (not |
| 1857 | only the active one), a picked route's provider is persisted explicitly in |
| 1858 | the saved profile TOML (`provider = "..."`, never inferred from the model |
| 1859 | id), and the loader/route resolver read that field back out verbatim. The |
| 1860 | draft-preview save keypress no longer competes with a separate pager's |
| 1861 | `g`/`G` scroll bindings — the exact TOML preview now renders inline on the |
| 1862 | same Review step that saves it (#4093). |
| 1863 | - `codewhale fleet run` and interactive in-process Fleet launches now honor a |
| 1864 | profile-pinned provider/model route instead of merely recording it on the |
| 1865 | receipt. Headless workers receive the non-secret `--provider` and `--model` |
| 1866 | pair; TUI workers resolve the same explicit route in process. Credentials |
| 1867 | still come from the worker's environment, provider is never inferred from a |
| 1868 | model id, and unpinned workers continue to inherit the run route (#4093, |
| 1869 | #4193). |
| 1870 | - The Fleet setup `m` model-assisted redraft no longer drops a picked |
| 1871 | cross-provider route: the provider/model the operator chose are re-pinned |
| 1872 | onto the drafted profile (a model draft is always `provider: None`), so |
| 1873 | saving it keeps the explicit route instead of persisting an ambiguous, |
| 1874 | provider-scoped profile (#4093). |
| 1875 | - Saving a Fleet profile now fails with a clear message when it pins a |
| 1876 | provider that has no configured credentials, using the same |
| 1877 | configured-provider check the model picker uses (#4093). |
| 1878 | - Workflow correctness: completion polling fails closed instead of |
| 1879 | fabricating success when a sub-agent reports no terminal status; cancel |
| 1880 | interrupts the JS VM (cancel handle + abort) and blocks further spawns; |
| 1881 | and `budget.spent()` reports real manager-scope usage instead of always 0. |
| 1882 | - Sub-agent spawns validate the model↔provider pair before dispatch: |
| 1883 | inherited/faster routes remap foreign models to the provider's catalog |
| 1884 | default, and explicit pins fail fast with a diagnostic instead of an |
| 1885 | upstream model-not-found error. |
| 1886 | - TUI stability: engine event drains break every 8–16 events / 8 ms to keep |
| 1887 | input live (#1830, #2317, #1198); the terminal input pump restarts after |
| 1888 | stall recovery on macOS/Linux too; the startup raw-mode probe no longer |
| 1889 | leaks raw mode on timeout; recovery snapshots persist every 45 s during |
| 1890 | long turns and the offline queue persists on every push (#1830); |
| 1891 | queue/steer paths surface toasts while streaming (#2317, #1338); and |
| 1892 | modal submit errors re-open the modal instead of being swallowed (#1198). |
| 1893 | - Core/state: paused jobs persist as paused across restarts; unarchive |
| 1894 | updates the in-memory cache; tool dispatch has a timeout; MCP |
| 1895 | notifications no longer receive responses; corrupted checkpoints surface |
| 1896 | errors instead of loading empty state; the session index compacts instead |
| 1897 | of growing unbounded; and recording thread-goal usage no longer |
| 1898 | self-deadlocks the state store. |
| 1899 | - Runtime compaction summaries are now persisted into `/v1` thread records so |
| 1900 | engine reloads and restarts preserve compacted context. Contributed by |
| 1901 | MXAntian (@MXAntian) (#4091). |
| 1902 | - The TUI leaves xterm alternate-scroll mode off when mouse capture is disabled, |
| 1903 | preserving native terminal text selection in light-theme/no-mouse-capture |
| 1904 | sessions. Contributed by Nightt (@nightt5879) (#4088, #4026). |
| 1905 | - The public `/api/github/feed` endpoint is now forced dynamic on Cloudflare so |
| 1906 | it returns live GitHub activity instead of a build-time empty feed. |
| 1907 | |
| 1908 | ### Security |
| 1909 | |
| 1910 | - Require bearer authentication for `/v1/chat/completions`, compare tokens in |
| 1911 | constant time, return accurate 4xx/5xx statuses, bound request bodies and SSE |
| 1912 | frames, redact secrets from stdio `config get`, and reliably reap the runtime |
| 1913 | child during shutdown. |
| 1914 | - Keep trust precedence and secret persistence fail-closed: user ExecPolicy |
| 1915 | rules outrank agent-layer rules, chained commands cannot propose unsafe |
| 1916 | trusted-prefix amendments, and config and secret writes are atomic with |
| 1917 | filesystem synchronization on every supported platform. |
| 1918 | |
| 1919 | ### Changed |
| 1920 | |
| 1921 | - Tool-hang watchdog trimmed from 15 minutes to 10 (#1862); approval modal |
| 1922 | footer hints use a higher-contrast tier (#3380); status/mode copy is |
| 1923 | disclosed once across header, footer, cards, and sidebar instead of |
| 1924 | repeated per layer. |
| 1925 | - Removed the unused `tui::whale_routes` taxonomy module and its tests. |
| 1926 | Contributed by Darrell Thomas (@DarrellThomas) (#4041, #3852). |
| 1927 | |
| 1928 | ### Deprecated |
| 1929 | |
| 1930 | - YOLO mode: `--yolo`, `default_mode = "yolo"`, and the hotbar YOLO action |
| 1931 | now map to Act + Full Access permissions via a compatibility shim and |
| 1932 | show a one-shot deprecation notice. Removal is deferred beyond v0.9.0 so |
| 1933 | this release does not break existing scripts without a dedicated cutover. |
| 1934 | |
| 1935 | ### Removed |
| 1936 | |
| 1937 | - Remove the deprecated `deepseek` and `deepseek-tui` binary shims in this |
| 1938 | breaking release. `codewhale`, `codew`, and `codewhale-tui` are the supported |
| 1939 | entry points; existing DeepSeek provider support and legacy config/session |
| 1940 | migration remain intact. |
| 1941 | |
| 1942 | ### Known issues |
| 1943 | |
| 1944 | - Android/Termux arm64 remains a preview in v0.9.0. The target, asset wiring, |
| 1945 | updater selection, dependency graph, and source-build path have automated or |
| 1946 | static coverage, but shell/PTY/config/TUI startup and runtime behavior remain |
| 1947 | unverified on a real device (#4236, #4242). Do not use a GNU/Linux arm64 |
| 1948 | archive in Termux. |
| 1949 | |
| 1950 | ### Contributors |
| 1951 | |
| 1952 | Thank you to the international community whose code, reports, reviews, and |
| 1953 | reproductions shaped v0.9.0: |
| 1954 | |
| 1955 | - [@amuthantamil](https://github.com/amuthantamil), |
| 1956 | [@bistack](https://github.com/bistack), |
| 1957 | [@bruce6135](https://github.com/bruce6135), |
| 1958 | [@CCChisato](https://github.com/CCChisato), |
| 1959 | [@ci4ic4](https://github.com/ci4ic4), |
| 1960 | [@cyq1017](https://github.com/cyq1017), and |
| 1961 | [@DarrellThomas](https://github.com/DarrellThomas). |
| 1962 | - [@eugenicum](https://github.com/eugenicum), |
| 1963 | [@findshan](https://github.com/findshan), |
| 1964 | [@gaord](https://github.com/gaord), |
| 1965 | [@hmr-BH](https://github.com/hmr-BH), |
| 1966 | [@hongqitai](https://github.com/hongqitai), and |
| 1967 | [@idling11](https://github.com/idling11). |
| 1968 | - [@JayBeest](https://github.com/JayBeest), |
| 1969 | [@knqiufan](https://github.com/knqiufan), |
| 1970 | [@LeoLin990405](https://github.com/LeoLin990405), |
| 1971 | [@moduvoice](https://github.com/moduvoice), |
| 1972 | [@mvanhorn](https://github.com/mvanhorn), |
| 1973 | [@Mr-Moon121](https://github.com/Mr-Moon121), and |
| 1974 | [@MXAntian](https://github.com/MXAntian). |
| 1975 | - [@Angel-Hair](https://github.com/Angel-Hair), |
| 1976 | [@nightt5879](https://github.com/nightt5879), |
| 1977 | [@nsfoxer](https://github.com/nsfoxer), |
| 1978 | [@octo-patch](https://github.com/octo-patch), |
| 1979 | [@qinlinwang](https://github.com/qinlinwang), |
| 1980 | [@SamhandsomeLee](https://github.com/SamhandsomeLee), and |
| 1981 | [@taixinguo](https://github.com/taixinguo). |
| 1982 | - [@WavesMan](https://github.com/WavesMan), |
| 1983 | [@wuisabel-gif](https://github.com/wuisabel-gif), and |
| 1984 | [@yekern](https://github.com/yekern). |
| 1985 | |
| 1986 | ## [0.8.68] - 2026-07-10 |
| 1987 | |
| 1988 | ### Changed |
| 1989 | |
| 1990 | - Make the advertised Android/Termux release target buildable by generating |
| 1991 | QuickJS bindings against the Android NDK instead of expecting an upstream |
| 1992 | pre-generated `aarch64-linux-android` binding file, and give Android CLI/TUI |
| 1993 | HTTP clients a preconfigured rustls root store (Mozilla WebPKI roots) so |
| 1994 | standalone Termux processes stop panicking inside |
| 1995 | `rustls-platform-verifier`'s JVM expectations (#4236, #4242). |
| 1996 | - Rebalance the bundled Constitution after the v0.8.67 prompt ablation: keep |
| 1997 | the procedural policy tail in mode-specific layers, while restoring concise |
| 1998 | behavioral guidance for momentum, causal investigation, constraint-first |
| 1999 | decisions, mechanism-backed guarantees, and clean continuity. |
| 2000 | - Wire live catalog cache into provider/model pickers without dropping stale or |
| 2001 | prior rows after TTL expiry / refresh failure (#4139). Remove the dead |
| 2002 | `OFFERING_SEEDS` hand table so the bundled Models.dev catalog is the sole |
| 2003 | seed source; pickers show a compact `stale` / `cache failed` chrome chip when |
| 2004 | the Models.dev layer is past TTL or last refresh failed. |
| 2005 | - Make `work_update` the sole model-facing To-do / Work progress tool (#4132). |
| 2006 | `checklist_*` and `todo_*` remain registered as hidden compat aliases for |
| 2007 | transcript replay; `update_plan` stays Strategy metadata/context/route, not |
| 2008 | a second checklist. Mode/approval prompts nudge the single surface. |
| 2009 | - Demote the bundled Models.dev snapshot to an offline/stale fallback after |
| 2010 | live catalog refresh (#4188). ProviderLake precedence is live Models.dev > |
| 2011 | bundled seed > legacy hardcoded completion names; pickers, inventory, and |
| 2012 | subagent validation stay catalog-backed, and CodeWhale-only providers keep |
| 2013 | defaults when Models.dev has no rows. |
| 2014 | |
| 2015 | ### Added |
| 2016 | - Wire xAI device-code OAuth into `codewhale auth xai-device`, the TUI |
| 2017 | `/auth xai-device` command, and guided provider setup, with comment-preserving |
| 2018 | auth-mode persistence and loopback exchange coverage (#4257). |
| 2019 | - Add GPT-5.6 Sol, Terra, and Luna to the OpenAI API route, including their |
| 2020 | 1.05M context metadata, 128K output limits, pricing, and `max` reasoning |
| 2021 | effort. Add Meta Model API as a first-class OpenAI-compatible provider for |
| 2022 | Muse Spark 1.1 with 1M context, tool/reasoning metadata, provider aliases, |
| 2023 | and both `META_MODEL_API_KEY` and Meta's `MODEL_API_KEY` credential names. |
| 2024 | - Catalog automation: `scripts/catalog_models_dev.py` refreshes secret-free |
| 2025 | Models.dev / OpenRouter listings and validates the offline seed snapshot |
| 2026 | (`snapshot --check`) without ever persisting API keys (#4117). |
| 2027 | - `/model` picker cycles six catalog views with `A` (Configured → Catalog → |
| 2028 | Recent → Coding → Cheap → Long context) and richer row metadata from the |
| 2029 | live/bundled catalog (context, max output, tools, reasoning, price/M, |
| 2030 | freshness). Discoverability views do not auto-apply a surprising route |
| 2031 | (#4115). |
| 2032 | |
| 2033 | - Workflow runs are now durable: every run appends to a |
| 2034 | `.codewhale/workflow-runs.jsonl` journal and hydrates on startup, so |
| 2035 | `workflow status` survives restarts; runs left `running` by a dead process |
| 2036 | are recovered as failed (#4011). The transcript renders workflow tool |
| 2037 | output as a run card (status, goal, children, progress, verification) |
| 2038 | instead of a generic one-liner (#4038), and `workflow` accepts a `verify` |
| 2039 | flag that runs post-completion verification gates and fails the run when |
| 2040 | gates fail (#4013). |
| 2041 | - Hotbar sources for MCP tools and skills: MCP tool slots prefill the |
| 2042 | composer (execution stays behind the normal tool-approval flow) and skill |
| 2043 | slots activate through the existing `$skill` alias (#2068, #2069). |
| 2044 | - Mode & permission surface: Tab cycles Plan → Act → Operate; Shift+Tab |
| 2045 | cycles the Agent permission posture (Ask / Auto-Review / Full Access) with |
| 2046 | a footer permission chip; Ctrl+T cycles reasoning effort and Ctrl+Shift+T |
| 2047 | opens the live transcript overlay. Operate is the orchestration mode |
| 2048 | (delegate, wait, inspect, dispatch) and raises sub-agent fan-out while |
| 2049 | focusing the Agents sidebar. |
| 2050 | - Provider lake facade: the provider/model pickers, hotbar, and model |
| 2051 | inventory now enumerate configured providers' models from the bundled |
| 2052 | catalog (with an `A` toggle to browse the full catalog), replacing the |
| 2053 | hardcoded per-provider model table (#3830 follow-up). |
| 2054 | - Added Cursor-integrated-terminal dogfood evidence for the published v0.8.67 |
| 2055 | release, covering installed binary provenance, release/publication checks, |
| 2056 | headless runtime smoke, setup QA, and remaining manual visual TUI checks. |
| 2057 | - README and README.zh-CN now point users to the community-maintained |
| 2058 | CodeWhale for VS Code GUI frontend while clarifying that this repository's |
| 2059 | `extensions/vscode/` scaffold remains the read-only Phase 0 viewer (#4035). |
| 2060 | |
| 2061 | ### Fixed |
| 2062 | |
| 2063 | - Sub-agent waiting no longer peek→sleep polls: `agent(action="wait")` joins |
| 2064 | children, unchanged peeks are throttled (~30s) with an anti-polling nudge, |
| 2065 | and mode prompts teach the join primitive (#4097). Harvested from PR #4098 |
| 2066 | by [@Mr-Moon121](https://github.com/Mr-Moon121) (Jeffrey Luna). |
| 2067 | - `/provider` picker remembers catalog/configured view and highlighted row |
| 2068 | across reopen, matching `/model` picker memory. |
| 2069 | - Mode picker roster is exactly Act / Plan / Operate (no Multitask, no |
| 2070 | numeric `4`/`5` gaps). Legacy `yolo`/`4` remain invisible one-way |
| 2071 | permission shorthand for Act + Bypass. |
| 2072 | |
| 2073 | - Fleet setup is a role/profile roster editor, not a provider-scoped model |
| 2074 | picker: the Model step lists routes from every configured provider (not |
| 2075 | only the active one), a picked route's provider is persisted explicitly in |
| 2076 | the saved profile TOML (`provider = "..."`, never inferred from the model |
| 2077 | id), and the loader/route resolver read that field back out verbatim. The |
| 2078 | draft-preview ratify keypress no longer competes with a separate pager's |
| 2079 | `g`/`G` scroll bindings — the exact TOML preview now renders inline on the |
| 2080 | same Review step that ratifies it (#4093). |
| 2081 | - The headless `codewhale fleet run` CLI now launches workers on their profile-pinned route, not just records it on the receipt: `codewhale exec` gains a non-secret `--provider` flag, and a worker whose profile pins provider B is dispatched with `--provider B --model <B's model>` even when the parent session is on provider A (credentials still resolve from the worker's own environment; provider is never inferred from the model id). Workers with no profile-bound provider are unchanged — no `--provider`, run-level model. The interactive TUI spawns roster members in-process and does not yet honor the pinned provider (it uses the session provider); that remainder is tracked in #4193 (#4093). |
| 2082 | - The Fleet setup `m` model-assisted redraft no longer drops a picked |
| 2083 | cross-provider route: the provider/model the operator chose are re-pinned |
| 2084 | onto the drafted profile (a model draft is always `provider: None`), so |
| 2085 | ratifying it keeps the explicit route instead of persisting an ambiguous, |
| 2086 | provider-scoped profile (#4093). |
| 2087 | - Ratifying a Fleet profile now fails with a clear message when it pins a |
| 2088 | provider that has no configured credentials, using the same |
| 2089 | configured-provider check the model picker uses (#4093). |
| 2090 | - Workflow correctness: completion polling fails closed instead of |
| 2091 | fabricating success when a sub-agent reports no terminal status; cancel |
| 2092 | interrupts the JS VM (cancel handle + abort) and blocks further spawns; |
| 2093 | and `budget.spent()` reports real manager-scope usage instead of always 0. |
| 2094 | - Sub-agent spawns validate the model↔provider pair before dispatch: |
| 2095 | inherited/faster routes remap foreign models to the provider's catalog |
| 2096 | default, and explicit pins fail fast with a diagnostic instead of an |
| 2097 | upstream model-not-found error. |
| 2098 | - TUI stability: engine event drains break every 8–16 events / 8 ms to keep |
| 2099 | input live (#1830, #2317, #1198); the terminal input pump restarts after |
| 2100 | stall recovery on macOS/Linux too; the startup raw-mode probe no longer |
| 2101 | leaks raw mode on timeout; recovery snapshots persist every 45 s during |
| 2102 | long turns and the offline queue persists on every push (#1830); |
| 2103 | queue/steer paths surface toasts while streaming (#2317, #1338); and |
| 2104 | modal submit errors re-open the modal instead of being swallowed (#1198). |
| 2105 | - app-server hardening: `/v1/chat/completions` requires the bearer token; |
| 2106 | errors return real 4xx/5xx statuses; request bodies and SSE frames are |
| 2107 | size-limited; stdio `config get` redacts secrets and stdio shutdown reaps |
| 2108 | the runtime child; graceful shutdown on SIGTERM/Ctrl+C; constant-time |
| 2109 | token comparison; dropping the runtime bridge no longer blocks the |
| 2110 | runtime. |
| 2111 | - Policy/config/secrets: user-layer ExecPolicy rules outrank agent-layer |
| 2112 | rules; chained commands no longer propose trusted-prefix amendments; |
| 2113 | config and secrets writes are atomic (with fsync) on all platforms; empty |
| 2114 | provider chains no longer panic. |
| 2115 | - Core/state: paused jobs persist as paused across restarts; unarchive |
| 2116 | updates the in-memory cache; tool dispatch has a timeout; MCP |
| 2117 | notifications no longer receive responses; corrupted checkpoints surface |
| 2118 | errors instead of loading empty state; the session index compacts instead |
| 2119 | of growing unbounded; and recording thread-goal usage no longer |
| 2120 | self-deadlocks the state store. |
| 2121 | - Runtime compaction summaries are now persisted into `/v1` thread records so |
| 2122 | engine reloads and restarts preserve compacted context. Contributed by |
| 2123 | MXAntian (@MXAntian) (#4091). |
| 2124 | - The TUI leaves xterm alternate-scroll mode off when mouse capture is disabled, |
| 2125 | preserving native terminal text selection in light-theme/no-mouse-capture |
| 2126 | sessions. Contributed by Nightt (@nightt5879) (#4088, #4026). |
| 2127 | - The public `/api/github/feed` endpoint is now forced dynamic on Cloudflare so |
| 2128 | it returns live GitHub activity instead of a build-time empty feed. |
| 2129 | |
| 2130 | ### Changed |
| 2131 | |
| 2132 | - Tool-hang watchdog trimmed from 15 minutes to 10 (#1862); approval modal |
| 2133 | footer hints use a higher-contrast tier (#3380); status/mode copy is |
| 2134 | disclosed once across header, footer, cards, and sidebar instead of |
| 2135 | repeated per layer. |
| 2136 | - Removed the unused `tui::whale_routes` taxonomy module and its tests. |
| 2137 | Contributed by Darrell Thomas (@DarrellThomas) (#4041, #3852). |
| 2138 | |
| 2139 | ### Deprecated |
| 2140 | |
| 2141 | - YOLO mode: `--yolo`, `default_mode = "yolo"`, and the hotbar YOLO action |
| 2142 | now map to Act + Full Access permissions via a compatibility shim and |
| 2143 | show a one-shot deprecation notice; removal is planned for 0.9.0. |
| 2144 | |
| 2145 | ## [0.8.67] - 2026-07-06 |
| 2146 | |
| 2147 | ### Added |
| 2148 | |
| 2149 | - The model you select in `/model` is now the operator: fleet workers whose |
| 2150 | task spec and roster profile pin no model inherit the active session route |
| 2151 | instead of a hardcoded `auto` sentinel, matching the pinned operator row in |
| 2152 | `/fleet roster`. Task-level and profile model overrides still win, and |
| 2153 | route receipts record which source applied (`task.model`, |
| 2154 | `agent_profile.model`, or `run.model`). |
| 2155 | - Added the `/workflow` command (aliases `/workflows`, `/wf`) as the user |
| 2156 | opt-in to workflow orchestration. Bare `/workflow` orchestrates the current |
| 2157 | work — the model synthesizes the objective from the conversation context; |
| 2158 | `/workflow <objective>` narrows the run; `/workflow status [run_id]` and |
| 2159 | `/workflow cancel <run_id>` relay typed run receipts without starting new |
| 2160 | runs. |
| 2161 | - Bare `/goal` with no active goal now declares a goal from the conversation |
| 2162 | context via `create_goal` instead of printing usage; with an active goal it |
| 2163 | remains the status readout, and explicit `/goal <objective>` is unchanged. |
| 2164 | - Added the constitution-first setup wizard: a unified `/setup` shell with |
| 2165 | resume, back navigation, and skip-retry state; provider/model readiness |
| 2166 | cards with a custom-provider form and provider-picker detail layout; a |
| 2167 | runtime posture card with preset application and project-override warnings; |
| 2168 | a setup verification report; and transactional setup persistence with |
| 2169 | secret redaction and rollback (#3402, #3403, #3404, #3405, #3406, #3410, |
| 2170 | #3411). |
| 2171 | - Added a structured user-global constitution with a deterministic renderer, |
| 2172 | prompt-block injection, guided principle authoring with preview and preset |
| 2173 | save, and a `/constitution` manager command as the primary constitution |
| 2174 | management surface, with file state shown in setup and actions surfaced in |
| 2175 | diagnostics (#3793, #3806, #3811). |
| 2176 | - Added model-assisted constitution and fleet-profile drafting behind an |
| 2177 | explicit ratify gate, with untrusted-draft provenance recorded so |
| 2178 | model-authored text is never applied silently. Updating users keep their |
| 2179 | existing constitution unchanged, and a localized constitution checkpoint is |
| 2180 | required after update (#3794). |
| 2181 | - Added the Hotbar route editor v1 with route-switch slot actions and support |
| 2182 | for custom model routes, plus a configured-provider route manager for |
| 2183 | `/provider` and `/model` with a missing-auth handoff into provider key |
| 2184 | entry (#2066, #3830, #3831). |
| 2185 | - Added auto-discovery of `.codewhale/rules/` and `.claude/rules/` |
| 2186 | directories as project context, with a total byte-budget cap on the |
| 2187 | assembled rules block. Contributed by maple (@yekern). |
| 2188 | - Exposed `context_input_budget_for_route` from the engine so external |
| 2189 | integrations can reuse route budget math. Contributed by hexin |
| 2190 | (@h3c-hexin). |
| 2191 | - Added GUI config persistence to the runtime API. Contributed by @gaord. |
| 2192 | - Added a website localization matrix with a locale registry and drift |
| 2193 | checks. Harvested from #3763 by @idling11 (#3090). |
| 2194 | - Added `doctor` detection of half-applied setup state, and startup milestone |
| 2195 | tracing for boot-performance diagnosis. |
| 2196 | - Added a v0.8.67 computer-use dogfood prompt that covers the Cursor-terminal |
| 2197 | QA flow, headless gates, setup, sub-agent completion, Fleet, Workflow, model |
| 2198 | pricing, and release evidence collection. |
| 2199 | - Fleet: local worker memory usage is now reported, including retained memory |
| 2200 | while a task is in Running status. Contributed by @cyq1017 (#3901). |
| 2201 | - Website: community hub, constitution thesis page and constitution-centered |
| 2202 | homepage, models page generated from the provider registry, docs dark mode |
| 2203 | and full SEO metadata/sitemap coverage, terminal player for real |
| 2204 | constitution traces, and a live star badge and version. |
| 2205 | - Added Meituan LongCat as a first-class OpenAI-compatible provider |
| 2206 | (`longcat`, with `long-cat`, `meituan-longcat`, and `meituan` aliases), |
| 2207 | `LONGCAT_API_KEY` discovery, the `LongCat-2.0` default model, provider |
| 2208 | picker wiring, model completions, provider docs, and web provider facts. |
| 2209 | - Fleet: added per-provider setup cards (Persistence, Constitution, Hotbar, |
| 2210 | Tools/MCP, Remote Runtime) with a unified setup catalog and provider-specific |
| 2211 | credential links. Provider setup progress is persisted transactionally with |
| 2212 | rollback guards, Codex OAuth is kept out of provider key storage, and a |
| 2213 | headless QA contract verifies setup readiness across providers. |
| 2214 | - Fleet: added Fleet starter profiles with role-aware loadouts (scout→Fast, |
| 2215 | manager→Inherit, etc.), `/fleet setup` profile-authoring wizard, Fleet |
| 2216 | effective-permission recording, and route intent-source tracking. |
| 2217 | - Fleet: added 'operator' as a built-in Fleet roster member — the preferred |
| 2218 | helm Fleet slot for workflow coordination. Operator plans, routes, reviews |
| 2219 | outputs, and calls other Fleet slots as needed. This is a roster role, not a |
| 2220 | separate app mode. The full Operation/Operate-mode architecture is deferred |
| 2221 | to 0.9.0. |
| 2222 | - Workflow: declarative workflows now run through the production driver, the |
| 2223 | workflow tool is wired to sub-agent dispatch, public Workflow surfaces are |
| 2224 | renamed, and typed workflow-run and status receipts are emitted for |
| 2225 | debugging and verification. |
| 2226 | - Added provider-agnostic Fleet rosters and loadouts: provider-specific |
| 2227 | subagent limits, launch concurrency, and admission caps are derived from |
| 2228 | config without hardcoding any single provider. |
| 2229 | - Added Workflow runtime foundations: the internal JS authoring/runtime crates |
| 2230 | compile and replay example workflows. 0.8.67 ships the `/workflow` opt-in, |
| 2231 | production-driver dispatch path, sub-agent task handoff, and typed run/status |
| 2232 | receipts; richer authoring UX and the full TUI run view remain tracked for |
| 2233 | v0.8.68 (#2974, #4038). |
| 2234 | |
| 2235 | ### Changed |
| 2236 | |
| 2237 | - Clarified the Fleet coordination hierarchy and made roles carry real |
| 2238 | doctrine: the **operator** (the session's `/model` selection) runs the |
| 2239 | operation and assigns managers to workflows; a **manager** is the middle |
| 2240 | manager of exactly one workflow. The built-in **reviewer** is now explicitly |
| 2241 | adversarial (assume the change is broken, try to refute it), and the review |
| 2242 | sub-agent intro adopts the same framing. Built-in `manager`/`operator`/ |
| 2243 | `reviewer` roster members now ship role `instructions` that flow into worker |
| 2244 | prompts on both the Fleet task-spec and agent/workflow `profile:` spawn |
| 2245 | paths; custom profiles override them via the same `instructions` field. |
| 2246 | - Removed the decorative Fleet vocabulary that never routed differently: |
| 2247 | the `tool-heavy` slot and the `strong`/`balanced`/`deep-reasoning`/`code`/ |
| 2248 | `review`/`tool-heavy` loadout tiers. `inherit` (the operator's route) and |
| 2249 | `fast` (the provider's faster class) remain; retired names in existing |
| 2250 | configs keep parsing (as custom labels) with identical auto routing, and |
| 2251 | the `/fleet setup` model-class step now offers only the real choices. |
| 2252 | - Raised the default subagent concurrency for high-throughput fanout: |
| 2253 | `max_subagents` default 20 → 64 (config ceiling 128) and the queued+running |
| 2254 | admission cap 200 → 1024. Users on metered plans who want the old behavior |
| 2255 | can set `max_subagents = 20` in config.toml. |
| 2256 | - Renamed the internal `whaleflow` subsystem to `workflow` across the |
| 2257 | workspace: the `codewhale-whaleflow`/`codewhale-whaleflow-js` crates become |
| 2258 | `codewhale-workflow`/`codewhale-workflow-js`, Rust identifiers and JS bridge |
| 2259 | symbols are renamed, the `CODEWHALE_WHALEFLOW_JS_*` environment variables |
| 2260 | become `CODEWHALE_WORKFLOW_JS_*`, and the authoring/RFC docs move to |
| 2261 | `WORKFLOW_AUTHORING.md` and `WORKFLOW_EXTERNAL_MEMORY.md`. Historical |
| 2262 | changelog and retro-ledger entries keep the old name as a record. |
| 2263 | - Documented the Homebrew rollout strategy and added a distribution-channel |
| 2264 | check to the release checklist. Harvested from #3760 by @idling11 (#3489). |
| 2265 | - Paused Linux RISC-V prebuilt release and nightly artifacts because |
| 2266 | `rquickjs-sys` 0.12.0 does not ship `riscv64gc-unknown-linux-gnu` bindings; |
| 2267 | installers, docs, and update paths now treat RISC-V as unsupported until |
| 2268 | upstream bindings or a bindgen-enabled build lands. |
| 2269 | - Made the approval prompt calm, compact, and honest, and centered the |
| 2270 | first-run follow-up on the constitution; first-run onboarding now hands off |
| 2271 | into the setup wizard, and the language picker offers every shipped locale |
| 2272 | (#3929). |
| 2273 | - Startup performance: boot janitors and store scans no longer block the |
| 2274 | first frame, `@mention` completion no longer re-walks the workspace per |
| 2275 | keystroke, and idle offline-queue clones and duplicate tool-output hashing |
| 2276 | were eliminated. |
| 2277 | - Clarified the misleading "Ctrl+B backgrounds this command" shell wording |
| 2278 | (#3859) and the hotbar help shortcuts. Docs contribution by Chanhyo Jung |
| 2279 | (@roian6). |
| 2280 | - Documented the enforced repo-law invariants, the constitution flow, and the |
| 2281 | `/fleet setup` profile-authoring wizard; aligned `permissions.toml` action |
| 2282 | docs. Docs contribution by @greyfreedom. |
| 2283 | - Bumped web dependencies: wrangler 4.103.0 → 4.107.0, mermaid 11.15.0 → |
| 2284 | 11.16.0, vitest 4.1.8 → 4.1.9 (@dependabot). |
| 2285 | - Backfilled v0.8.67 regression coverage across sub-agent completion, budget |
| 2286 | exhaustion, delegate ordering, provider onboarding, setup scroll, model |
| 2287 | catalog pricing, Fleet routing, and Workflow gates (#4076). |
| 2288 | - Split the large TUI debug command group and palette/theme internals into |
| 2289 | smaller modules without changing user-visible behavior (#4078, #4081). |
| 2290 | |
| 2291 | ### Fixed |
| 2292 | |
| 2293 | - Fixed the goal sidebar elapsed timer so completed and blocked goals freeze |
| 2294 | their "completed in {elapsed}" readout instead of ticking forever. Goal state |
| 2295 | now records a `finished_at` instant that both sidebar render paths and the |
| 2296 | engine snapshot clamp elapsed against; `/goal resume` clears the freeze and |
| 2297 | the timer ticks again. |
| 2298 | - Fixed paused goals silently un-freezing their sidebar timer: usage keeps |
| 2299 | accruing while paused, and the next goal snapshot used to clear the frozen |
| 2300 | instant. Paused goals now stay frozen until an explicit resume. |
| 2301 | - Fixed durable `/goal` progress accounting so usage and continuation updates |
| 2302 | release the shared SQLite connection before re-reading the updated goal, |
| 2303 | unblocking resumed goal loops and full workspace release tests. |
| 2304 | - Fixed a scheduled-automation race where deleting an automation while its |
| 2305 | run was being enqueued left the already-created task running untracked; |
| 2306 | the run record is now persisted unconditionally. |
| 2307 | - Removed `panic = "abort"` from the release profile: it disabled unwinding |
| 2308 | and broke the panic supervision that keeps one failing tool call from |
| 2309 | taking down the whole session. The `lto`/`strip`/`codegen-units` size and |
| 2310 | speed tuning is unchanged. |
| 2311 | - Fixed session save/load to persist and restore the active model provider |
| 2312 | across restarts. Previously sessions created under one provider (e.g. |
| 2313 | DeepSeek) would silently load under a different active provider. Provider, |
| 2314 | subagent limits, fallback chain, context window, and reasoning effort are now |
| 2315 | restored from saved session metadata, with `"deepseek"` as the default for |
| 2316 | legacy sessions. |
| 2317 | - Raised the streamed model-response idle timeout and matched the TUI stall |
| 2318 | watchdog to the configured stream budget so long reasoning pauses are not |
| 2319 | recovered as stalled turns (#2487, #3998). |
| 2320 | - Fixed Codex OAuth/sub-agent release diagnostics so `auth list` reports an |
| 2321 | active Codex OAuth file, Responses API child requests encode inherited tool |
| 2322 | names safely, rate-limited child requests checkpoint as resumable provider |
| 2323 | interruptions, and failure records surface the real Responses API error |
| 2324 | (#3884). |
| 2325 | - Fixed fresh launch/setup testing with an explicit `CODEWHALE_HOME` so |
| 2326 | config, settings, theme prefs, and doctor legacy-state diagnostics do not |
| 2327 | inherit unrelated ambient `~/.deepseek` files (#4001, #4002). |
| 2328 | - Sub-agent state now persists to `.codewhale/` instead of the lingering |
| 2329 | pre-rebrand `.deepseek/` path (#3864). Contributed by Stime (@yekern). |
| 2330 | - `/plugin enable|disable` now persists across restarts (#3918), and the |
| 2331 | plugin command is hidden from the root slash menu and kept canonical after |
| 2332 | the scanner merge. Contributed by Nightt (@nightt5879). |
| 2333 | - `/config ask-rules` now shows ask rule actions with improved diagnostics, |
| 2334 | with file-rule action precedence under test. Contributed by @greyfreedom. |
| 2335 | - Fleet/sub-agents: enforced an absolute recursion-depth ceiling and widened |
| 2336 | task-id entropy, gave each atomic state write a unique temp path, kept |
| 2337 | sub-agent tool catalogs in parent parity (#3836), and made the Agents |
| 2338 | sidebar reconcile sub-agent completion and cancellation live (#3837). |
| 2339 | - Fixed apply_patch mangling newlines, defaulted fuzz to 3, and made writes |
| 2340 | atomic; fixed compaction to preserve pins on emergency compaction, harden |
| 2341 | the summary fallback, and count image tokens; corrected backtrack boundary, |
| 2342 | checkpoint clear ordering, prune guard, and durable rename. |
| 2343 | - Fixed the SSE client to flush the final frame, join multi-line data fields, |
| 2344 | and stop corrupting multibyte UTF-8 split across network reads. |
| 2345 | - Kept review-only turns read-only, aliased `auto` mode to the agent policy, |
| 2346 | showed the mode-derived safety policy in status (contributed by @cyq1017), |
| 2347 | and stopped the durable-review floor from holding routine YOLO work |
| 2348 | (#3883). |
| 2349 | - Fixed self-update to prefer exact binary release assets. Contributed by |
| 2350 | @LI-Jialu. |
| 2351 | - UI polish: stopped constitution and fleet-profile model drafts from |
| 2352 | freezing the event loop, scoped the context-menu backdrop to the popup |
| 2353 | rect, stacked model-picker panes on narrow modals, unified display-width |
| 2354 | helpers on one contract (#3924), removed misleading success toasts, |
| 2355 | issue-number leaks, and dead-end empty states, and repaired the onboarding |
| 2356 | trust and api-key keys. |
| 2357 | - Fixed the onboarding Trust step so plain Enter no longer silently grants |
| 2358 | workspace trust; users must choose the explicit trust or exit keys. |
| 2359 | - Fixed same-root skill-name collisions being silently shadowed; duplicate |
| 2360 | normalized skill names now warn while keeping discovery deterministic |
| 2361 | (#3919). |
| 2362 | - Normalized discovered skill names, removed unenforced trust copy, and |
| 2363 | surfaced the gated constitution override in prompts. |
| 2364 | - Fixed a parallel `subagent::` suite flake where one test's process-wide |
| 2365 | `Retry-After` pause could strand unrelated budget-capped workers for the |
| 2366 | full stale window; requests now re-poll the global pause in bounded slices |
| 2367 | and the rate-limit test clears the window on drop. |
| 2368 | - Sub-agent and Fleet reliability now fail empty, step-limited, and |
| 2369 | budget-exhausted children with explicit diagnostics instead of silent |
| 2370 | `Completed (no output)` success; budget exhaustion preserves partial output, |
| 2371 | `worktree: true` discovers one-level nested repos from harness directories, |
| 2372 | and completion-before-start delegate events recover into named rows instead |
| 2373 | of ellipsis-only identities (#4050, #4051, #4052, #4053). |
| 2374 | - Goal-mode writing and research tasks can complete with |
| 2375 | `verification.status = "not_applicable"` without triggering continuation |
| 2376 | loops (#4054). |
| 2377 | - First-run onboarding routes API keys through the selected provider, setup |
| 2378 | wizard bodies scroll with PageUp/PageDown, shipped locale packs are back to |
| 2379 | `en.json` parity with zh-Hant explicitly partial, stable feature flags stay |
| 2380 | out of Experimental, and model/provider rows include current LongCat and |
| 2381 | sourced-pricing hints (#4056, #4057, #4058, #4062, #4063). |
| 2382 | - Running tool rows animate while a lone foreground tool is active, and |
| 2383 | workflow receipts render run/status/failure cards instead of one-line or |
| 2384 | null-success output (#4059). |
| 2385 | - Model-facing turn metadata now includes a compact git workspace snapshot and |
| 2386 | escalates context pressure at the same thresholds as the TUI, helping agents |
| 2387 | narrow scope or compact before truncation (#4071, #4073). |
| 2388 | - Successful child sub-agent completions inline the child's `EVIDENCE` block |
| 2389 | before the completion sentinel, so parents can cite child findings without |
| 2390 | re-running tools (#4072). |
| 2391 | - Deferred tools hydrate and execute in the same batch when the original |
| 2392 | arguments are valid, and `[tools].always_load` now keeps configured MCP tools |
| 2393 | active instead of forcing the first-call retry. Thanks @SparkofSpike for the |
| 2394 | hot-path MCP report (#4074, #4027). |
| 2395 | - New commit-range co-author checks reject bot/tool trailers on newly pushed |
| 2396 | commits; historical release-range cleanup remains a separate maintenance |
| 2397 | concern (#4075). |
| 2398 | - Fixed fuzzy `edit_file` matching so matches that begin with multibyte UTF-8 |
| 2399 | characters, including CJK text, advance on character boundaries instead of |
| 2400 | panicking. Contributed by Nightt (@nightt5879), reported by Taixin Guo |
| 2401 | (@taixinguo) (#3971, #4045). |
| 2402 | - Fixed Unix dispatcher/TUI output under early-closing pipes such as |
| 2403 | `codewhale doctor | head` by restoring the default `SIGPIPE` handler before |
| 2404 | printing and propagating signal exits quietly. Contributed by @aznikline, |
| 2405 | reported by @BrathonBai (#4030, #4043). |
| 2406 | - Suppressed dead_code warnings in the unused plugin registry module and |
| 2407 | fixed formatting across the command-group files. Contributed by Paulo Aboim |
| 2408 | Pinto (@aboimpinto). |
| 2409 | - Pointed the website Community nav link at the community hub. |
| 2410 | |
| 2411 | ### Security |
| 2412 | |
| 2413 | - MCP client hardening: closed an SSE-endpoint SSRF, bounded the HTTP |
| 2414 | response body via Content-Length instead of a streaming read, bounded stdio |
| 2415 | line reads to prevent OOM denial of service, fixed a dead timeout, and |
| 2416 | removed an unbounded buffer. |
| 2417 | - Made execpolicy deny/trust rules segment-aware, closing a command-chaining |
| 2418 | bypass. |
| 2419 | - Closed repo-law and safety-floor bypasses found by adversarial review: |
| 2420 | protected invariants are now enforced as mechanism, the destroyer gap in |
| 2421 | the safety floor is closed, a catalog-present tool with no execution path |
| 2422 | now fails closed, `web_run` open/click is classified as destructive, and |
| 2423 | the allow-list gained wildcard and case handling. |
| 2424 | - Refused symlinked rules directories to prevent workspace escape via |
| 2425 | discovered rules. Contributed by maple (@yekern). |
| 2426 | - Bounded Fleet sub-agent worker output so fanout cannot exhaust TUI memory |
| 2427 | (#3882), and preserved event headroom for progress. Contributed in part by |
| 2428 | @cyq1017. |
| 2429 | - Added an untrusted constitution-draft gate with authoring provenance so |
| 2430 | model-drafted constitutions require explicit human ratification. |
| 2431 | |
| 2432 | ### Removed |
| 2433 | |
| 2434 | - Removed unused model-registry helpers. Harvested from #3872 by @cyq1017. |
| 2435 | - Removed unused request-tuning metadata. Harvested from #3871 by @cyq1017. |
| 2436 | - Removed dead fleet task helpers (#3894 by @cyq1017), the unused |
| 2437 | approval-cache container (#3845) and localization QA metadata (both by |
| 2438 | @nightt5879), the dormant tab collaboration subsystem (#3838), the legacy |
| 2439 | flash auto-router (#3839), the stale project_doc loader (#3840), ignored |
| 2440 | mock LLM placeholders (#3841), dead model-catalog helpers (#3842), the |
| 2441 | unused execpolicy amend module, and dead MCP/client retry helpers. |
| 2442 | - Retired the deprecated `WHALE.md` context fallback (#3798). |
| 2443 | |
| 2444 | ## [0.8.66] - 2026-06-29 |
| 2445 | |
| 2446 | ### Added |
| 2447 | |
| 2448 | - Added `codewhale doctor` / `codewhale doctor --json` legacy-state |
| 2449 | diagnostics that compare known `~/.deepseek` state paths with their |
| 2450 | `~/.codewhale` counterparts and flag unmigrated or dual-root data (#3727). |
| 2451 | - Added Sakana AI Fugu as a first-class OpenAI-compatible provider with |
| 2452 | `sakana`/`fugu` aliases, `FUGU_API_KEY` / `SAKANA_API_KEY` discovery, |
| 2453 | provider-picker wiring, model completions, and provider docs. Harvested from |
| 2454 | #3748 by @lerugray. |
| 2455 | - Added WhaleFlow-to-Fleet launch-shape validation: the default Fleet workflow |
| 2456 | contract allows up to 100 total agents and 5 recursive rings, requires |
| 2457 | bounded loops/expands before launch, and preserves per-slot model selection. |
| 2458 | - Added a read-only `/config ask-rules` view for the resolved |
| 2459 | `permissions.toml` path, file status, rule count, and configured |
| 2460 | tool/command/path ask rules. Merged from #3569 by @greyfreedom. |
| 2461 | - Added provider-level `context_window` overrides so OpenAI-compatible |
| 2462 | gateways and self-hosted providers can budget against their real model |
| 2463 | context window (#3545). |
| 2464 | - Added the native `codew` shim to release archives, Windows installer inputs, |
| 2465 | local release-asset preparation, and checksum verification so manual installs |
| 2466 | receive the same short command that Cargo installs build. |
| 2467 | - Added OpenModel as a first-class Anthropic Messages provider, with config, |
| 2468 | CLI, provider picker, docs, and registry coverage. Harvested from #3585 by |
| 2469 | @noaft. |
| 2470 | - Added WeCom Bridge deployment and security documentation, with shipped |
| 2471 | runtime/bridge commands and approval-timeout environment guidance. Harvested |
| 2472 | from #3640 by @pkeging. |
| 2473 | - Added a token/cache/cost `scorecard` command for offline release gating, |
| 2474 | baseline regression checks, and per-turn cost visibility (#3388). Stream-JSON |
| 2475 | exec metadata now also reports conservative `input_analysis` and |
| 2476 | `visible_final_answer_chars`, so benchmark harnesses can measure transcript |
| 2477 | growth and final-answer bloat without guessing (#2956, #2957). |
| 2478 | - Added a release evidence ledger for v0.8.66 and opened the external ACP |
| 2479 | registry submission for CodeWhale after validating the published |
| 2480 | `codewhale@0.8.65` ACP auth handshake against the upstream registry checker |
| 2481 | (#3192). |
| 2482 | - Added a typed `[verifier]` config table for the verifier-preview lane, with |
| 2483 | `enabled` and the shipped `verdict_policy = "hunt"` mapping documented and |
| 2484 | validated (#2093). |
| 2485 | - Added Hotbar `Alt+1`–`Alt+8` quick-slot switching with decision-card key |
| 2486 | disambiguation, plus an introductory card that explains and can dismiss the |
| 2487 | Hotbar (#3796, #3788). |
| 2488 | - Release/docs hygiene: guarded public install/version snippets and the npm |
| 2489 | `codewhaleBinaryVersion` pointer against drift, made `check-docs`/`check-facts` |
| 2490 | fail on stale snippets or unmapped providers, and stopped `sync-changelog` |
| 2491 | from dropping a release when only `[Unreleased]` exists (#3767, #3768, #3769, |
| 2492 | #3770, #3771, #3772). |
| 2493 | |
| 2494 | ### Changed |
| 2495 | |
| 2496 | - Deferred Auto mode from the user-facing mode picker, cycle, hotbar, `/mode` |
| 2497 | command, and runtime-thread mode overrides until it has a distinct prompt and |
| 2498 | auto-review behavior; existing `auto` mode text now folds back to Agent |
| 2499 | instead of selecting a hollow mode, and approval modal copy no longer implies |
| 2500 | the current mode is YOLO (#3730, #3733). |
| 2501 | - Clarified the Fleet setup surface and docs so Fleet is treated as the durable |
| 2502 | sub-agent configuration layer while WhaleFlow is the agent-authored |
| 2503 | orchestration plan that selects and monitors Fleet slots. |
| 2504 | - Slimmed the default Constitution prompt while keeping its required structural |
| 2505 | anchors under regression coverage, reducing the static prompt footprint for |
| 2506 | cache-sensitive turns (#2953). |
| 2507 | - Made the approval prompt inline and bottom-anchored instead of a full-screen |
| 2508 | takeover, so context and controls stay visible while a tool awaits a decision |
| 2509 | (#3799). |
| 2510 | - The Hotbar is now hidden by default until explicit setup opt-in (#3807); the |
| 2511 | interactive Agent shell also defaults to approval-gated on with a shared |
| 2512 | baseline (#3756). |
| 2513 | - Mode authority now resolves approval prompts through a single authority |
| 2514 | source instead of per-surface checks (#3795). |
| 2515 | |
| 2516 | ### Fixed |
| 2517 | |
| 2518 | - Surfaced legacy state relocation with a user-visible migration notice whenever |
| 2519 | `~/.deepseek/<state>` is moved or copied into `~/.codewhale/<state>`, so |
| 2520 | upgraded users know their data was preserved and where the canonical state |
| 2521 | now lives (#3726). |
| 2522 | - Restored legacy `.deepseek/sessions` visibility for upgraded installs where |
| 2523 | an empty `~/.codewhale/sessions` directory already existed, by copying |
| 2524 | missing legacy session entries into the primary CodeWhale session store |
| 2525 | without overwriting newer data (#3724). |
| 2526 | - Calmed approval risk classification for read-only shell commands such as |
| 2527 | `codewhale --version`, `codewhale --help`, and `git status --porcelain` so |
| 2528 | the modal no longer labels proven read-only shell as destructive (#3730). |
| 2529 | - Added provider/model route columns to `/cache` turn telemetry so DeepSeek |
| 2530 | cache-hit regressions can be correlated with Auto route changes (#3738). |
| 2531 | - Fixed runtime API approval handling so workspace trust no longer auto-resolves |
| 2532 | ordinary tool approvals; trust now only participates in full-access retry |
| 2533 | decisions while YOLO/auto-approve remains the approval bypass (#3736). |
| 2534 | - Fixed modal surfaces so the shared view stack paints an opaque backdrop before |
| 2535 | any overlay, while Plan/request-input popup interiors stay opaque and the Plan |
| 2536 | confirmation footer keeps action choices visible on narrow terminals (#3732). |
| 2537 | - Added a turn-loop Plan-mode guard for file-writing tools and write-capable MCP |
| 2538 | tools so Plan's "no writes" promise is enforced before approval or execution, |
| 2539 | not only by the sandbox/catalog layer (#3734). |
| 2540 | - Preserved the durable review safety floor for publish-like shell actions in |
| 2541 | YOLO mode, so `cargo publish`, `npm publish`, and tag/release pushes force |
| 2542 | approval instead of silently auto-approving (#3735). |
| 2543 | - Fixed Ctrl+O external-editor freezes where CodeWhale's terminal input pump |
| 2544 | could keep reading keys while Vim/editor owned the terminal, especially in |
| 2545 | Windows mintty/cygwin shells. Thanks @buko for the precise repro (#3657). |
| 2546 | - Hardened the OHOS dependency drift check against transient Cargo registry EOFs |
| 2547 | by retrying the dependency graph probe before failing CI. |
| 2548 | - Updated the `/links` provider fallback to the current CodeWhale docs URL and |
| 2549 | added a Baidu Qianfan docs link. Harvested from #3621 by @noaft. |
| 2550 | - Hardened `CODEWHALE_TOOL_SURFACE=shell-only` for benchmark/exec runs: the |
| 2551 | shell-only surface hides native tools from the model-visible catalog, and |
| 2552 | unknown `CODEWHALE_TOOL_SURFACE` values now warn instead of silently falling |
| 2553 | back to the full tool surface (#2954). |
| 2554 | - Sub-agent fanout and lock hot paths: preserved event-channel headroom for |
| 2555 | progress events (#3783, thanks @cyq1017), let independent sub-agent starts |
| 2556 | join a single parallel dispatch batch instead of serializing (#3801), rendered |
| 2557 | the sub-agent sidebar/ListSubAgents from a read-only snapshot with bounded |
| 2558 | cleanup (#3803), used nonblocking best-effort sends for ListSubAgents refresh |
| 2559 | while still awaiting critical events (#3802), moved sub-agent state |
| 2560 | persistence disk I/O off the manager write lock (#3805), and used `try_lock` |
| 2561 | for shell-manager refresh in async UI paths (#3804). |
| 2562 | - Provenance: runtime continuations and `SubAgentHandoff` now inherit standing |
| 2563 | YOLO authority, while `MemoryRecall`, `ImportedTranscript`, and |
| 2564 | `AssistantGenerated` inputs remain guarded (#3817). |
| 2565 | - Approval honesty: labeled session-scoped approvals accurately instead of |
| 2566 | "always", and surfaced approval decisions in tool results (#3766). |
| 2567 | |
| 2568 | ## [0.8.65] - 2026-06-24 |
| 2569 | |
| 2570 | ### Added |
| 2571 | |
| 2572 | - **Provider/model/route resolution (EPIC #2608).** Canonical provider, model, |
| 2573 | offering, and route types with a single `RouteResolver` that produces a |
| 2574 | resolved `ReadyRouteCandidate` (endpoint, wire protocol, model id, context |
| 2575 | limit, price) for every switch (#3458, #3084, #3384). The executing client is |
| 2576 | now constructed from the resolved candidate rather than re-derived from config |
| 2577 | (#3384). A committed, network-free Models.dev-shaped catalog gives models real |
| 2578 | context windows and pricing, with a secret-free live cache (#3497, #3498, |
| 2579 | #3385). Offering pricing with provenance is projected onto candidates (#3501, |
| 2580 | #3085), and route limits feed a route-aware context-budget service (#3508, |
| 2581 | #3523, #3086). |
| 2582 | - **Fleet execution substrate (EPIC #3154).** Fleet profile types and config |
| 2583 | (#3469), durable manager resume, workspace agent-profile loading resolved into |
| 2584 | the worker runtime (#3367), loadout intent carried in task specs (#3512), and |
| 2585 | receipts that persist the resolved route for inspection (#3154, #3166). Worker |
| 2586 | status is folded into the unified `/fleet` surface and exposed through the |
| 2587 | Runtime API. |
| 2588 | - **Provider surfaces.** A `/provider` readiness dashboard with reasoning |
| 2589 | readiness, an experimental/supported maturity marker, and an "open models for |
| 2590 | this provider" action (#3083, #2984, #3485); cross-provider `/model` search |
| 2591 | with scroll and provider type-ahead (#3484, #3075); inline `<think>` |
| 2592 | reasoning-stream routing with per-provider overrides (#3222); usage telemetry |
| 2593 | normalized into canonical token classes including Responses cache-miss and |
| 2594 | reasoning tokens (#2961, #3509); and remote MCP OAuth login with bearer/header |
| 2595 | auth precedence (#3527). |
| 2596 | - **More providers and routes.** User-defined OpenAI-compatible custom providers |
| 2597 | via `[providers.<name>]` (#1519); a DeepSeek Anthropic-compatible route (#2963, |
| 2598 | #3449); a Qianfan route (#3425); Zhipu folded into Z.ai with equal-treatment |
| 2599 | model normalization (#3539); DashScope/Together fixtures. |
| 2600 | - **Localized mode picker and composer indicators.** The `/mode` picker prompt, |
| 2601 | mode names, and hints, plus the composer's Vim mode indicator, now render in |
| 2602 | all seven shipped locales (model-facing mode labels stay English). Harvested |
| 2603 | from #2239 by @gordonlu. |
| 2604 | - **Website and automation.** A runtime/integrations page, provenance and |
| 2605 | mirror-trust copy, a fact-drift CI gate, a published install script, and a |
| 2606 | weekly community digest archive on codewhale.net (#3419, #3421, #3415, #3482, |
| 2607 | #3420); per-automation mode/shell/trust/approval settings (#3467). |
| 2608 | - **Model reference browser.** A read-only `/modeldb` command (aliases |
| 2609 | `model-reference`, `modelref`) opens a pager over the bundled catalog — every |
| 2610 | model's factual context window, max output, modality, and price, grouped by |
| 2611 | provider/kind. Labels only: it never selects, routes, or tiers a model |
| 2612 | (#3205, #2300). |
| 2613 | - **Transcript presets.** A `/config preset <name> [--save]` mechanism with a |
| 2614 | first `calm` preset — calm mode, calm tool collapse, comfortable spacing, and |
| 2615 | low motion — presentation-only and evidence-preserving (#3478). |
| 2616 | - **Model capability profiles.** A typed `model_profile` module separates |
| 2617 | intrinsic model facts from resolved provider-route capability, so compact |
| 2618 | routes defer heavier nonessential tools while standard/full routes keep the |
| 2619 | eager tool surface (#3451, #3365). |
| 2620 | - **Live provider catalog refresh.** A secret-free `/models` live-fetch layer |
| 2621 | (401/403/404/429 mapped to typed outcomes) feeds the catalog cache; the API |
| 2622 | key authorizes the request but is never persisted into the delta or cache |
| 2623 | (#3385). |
| 2624 | |
| 2625 | ### Changed |
| 2626 | |
| 2627 | - **Config modularization (#3311).** `ProviderKind` (#3505), harness posture |
| 2628 | (#3507), and provider default seeds (#3503) moved into dedicated modules, and |
| 2629 | the `config.rs` monolith split into clean leaf modules (paths, search, |
| 2630 | model/base-URL constants, sub-agent limits) behind a `pub use` facade. |
| 2631 | `AppMode` helpers were centralized (#3510), and mode-vs-permission policy is |
| 2632 | now derived through a single `base_policy_for_mode` resolver instead of |
| 2633 | scattered mutation (#3386, advisory review-intent behavior preserved). |
| 2634 | - **Leaner tool surface.** Dropped `task_shell_*` from the active set and folded |
| 2635 | `tool_search_*` (#3463); ablated the in-turn loop_guard and encoded reasoning |
| 2636 | dispositions (#3462); added the Orchestration disposition to the constitution. |
| 2637 | - **Routing.** Provider/model switches and the capability-aware fallback chain |
| 2638 | resolve through `RouteResolver`; reasoning effort is normalized for the |
| 2639 | *resolved* provider; the fallback chain now skips providers that lack auth |
| 2640 | (#2574); and context window and memory-pressure come from the resolved route |
| 2641 | (#3086). |
| 2642 | - **UX.** Approval modal gained a group divider and selected-row caret (#3515); |
| 2643 | picker scroll/type-ahead and selection contrast hardened (#3500); the README |
| 2644 | was rewritten as an architecture end-cap (#3087); and repo agent guidance was |
| 2645 | de-hardcoded to live truth. |
| 2646 | - **Fleet identity and defaults.** Fleet workers now enter with an explicit |
| 2647 | "summoned Fleet member" operating contract, setup/profile prompts keep the |
| 2648 | default model behavior as same-route inheritance, and generated worker |
| 2649 | instructions avoid leaking recursive topology that only the orchestrator |
| 2650 | needs. |
| 2651 | - **Legacy swarm cleanup.** Removed the obsolete `/swarm` core command/menu |
| 2652 | registration so `/fleet` is the product surface, while `/subagents` remains a |
| 2653 | compatibility shortcut to worker status. |
| 2654 | - **Running-state animation.** Tool cards and background-task rows now share one |
| 2655 | faster braille spinner cadence, so Bash/background work reads consistently |
| 2656 | alive across the transcript and sidebar. |
| 2657 | - **Restored contributor credit.** Threaded machine-readable credit |
| 2658 | (`docs/CONTRIBUTORS.md` + `.github/AUTHOR_MAP`) for earlier merged work that |
| 2659 | shipped without it, including the `/jobs cancel-all` action and the npm |
| 2660 | retry-timeout hint (#1538) by @jieshu666, and the community ACP adapter |
| 2661 | reference by @rockeverm3m. |
| 2662 | |
| 2663 | ### Fixed |
| 2664 | |
| 2665 | - **Release hygiene.** The strict `cargo clippy --workspace --all-targets --locked |
| 2666 | -- -D warnings` gate passes; `npm run build` no longer dirties the generated |
| 2667 | web facts; the site sets `metadataBase`; the community digest page parses each |
| 2668 | record independently and localizes its chrome; and `cargo audit` is clean with |
| 2669 | the starlark-transitive unmaintained advisories documented. |
| 2670 | - **Routing and mode correctness.** Ordinary prompt text is no longer |
| 2671 | interpreted as a mode switch (#3387, #3491); model candidates are scoped to the |
| 2672 | active provider; Together-owned DeepSeek routes are accepted (#3426); insecure |
| 2673 | `http://` custom endpoints raise an advisory warning (#1519); and the Fleet |
| 2674 | setup planner's role/model selection now drives the generated profile. |
| 2675 | - **Runtime stability.** MCP connection drops are explicit (#3524), HTTP API |
| 2676 | calls reuse a shared MCP pool (#3532), and per-agent sub-agent mailbox |
| 2677 | telemetry is throttled to cut UI lag (#3454). |
| 2678 | - **YOLO background-shell approvals.** A background shell command no longer pops |
| 2679 | an approval modal in YOLO mode. `classify_risk` marks all shell commands |
| 2680 | destructive, so the auto-review safety floor held every *background* shell for |
| 2681 | review, and the `ForcePrompt` site never checked `auto_approve` — only |
| 2682 | background commands surfaced it, since foreground shells take the |
| 2683 | `Interactive` origin and skip that branch. |
| 2684 | - **Bash approval modal fit.** The shell approval modal now labels Bash |
| 2685 | commands directly, avoids repeating command/workdir in the impact summary, |
| 2686 | wraps long commands, and switches to compact controls on short terminals so |
| 2687 | the decision keys stay visible. |
| 2688 | - **Custom-provider picker rows.** Concrete `[providers.<name>]` entries now |
| 2689 | appear in the provider picker (id, endpoint, auth readiness, wire protocol, |
| 2690 | current model) instead of only the generic placeholder; auth readiness honors |
| 2691 | per-entry key/env/metadata/no-auth/loopback. |
| 2692 | - **Passive MCP tool discovery.** Runtime API-owned stdio MCP processes are no |
| 2693 | longer spawned from passive `/v1/apps/mcp/tools` requests; live discovery |
| 2694 | remains available through `?connect=true`. `doctor` now warns on relative-path |
| 2695 | stdio MCP commands without `cwd`. |
| 2696 | |
| 2697 | ## [0.8.64] - 2026-06-22 |
| 2698 | |
| 2699 | ### Added |
| 2700 | |
| 2701 | - **Seamless auto-compaction defaults.** Known large-context routes now keep |
| 2702 | automatic compaction on by default while carrying summaries forward through |
| 2703 | the stable prompt path, reducing surprise context loss without changing |
| 2704 | explicit opt-out behavior. |
| 2705 | - **Runtime web automation readiness.** Local app automation gains a |
| 2706 | loopback-only dev-server readiness primitive so agents can wait for TCP and |
| 2707 | optional HTTP health checks before browser verification. Harvested from |
| 2708 | #3376 by @cyq1017. |
| 2709 | - **Model and integration polish.** `/model pro` and `/model flash` shortcuts |
| 2710 | now resolve to the current DeepSeek V4 routes while preserving existing model |
| 2711 | IDs. Harvested from #3350 by @KUK4. The WeCom bridge landed with |
| 2712 | maintainer follow-up hardening for state permissions and chat-facing error |
| 2713 | reporting, from #3370 by @pkeging. |
| 2714 | |
| 2715 | ### Fixed |
| 2716 | |
| 2717 | - **Security and trust-boundary hardening.** Project-local config can no longer |
| 2718 | loosen user-owned shell or instruction-file policy, file edits now require a |
| 2719 | fresh read of the target file, git history inputs reject option-shaped or |
| 2720 | control-character revisions, interactive execution surfaces require approval, |
| 2721 | and local tool paths are narrowed through workspace/root validation. |
| 2722 | - **Runtime and diagnostics redaction.** Generated runtime/app-server tokens, |
| 2723 | raw session lineage identifiers, provider registry drift values, review |
| 2724 | receipt internals, and webhook URLs are no longer echoed into human-facing |
| 2725 | logs or diagnostics. |
| 2726 | - **Network and alert safety.** Provider TLS verification bypass requests now |
| 2727 | fail closed, fleet alert webhooks require HTTPS, fetch URL hostnames are |
| 2728 | resolved before requests, and runtime mobile auth no longer relies on |
| 2729 | token-bearing URLs. |
| 2730 | - **Path-state hardening.** Config sibling files, project MCP cwd values, |
| 2731 | runtime thread store files, sub-agent state, project-local state roots, and |
| 2732 | app-server sidecar config paths now resolve through checked roots before |
| 2733 | reads/writes. |
| 2734 | - **Release CI repair.** Nightly cross-target builds install Rust targets |
| 2735 | explicitly and retry transient cargo failures; auto-tag runs are serialized |
| 2736 | and treat an already-created remote tag as a no-op. Safe slices harvested |
| 2737 | from #3374 by @donglovejava. |
| 2738 | - **Provider wait and sidebar regressions.** Provider-wait footers suppress |
| 2739 | noisy countdowns until useful while keeping timeout warnings visible, |
| 2740 | harvested from #3375 by @idling11. The pinned sidebar can render at a |
| 2741 | narrower 64-column boundary, harvested from #3371 by @donglovejava. |
| 2742 | - **Delegated server cleanup.** Delegated `serve` / `app-server` children gain |
| 2743 | OS-level parent-death cleanup on supported platforms, completing the #3259 |
| 2744 | follow-up from #3378 and #3317 by @wuisabel-gif. |
| 2745 | - **ACP and sandbox correctness.** ACP sessions preserve multi-turn |
| 2746 | conversation history across prompt turns, harvested from #3372 by @xulongzhe. |
| 2747 | Worktree Git metadata writes are allowed through sandbox policy without |
| 2748 | broad trust-mode escalation, from #3356 by @cyq1017 and the #3355 report by |
| 2749 | @linletian. |
| 2750 | |
| 2751 | ### Changed |
| 2752 | |
| 2753 | - **Community and dependency harvests.** The release train carries focused |
| 2754 | community-credit slices from #3379 by @greyfreedom, #3348 by @nightt5879, |
| 2755 | #3346 by @hongqitai, #3345/#3333 by @cyq1017, and Dependabot updates for |
| 2756 | `windows`, `toml`, `tokio`, `lru`, `similar`, and web tooling security locks. |
| 2757 | - **Public release surface cleanup.** Benchmark-specific materials were kept |
| 2758 | out of the public release repo; benchmark source fragments belong in the |
| 2759 | separate `codewhale-bench` lane. |
| 2760 | |
| 2761 | ## [0.8.63] - 2026-06-19 |
| 2762 | |
| 2763 | ### Added |
| 2764 | |
| 2765 | - **Sub-agent fanout safeguards (#3318, #3319).** High-fanout Workflow runs can |
| 2766 | now queue and drain more agents than the instantaneous concurrency cap by |
| 2767 | default, with `[subagents] max_admitted` available to tune that bounded |
| 2768 | admission population. Distinct `agent` calls are no longer capped by the |
| 2769 | per-turn loop guard before runtime launch concurrency and provider |
| 2770 | rate-limit backoff can apply. `[subagents] token_budget` applies a shared |
| 2771 | aggregate token ceiling to a root `agent` run and its descendants. |
| 2772 | - **Per-worker sub-agent token enforcement (#3321).** A `token_budget` / |
| 2773 | `max_tokens` set on an individual `agent` call now bounds that single worker |
| 2774 | mid-run: once its accumulated model tokens exceed the cap it stops cleanly |
| 2775 | with a `budget_exhausted` status instead of running to `max_steps`. This |
| 2776 | complements the scope-level admission gate (#3319) — the per-worker cap stops |
| 2777 | one runaway worker, the scope cap bounds total fan-out — without |
| 2778 | double-counting. Harvested from #3321 by @donglovejava. |
| 2779 | - **Provider-specific sub-agent fanout config.** `[subagents.providers.<provider>]` |
| 2780 | profiles now override `enabled`, `max_concurrent`, `max_admitted`, |
| 2781 | `launch_concurrency`, `max_depth`, token budget, API timeout, and heartbeat |
| 2782 | timeout for the active provider. Use broad direct-API profiles such as |
| 2783 | `[subagents.providers.deepseek]` and tighter subscription profiles such as |
| 2784 | `[subagents.providers.glm]`; `/config subagents status` shows both global |
| 2785 | and active-provider resolved values. |
| 2786 | - **Sub-agent control and isolation.** The single `agent` tool now exposes |
| 2787 | status, peek, and cancel actions for running children, and accepts |
| 2788 | `worktree: true` to create an isolated git worktree/branch for parallel edit |
| 2789 | lanes instead of requiring callers to hand-roll a `cwd`. |
| 2790 | |
| 2791 | ### Fixed |
| 2792 | |
| 2793 | - **Mode and tool catalog correctness.** Core action tools remain discoverable |
| 2794 | in the model-facing catalog/tool search, and a consistency self-check flags |
| 2795 | registered handlers that drift out of the advertised catalog. Review-looking |
| 2796 | prompts in explicit Agent/YOLO mode now keep the requested mode and tools, |
| 2797 | with only an advisory review hint. |
| 2798 | - **Sub-agent orchestration recovery.** Child agents now retry transient |
| 2799 | provider header/SSE timeouts before failing, and parent runs synthesize missed |
| 2800 | child completions from terminal child state so orchestration cannot hang on a |
| 2801 | lost completion event. |
| 2802 | - **DeepSeek thinking tool calls.** DeepSeek chat-completions requests now omit |
| 2803 | explicit `tool_choice` whenever reasoning/thinking is enabled, avoiding |
| 2804 | provider rejections while leaving no-thinking routes unchanged. |
| 2805 | - **Task sidebar shortcuts and attribution.** Ctrl-K stays palette/emacs-kill, |
| 2806 | while Ctrl-X is scoped to Tasks-sidebar background shell cancellation. Shell |
| 2807 | jobs launched by sub-agents now render with their child-agent owner in the |
| 2808 | Tasks sidebar and transcript. |
| 2809 | - **Long-turn recovery and context economy.** Repeated read-only search |
| 2810 | loop blocks now return guidance instead of fatal tool failures, Python build |
| 2811 | failures that are missing `setuptools` include an install/retry hint, long |
| 2812 | foreground shell timeouts steer models toward background execution, and noisy |
| 2813 | shell/test/web outputs are compacted earlier for large-context routes. |
| 2814 | - **Config display redaction.** `codew config get/list` now recursively masks |
| 2815 | token-, secret-, password-, credential-, and authorization-like keys inside |
| 2816 | unknown `extras` tables and redacts sensitive HTTP header values before |
| 2817 | printing config output. |
| 2818 | - **Queued follow-up hints and force-steer keys.** The pending-input preview now |
| 2819 | advertises `Ctrl+S send now` whenever queued follow-ups exist, and |
| 2820 | Ctrl/Cmd+Enter force-steering also accepts the common Ctrl+J terminal |
| 2821 | encoding while a turn is running. |
| 2822 | - **Sidebar default visibility restored (#3328).** New and upgraded sessions |
| 2823 | now use a pinned composed sidebar by default when the terminal is wide |
| 2824 | enough, so live Agents and Tasks surface without opting back into idle |
| 2825 | auto-collapse. Older settings files that captured the v0.8.62 auto-collapse |
| 2826 | default now migrate to `pinned` unless `/sidebar auto --save` records an |
| 2827 | explicit opt-in. `/sidebar` now reports when width or auto-collapse |
| 2828 | suppresses rendering instead of saying the sidebar is visible. Reported by |
| 2829 | @dxfq. |
| 2830 | - **JavaScript execution proxy env handling (#3273, #3331).** `js_execution` |
| 2831 | now enables Node's environment-proxy mode when proxy variables are present, |
| 2832 | mirrors lowercase proxy variables for the child process, and backfills |
| 2833 | `HTTP_PROXY` / `HTTPS_PROXY` from `ALL_PROXY`. Reported by @lordwedggie and |
| 2834 | harvested from #3331 by @cyq1017. |
| 2835 | - **Legacy app-server non-loopback auth hardening (#3258).** Bare |
| 2836 | `codewhale app-server --host 0.0.0.0` now fails fast unless an explicit |
| 2837 | `--auth-token` or `CODEWHALE_APP_SERVER_TOKEN` is supplied, keeping generated |
| 2838 | one-time `cwapp_*` tokens loopback-only. |
| 2839 | - **Legacy `.deepseek` state write-path migration (#3240).** State subdirectories |
| 2840 | (`sessions`, `slop_ledger`, `trophies`, `catalog`) are now always written under |
| 2841 | `~/.codewhale/`, and the first write of a subdir relocates any pre-existing |
| 2842 | `~/.deepseek/<sub>` contents into the primary location so the legacy tree stops |
| 2843 | growing while old data is preserved. The read resolver still finds legacy data |
| 2844 | for backfill until each subdir migrates. Reported by @Final527; onboarding |
| 2845 | marker slice from #3302 by @nightt5879. |
| 2846 | - **State subdir validation on Windows (#3240).** State path hardening now |
| 2847 | rejects rooted/prefixed subdir strings such as `/etc` before resolving or |
| 2848 | migrating state directories, keeping the `.codewhale` write resolver inside |
| 2849 | its state root across platforms. |
| 2850 | |
| 2851 | ## [0.8.62] - 2026-06-17 |
| 2852 | |
| 2853 | ### Changed |
| 2854 | |
| 2855 | - **GLM-5.2 is now the default direct Z.AI model.** `DEFAULT_ZAI_MODEL` resolves |
| 2856 | to `GLM-5.2` in both `codewhale-tui` and `codewhale-config`; the `glm-5.1` |
| 2857 | alias still resolves to `GLM-5.1` (the defaulting was decoupled from the alias |
| 2858 | arm so it no longer tracks the default). Docs and `config.example.toml` no |
| 2859 | longer describe GLM-5.2 as an opt-in preview. |
| 2860 | - **GLM-5-Turbo registered as a real model** and wired as the faster/explore |
| 2861 | sub-agent sibling for the GLM family: a `GLM-5.2` parent routes |
| 2862 | faster/explore children to `GLM-5-Turbo` (direct Z.ai) and `z-ai/glm-5-turbo` |
| 2863 | (OpenRouter), instead of down to GLM-5.1. GLM-5.1 and GLM-5-Turbo themselves |
| 2864 | have no cheaper tier and keep children on the parent. |
| 2865 | - **`type: "explore"` sub-agents default to `model_strength: "faster"`.** Bounded |
| 2866 | read-only lookup/search/status work now uses the cheaper same-family sibling |
| 2867 | automatically, unless an explicit `model` or `model_strength: "same"` is |
| 2868 | supplied. Non-explore roles keep the conservative `same` default. |
| 2869 | - **GPT-5.5 / OpenAI Codex faster route stays on GPT-5.5** with reasoning |
| 2870 | resolved to `low` (the Codex Responses API has no true `off`, so the resolved |
| 2871 | effort is now honest `low` rather than `off` silently rewritten). No |
| 2872 | DeepSeek/GLM fallback is fabricated when no cheaper same-provider sibling |
| 2873 | exists. DeepSeek Pro→Flash routing and its no-thinking faster lane are |
| 2874 | unchanged. |
| 2875 | - **Base prompt / delegate skill guidance** updated to encourage parallel |
| 2876 | read-only exploration (2-4 `type: "explore"` sub-agents) for broad repo, |
| 2877 | version, branch, release, and API-surface investigations, while keeping |
| 2878 | architecture, integration, and final verification in the parent. The |
| 2879 | delegate skill examples now use provider-neutral `model_strength` instead of |
| 2880 | hardcoded DeepSeek model ids. |
| 2881 | - **Agent synthesis guardrails.** The base constitution now frames tools around |
| 2882 | sufficient evidence rather than open-ended persistence: extra reads, searches, |
| 2883 | and delegation must target a missing fact, and agents should answer with |
| 2884 | limits instead of broadening searches indefinitely. The runtime loop guard |
| 2885 | now blocks duplicate read-only/delegated calls earlier and caps repeated |
| 2886 | broad lookup/delegation loops in a single turn with a synthesis-forcing tool |
| 2887 | error. Guard metadata distinguishes exact duplicates |
| 2888 | (`identical_tool_call`) from no-progress loops (`no_progress_tool_loop`). |
| 2889 | - **Sub-agent handoff and visibility.** Direct sub-agent completions are drained |
| 2890 | before the next parent model request, so finished children can wake the main |
| 2891 | model promptly instead of waiting for an empty-tool-use branch or idle engine |
| 2892 | path. Nested sub-agents now report completions to their immediate parent |
| 2893 | inbox; the main model still receives only direct-child completions, avoiding |
| 2894 | grandchild floods while preserving nested evidence flow. Sub-agent output |
| 2895 | guidance now requires child-agent provenance when a sub-agent relies on a |
| 2896 | child report: cite the child `agent_id` and the child's EVIDENCE line(s), and |
| 2897 | do not present child findings as directly verified facts. The sidebar orders |
| 2898 | sub-agents as a parent/child tree and annotates nested rows with parent and |
| 2899 | depth information in hover text. |
| 2900 | - **Sub-agent summary provenance (#2652).** A sub-agent's free-text result is now |
| 2901 | explicitly treated as an unverified self-report rather than confirmed |
| 2902 | evidence. The completion sentinel carries `summary_kind: complete | truncated` |
| 2903 | so the parent model can branch on whether it saw the full report or a clipped |
| 2904 | excerpt. Short summaries (≤ 12,000 chars) get a soft "re-verify material |
| 2905 | claims" suffix; longer ones are head+tail truncated with an honest marker |
| 2906 | stating the elided middle is not retrievable via `retrieve_tool_result`. |
| 2907 | Every summary therefore carries exactly one boundary marker, never both. |
| 2908 | - **Provider metadata centralization.** Provider env vars, config keys, aliases, |
| 2909 | and auth hints are now resolved through the shared `ProviderMetadata` registry |
| 2910 | across `codewhale-config`, `codewhale-tui`, and `codewhale-cli`, reducing drift |
| 2911 | between the provider picker, `codewhale auth`, `doctor --json`, and setup |
| 2912 | hints. |
| 2913 | |
| 2914 | ### Added |
| 2915 | |
| 2916 | - **Agent clarification questions (#3102).** Agents now have a first-class |
| 2917 | `request_user_input` tool to ask the user structured clarifying questions |
| 2918 | through a modal UI surface instead of only emitting a chat message and hoping |
| 2919 | the user notices. Mirrors the approval/secret-request flow the harness |
| 2920 | already used for permissions. The tool accepts 1-3 questions, each with a |
| 2921 | header, an id, 2-4 selectable options (label + description), and |
| 2922 | `allow_free_text` / `multi_select` flags (both default to `false` for |
| 2923 | back-compat). Input is validated up front with actionable errors. Wired |
| 2924 | across all layers: the `request_user_input` tool, engine handling |
| 2925 | (`turn_loop` → `approval`), an interactive TUI modal (`UserInputView`) with |
| 2926 | full keyboard navigation, and the runtime protocol |
| 2927 | (`EventFrame::UserInputRequest` + `AppRequest::SubmitUserInput`) so headless |
| 2928 | / app-server clients can answer programmatically. Parity tests cover the |
| 2929 | wire round-trip and the omitted-flags default. |
| 2930 | - **Transcript hyperlinks — out-of-band OSC 8 (#3029).** Clickable file / |
| 2931 | file:line / URL links now reach the terminal through a column-drift-safe |
| 2932 | path. Link payloads are embedded in-band by the markdown renderer, then |
| 2933 | extracted out of the ratatui buffer cells and re-emitted out-of-band by |
| 2934 | `ColorCompatBackend` — so the `ESC` bytes never occupy display columns or |
| 2935 | corrupt selection. Supporting terminals get live hyperlinks; others see the |
| 2936 | label text unchanged. Clipboard/selection extraction strips residual codes as |
| 2937 | defense-in-depth. |
| 2938 | - **CodeWhale-only skill discovery gate (#3296).** New |
| 2939 | `[skills].scan_codewhale_only = true` limits session-time skill discovery to |
| 2940 | CodeWhale-owned roots (`<workspace>/.codewhale/skills`, `~/.codewhale/skills`, |
| 2941 | and any explicit `skills_dir`) while ignoring cross-tool directories such as |
| 2942 | `.claude/skills`, `.opencode/skills`, `.cursor/skills`, and `~/.agents/skills`. |
| 2943 | The default remains the broad compatibility scan. |
| 2944 | - **Permission/ask runtime rules (#3295).** Sibling `permissions.toml` ask-only |
| 2945 | rules are now loaded by the TUI engine and applied to `exec_shell` before |
| 2946 | Auto/session approval shortcuts. Matching ask rules force an approval prompt |
| 2947 | in otherwise auto-approved flows and are rejected under |
| 2948 | `approval_mode = "never"`. |
| 2949 | - **Runtime API no-auth documentation.** `docs/RUNTIME_API.md` now documents |
| 2950 | `codewhale app-server --insecure-no-auth` for loopback-only testing and warns |
| 2951 | against combining it with `--mobile` on `0.0.0.0`. |
| 2952 | |
| 2953 | ### Fixed |
| 2954 | |
| 2955 | - **TUI polish.** The empty-startup welcome block is centered by the actual |
| 2956 | rendered text width, fixing the off-center layout left over from the old |
| 2957 | sidebar-oriented welcome composition. Streaming HTTP body read errors now |
| 2958 | explain whether CodeWhale can retry before output, or is surfacing a warning |
| 2959 | after partial output to avoid replaying and duplicating streamed text. |
| 2960 | - **Config comment preservation.** Rewriting `config.toml`, `settings.toml`, or |
| 2961 | `tui.toml` now merges user comments and formatting back into the serialized |
| 2962 | document; if comment merge fails, the write falls back to plain serialized |
| 2963 | output rather than failing. |
| 2964 | - **Snapshot gate respected for per-tool snapshots (#3292).** Per-tool snapshots |
| 2965 | now check `[snapshots].enabled` before writing, matching the existing |
| 2966 | session-level gate. |
| 2967 | - **Poppler `pdftotext` detection (#1667).** The dependency resolver now probes |
| 2968 | `pdftotext -v` instead of `--version`, because Poppler treats `--version` as |
| 2969 | an input filename. Fixes detection on systems where only Poppler is installed. |
| 2970 | - **Plan confirmation checklist visibility.** The Plan-mode confirmation modal |
| 2971 | now shows the active checklist under the plan details, so users can review the |
| 2972 | concrete `checklist_write` work breakdown before accepting or revising a plan. |
| 2973 | |
| 2974 | ### Retroactive credits |
| 2975 | |
| 2976 | A credit-reconciliation pass found shipped community fixes that were never |
| 2977 | recorded in this changelog. Crediting them now, with the version they shipped in: |
| 2978 | |
| 2979 | - Global `~/.deepseek/AGENTS.md` fallback loading — thanks @manaskarra (fix) and @xfy6238 (report) (#1157, v0.8.27) |
| 2980 | - CRLF SSE event parsing for MCP — thanks @reidliu41 (fix) and @djairjr (report) (#1309, v0.8.29) |
| 2981 | - Reduce-motion default on VTE/flicker terminals — thanks @Geallier (report) (#1470, v0.8.34) |
| 2982 | - `portable-pty` 0.9 upgrade for LoongArch64 — thanks @quentin-lian (fix) and @k0tran (report) (#1531, #1992, v0.8.46) |
| 2983 | - `DEEPSEEK_ALLOW_INSECURE_HTTP` guard for LAN vLLM — thanks @F1LT3R (report) (#1656, v0.8.47) |
| 2984 | - Hidden `reasoning_content` kept in English regardless of locale — thanks @cmyyy (report) (#1842, v0.8.47) |
| 2985 | - `ExternalTool` abstraction layer — thanks @aboimpinto (#1794, #2294, v0.8.48) |
| 2986 | - Ephemeral generated project context — thanks @Final527 (report) (#3058, v0.8.59) |
| 2987 | |
| 2988 | ## [0.8.61] - 2026-06-15 |
| 2989 | |
| 2990 | This release lands the **runtime control plane** for multi-agent work: the TUI stays |
| 2991 | responsive while sub-agents run, sub-agents converge toward fleet-style durable workers |
| 2992 | with per-role model routing, and provider/model routes are isolated per session. It also |
| 2993 | folds in several community contributions. |
| 2994 | |
| 2995 | ### Added |
| 2996 | |
| 2997 | - **WhaleFlow runtime foundations** — worker runtime profiles (role / permissions / shell / |
| 2998 | tools / model-route, with non-escalating child derivation), a cross-provider model registry |
| 2999 | with offline catalog hydration, and provider-readiness / context-budget / provider-adapter / |
| 3000 | resource-telemetry services. (#3217, #3071, #3072, #3073) |
| 3001 | - **Per-role, heterogeneous-model sub-agent routing** — sub-agents can be assigned a model and |
| 3002 | provider per role (e.g. scout vs. synthesis; verifiers route to a fast model). (#2027, #1768) |
| 3003 | - **Durable goal mode** — cross-turn goal progress with token/time accounting and a |
| 3004 | verifier-as-judge gate before a goal may complete. (#3215, #891, #1976, #2058, #2029) |
| 3005 | - Parent-visible worker interaction contract — a recommended action per worker. (#3226) |
| 3006 | - Maintainer GitHub workflow skills; ACP registry submission prepared. (#3192) |
| 3007 | - OpenAI-compatible `/v1/chat/completions` endpoint on the legacy app-server HTTP transport, |
| 3008 | provider-neutral, with model registry resolution and configured-credential forwarding. |
| 3009 | |
| 3010 | ### Changed |
| 3011 | |
| 3012 | - **Sub-agents converge toward fleet-style durable workers** — real worker lifecycle states are |
| 3013 | projected to the sidebar instead of a hardcoded "running", and a sub-agent returns a structured |
| 3014 | needs-input checkpoint instead of parking. (#3226, #3096, #3154) |
| 3015 | - The per-turn runtime tag exposes capability posture instead of human-facing mode labels. (#3213) |
| 3016 | - Independent shell and verifier work defaults to background jobs with nonblocking waits and a |
| 3017 | completion notification; blocking now requires an explicit wait. (#3212) |
| 3018 | - Sub-agent launches now expose explicit `model_strength` and `thinking` controls to the model |
| 3019 | instead of hidden child-model auto-routing; `explore` work is documented as a good fit for |
| 3020 | faster models and `thinking: "off"`. |
| 3021 | - Plan mode is strictly read-only (no shell tools), consistent with its runtime posture. |
| 3022 | - `/swarm` is gated behind the durable worker substrate. (#3218) |
| 3023 | - Legacy `deepseek` install/update path resolves to `codewhale`. (#2960, #2924, #2917) |
| 3024 | |
| 3025 | ### Fixed |
| 3026 | |
| 3027 | - **TUI freeze when multiple sub-agents spawn (launch blocker)** — the terminal input pump runs |
| 3028 | off the render thread, AgentProgress events are coalesced, and sub-agents no longer park on |
| 3029 | input with no orchestrator to answer; a six-worker stress test guards input/render/cancel |
| 3030 | liveness. (#3216, #3096) |
| 3031 | - Idle sub-agent completion notifications now resume the parent turn instead of waiting for a |
| 3032 | later user message; thanks @giovanni-paolilla for the deadlock report (#3266). |
| 3033 | - **Provider/model route isolation** — provider and model state is session-local, and a |
| 3034 | mismatched provider+model tuple is rejected at the route boundary. (#3227) |
| 3035 | - Route-effective context-window metadata, over-limit preflight, and bounded recovery from |
| 3036 | `context_length_exceeded` instead of re-looping. (#3204) |
| 3037 | - Synchronous tools (`file_search`, `grep_files`, `list_dir`) are cancellable and no longer hold |
| 3038 | a turn open against cancellation. (#1791) |
| 3039 | - MCP stdio proxy startup prompts no longer strand YOLO / non-interactive runs. (#2475) |
| 3040 | - Stalled / failed background-shell recovery; configurable sub-agent API timeout. (#1737, #1786, #1806) |
| 3041 | - Composer: reliable queued steering + Ctrl+S send (#3203, #3224); footer busy/idle indicator |
| 3042 | (#2982); CJK word-wrap (#963); clickable sidebar stop targets (#3028); live token throughput |
| 3043 | (#3190); auto-expiring terminal sub-agent cards (#3078). |
| 3044 | - Linux glibc preflight in the installer/update path with a clear error. (#3207, #1067) |
| 3045 | - Self-update retries transient GitHub metadata/asset failures and falls back from the GitHub |
| 3046 | REST API to the public `releases/latest` redirect before constructing release asset URLs. (#3232) |
| 3047 | - Provider picker lists providers in neutral alphabetical order instead of hard-coding DeepSeek first; the active provider stays pre-selected. (#3076) |
| 3048 | - Work sidebar no longer shows stale `phase now:` / `phase next:` strategy rows once the checklist |
| 3049 | is 100% complete. |
| 3050 | - Plan mode no longer shortcuts investigation for requests that name a repository, URL, version, |
| 3051 | release, build state, bug, PR, issue, API surface, or local code path. |
| 3052 | - Oversized pasted text stays editable in the composer, with a file backup appended at submit |
| 3053 | time for model access; thanks @idling11 (#3267, closes #3263). |
| 3054 | - Bare digit keys `1`-`8` now insert text instead of firing hotbar slots; use `Alt+digit` for |
| 3055 | hotbar actions. Thanks @wjq2026 for the report and @DieMoe233 for the paste-path note (#3243). |
| 3056 | - Kimi/Moonshot tool schemas normalize empty function parameters to a root object schema; thanks |
| 3057 | @jghwwnq for the provider repro (#3265). |
| 3058 | - Novita defaults to its OpenAI-compatible `/openai/v1` endpoint so chat completions no longer |
| 3059 | 404 out of the box; thanks @buko for the report and endpoint verification (#3255). |
| 3060 | - Dependency security: `ws` pinned to 8.21.0 across npm packages to close remote memory-exhaustion |
| 3061 | DoS (dependabot). |
| 3062 | |
| 3063 | ### Community contributions |
| 3064 | |
| 3065 | - Non-DeepSeek model pricing — thanks @mvanhorn (#3201) |
| 3066 | - Telegram polling transport — thanks @cyq1017 (#3195) |
| 3067 | - Mobile event history — thanks @RobertEmprechtinger (#3220) |
| 3068 | - Runtime-API session save — thanks @gaord (#3199) |
| 3069 | - Whale-accent rename — thanks @nightt5879 (#3197) |
| 3070 | - `DEEPSEEK_BASE_URL` / `MODEL` honored in `exec` — thanks @hongchen1993 (#3221) |
| 3071 | - VS Code read-only API documentation — thanks @cyq1017 (#3013) |
| 3072 | - Atomic ask-only permission rule persistence — thanks @greyfreedom (#3233) |
| 3073 | - DeepInfra provider support and release-surface follow-through — thanks @idling11 (#3235, closes #3231) and @nightt5879 (#3236) |
| 3074 | - Editable oversized paste composer flow — thanks @idling11 (#3267, closes #3263) |
| 3075 | - WeChat bridge (`integrations/weixin-bridge` via Feishu + Tencent OpenClaw) — thanks @VincentCorleone (#3206) |
| 3076 | - Config robustness: atomic permission-rule save, one-time config `.bak` backup before the first changed write, `CODEWHALE_HOME` as primary config home, and accepting the dispatcher-written config shape (camelCase aliases + `[features.enabled]` table) so legacy/dual-written configs parse cleanly |
| 3077 | - Dependency/CI bumps: docker login/qemu actions, softprops gh-release, download-artifact, vitest, @opennextjs/cloudflare, form-data, js-yaml, dompurify, ws |
| 3078 | |
| 3079 | ## [0.8.60] - 2026-06-13 |
| 3080 | |
| 3081 | ### Added |
| 3082 | |
| 3083 | - **Agent Fleet real-run cutover (#3154/#3096).** `codewhale fleet run` now |
| 3084 | launches durable workers through the headless `codewhale exec --output-format |
| 3085 | stream-json` path instead of the local simulation interpreter, with terminal |
| 3086 | worker events freeing leases so queued fleet tasks continue running. |
| 3087 | - **Read-only shell parallelism (#2983).** The engine can now run conservative |
| 3088 | read-only shell calls in parallel, including strict `bash`/`sh`/`zsh -c` |
| 3089 | wrappers for whitelisted commands, while writes, stdin, background TTY work, |
| 3090 | redirects, pipes, command substitution, and follow-mode tails stay serial. |
| 3091 | - **Declarative JS/TS WhaleFlow authoring (#3097).** WhaleFlow now accepts a |
| 3092 | compile-only `workflow({...})` JavaScript/TypeScript authoring form that |
| 3093 | lowers into the existing `WorkflowSpec` validator without executing user |
| 3094 | JavaScript. |
| 3095 | - **Slash-menu Ctrl+P/Ctrl+N navigation (#3196).** The slash command menu now |
| 3096 | supports Ctrl+P/Ctrl+N movement without letting the global file picker steal |
| 3097 | focus while the menu is open. Thanks @1Git2Clone for the PR. |
| 3098 | - **New models and first-party provider routes.** This release adds |
| 3099 | **GLM-5.2** (selectable on the Z.ai Coding Plan and over OpenRouter as |
| 3100 | `z-ai/glm-5.2`, alongside the existing GLM-5.1 default), a first-party |
| 3101 | **Z.ai** provider route, a first-party **StepFun / StepFlash** route |
| 3102 | (`step-3.7-flash`), and a first-party **MiniMax** route defaulting to |
| 3103 | `MiniMax-M3` with the M2.7/M2.5/M2.1 family selectable (#3187/#3191). |
| 3104 | |
| 3105 | ### Changed |
| 3106 | |
| 3107 | - **README and contributor credits.** The README now has a shorter public |
| 3108 | overview and moves the full contributor ledger to `docs/CONTRIBUTORS.md`, |
| 3109 | preserving public thanks for [DeepSeek](https://github.com/deepseek-ai), |
| 3110 | [DataWhale](https://github.com/datawhalechina), |
| 3111 | [OpenWarp](https://github.com/zerx-lab/warp), and |
| 3112 | [Open Design](https://github.com/nexu-io/open-design). |
| 3113 | - **Fleet-backed sub-agent direction.** Runtime docs now state the intended |
| 3114 | cutover clearly: "sub-agent" is role/UX vocabulary, while durable detached |
| 3115 | work should converge on the fleet-backed worker lifecycle with retries, |
| 3116 | receipts, and ledgered inspection. |
| 3117 | |
| 3118 | ### Fixed |
| 3119 | |
| 3120 | - **Sub-agent eval no longer blocks by default.** `agent_eval` now returns the |
| 3121 | current projection immediately and delivers follow-up input without waiting |
| 3122 | for a running child to finish its provider call. Pass `block:true` for an |
| 3123 | intentional terminal wait. |
| 3124 | - **Z.ai GLM thinking traces.** Direct Z.ai requests now use the documented |
| 3125 | `thinking` shape, preserve and replay `reasoning_content`, classify GLM |
| 3126 | reasoning streams as thinking output, and accept `ultracode` as a max-effort |
| 3127 | alias. |
| 3128 | - **Claude skill archive compatibility (#2743).** `/skill install` keeps |
| 3129 | portable Claude-style skill folders supported while rejecting multi-skill |
| 3130 | Claude plugin archives clearly instead of silently installing only one skill |
| 3131 | and dropping plugin semantics. Thanks @AiurArtanis for the ecosystem request. |
| 3132 | |
| 3133 | ## [0.8.59] - 2026-06-12 |
| 3134 | |
| 3135 | ### Added |
| 3136 | |
| 3137 | - **Moonshot Kimi K2.7 Code model.** The Moonshot/Kimi provider now defaults to |
| 3138 | `kimi-k2.7-code`, recognizes `kimi`/`kimi-k2` aliases for that model, keeps |
| 3139 | explicit `kimi-k2.6` selectable, and adds the OpenRouter |
| 3140 | `moonshotai/kimi-k2.7-code` registry row. |
| 3141 | - **Concise verbosity mode (#3052).** CLI noninteractive launches now default |
| 3142 | to concise prompt/output discipline unless overridden by config, env, or |
| 3143 | `--verbosity`, while interactive TUI launches remain normal by default. |
| 3144 | Thanks @cyq1017 for the PR. |
| 3145 | - **Ephemeral generated project context (#3058).** Opening CodeWhale in a |
| 3146 | directory with no instruction files now keeps the bounded generated project |
| 3147 | overview in memory instead of creating `.codewhale/instructions.md`. |
| 3148 | - **ACP registry auth metadata (#1447).** The ACP stdio adapter now advertises |
| 3149 | terminal authentication setup in `initialize.authMethods`, matching the |
| 3150 | registry's validation requirement. |
| 3151 | - **Sidebar context menus (#3065).** Right-clicking the sidebar no longer shows |
| 3152 | `Paste`; clickable sidebar rows now offer their row command as the first |
| 3153 | context action. |
| 3154 | - **Sidebar hover popovers (#3088).** Streaming turns now keep sidebar hover |
| 3155 | popovers responsive while continuing to throttle transcript/body mouse |
| 3156 | motion. |
| 3157 | - **Dark-theme selection contrast (#3074, thanks @drpars).** Session, config, |
| 3158 | help, context-menu, and approval selections now use the muted selection |
| 3159 | background instead of the bright accent color. |
| 3160 | - **Cursor-style activity metadata rows (#3146).** Dense successful tool-run |
| 3161 | summaries now render as a single muted `Explored ...` / `Updated metadata` |
| 3162 | row, include short command-family labels for successful generic verifier |
| 3163 | groups, and keep keyboard/mouse expansion and detail inspection intact. |
| 3164 | - **Provider-wait observability (#3095).** Footer stall reasons now name the |
| 3165 | active provider/model route, idle seconds vs stream budget, and whether a |
| 3166 | fanout plan is still at `0 running` or dispatch is pending. Structured |
| 3167 | provider-wait incidents log once per turn from the main tick loop (not on |
| 3168 | every footer redraw). |
| 3169 | - **Interactive fanout launch gate (#3095).** Direct sub-agent children queue |
| 3170 | behind a configurable semaphore (`[subagents] interactive_max_launch`, |
| 3171 | default 4) with a visible `queued: waiting for an interactive fanout slot` |
| 3172 | reason before their first model step. |
| 3173 | - **Goal lifecycle controls.** `/goal` is now the primary command surface for |
| 3174 | session goals, with `pause`, `resume`, `complete`, `blocked`, and `clear` |
| 3175 | controls while `/hunt` remains a compatibility alias. |
| 3176 | - **Persistent thread-goal API.** App-server clients can now set, get, and clear |
| 3177 | durable thread goals through `thread/goal/set`, `thread/goal/get`, and |
| 3178 | `thread/goal/clear`, backed by the state store with Codex-style status and |
| 3179 | token/time accounting fields. |
| 3180 | - **Command-boundary ownership layers (#2888/#3055).** Built-in slash command |
| 3181 | metadata now lives in `commands/registry.rs`, slash parsing in |
| 3182 | `commands/parse.rs`, and handlers under group-owned command areas, preserving |
| 3183 | the existing dispatch surface while reducing future `commands/mod.rs` churn. |
| 3184 | - **Approval-rule source metadata (#1186/#2971).** Runtime API |
| 3185 | `approval.required` events now include optional `matched_rule` metadata when |
| 3186 | an execution-policy rule caused the prompt. Thanks @greyfreedom for the PR |
| 3187 | and @Ram9199 for the audit-semantics discussion. |
| 3188 | - **Localized tool-family labels (#2901).** Tool activity labels for read, |
| 3189 | patch, run, find, delegate, fanout, RLM, verify, think, and generic tool |
| 3190 | work now route through the shipped locale tables. Thanks @gordonlu for the |
| 3191 | PR. |
| 3192 | - **Localized config section labels (#2918).** The interactive config view now |
| 3193 | localizes section and session/saved scope labels while preserving English |
| 3194 | search terms. Thanks @gordonlu for the PR. |
| 3195 | - **Localized config editor labels (#2919).** The config editor modal now |
| 3196 | localizes edit labels, default/unavailable placeholders, and effective |
| 3197 | currency hints. Thanks @gordonlu for the PR. |
| 3198 | - **Hotbar number-key dispatch (#3056).** Bare `1`-`8` now trigger bound |
| 3199 | hotbar slots only when the composer is empty, while `Alt+1`-`Alt+8` trigger |
| 3200 | slots regardless of composer text and overlays keep key ownership. Thanks |
| 3201 | @reidliu41 for the PR. |
| 3202 | - **Voice dictation commands (#3051).** `/voice`, `/voice-send`, and |
| 3203 | `/voice-control` now record through `sox`/`rec`/`arecord`, transcribe via the |
| 3204 | active provider's chat-completions API, and insert transcripts at the |
| 3205 | composer cursor. The `voice.toggle` hotbar action dispatches the real voice |
| 3206 | command, with help and status text localized across all seven shipped |
| 3207 | locales. Thanks @huqiantao for the PR. |
| 3208 | - **Thread rewind and snapshot restore API (#2808).** GUI clients can now call |
| 3209 | `POST /v1/threads/{id}/undo`, `/patch-undo`, and `/retry` to fork, roll back, |
| 3210 | or rerun recent thread turns, plus `POST /v1/snapshots/{id}/restore` to |
| 3211 | restore a workspace snapshot by id. Thanks @bengao168 for the PR. |
| 3212 | - **Active provider fallback chain (#2773).** Configured `fallback_providers` |
| 3213 | now build an ordered primary-plus-fallback route that the TUI can report, |
| 3214 | advance through, and reset with `/provider fallback reset`, including footer |
| 3215 | visibility for fallback state. Thanks @idling11 for the PR. |
| 3216 | - **Provider metadata registry (#3005).** Built-in provider ids, display names, |
| 3217 | defaults, env vars, config keys, aliases, and wire formats now live in a |
| 3218 | shared metadata registry, with the provider drift check covering the registry |
| 3219 | contract. Thanks @sximelon for the PR. |
| 3220 | - **Hugging Face provider route (#2879).** Hugging Face Inference Providers now |
| 3221 | have first-class config, env, docs, and registry coverage for the |
| 3222 | OpenAI-compatible router, including `huggingface`/`hugging-face`/ |
| 3223 | `hugging_face`/`hf` aliases and `HUGGINGFACE_*`/`HF_*` env fallbacks. Thanks |
| 3224 | @mvanhorn for the PR. |
| 3225 | |
| 3226 | ### Fixed |
| 3227 | |
| 3228 | - **SSE data lines without spaces (#3152).** Chat Completions, Responses, and |
| 3229 | Anthropic stream readers now accept both `data: {...}` and `data:{...}` SSE |
| 3230 | frames, matching the spec and preventing providers that omit the optional |
| 3231 | space from streaming empty output. Thanks @wgeeker for the PR. |
| 3232 | - **Runtime thread detail N+1 reads (#3141).** `get_thread_detail` now scans |
| 3233 | persisted turn items once and groups them by turn instead of reading the |
| 3234 | items directory once per turn, preserving item order while keeping large |
| 3235 | thread detail loads responsive. |
| 3236 | - **Project-local hook trust boundary (#3140).** `.codewhale/hooks.toml` is now |
| 3237 | loaded only after the workspace is trusted in user-owned config, matching the |
| 3238 | project-local MCP trust model while preserving the documented shell-command |
| 3239 | hook contract. |
| 3240 | - **Skill registry sync latency (#3139).** `/skills sync` now syncs registry |
| 3241 | entries with bounded ordered concurrency, so network latency no longer stacks |
| 3242 | one skill at a time while output order stays deterministic. |
| 3243 | - **SiliconFlow China provider config (#2893/#2895).** `siliconflow-CN` |
| 3244 | now reads its own `[providers.siliconflow_cn]` / `[providers.siliconflow-CN]` |
| 3245 | table and falls back to `[providers.siliconflow]` only for unset |
| 3246 | `api_key`/`base_url`/`model` fields. Thanks @Artenx for the report and |
| 3247 | @idling11 for the PR. |
| 3248 | - **Self-update download timeout (#3006).** `codewhale update` now applies a |
| 3249 | five-minute HTTP client timeout so blocked or very slow GitHub release |
| 3250 | downloads fail instead of hanging indefinitely. Thanks @New2Niu for the PR. |
| 3251 | - **Legacy `deepseek` update migration (#2960/#3013/#3053).** Running |
| 3252 | `deepseek update` or `deepseek-tui update` from a pre-rebrand install now |
| 3253 | returns copy-pasteable npm, Cargo, Homebrew, and manual-binary migration |
| 3254 | steps instead of trying to spawn a missing `codewhale` binary. README and |
| 3255 | rebrand docs now cover the same upgrade path. Thanks @jazzi and |
| 3256 | @tiangangQiu for the reports, @cyq1017 for the update-path PR, and |
| 3257 | @angus-guo for the README PR. |
| 3258 | - **Short `codew` shim delegation.** The `codew` convenience binary now |
| 3259 | prefers the sibling `codewhale` dispatcher installed next to it before |
| 3260 | falling back to `PATH`, preventing fresh local builds or installs from |
| 3261 | accidentally invoking an older global dispatcher. |
| 3262 | - **Constitution trust wording (#2950/#3008).** The base prompt now explains |
| 3263 | that "begins with an A" means a baseline of trust, not a literal output |
| 3264 | formatting rule. Thanks @cyq1017 for the PR. |
| 3265 | - **TUI provider-source recovery (#3007/#3011).** Unsupported interactive |
| 3266 | providers now report whether the value came from `--provider`, environment, |
| 3267 | or config. Config-sourced unsupported providers fall back to DeepSeek without |
| 3268 | forwarding stale keyring secrets. Thanks @cyq1017 for the PR. |
| 3269 | - **Exec auto-model handoff (#3148).** `codewhale exec --model auto` now |
| 3270 | survives the CLI/TUI boundary by honoring the CodeWhale model env alias and |
| 3271 | legacy DeepSeek model handoff before falling back to provider defaults. |
| 3272 | Thanks @hongchen1993 for the PR. |
| 3273 | - **macOS shortcut modifiers (#2938/#2943).** Ctrl-like shortcuts that are |
| 3274 | reported as `SUPER` by macOS terminals now work for backgrounding tasks and |
| 3275 | sidebar-focus chords without rewriting clipboard shortcuts. Thanks @idling11 |
| 3276 | for the PR. |
| 3277 | - **TUI mouse-report leak (#3063/#3067).** Strip raw SGR mouse coordinate |
| 3278 | tails from the composer even when `use_mouse_capture` is false, covering |
| 3279 | orphaned terminal reporting state after crashes or focus races. |
| 3280 | - **Interrupted sub-agent lifecycle (#3080).** API-timeout interruptions now |
| 3281 | emit `MailboxMessage::Interrupted`, render terminal interrupted cards, and |
| 3282 | reconcile stale running fanout counts from manager snapshots. |
| 3283 | - **OpenAI Codex stream diagnostics and active tool collapse (#3146).** The |
| 3284 | Responses bridge now reports nested `response.failed` / |
| 3285 | `response.incomplete` errors instead of `unknown`, and dense successful |
| 3286 | in-flight tool bursts collapse into the same calm activity metadata row as |
| 3287 | committed history. |
| 3288 | - **OpenAI Codex reasoning tiers.** Switching from DeepSeek to `openai-codex` |
| 3289 | now normalizes stale reasoning state into Responses-compatible |
| 3290 | `low`/`medium`/`high`/`xhigh` tiers. Startup, `/config`, and the model |
| 3291 | picker now display Codex labels instead of leaking DeepSeek |
| 3292 | `off`/`max` names, while Codex still reports as a Responses payload |
| 3293 | provider. The Responses request builder also clamps legacy `minimal` input |
| 3294 | to `low` and has regression coverage that Codex requests use |
| 3295 | `reasoning.effort`, not DeepSeek `thinking` fields. |
| 3296 | - **OpenAI Codex context metadata (#3070).** The `gpt-5.5` default and |
| 3297 | CodeWhale aliases now use OpenAI's documented 1,050,000-token context window |
| 3298 | and 128,000 max-output metadata for context pressure, prompts, and doctor |
| 3299 | capability output. |
| 3300 | - **OpenAI Codex effective context budgeting.** The public OpenAI API metadata |
| 3301 | for `gpt-5.5` remains 1,050,000 tokens, but the `openai-codex` OAuth route now |
| 3302 | budgets prompts against the 400K Codex-family effective window so preflight |
| 3303 | compaction runs before the backend returns `context_length_exceeded`. |
| 3304 | - **OpenRouter Nemotron 3 Ultra preset.** The OpenRouter preset and model |
| 3305 | registry now emit `nvidia/nemotron-3-ultra-550b-a55b` while keeping the old |
| 3306 | Ultra aliases compatible. |
| 3307 | - **OpenRouter auth after MiMo switches (#3064).** Switching from Xiaomi MiMo |
| 3308 | to OpenRouter now has regression coverage for preflight key failures and |
| 3309 | Bearer auth header isolation before any request can be dispatched. |
| 3310 | - **Responses strict-tool schema compatibility (#3062/#3017/#1883).** Responses |
| 3311 | function tools now preserve per-tool strict-mode compatibility, keep optional |
| 3312 | strict-schema fields nullable, and append deterministic constraint notes when |
| 3313 | root composition groups must be flattened for Responses. |
| 3314 | - **Runtime prompt autonomous loop guard (#3061).** Runtime policy reference |
| 3315 | now explicitly forbids initiating new work when `<runtime_prompt>` is the |
| 3316 | only new turn content and no tool/sub-agent handoff is pending. |
| 3317 | - **Goal runtime status sync.** Goal token budgets and active/paused/complete |
| 3318 | status now sync into the engine alongside the objective, and model-visible |
| 3319 | `update_goal` can only mark goals complete or blocked. |
| 3320 | |
| 3321 | ### Contributors |
| 3322 | |
| 3323 | - Devin session work on #3080/#3095 (PRs #3103, #3104, #3106) — Hunter Bown |
| 3324 | (maintainer integration/cherry-pick on `codex/v0.8.59-release-ready`). |
| 3325 | - Nightt (@nightt5879) for the Responses strict-tool schema hardening in PR |
| 3326 | #3062. |
| 3327 | - yekern (@yekern) for the #3061 runtime-prompt loop safety report and repro |
| 3328 | that shaped the dispatch guard. |
| 3329 | - Paulo Aboim Pinto (@aboimpinto) for the staged command-boundary design and |
| 3330 | Layer 3 registry/parser extraction in PR #2888, plus the #2851/#2791/#2870 |
| 3331 | architecture stream that guided the grouped command areas in #3055. |
| 3332 | |
| 3333 | --- |
| 3334 | |
| 3335 | Older releases: [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md). |
| 3336 |