Codewhale v0.10.1 (Formerly DeepSeek TUI) Release Notes: Codewhale is the public product from Shannon Labs. The codewhale</blockquote>
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.
Install
Recommended — official GitHub release
New macOS/Linux install (checksummed binaries from this release):
bash
curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.10.1" sh
"$HOME/.local/bin/codewhale" --version
For Windows, use the matching installer or archive below. For an existing
direct install, run codewhale update; it prints the executable path and
keeps newer builds. If the install directory is occupied by a different build,
use the fresh-directory migration in the installation guide.
Secondary packaging — npm and Cargo
bash
npm install -g codewhale
or build from source
cargo install codewhale-cli --locked
The wrapper downloads the matched codewhale and codew command assets
from this Release. Both contain the same compiled runtime.
Docker / GHCR
bash
docker run --rm -it \
-e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
-v codewhale-home:/home/codewhale/.codewhale \
ghcr.io/codewhale-hq/codewhale:v0.10.1
The image exposes the same runtime as both codewhale and codew. The
latest tag is also updated on release.
Cargo (Linux / macOS)
bash
cargo install codewhale-cli --locked
The Cargo package installs codewhale. Cargo cannot create a second command
alias from one binary target; users who want the shorter spelling can add a
codew symlink to that installed executable. The npm, Homebrew, archive,
shell-installer, and container channels install both command names directly.
Manual download — platform archives (recommended)
Each archive below contains the same runtime under the codewhale and
codew command names, plus an install script:
- Linux x64:
codewhale-linux-x64.tar.gz | install.sh
- Linux ARM64:
codewhale-linux-arm64.tar.gz | install.sh
- Android ARM64 (Termux):
codewhale-android-arm64.tar.gz | install.sh
- macOS x64:
codewhale-macos-x64.tar.gz | install.sh
- macOS ARM:
codewhale-macos-arm64.tar.gz | install.sh
- Windows x64 (installer):
CodeWhaleSetup.exe | NSIS setup
- Windows x64:
codewhale-windows-x64.zip | install.bat
- Windows x64 (portable):
codewhale-windows-x64-portable.zip | —
- Windows ARM64:
codewhale-windows-arm64.zip | install.bat
- Windows ARM64 (portable):
codewhale-windows-arm64-portable.zip | —
Unix (Linux / macOS):
bash
tar xzf codewhale-.tar.gz
cd codewhale-
./install.sh
Windows:
- For the installer path, run
CodeWhaleSetup.exe; it installs
codewhale.exe, codew.exe, and codewhale.bat under
%LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
current-user PATH, and creates a Start Menu shortcut that prefers
Windows Terminal (wt.exe) when it is installed.
- Extract the archive for your machine:
codewhale-windows-x64.zip or
codewhale-windows-arm64.zip
- Double-click
codewhale.bat (not the raw .exe) to launch
- Run
install.bat to copy the binaries and launcher to %USERPROFILE%\bin
- Add
%USERPROFILE%\bin to your PATH
The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.
Each platform also has bare, unarchived codewhale- and
codew- assets. The seven codewhale-tui- filenames
attached to v0.9.5 are byte-identical compatibility copies used only to let
already-installed v0.9.4 clients discover and cross this single-binary
transition; current installers do not expose a third runtime. The legacy npm
package deepseek-tui is deprecated and is not republished. For migration
from v0.8.x legacy binary names, see docs/REBRAND.md.
Verify (recommended)
Download the checksum manifests from this Release and verify:
bash
Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing
Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing
macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing
What's in v0.10.1
Contributor integration and reliability
- OAuth retry diagnostics omit provider-controlled error fields; account replacement stops before retired Weixin receipts exceed their storage limit, preserving uncertain work for local review.
- Resuming a session through a symlink to the same workspace no longer shows a false workspace-change warning.
- Runtime clients can read one tool call's actual workspace changes and reviewed skill details (thanks @gaord, #6817 and #6869). In-flight snapshot pairs remain pending; missing objects and corrupt repository metadata are distinguished.
- Search accepts valid preferred locales, and image dimensions describe the same bytes sent to the model (thanks @asto18089, #6860 and #6858). Automation deletion keeps its definition until cleanup succeeds, and compaction preserves its original summary anchor (#6864 and #6857).
- Config/status/permission commands share portable contracts while the host retains mutation authority; queue workers acknowledge a scheduled retry for temporary first-claim contention and fail honestly on corruption (thanks @aboimpinto, #6832).
- Indefinite questions, approvals and elevation waits survive the TUI watchdog. Answers get time to resume the current turn; settled requests disappear by identity. Thanks @7jrxt42BxFZo4iAnN4CX for #6872.
- Configured approval expiry belongs to the held Engine request; hiding or covering its card cannot restart the deadline, and a late queued answer cannot approve an expired call.
- Tool discovery keeps the highest-ranked matches when a result batch exceeds the existing cache bounds, preserving search order and the 16 KiB limit (adapted from @AdityaVG13's #6393).
- Model-switch receipts now translate their session-only saving note in every complete locale pack; the three save commands remain directly usable (thanks @Lstarsky0, #6875).
- Route-save receipts and
/workspace replies are translated in every complete locale pack, the Operate descriptions in fourteen packs match the current English, pt-BR, es-419 and ca regain accents six strings had lost, and long CJK text can be shortened between Han and kana characters (thanks @Lstarsky0, #6884, #6885, #6886, #6888, #6887 and #6882).
- Long sessions keep less in memory: superseded journal entries beyond a retained window move out of the live session into a per-session archive under
sessions/.journal-archive/ (kept until the session is deleted; /branch can still restore an archived entry), ended shell operations in the work graph are capped, and session metadata larger than the first read no longer forces a full-file read. Not yet addressed: usage fingerprints in session metadata still grow without a bound, snapshots are still cloned on the UI task, and resume still reads the session file twice (thanks @7jrxt42BxFZo4iAnN4CX, refs #6842).
- Weixin bridge threads belong to the account and chat that created them:
resuming or listing another chat's thread is refused. An explicit /new after
an account replacement keeps the old account's private receipt and never
replays its prompts automatically. Replies never reuse another bot account's
Weixin context token, and /threads lists this chat's own older threads even
when other chats have newer ones.
- Windows messaging bridges retry a briefly locked record replacement
(EPERM/EACCES/EBUSY) with bounded delays and never delete the previous record
first.
- The website and README installation guides are generated from one shared
source, and the critical Simplified Chinese guides were re-reviewed against
current English.
- A Codewhale sign-in that expired, or an account service that is unreachable,
no longer blocks turns on your own provider key. The turn uses your local
settings and Codewhale says once how to restore account preferences.
codewhale login keeps a DeepSeek route you chose, or one with a local key,
instead of switching it to the managed Codewhale provider.
- The bundled
computer-use plugin is 0.12.1, reconciled with canonical source
724f9c422db1a51880dc81154dae70816c475ed8 while retaining Core's embedding
manifest and version contract. Its image renderer lock now carries Sharp 0.35.5.
- The bundled first-party catalog pins marketplace revision
6512f1dfaa91ee287e9f81ebabaf4909e8a371a3 and lists all 19 reviewed plugins,
up from 6. Every catalog plugin still installs disabled and untrusted until
you review it.
- Every committed npm lockfile is audited in CI, including build tooling. The
VS Code extension packages with @vscode/vsce 4 on Node 22 while it still
compiles and tests on its Node 20 runtime. The website keeps one reviewed,
hash-verified depth guard for an unpatched braces advisory
(GHSA-vfj7-8cjw-p6xm); its raw audit findings are retained, not hidden.
- Pasting through Windows Terminal (Ctrl+Shift+V) no longer drops emoji and
other characters outside the Basic Multilingual Plane. Release binaries and source builds carry
a small patch to crossterm 0.29.0 in patches/ (the change proposed upstream
as crossterm-rs/crossterm#1073); a real Windows Terminal paste of 24 Unicode
lines is now a release gate.
- Experimental extension host: reviewed Native plugins can register avatar
packs with ctx.avatars.registerPack (/pet avatar [key], `/pet action|view
). /plugin import dsh ` reviews a DeepSeek Harness
bundle and now lists the Native host code it contains; `approve
` installs it disabled and untrusted. Trusted host plugins stay
trusted across a restart, enabling a second host plugin activates it without
/plugin reload, and the review no longer crashes the TUI.
Codewhale v0.10.1 focuses on reliability and first-run behavior. Turns that
stall now say so, approvals keep what you approved, plugin suggestions are
quieter, and Fleet runs can be checked before they spend anything.
Scripts that parse --json output should read the Breaking for scripts
note below before upgrading.
Added
/plugin doctor reports stale built-in records and snapshots, and
/plugin doctor --fix retires them. A user plugin, a snapshot a running
process names, and a snapshot inside the grace window are kept. The
previous state.json is kept as state.json.pre-gc.
- Reviewed plugins can declare named OpenAI-compatible OAuth routes. The host
owns PKCE, refresh and credential storage, and checks the review at each
request (docs/PLUGIN_PROVIDERS.md, #6805).
The provider capability advances plugin review policy to v5 (v6 with the
extension host): older receipts require explicit review again.
- OrcaRouter account sign-in uses PKCE and saves the same durable API key as
manual setup; its live catalog keeps chat-capable rows and stated pricing
and modality facts (#6867).
- Experimental TypeScript extension host. New in this release and off by
default: turn it on with [features] extension_host = true. A plugin that
declares a native TypeScript or JavaScript entry (the Cordis / DeepSeek
Harness plugin model) can contribute tools, slash commands, pre-execution
policy hooks, additive prompt sections, reviewed skill roots and plugin-local
JSON state. Its code runs in a separate
Node process, never inside Codewhale (Bun is an opt-in through
[extension_host] runtime), and every call goes through Codewhale's own gate:
an extension tool is never treated as read-only, so it always meets the
approval gate (Full Access, Bypass or a session grant for that reviewed plugin
can satisfy it), a command runs only when you type it, and a plugin must be
reviewed and enabled first. The host is sandboxed on macOS (Seatbelt) and on
Linux with bubblewrap, with no direct network and no reads of the protected
credential locations (Codewhale's secret stores and the Codewhale, Codex and
DSH homes). A Native extension starts only after that sandbox is verified at
launch: if bubblewrap is missing or its namespace probe fails, activation is
refused with the concrete error. Codewhale's own pinned built-in host modules
keep a diagnosed exception, and every effect still needs a Rust operation
ticket. On Windows a Native extension starts only in a freshly created Less
Privileged AppContainer whose only capability is registryRead (Winsock
cannot start without it), after Codewhale checks its token and a real file
and network probe; otherwise activation is refused.
Other files you
can read, such as project .env files, stay readable, and plugins sharing the
host can interfere with each other, so enable only plugins you have reviewed
(docs/EXTENSIONS.md).
- Extension slash commands: a plugin registers one with
ctx.commands.register.
It runs only when you type it, and it can show text, or submit a prompt as
your next message that then goes through the ordinary turn and its approvals;
it cannot call the model or a tool itself. A command cannot take a built-in
command's name or another plugin's, and a markdown command with the same name
wins. A command has 30 seconds, and commands are TUI only: the Runtime API
does not list or run them.
- Native extension authoring now includes policy listeners through
ctx.on('tools/pre-execute', ...), prompt sections through
ctx.prompt.registerSection, and persistent plugin-local state through
ctx.storage. Listeners may deny, ask, revise input or annotate; Rust
rechecks revised calls and owns every approval. Prompt sections cannot
replace the system prompt, and state exposes no session history or secret
API. These services share the experimental, off-by-default host's reviewed
owner lifecycle and are withdrawn when their owner unloads or is revoked;
saved state remains available when the plugin reloads.
- Extension tool input is checked against the JSON Schema the tool registered,
before an approval card appears and again before the call reaches the host. An
invalid call comes back to the model as an error naming what to correct, and
the host never sees it. A schema that cannot be compiled, or that refers
outside itself with $ref, is refused when the tool registers.
- An extension tool can call eligible core tools with
core/call while the
ordinary turn is running that extension tool. Rust supplies a temporary
invocation ticket and still owns planning, hooks, permissions, approval and
execution. The ticket is bound to the plugin owner, host process and live
invocation, and expires when that invocation ends or is revoked. Commands,
timers and plugin startup cannot use this path. Approval grants are scoped
to the reviewed extension build; a grant to the model does not cover it.
Shell and network calls require a person's prompt even with a remembered
grant; a permission mode that cannot present that prompt refuses the call.
MCP tools, Computer Use, other extensions, agent/workflow launches and
permission-changing tools remain unavailable through this path. A cancelled
invocation withdraws its pending approvals instead of deciding them for you.
- Extension host identity is checked at startup: its reported trust tier and
built-in module digests must match the process Rust launched. Built-in host
code and third-party plugins have separate process and owner namespaces;
the table pins the MCP protocol module and the execution harness. The
optional Host MCP backend uses the official TypeScript SDK for framing,
with Rust retaining credentials, network/process access, approval and exact
operation tickets. All 30 existing recorded comparisons pass locally.
The Rust backend stays the default until platform and rollout gates pass;
its protocol adapters remain through the compatibility window.
- A plugin can declare several
native entries (native.paths, up to 64). They
activate in order under one owner, so one disable, review change or crash
takes all of them down. If one entry fails to activate, only that entry is
withdrawn: entries that already activated stay registered, and the plugin
fails only when no entry activates.
- Plugin settings and context:
[plugins."".config] in your own
config.toml is passed to the plugin's apply(ctx, config) and checked
against its exported Config schema; a project's .codewhale/config.toml
cannot set it, a change applies at /plugin reload, and /plugin show lists
the keys, never the values. Tools and commands also receive the workspace of
the session that called them and a private data directory for the plugin under
~/.codewhale/extension-host/data/plugins/; no home, credential or other
workspace path is passed.
codewhale --enable and --disable work from the
codewhale command; before, they were rejected. Put the flag before any
subcommand.
- The extension host bundle carries MIT-licensed code (Cordis, Schemastery and
others). Its third-party licence notices are generated from what the bundle
actually contains and written beside the bundle when it is unpacked, and
THIRD_PARTY_NOTICES.md lists the packages.
- Extension host runtime: Bun 1.4.0 or newer is an opt-in; Node stays the default.
[extension_host] runtime = "node" | "bun" | "auto" chooses: unset means node (or bun when the table sets only a bun path), bun runs only Bun, and auto prefers a supported Bun and uses Node when none is found or the Bun host fails to start. An explicit choice never falls back, and restarts keep the runtime the session first started on; a runtime binary replaced mid-session is refused. A configured node or bun path is used as given and fails loudly rather than falling through to PATH, and a runtime found on PATH inside a node_modules directory or the working directory is skipped, not run. codewhale doctor and /plugin show which runtime runs the host, why, and how its memory is capped. Under Bun the host never auto-installs packages and ignores .env and bunfig.toml in its data directory. Extensions cannot run native code inside the host on either runtime: bun:ffi, Bun.FFI, node:ffi, the SQLite builtins, process.dlopen, process.execve, Worker threads and ShadowRealm are refused, and the host will not start if one of these restrictions does not hold. Known limit: that lockdown covers the native-code entry points found so far (Bun 1.4, Node 22 and 26); one a newer runtime adds is not covered until it is added. The 1 GiB memory cap uses RLIMIT_DATA on Linux, the Job Object on Windows and, for a Bun host, a kernel jetsam limit on macOS; a Node host on macOS is checked at each heartbeat. Bun is qualified on macOS only: the Rust host tests, the memory cap included, have not run a Bun host on Linux or Windows (CI runs them with Node, and the JS host suites under Bun 1.4.0 on Linux). host/hello reports the runtime and version that actually run.
docs/features.toml lists every user feature with its status, first
release, docs page and owning code. A test fails when a [features] flag
and its row disagree, or when a listed docs page or code path is missing.
The configuration reference now lists the verify_tool, vision_model and
extension_host flags, and config.example.toml lists code_mode.
- A reusable GitHub Action runs PR reviews with a configurable model endpoint
and a checksum-pinned Codewhale binary. It checks the PR's eligibility and
exact revisions before inference; fork events receive no model key
(#6780).
- An optional, off-by-default shadow Decision Gate classifies the first request
of a turn — tool need, answerability from context, intent — through the
existing System One client and only logs a typed recommendation; it never
changes routing or delays the model call. Configure it with
SUPERFAST_ENABLED and SUPERFAST_PROVIDER (docs/CONFIGURATION.md)
(#6603,
#6604, thanks @Andrea-Bruno).
tool_call_after hooks for shell tools receive DEEPSEEK_TOOL_EXECUTION_RECEIPT: the command that actually ran after admission, its working directory, how it ended, and bounded stdout/stderr previews, so a hook can record exactly what executed (#6689, requested by @wuisabel-gif).
Supported settled local shell calls also send a versioned JSON document on
stdin to foreground or background observers, with session/tool-call IDs,
nullable exit status and output truncation flags. Existing environment fields
stay available; unsupported execution paths send no document, and observer
output cannot change the completed call
(#6582).
- Runtime API: turns now record what they produced. Each item and turn
carries typed artifact references (path, kind, size, revision, and a
restore point when file-revert would accept one) for files a tool wrote,
spilled tool output, and media.
- Once the post-turn snapshot settles, the turn also lists what changed in
-- the workspace while it ran, including shell and sub-agent writes. It then
-- publishes turn.artifacts.
GET /v1/threads/{id}/turns/{turn_id}/artifacts lists a turn's
-- references, and .../artifacts/{artifact_id} reads one from the
-- workspace, the post-turn snapshot or the session artifact directory.
- Spills from unbound runtime threads were unreadable before; they are now
-- readable.
- The legacy
artifact_refs field is now filled with the workspace files a
-- tool call wrote, so Preview in current desktop builds shows them
(#6653).
- Runtime API: git stage, unstage, discard and commit accept optional
expect preconditions (full HEAD id, an index token, per-file rev, or a
whole-tree revision, all read from GET /v1/git). When the repository
changed since the client read it, the write does nothing and answers 409
git_state_changed with the current state, so a Review sheet can no
longer stage bytes, discard edits or commit an index the user never saw.
Requests without expect behave as before. Path writes now use literal
pathspecs, as the docs already said, and files[].path is
workspace-relative in a subdirectory workspace. Guards cover executable
mode, submodule HEAD and changes outside that workspace; oversized or
budget-limited stat-only revisions cannot authorize a guarded write.
Status stays best-effort: unreadable paths, symlinked ancestors, special
files and broken nested repositories withhold only affected row tokens
and the whole-tree revision. Normal Git filters and untracked settings
apply, with directory inventories scoped to the rows or paths that need
them. Untracked workspace files and renames leaving the workspace remain
visible, and broken HEADs cannot satisfy an unborn-HEAD guard
(#6647).
- Runtime API:
POST /v1/threads/{id}/fork-at-turn forks a thread at a named
user turn, keeping that turn and every turn before it. The receipt matches
/undo and returns the first dropped prompt so a client can put it back in
the composer. Naming the turn replaces a client-computed depth, which could
fork the wrong prefix. The fork leaves the workspace and any running turn
untouched
(#6580, thanks @gaord).
- Official model routing:
/router (also /model router) sets up the Auto
router with presets: Jev (TypeSafe's decision model, via OpenRouter or a
TypeSafe key), your provider's fast tier, Off, or Custom. Jev and Fast each
make one test call before you save, the Turn Inspector (Ctrl+Alt+O or
/turn inspect) shows the router's choice, cost and latency, and a failing
router is shown as failing
(#6525).
- ChatGPT sign-in uses Codewhale-owned protected credentials and a model roster
fetched for the signed-in account. Account, workspace and issuer changes
cannot reuse another roster; a missing or stale roster offers no models.
Authentication failures and subscription limits do not silently fall back
to a paid API route.
- Code mode composes MCP and plugin tools and is on by default:
execute_tools programs can call MCP tools, and each nested call passes the
same approval gate as a direct call, pausing the program for approval when
needed. Every nested call keeps its receipt, including calls that finish
before a deadline, and [features] code_mode = false stops offering
execute_tools up front (it stays reachable through tool search).
codewhale mcp list
and codewhale doctor warn when a user MCP server duplicates the built-in
Computer Use bundle
(#6562,
#6509).
- Tsubasa is a bundled OpenAI-compatible provider row: base
https://api.tsubasa.sh/v1, key TSUBASA_API_KEY, model tsubasa-pro
(also tsubasa-fast). Its window is 32,768 tokens; set
providers.tsubasa.context_window to match
(#6695, thanks @cenab).
Changed
- The pinned prompt header follows the turn at the top of the viewport,
handing over to the previous prompt as you scroll, and clicking it jumps back
to the message it names
(#6830, thanks @SparkofSpike).
- On Windows, every PowerShell command the shell tool starts now passes
-ExecutionPolicy Bypass for that process only, so a local Restricted or
AllSigned policy no longer blocks multi-line commands. (.ps1 script tools
still start as powershell -File without the flag and remain subject to the
local policy.) A policy set by
Group Policy still wins and the command is refused with PowerShell's own
message. Scripts that a command invokes run under the same process-scoped
setting. To let the machine or user policy apply instead, start Codewhale
with CODEWHALE_POWERSHELL_EXECUTION_POLICY=inherit: it then omits
-ExecutionPolicy, so a Restricted or AllSigned policy refuses the
multi-line commands that need a temporary script; any other value keeps
the default. Not verified on a native Windows machine
(#6745).
- The website's not-found page now uses the Codwhale poster and typo joke,
with English/Chinese recovery links to home and docs
(#6419,
#6420).
- Script tools can no longer approve themselves or replace built-in tools
(founder decision D4). A # approval: auto line in a script under
~/.codewhale/tools (or [tools].plugin_dir) is ignored: the tool follows
the session's approval setting like a script with no approval: line, and
the runtime log and /plugin tools name each script that still declares it.
A [tools.overrides] entry of type = "script" or type = "command" keyed
by a built-in tool name is refused, and the built-in stays active; a status
line names the key once per session, and the runtime log records it. type = "disabled" still turns a
built-in off, and script or command overrides under a new name still work.
To keep a wrapper such as an audited shell, disable the built-in and give
the wrapper its own name
(configuration).
- Complete the session slash-command group’s shared command boundary, including
/structcopy, so all seventeen commands can compile independently of the TUI.
Host operations remain behind capability interfaces; command behavior and
upstream tool-execution identity safeguards are preserved
(#6792,
#6145).
- The declared minimum Rust version is now 1.89. It said 1.88, which could not
build Codewhale: a locked dependency (serde-saphyr) needs 1.89, the version
CI's minimum-version job builds. The install guides and the npm wrapper's
build-from-source hints now say 1.89 too.
- A deferred tool's first call now runs when its arguments already carry every
required field and no field the schema does not declare, instead of costing a
retry turn. Malformed calls still get the schema, and approvals, deny lists
and Plan mode apply first. Argument types are still checked by the tool
itself. Sub-agents preload tools named in allowed_tools
(#6494,
#6437).
- Automatic Git status and review reads need Git 2.31 or newer, because they pin
Git's runtime configuration overrides. With an older Git they refuse with
"upgrade Git (2.31 or newer)". This covers the read-only Git tools
(git_status, git_diff, git_log, git_show, git_blame, verify); Git
writes you ask for keep their existing behavior
(docs/dependency-maintenance.md).
Fixed
- A failure Codewhale can name is no longer labelled an internal fault. An HTTP
400/405/409/413/422 rejection, an out-of-credits 402, the context-budget stop
and a turn's own step or wall-clock ceiling now carry an input or budget
label, and a bare ERROR from a provider is reported as an unreadable error
instead of a warning. Refs #6843.
- A transient upstream failure reported as an error frame inside a successful
response is retried within the stream retry budget. When the budget is spent
the turn fails once with an error card instead of an amber warning that
promised a retry. Refs #6795.
- Diff lines and tool output wrap at grapheme boundaries, so emoji families,
skin tones and variation selectors no longer split across lines
(#6829, thanks @Lstarsky0).
- Twelve translated packs now translate the context inspector's making-room
and anchors rows, the Ctrl+O hint and the /turn inspect and /advisor
descriptions instead of showing English
(#6831, thanks @Lstarsky0).
- Optional MCP servers can be found before they connect.
tool_search matches
the query against configured, enabled server names (or an mcp__
prefix), connects up to eight matches within the existing boot wait, and
returns their real tool schemas. Before, a lazily started server exposed no
tools, so the model could never trigger its connection
(#6828). Known limit: a
query that names neither the server nor mcp does not wake it.
codewhale mcp connect, validate and tools run their own connection and
do not attach to a running session.
/undo and /restore refuse while a turn is running in the workspace,
instead of rewriting files under it.
--resume after a crash recovers that session's interrupted turn from
its crash checkpoint, as --continue does.
/resume keeps an imported session on the current provider route
instead of a default one.
- When the stall watchdog recovers a turn, the Engine's turn is ended too, so
the next message is accepted
(#6800).
- A turn you cancel, or one the stall watchdog recovers, releases input at once.
A message still waiting to reach the engine is abandoned and its unsent text
returns to the composer, instead of holding input for up to 60 seconds
(#6800).
- A transient upstream failure that a gateway reports as an error frame inside
a successful response ("Provider returned an empty response") is retried
under the stream retry budget when nothing had streamed; authentication and
invalid-model frames still fail at once
(#6795).
- Long sessions no longer start every turn late. Once a workspace held more
than 50 undo snapshots (around the sixteenth turn), each new snapshot rebuilt
the whole snapshot history before the provider request, about 2.8 s per turn
in a small workspace. Old snapshots are now dropped half a window at a time.
- Resuming a crashed session from inside the TUI recovers its interrupted
turn too.
- Release builds compile on Rust 1.99.
- TUI undo and retry rewind the Engine conversation and saved session before
replacement inference. If the conversation or its settings change while
undo is being prepared, it refuses without overwriting that newer state or
changing the draft. Retained compaction summaries survive the rewind and
cannot be selected as editable user prompts
(#6788).
/edit replaces the exchange it revises through the same rollback: the old
prompt and its answer leave the transcript, the model's context and the
saved session before the edited prompt is sent.
- When the rollback that
/edit needs is refused, your revised text goes back
to the composer with edit mode still on, instead of being dropped. Opening
/edit while you are editing a queued follow-up returns that follow-up to the
queue first.
- A session can still be resumed by its id when a stray copy of its file sits
in the sessions directory; before, the id was reported as ambiguous.
- Agents follow the Permissions you choose while they run: switching to
Full Access reaches an agent that is already working, instead of leaving
it with the Auto-Review guardian that denied it. Tightening reaches it too.
An agent's answer to an approval prompt is delivered while the main
session is busy, and a forced delete inside the workspace is no longer
treated as a catastrophic system delete. On Linux, Full Access switched on
at runtime cannot lift the kernel no-new-privileges flag set at startup,
so sudo and setuid helpers still fail; start with
sandbox_mode = "danger-full-access" or CODEWHALE_NO_NEW_PRIVS=0 if
agents need them (#6787).
- Stream limits and transport settings share a typed
[stream] configuration
table, including retry budgets, TCP keepalive and HTTP/2 keepalive. Explicit
values take precedence over legacy [tui] aliases; omitted values preserve
existing defaults and environment behavior. A configured HTTP/1 pin stays
pinned during recovery. /config stream_chunk_timeout_secs ... --save
updates the canonical setting so it survives reopening a configuration
that already had a timeout. Transport changes apply when a client is built
(#6700).
- Switching providers keeps a model set only in the root
default_text_model
with the provider it belongs to. Switching away and back (/provider in the
TUI, or the desktop app's model chip) used to land on the provider's catalog
default such as gpt-5.6, and a pass-through provider switched to in between
inherited the other provider's model, or a stale legacy root model that the
root default had been shadowing
(#6693).
- A turn no longer stops after an hour of work. The cumulative per-turn wall
clock is unlimited by default, like model steps; set
[tui].turn_wall_clock_secs to cap it.
- OpenRouter turns are priced again instead of always showing "rate
unavailable". The model-list refresh no longer fails as a whole on one bad
row: ~ "latest" aliases are dropped, routers that publish a -1
variable price are listed without a rate, and other malformed rows are
skipped and counted. Main interactive turns now honor a [[custom_models]]
rate the same way background work does, a declaration without rates no
longer hides the catalog price, and an explicit declared rate prices a
vendor-pinned OpenRouter route
(#6690).
codewhale exec can take prompts past the OS argument limit (~128 KiB on
Linux, where larger prompts failed with Argument list too long before
Codewhale started): --prompt-file reads the prompt from a file, and
--prompt-file - reads it from stdin; a positional - stays literal text
(#6688).
- Keep reasoning effort labels, including
xhigh and ultra, visible beside
short model names in the 80-column terminal footer.
- First-run TUI startup keeps explicitly configured providers, models and
endpoints (including environment overrides and a legacy top-level
base_url), even with a missing key, instead of adopting a detected local
Ollama model. The default_text_model line written into the generated
first-launch config is not treated as a choice, so starting Ollama after the
first launch is still detected. Usable configured routes skip the provider
picker and record the provider step as configured, without claiming a
successful check; missing-key recovery focuses the configured provider even
on a fresh home. Switching from that recovery picker (or after Esc) to a
provider that has its key clears the launch "needs a key" state, so the
footer names the route instead of "model not connected" and a detected local
Ollama can no longer take over the provider just chosen. Empty sessions no
longer show a full context window from the startup prompt; a submitted first
turn or reported usage still shows real pressure.
/trust on|off changes file-tool trust for this session. Add --save to
persist workspace trust for project skills, commands, hooks, MCP servers,
and project context. Skipped-skill notices stay out of conversation titles
and user bubbles, and trust changes append a correction to the model's history.
- Stored-secret cleanup skips busy Runtime stores and reports unreadable paths
while continuing through other files. Configured storage roots may be symlinks;
discovered symlinks are not followed. Cleanup also masks current configured
credentials, and doctor's bounded scan reserves capacity for saved transcripts
and checkpoints separately from Runtime receipts.
- Hooks:
tool_call_after and on_error now get a shell command's exit code
in DEEPSEEK_TOOL_EXIT_CODE on Runtime API threads as well as in the TUI,
and for a failing command as well as a passing one, so exit_code
conditions match. The Runtime API path passed no exit code at all, and a
command that exited nonzero, timed out, or was killed reached hooks with no
exit code on either surface. The new DEEPSEEK_TOOL_STATUS says how the
command ended (completed, failed, timed_out, killed)
(#6582).
- Scrolling a long transcript repaints the reasoning reveal hint in place
instead of rebuilding the transcript tail. Wheel and scrollbar input use
interactive frame pacing, collapsed tool groups reuse cached summaries, and
height-only resizes keep wrapped history. Width changes still rewrap content,
and other per-frame work still grows with session length
(#6652).
- A settled transcript frame reuses its existing render plan instead of
rebuilding or moving unchanged history on every poll. New output, selection,
resize and other real changes still invalidate the affected work
(#6652).
- Workflow progress rows and working, verification and translation indicators
use the pinned Codewhale terminal component kit. Quiet and reduced-motion
working/verification indicators hold its semantic current-work mark. Working
and verification keep their existing delay and cadence, while translation
uses the same earned marker and five-frame-per-second cadence. The Engine
still supplies workflow state, clocks, localized text, custom themes and
terminal adaptation. The composer, transcript viewports, dock tabs,
posture/metrics rows, pending-input cards, approval band, Ocean background
and the whale's Braille raster now also render through the pinned kit.
- Calm transcript previews keep the latest three rows of live thought and a
single duration header when it settles. Successful tool headers are quieter;
failed generic and MCP calls keep a bounded head-and-tail excerpt, with full
output available in details. Existing collapsed groups show their hidden
count and reveal cue, and explicit thought expansion stays available.
- Composer history preserves multiline entries and literal quoted text while
retaining the old history file during migration. An oversized message stays
in the composer if its paste file cannot be saved, with a localized notice;
mouse placement and quoted file mentions handle multibyte text and spaces
(#6776).
- The notice for an oversized message that cannot be saved as a paste file is
now a short line that fits the footer ("Not sent: over N characters; paste
file not saved."), in every supported language. The full reason, including the
write error, goes to the transcript once.
- Model-facing guidance names callable tools and explains discovery before a
deferred read. The stopship workflow's scout activates the deferred
grep_files with one required tool_search call, then gathers bounded
grep_files evidence from the current workflow source paths
(#6747).
- Simplified and Traditional Chinese permission, provider and session wording
now follows the current behavior. Chinese guides correct hook receipts,
trusted skills, MCP startup and Windows limitations, preserving the
contributor translations and a shared glossary.
- Unknown website locale segments, including dotted missing paths, return a
real 404 with noindex metadata and no home-page canonical URL. The existing
layout guards now have regression coverage across all registered locales
(#6786).
- The terminal caret no longer blinks at the hidden composer while a picker,
settings screen or other view covers it; it returns when the view closes
(#6545).
- On Linux and macOS, a
background: true shell's process group is now
stopped when the TUI dies without cleaning up (SIGKILL, a crash, or the
signal exit path). The shell and the processes it started used to keep
running as orphans. Processes that move to their own process group or
session, staged services you choose to keep, and tty: true background
shells are not covered. Under the bwrap sandbox, the sandboxed command
now also exits when bwrap does
(#6654).
- Idle task workers stop periodically reloading a settled, unchanged empty
queue, and task listings reuse an unchanged store snapshot. New queue writes
and local notifications still wake workers; recent or unreadable metadata and
failed claims keep bounded retries. This reduces repeated disk work when
several TUIs share a data directory without changing task ownership or
cancellation (#6573,
#6728).
- Idle task workers check the queue file's metadata about once a second instead
of five times a second, and no longer reloads the store when nothing changed.
An in-process notification still wakes a worker at once; a
write by another Codewhale process that shares the data directory is noticed
within about a second instead of about 200 ms. A worker with pending work, a
retry deadline or a failed claim keeps the short interval
(#6728,
#6573).
- After five seconds without session activity, the UI loop polls every 250 ms
instead of 48 ms and the automation-panel scan backs off to 15 seconds. After
thirty quiet seconds, the Git probe runs one git status every 15 seconds
instead of the full probe every two seconds, unless the Git panel is showing.
User input and engine events restore the active cadence. This reduces idle
work; it does not remove every cost that grows with session history
(#6728).
- When the task store is busy, the message now names the process that holds its
lock and how long it has held it ("lock held by pid 1234 for 12s"), when that
can be read. A repeated "Task claim unavailable" error is logged once per
episode, then at debug level
(#6573).
- On Windows, Fleet can read a running worker's log while its writer holds the
file open, and task-store contention can still read the lock-holder record.
These paths previously failed because of whole-file sharing and locking.
- File writes, including legacy
File and write_file calls, stop if the
original contents cannot be read; legacy writers also reject non-UTF-8
originals, keeping undo and diffs from recording an empty original file.
- Resuming a session preserves user messages that quote a compaction marker.
- Requirements allow-lists now check unset approval and sandbox defaults,
accept equivalent approval aliases, and lock permission posture when sandbox
modes are constrained so saved Full Access and YOLO cannot bypass them.
- Logout completes xAI OAuth revocation and attempts every credential deletion
before reporting remaining credentials with a non-zero exit status.
- ChatGPT and xAI sign-in now show the account the selected route actually
uses, and sign-in names the account it replaces. /auth chatgpt and
/auth xai-device switch the running session; signing in from a separate
shell requires restarting an already-open session. Subscription-limit errors
name the account that made the request and explain how to switch, without
printing credentials (#6715).
doctor --fix keeps temporary files modified within the last hour.
- Provider streams stop with a clear error if an SSE line exceeds 8 MiB.
- Recursive
rlm_query turns inherit the parent's remaining deadline,
bounded by the existing child budget, including asynchronous lock waits,
startup, model requests and Python evaluation. Expired work is refused before
dispatch; a timeout returns the last response with an incomplete-result error.
Nested code and status receipts accompany the enclosing tool result on success
or failure and survive its session save/reopen. In-flight receipts still need
that result to be handed back before they become durable
(#6511).
- The TUI keeps redrawing while its terminal is unfocused. v0.10.0 held
every frame on focus loss, so on Windows Terminal, macOS and other
terminals a window sitting behind another one looked frozen until you
clicked back into it. Frames are now held only on GTK/VTE terminals, which
replay the damage themselves when they return. That hold was added for the
MATE flicker in #6311
(#6651).
- TUI
/undo now restores only the files the undone tool call or turn
changed, and refuses, changing nothing, when one of them changed since.
Before, it checked out the whole snapshot tree, which also reverted later
edits to other files. It also finds restore points older than the newest
100 snapshots, and a forked session can undo the turns it inherited. It
waits for a post-turn snapshot that is still being written, leaves a
changed symlink or other non-regular path in place (and says so) instead
of refusing the whole undo, and writes nothing to the snapshot store when
it refuses outside trusted mode
(#6644).
- On a fixed model, each Ctrl+T press now moves to a different thinking
tier. Ctrl+T and the /model picker could list tiers the route treats as
the same one — DeepSeek's medium is high, and Z.ai GLM-5.2's low is
high — so some presses changed nothing. They now share one list per
route with one entry per effective tier. Under Auto model routing, Ctrl+T
walks the picker's Auto list instead of a longer private one; the tier is
still settled when the turn is routed, so two neighbouring choices can
land on the same tier. DeepSeek now reports minimal, xhigh and ultra
as the low, high and max it sends, in /status, receipts and
/effort, and Kimi Code K3 no longer offers off, which it always ran as
low (#6650).
- A top-level
base_url or api_key in config.toml now means one thing
everywhere. Every reader used its own rule for which routes inherited it,
which is how a DeepSeek endpoint became the Xiaomi MiMo route's and failed
with DeepSeek's 401. Old files keep working: the keys are read as
[providers.deepseek] (or the vendor whose official host they name), the
next save moves them there with a one-time backup and a one-line note, and
a value that disagrees with its table is left for `codewhale config migrate
--prefer to settle. codewhale config doctor` shows what is in use
(#6394).
- Setting up a bundled OpenAI-compatible host from
/provider now shows
that host's key console, docs link and guidance on the setup form, the same
way the built-in providers' key entry does; before, the descriptor file
carried them and nothing read them. AICraft gains all three
(#6616, thanks @BX166).
- Runtime API undo now restores the files of the turns it undoes, for every
kind of thread. Before, a new thread's turns were not linked to their
workspace snapshots, so patch-undo returned 201 and rewound the
conversation but left the files changed, and file-revert refused. Each
turn record now lists its snapshots in workspace_snapshots, the engine runs
under the thread's own id across restarts, and a fork owns the turns it
inherited. patch-undo restores only the files the undone turns changed,
including every write in a turn, and leaves later edits by the user or
another thread alone. Every tool call that may write is bounded by its own
snapshots, so a file another thread or an editor changed while the turn ran
is never reverted as the turn's, and a turn's restore points survive the
snapshot count cap. When it cannot restore files (including a write to a
gitignored path) it now refuses with 409 and an error.code instead of
returning 201. A nameless PUT /v1/sessions updates the document the
thread is bound to
(#6621).
- A Runtime thread that is not bound to a saved session keeps one engine
session id, its own thread id, across its first turn, eviction and
restarts. Before, each engine spawn generated a new id, so the thread's
tool-output spills, snapshot tags and shell jobs were scattered across a
different sessions// per spawn
(#6659).
- Saved sessions no longer go orphaned, and existing orphans are repaired at
launch. Deleting a session now sets aside the Runtime store it was actually
bound to, and switching a conversation to another host's store sets aside the
store it left, unless another session still uses that store or it holds
work. Exporting a thread (POST /v1/sessions) updates the thread's own
document instead of creating a new one each time. A thread whose document was
appended to elsewhere keeps loading. A thread whose document was deleted or
rewritten loads from its own turns instead of failing, and threads write
their files under the session they belong to. Each launch and `codewhale
serve` repairs the store in the background: a store holding threads with no
session gets a "Recovered:" session for each thread, and unreadable
documents, unused empty stores and old files no session names move to
sessions/.set-aside/ with a manifest. Nothing is deleted. codewhale doctor
reports the last repair, and codewhale doctor --repair-sessions [--dry-run]
runs one now. PUT and DELETE /v1/sessions refuse a session that another
Codewhale process has open
(#6144).
- Runtime API: the thread event stream now ends with a typed
stream.end
frame (reason and resume cursor) whenever the server closes it, including
on shutdown, so clients can tell a Runtime error from a dropped connection
and resume from the right event. A replay worker crash no longer ends
history early and skips events without a detectable gap, and the mobile
page resumes from its last event instead of replaying from zero, with stream
statuses in the configured UI language. Cross-origin clients can read the
stream-end and replay-progress capability headers, and the SDK exports
isThreadStreamEnd for TypeScript narrowing.
codewhale exec --auto no longer exits 141 with no output when a child
it writes to, such as a stdio MCP server, closes its pipe early. Headless
exec now ignores SIGPIPE while it runs, as the interactive TUI already did,
and exec ... | head still ends quietly. One-shot codewhale exec no
longer prints DeepSeek's raw <｜｜DSML｜｜ calls> tool-call markup as its
answer: the markup is removed, and an answer that was only a tool call
fails at once with the reason and a pointer to --auto, instead of asking
the model again and blaming an incomplete provider response.
- Resuming a session keeps its "Resumed:" confirmation on screen instead of
replacing it with "Make room automatically: on" when nothing was switched.
- Tool output is no longer cut off where you can't get it back. Search
answers, test runs, git, verifier and web results reach the model whole up
to one budget sized to the model's context window, and anything beyond it
can be read back with retrieve_tool_result, including read-only tools
executed alone or in parallel. Restored raw results use the
active route's same inline budget; existing recovery receipts stay intact.
Tiny budgets use a compact retrieval reference instead of a long artifact
path and instructions; a complete reference is kept even when it alone
exceeds the allowance.
Native search now asks for answers up to 8,192 tokens (was 2,048–4,096)
and waits long enough for
them to arrive, and an answer the provider still cuts short is marked as
cut (#6508).
- The installation page is generated from
docs/INSTALL.md, so the website
and the guide can no longer disagree; broken anchors and unsafe links fail
the build (#6450).
codewhale config set refuses a value of the wrong type for a known setting
(a word for an on/off switch, text for a number, a choice outside the list)
instead of saving it (#6568,
thanks @dajiaohuang).
- Receipts:
/receipts, codewhale receipts [ID|--last] [--format md|json],
and GET /v1/threads/{id}/receipt (plus a per-turn form) list what a session
did, one line per action: files changed with line counts, commands with exit
codes, web and MCP calls, agents, approvals and who gave them, and failures.
They also count what ran without asking and name the posture each turn ran
under, read from the turn's own record. A call Codewhale blocked before it
started (Auto-Review or guardian, a tool policy, a refused sandbox
escalation, invalid input, a missing tool) is listed as blocked, with the
reason, and is not counted as run or as ran without asking. Only
Codewhale's own refusal text counts: an MCP server, a fetched page, or a
program cannot make a call that ran read as blocked. A terminal
session's receipt also lists the files a command changed in each turn,
from the workspace snapshots taken before and after it (not ignored files
or anything outside the workspace), with control characters in paths
escaped so a file name cannot forge a receipt line. All three read the
records Codewhale already keeps and say what those records do not hold
(docs/RECEIPTS.md). audit.log is not that record: it
logs security events, and it logs an approval only when one is requested,
which under Full Access is almost never.
- Approvals now record who decided: you, a session rule, or the posture. An
automatic approval used to be saved exactly like one you gave, and an app
approval that expired was saved as your denial. GET /v1/approvals now
returns decided_by.
- Network audit lines now go to the same
audit.log as every other audit
event ($CODEWHALE_HOME included), and test runs no longer append to your
real one.
- In the terminal UI, Auto-Review verdicts now reach
audit.log, as
/permissions said they did; before, they were written only when
CODEWHALE_TOOL_AUDIT_LOG was set. Headless exec and Runtime API sessions
do not write them yet.
- A turn that stops producing output now reports itself: the turn loop records
its phase and last progress, and an overdue phase surfaces instead of
hanging silently until the stream idle timeout. A delegated agent's final result is
never dropped when the host is busy, so a finished child no longer leaves a
ghost Running row behind (#6184).
- Git commands run by tools never stop to ask for a password, passphrase or
host-key confirmation inside the terminal, and git_fetch has a timeout
(#6184).
- A provider response that ends cleanly with no text and no tool call is
retried before the turn fails, and the failure names how many retries ran
(#6310).
- The context meter, the point where Codewhale makes room, preflight,
/context and turn receipts show one pressure number instead of disagreeing
(#6407).
- When Codewhale makes room, the note it leaves for the next turn is written in
its own words, under fixed headings: the objective, the user's corrections,
permissions and limits, changed files, what is still running and the checks
left. A message that quotes the note's opening words now stays in the
conversation instead of being dropped. If the summary request itself is too
large, older history is dropped but the previous note is kept, and making
room stops rather than write a new note without it.
- Continuing a conversation that is already open no longer adds a second
thread, and a fork keeps its own session file, so autosave on one side no
longer leaves the other unloadable
(#6406, thanks @gaord).
- Upgrading Codewhale no longer turns off the built-in Computer Use. Each build
writes the built-in bundle to its own directory, so an upgrade used to present
it as never reviewed and disabled. Now the review and enablement carry to the
new build when its capabilities are unchanged. Changed capabilities show
capabilities-changed and wait for review, and a revoked trust never carries
(#6303).
- "Allow for this conversation" records a grant for that tool and argument
class instead of switching the whole thread to Full Access, so the call you
just approved is no longer failed by a Permissions change. An approval
also survives a Permissions change that only widens what is allowed, grants
end when a thread is archived or deleted, and web.run open grants are
scoped by host. Full Access covers MCP tools that declare themselves destructive in
every host, including codewhale exec
(#3866).
web.run retries a refused page once with a browser user agent, and one
site's failure no longer fails the whole call or drops its search results.
- Web search no longer stops when DuckDuckGo cannot be reached. After a
connection error, timeout or non-2xx answer, the search tries Bing before
giving up, and the result says it used Bing. A DuckDuckGo that hangs no longer
uses up the whole time budget: when Bing may follow, DuckDuckGo gets 60% of it
and Bing the rest. This also covers the DuckDuckGo step after a configured API
provider. A custom search_base_url still has no public fallback and keeps
the full budget. Bing sees the query only after DuckDuckGo has failed or
returned nothing it could read
(#6746).
- Hooks treat
bash, Bash and exec_shell as one tool in tool_name
conditions, so the documented example fires.
- macOS no longer reports Codewhale's ordinary heap as GPU (IOAccelerator)
memory.
- Code highlighting uses less memory, and long transcripts, the pager and the
session picker do less work on the event loop; session previews load in the
background (#6014).
- The composer's send cue follows the draft, not a paste in progress
(#6397).
- Voice status is localized, ASCII-mode markers are distinct, and the cursor
honours NO_COLOR (#5846).
/cache, /stash, /config, session prune, metrics --since and the
lane start/lane stop --json flags handle their edge cases.
- Plain
codewhale exec (no --auto) runs one Engine turn with the same
system prompt as every other run, so --json no longer changes the model's
instructions. It offers no tools unless a flag grants them (--auto,
--yolo, --allowed-tools, or resuming a session): --max-turns,
--disallowed-tools, --append-system-prompt, --sandbox and
--output-format stream-json no longer turn a chat call into a tool-using
agent, and tool-only flags passed without a grant print a warning. A reply
cut off at the provider's output limit is continued instead of failing the
run, for at most 8 model steps unless --max-turns sets another limit.
Breaking for scripts: the --json one-shot receipt no longer has
stop_reason, adds the agent receipt's fields (prompt, tools,
outcomes, status, termination_reason, error_category), and leaves
out usage when the turn never settled
(#6510).
codewhale review of a plain diff uses the same review prompt as
review --pr and prints the structured review as Markdown, or the model's
prose when it ignores the JSON format
(#6510).
- A recursive
rlm_query that runs out of rounds returns its last answer
marked [rlm_query incomplete: …] instead of an empty string, its model
calls appear in the parent turn's record, and its history is no longer
trimmed (#6511).
- Starting without a network connection no longer drops images you attach to a
model that accepts them. The offline model list lagged behind providers and
listed Claude and others as text-only; it can now only say a model takes
images, never that it refuses them, and a provider that does refuse gets one
resend without the image and a message saying so
(#6396).
- Model prices that a flat rate would get wrong now show as unknown after the
model list refreshes online, as they already did offline: DeepSeek (priced by
time of day, or from Codewhale's reviewed table on hosted providers), Grok and MiniMax M3 (rates rise on long prompts), Xiaomi MiMo
(pay-as-you-go and Token Plan keys look the same), GLM-5.3 and the Alibaba
Model Studio plans (quota or credits, not per-token) and StepFun. DeepSeek's output limit stays at its
published 384K instead of the refreshed 393,216, and the reasoning controls
Codewhale records for Grok, MiniMax, Qwen 3.8 Max, Muse Spark and Step 3.5
(defaults, always-on thinking, extra effort tiers) survive the refresh.
Committed corrections now fail at load if their provider or model is missing
from the bundled seed; partial live refreshes may still omit those rows
(#6396).
- The offline model list is now generated from Models.dev instead of edited by
hand, so a fresh install without network sees the same limits, image
support and reasoning controls as an online one. Claude, GPT-5.5, Kimi and
several OpenRouter models now show image input offline, and a model whose
catalog row offers an on/off switch next to its effort tiers keeps Off in
/effort and Ctrl+T instead of rounding it up
(#6396,
#6612).
- Cost estimates for GPT-5.6 and GPT-5.6 Sol use OpenAI's current rates of
$4 input, $0.40 cached input and $20 output per million tokens. They were
still at the older $5, $0.50 and $30
(#6396).
codewhale integrations dsh now reads current DeepSeek Harness prerelease
versions such as 0.1.7-alpha.2 as semver. They were reported as offline
and refused; they now show as stale-version (launchable once connected,
clearly unverified). Only 0.1.0-rc.6 is still the verified version, and text
that is not a version is still offline.
- Rule and chain-segment source labels in the project instructions the model
receives (<project_rule source=...> and the scoped-instructions comments)
are repo-relative instead of absolute. Moving or recasing a checkout no longer
changes the pinned system prompt prefix or adds a spurious context update
(#6739, thanks @asto18089).
Security
- On Windows, a broad Node kill (
Stop-Process -Name node,
Get-Process node | Stop-Process, taskkill /IM node.exe, and wrapped,
aliased or nested-shell forms) is held by a built-in safety floor: it is
refused in Full Access, Auto-Review and Never, and asks in other modes. With
the npm launcher such a command ended this and every other npm-launched
Codewhale session without cleanup. Stopping a server by PID or port still
works, and the Windows installer and archives have no Node launcher
(#6827, thanks @jayanthvee).
code_execution and js_execution now start their Python and Node
interpreters through the same permission-aware launcher as other commands, so
the session's execution policy applies to them. Before, an approved call ran
the interpreter directly, and its working directory was the only boundary
(#6820, thanks @Guan0923).
- A saved task without an
auto_approve field is no longer treated as
auto-approved. Updates accept HTTPS URLs only from the release-host
allow-list, and the npm release-asset check bounds every request.
- Workspace profile and skill discovery, pasted-image and screenshot writes,
configuration redaction receipts and legacy configuration migration reject
linked paths where they could redirect access outside their intended roots.
Additional .codewhale writers use the existing confined filesystem helpers.
The VS Code file opener checks the file's real path, and PowerShell temporary
scripts receive unpredictable names and owner-only permissions.
- Update development tooling to Undici 7.29.1 or newer for
GHSA-w293-vg96-wgc3,
brace-expansion 1.1.21/5.0.12 for
GHSA-q2hr-2g5m-vwhr,
and the VS Code extension's markdown-it to 14.3.2 for
GHSA-253c-mchw-3w2r.
- Harden local runtime browser sessions, fleet SSH trust, agent continuation
ownership, task gate approval, plugin tool registration, bridge action tokens,
and release metadata credential forwarding. Browser sessions recover across
reloads and new tabs, and stream tickets retry after transient failures.
Fleet SSH known-host checks support OpenSSH 7.x and later. SSH host configs
using host_key_fingerprint must migrate to known_hosts with verified host
keys; the unsupported fingerprint field is now refused when an SSH worker
starts, before any connection is made, instead of being silently ignored.
- Harden workspace instruction, note, and anchor file access with shared
no-follow reads and writes. Compaction loads pinned anchors only from
trusted workspaces. Validate registry skill names before selecting cache paths.
- Tighten approval, execution and endpoint boundaries. Computer control
consent and script calls need an exact decision a person gave on that call's
own approval card. Automatic Git status and review reads go through the
sanitized review command and stay pinned to the checked Git executable.
Config backups, config dumps, MCP listings and notification payloads share
one sensitive-key vocabulary; structured exports now also redact keys ending
in key. Python a child model writes during a recursive rlm call is
admitted round by round like an inline repl block, and Python kernels are
discarded when permissions narrow. Gate commands and the cargo test runner
start inside the session's shell sandbox. Mutable session artifacts are
written and read through pinned session-relative paths. The stdio bridge's
Runtime child chooses and reports its own loopback port.
- Chat bridges (Feishu, Telegram, WeCom, Weixin) accept an approval decision
only from the person who started that turn, for the Runtime's current
pending approval. After upgrading, approvals for turns that were already
running are decided from the TUI, and WeCom /allow no longer takes
remember.
- More file and network paths are confined. A task or automation created by a
session without full shell access no longer inherits the host's shell default.
The commit planner, oversized-paste backup and project harness notes do not
read or write through links that leave the workspace. On Unix, audit and
approval logs are created owner-only and are not opened through a link;
Windows is unchanged. Lane ids must be plain names. A session file is refused
when it records a different session id than its name. The updater does not
follow a redirect from HTTPS to plain HTTP and stops reading a response larger
than 512 MB.
- Nothing is written through a
.codewhale that is a link. The workflow run
journal no longer creates .codewhale/ or its ledger when it is opened, only
when the first record is written, and reads and appends through the same
confined helpers as other state. The sub-agent coordination lock refuses a
linked .codewhale or state directory before it creates anything.
- On Unix, the runtime log is created owner-only and is not opened through a
link; an existing log from an earlier version is tightened. The
.reconcile.lock and current.json.lock lock files are created owner-only
too.
- Inline
repl
code_execution tool. They never run in Plan mode or when
code_execution is not on the turn's tool surface, and they are admitted
like a code_execution call with the same code: before-tool hooks,
disallowed-tool rules, Auto-Review (including its reviewer) and repository
law all apply, then the same approval under the session's permission
posture (a blocked, denied or unanswerable call skips them with a visible
note). Only a fence that opens its own line counts, here and in the rlm
tool's child rounds, so a reply that mentions a fence in prose runs nothing.
An rlm(...) call from a fence gets a one-shot child answer rather than a
child that runs its own code. The docs no longer describe the REPL kernel
as sandboxed.
codewhale serve --mcp now exposes only read-only tools by default
(file_read, search). Tools that write files or run commands are
neither listed nor run unless the operator sets require_approval = false
in the MCP server config; a client's own approved flag no longer counts
as approval. At startup the server names on stderr each configured tool it
withholds and the setting that allows it.
- A
Bash entry in the disallowed tools now also blocks start_mcp_server
and start_registry_mcp_server, which launch local processes.
- An MCP tool call whose connection closes before it answers is no longer
sent again on a new connection, since the server may already have run it.
The same holds for a server error reply that mentions an expired or invalid
session. The call reports an unknown outcome and the next call reconnects.
Only a call the HTTP transport turned away for a stale session, before the
server handled it, is still retried once.
- Durable tasks and scheduled automations created by the agent no longer
carry more authority than the session that created them: requested
auto_approve, trust_mode and allow_shell are capped at what that
session holds, a task's workspace and an automation's directories must be
reachable from the session, and a task's turn runs under the posture pinned
when it was created instead of re-deriving one from the legacy bit or a
legacy mode alias.
- The approval card for creating a task or creating/updating an automation
now lists the requested trust mode, shell, auto-approve, mode and
workspace as labeled lines.
- "Approve for session" on a shell command now covers only a simple, known
command family (git status still covers git status -s). Compound,
wrapper, interpreter, unrecognised and option-configured commands are
granted as the exact command, and interact/wait calls on a running shell as
the exact call.
- Workflow plan approval flags shell, network and file-write capability for
the Bash, Web and File tool families regardless of letter case.
- An agent session can no longer update, resume or run an automation whose
stored auto_approve, trust_mode or allow_shell is more than the
session holds, unless the same update lowers those fields.
- The approval summary every Runtime client receives for task and
automation create/update now names the requested trust mode, shell,
auto-approve, mode and workspace, from the same fields the TUI card shows.
- A shell session grant keeps its command family only when every option is a
known value-free option such as --release or --porcelain; other options,
in any spelling, grant the exact command. Families whose arguments are what
runs or is installed (go run, deno run, cargo run, make,
git bisect, git submodule, package installs) grant the exact command.
- Workflow plan approval recognises tool names in any quote style and with a
pattern suffix ('Web', File Web(*)), and flags rlm, Git and
GitHub, computer and browser control, and task/automation tools with the
capabilities they carry.
- Model-run code no longer inherits provider credentials or other secrets
from Codewhale's environment. Python code_execution (and every other
Python runner), gate_run task gates, custom and completion verifier gates,
persistent terminal sessions, and run_tests now start from the same
scrubbed child environment as exec_shell; variables a gate declares are
still passed through. gate_run also runs /bin/sh -c instead of a login
shell, so profile files cannot re-export what was removed.
- A
workflow start with verify: true now needs approval even for a
read-only plan, because the completion gates run workspace build and test
scripts.
- Git commands no longer hand provider credentials to programs that a
workspace's git config can start (core.fsmonitor, hooks, filters) when
they run through Codewhale's shared git helper: those start from the scrubbed
environment plus the ssh agent, global config location and author identity.
Sub-agent worktree provisioning and delivery do not use it yet. The read-only git_status,
git_diff, history and verify tools also disable the workspace's
fsmonitor, hooks and clean/process filters.
- Language servers started for post-edit diagnostics, and every Python and
Node command constructor, start from the scrubbed child environment.
- Proxy URLs passed to model-run children (
HTTP_PROXY, HTTPS_PROXY,
ALL_PROXY, FTP_PROXY, CARGO_HTTP_PROXY) keep their host and port but
lose any user:password@ part.
- Behaviour change: the scrubbed child environment now keeps non-secret build
configuration — CARGO_* (except registry and token-like keys),
RUSTFLAGS, RUST_LOG, RUST_BACKTRACE, VIRTUAL_ENV, JAVA_HOME, Go
paths, NVM_*/NODE_OPTIONS and CA-bundle variables — so run_tests and
gates keep the user's target dir, job limit and toolchain. Connection
strings such as DATABASE_URL are still dropped; set them in the project's
own config, or wrap the command in a script that sets them, when a build
needs them.
- Deny rules in the permission settings now hold for these ways of hiding a
command word until the shell runs it: a variable ($v), a substitution, a
glob or brace list, escaped ANSI-C quoting, or a shell reading its script
from a pipe, here-string or process
substitution. Rules in a separate execpolicy.toml file are applied when
the command runs, so there such a command is refused at run time rather than
before an approval prompt. While any deny rule is configured in the permission
settings, such a command is refused instead of being checked against text
the shell will rewrite (an
approval-always policy asks instead). This also applies to common forms such
as source "$HOME/.cargo/env", eval "$(pyenv init -)" and `$PYTHON -m
pytest`; name the command directly to run it. The same holds when the text
does not parse cleanly (an unterminated quote, substitution or heredoc, a
case inside $( … )) or when a parse budget runs out. Commands after
if, then, while, do, ! and similar words, function f { … }
bodies, and find -exec payloads are now checked like any other command.
- Wrapper commands are unwrapped by their real option grammar, so
chroot DIR cmd, sudo --user NAME cmd and timeout -s SIG N cmd expose
cmd (and any -c payload) to deny rules. Options missing from a wrapper's
table are read both with and without a value, BSD and macOS options are
covered (env -P, xargs -J, chroot -u), and more wrappers are recognized
(caffeinate, arch, sandbox-exec, nsenter, unshare, runuser,
flock, watch, wsl, noglob, nocorrect), including .exe spellings.
Code passed as a string to trap, su -c, flock -c, script -c,
watch, cmd /c and PowerShell -Command is checked as a command line.
(( … )) arithmetic no longer reads << as a heredoc that hides the lines
after it, and an xargs or find -exec replacement string used as the
command or as shell code (xargs -I{} sh -c {}) counts as known only at run
time.
task_shell_start and task gate commands are now checked against shell deny
and ask rules, like any other shell command.
- An "approve for session" grant for a shell command covers only flag variants
of that command as written; a command with options before the subcommand,
a chain, or nested code matches only an identical repeat.
- The read-only shell surface for sub-agents rejects a word that starts with
an unquoted *, whose matches could be read as options; quote the pattern
or give it a path prefix (src/*.rs).
- A trusted or allow prefix such as
git status no longer covers options
placed before the subcommand (git -c key=value status,
git --exec-path=… status), nor a command that runs nested code or whose
command word is resolved at run time. Such commands ask instead. Typed deny
rules also match a path-qualified command word (/bin/rm).
- Commands containing parentheses are no longer auto-approved as parallel
read-only commands, since some shells treat them as glob qualifiers or
command substitution.
- Sub-agent worktrees stay under the per-repo
.codewhale-worktrees//
root: an absolute worktree_path is now held to the same containment as a
relative one, with symlinks resolved before the check. Any start that asks
for a worktree keeps the approval card, even for a read-only role. A
worktree_base starting with - is refused, and git worktree add now
receives its path and base after --.
- Fleet and reasoning-router names must be plain file names (optionally
origin/name); a name with path separators or .. is refused before any
file is looked up, through one shared check in the workflow crate.
pandoc_convert and image_ocr apply the same read deny-list and
credential-store checks as read, through one shared helper, and pandoc
always runs with --sandbox. This needs pandoc 2.15 or newer; an older
pandoc gets an upgrade message instead of a conversion.
- Computer Use: screenshot and zoom output paths must be
.png/.jpg/.jpeg
files inside the recordings directory, and zoom always crops the last
captured raster instead of a caller-named source file.
- Skill registry sync refuses an index key that is not a single path-safe
name before it is used as a cache directory, the same check an installed
skill name already gets.
- A project's
.codewhale/config.toml can no longer set notes_path; it is
ignored with the other user-only keys. The note tool and /note refuse a
notes file that is a symlink or whose directory resolves outside the
workspace, and a note is flushed to disk before the tool reports success.
- Diffs and shows that read repository content (
codewhale review, the
git_diff/git_show tools, verification, delivery, task attempt records,
@diff and the runtime API diff routes) share one flag set: no external
diff, no textconv, and submodules compared by commit only, so a submodule's
configured filters and diff drivers never run. Reads of the working tree
(git_diff, git_show, git_blame, commit planning, verification, task
attempt records, @diff/@git) also run through the hardened review
command, so the repository's clean filters do not run either. git_blame
and read-only shell git blame skip textconv, and read-only shell git
reads neutralize the repository's clean filters.
git_fetch refuses refspecs that would write a local branch or tag: a
src:dst destination must be under refs/remotes/, and the two-word
tag form is rejected.
- Opening a URL on Windows goes through the URL protocol handler instead of
cmd /C start, so characters in the URL are not interpreted by the shell.
- Skill downloads and the skills registry index are read through a streaming
size cap shared with the MCP HTTP transport, instead of buffering the whole
body before checking its size.
- Durable runtime thread, turn and item ids carry a full UUID instead of 32
random bits, so two records can no longer collide and overwrite each other.
Removed
- Flags, settings and tool parameters that did nothing are gone
(#6516). --output-mode
is hidden. It is still accepted, prints a warning, and is ignored.
- The dispatcher no longer exports
DEEPSEEK_ copies of its CODEWHALE_
variables. A DEEPSEEK_* variable you set yourself is still read.
lane start and workflow run --runtime vm|ci are rejected before a lane
is created. Older lane records for those runtimes still load.
- The control socket's
relaunch verb is removed; it always returned an
error.
- The
speech tool drops stream. stream=true used to fail; it is now
ignored, a complete audio file is written, and the result no longer carries
"stream": false. The finance tool drops market, and a call that still
passes it has it ignored.
[context].enabled, the seam-manager keys and
tui.terminal_probe_timeout_ms no longer load; old configs that carry
them still start. The [workshop] docs now describe bounded spillover
instead of a synthesis sub-agent.
- About 2,650 lines of workflow code that nothing ran are deleted: the replay
executor, the review-repair loop and experimental search. The
replay_diverged status they produced goes with them. The isolated
Runtime Chat prompt and the legacy YOLO alias list each have one owner now
(#6517).
Experience
- Typing a first message with no model connected leaves a line in the
transcript that says the message was not sent and opens the provider picker.
- First run picks a chat-capable Ollama model instead of the alphabetically
first tag, and says plainly when no model is available yet.
codewhale doctor leads and ends with one verdict and the next step, and
gives the update command for how you actually installed Codewhale.
Command-line usage and errors say codewhale.
- The approval card leads with a plain summary of the action, such as
"Run cargo test", and shows workspace-relative paths. The footer labels
its values.
/status warns when the session's pinned model is no longer in its
provider's live model list
(#6035).
- Error messages give one true sentence and one next step. The TUI's English
copy says agent, Fleet, Permissions and Work consistently, help lists one
summary per row, provider rows without a key say "needs key", /setup says
what it sets up, and the pet tank rests when it is offline.
- ACP clients can see the Permissions setting the server started with,
including Full Access and how to turn it on, but cannot select it
(#6310).
GET /v1/commands tells clients each command's argument shape, so they do
not re-derive composer behaviour from the usage string
(#6230).
Fleet and agents
codewhale fleet run --check runs every validation a real run would
and stops there: nothing is created, launched or spent.
- A queued agent says why it is waiting, for example when launches are
throttled after provider rate limits, and when it stops waiting
(#6277).
- Read-only agents can run chained inspection commands (a leading
cd,
&&, ;, echo separators, 2>/dev/null), and a refused command now
names the rule it broke and what to do instead. Durable Fleet workers
accept the same read-only commands as in-session agents. An agent's time
budget starts when it launches, and a queued agent that never gets a slot
says it never started
(#6015).
- Stopping an agent that writes files keeps and names the work it had
changed, as a budget stop already did
(#5529).
workflow(fleet:) runs Fleets saved from the Fleet UI, and finds
workspace Fleets under .codewhale/fleets.
- The runtime API can stop a delegated agent run from the desktop.
- A finished agent's answer is no longer cut off. Its row and its completion
notification show the first sentence of its result instead of a
## Summary heading or its last tool, and opening the agent shows the whole
result, or the full reason it stopped, even when no transcript was captured.
Each agent also has one name: a workflow task's label or its dispatch name
appears on the rows, the notification and the runtime API alike, never its
internal id (#6565).
- The mobile page shows the thread's agents: a strip naming each one, its
state, and what it is doing or what it found, rebuilt when the page
reconnects. Sub-agent prompt caching now counts toward the session, including
cache-write-only reports. PRICE and /cache show the parent, agents and
combined hit rates, each labelled and weighted by all input tokens,
including cache writes,
and the footer cache N% still means this conversation's own requests
(#6565).
- The dock's GIT, FILES and NOTES views are real. GIT shows the branch and
where it stands against its upstream, the changes (with their paths one
Enter away), linked worktrees and the last five commits, and it keeps
updating during a turn while it is open. It says "not a git repository"
only when that is true, reports failed status probes in the view and composer
instead of claiming a clean tree, counts every unmerged path as a conflict, and only
says there are more changed paths when the list is capped. FILES lists the
files this session edited, including writes without diff receipts, and the
files it read, with every unique path retained beyond the activity summary's
twelve-path preview. FILES and its badge refresh from the current session
even before TASKS opens. Edits with receipts show their size and open their diff.
NOTES lists your /note notes. The git
badge, the Git view and the model's git line now share one
git status --porcelain=v2 call, so there are fewer git processes than
before (#6565).
- Background work tells you when it ends, even between refreshes. Batched
shell notices cover explicitly backgrounded or detached commands; foreground
results and old completions from before this TUI session stay quiet.
Switching sessions does not repeat a completion notice. Batched
notices count completed, failed and stopped work separately; shell commands,
task prompts and errors stay in the app, away from lock-screen notifications.
A running dev server no longer holds the notice back. Failed, killed and
timed-out shells retain their outcomes, and the last eight finished shells
stay listed per session. Finished tasks no longer look live or reopen the
dock. Background labels follow the UI language, long agent previews keep
their full-result pointer, and the quiet indicator uses the engine's clock
and limit without marking an active tool as quiet
(#6565).
Plugins
- Codewhale no longer appends plugin recommendations to your messages to the
model. Suggestions appear in one place, follow one switch and one budget,
and never advertise built-in plugins, generic words or plugins for another
operating system.
/plugin dismissals lists the plugins suggestions skip, and
/plugin dismissals reset [] brings them back.
- Tools from reviewed plugins that declare themselves read-only no longer ask
for approval on every call.
- The bundled Computer Use plugin is 0.12.0, the published upstream release
8435692 (#6303,
#5856). On macOS the agent
uses its own pointer and never drives your cursor. app_script refuses shell
escapes. Clicks on irreversible actions such as
pay, send or delete need confirmation. Consent decisions cannot ride inside
run_actions or trajectory replay, and trajectories redact secure fields.
Also new: a shared-computer control lease that pauses agent input while a
person drives, and a browser attach mode for a shared Chromium. The vendored
README no longer claims delegated agents share the Computer Use session; they
never receive its tools.
- The bundled first-party catalog pins marketplace revision
ae3dd2255a9a266365c6125a084f511eb26bc04d. It lists Computer Use 0.12.0 and
adds Codewhale for Chrome (Chromewhale) 0.3.0 as a developer preview: you
load its Chrome extension unpacked, and like every catalog plugin it installs
disabled and untrusted until you review it.
Release reliability
- Upload the complete release into a private draft, verify every asset's size
and SHA-256 digest, then publish. An interrupted retry cannot reuse stale
same-size bytes. CNB and GHCR version tags follow canonical publication.
- Ubuntu Lighthouse bootstrap requires trusted SSH source CIDRs or an explicit
public-SSH opt-in before changing the host; malformed IPv6 and broad default
networks are refused.
CI
- State-touching command and session tests seal
HOME, USERPROFILE and
CODEWHALE_HOME onto temporary directories. Unsealed session, snapshot,
artifact, composer-history, audit and built-in-plugin storage resolves into
an isolated test root; unrelated worker threads cannot borrow another test's
home seal. A child-process sentinel checks that known command-dispatch and
session cases leave their ambient home unchanged.
- Fork pull requests stay under the macOS runner limit and the Actions cache
stays under its cap.
- Release candidates and releases share one parity gate, and a release tag
without a release-candidate receipt is refused.
- Budget ratchets block same-repository pull requests unless the pull request
updates the budget with a receipt.
- A CodeQL advanced-setup workflow is ready for when the repository switches
from default setup.
Contributors
- @AdityaVG13 — supplied the discovery-cache priority correction adapted from #6393, keeping highest-ranked tools through cache overflow. Its broader echo and fork-inheritance draft remains open.
- @LIghtJUNction — added reviewed plugin-provided AI routes with host-owned OAuth PKCE credentials and request-time authority checks (#6805).
Contributors and issue reporters are credited below, including
@cenab's provider report.
- @Guan0923 — accepted case-insensitive HTTP(S) schemes in
config doctor without rewriting the configured URL (#6819), and routed the Python and JavaScript execution tools through the session's execution policy (#6820).
- @harryvgiunta — added Yolo-Auto as a bundled OpenAI-compatible host, starting on the vendor's recommended
qwen3.8-flash model (#6408).
- @asto18089 — contributed the integrated runtime liveness, context, search, JavaScript execution, stopship scout and pet repairs, preserving their original contributor commits (#6799); made context rule and chain-segment source labels repository-relative (#6739).
- @qiuYliangM — made provider-bound project instruction and constitution labels stable across directory moves and kept their absolute paths in operator reports (#6799).
- @zhuowp — supplied the process-scoped PowerShell execution-policy repair adapted for Codewhale, preserving machine and user Group Policy precedence (#6745).
- @Andrea-Bruno — designed the Superfast Decision Gate and contributed its off-by-default shadow classifier (#6604, #6603).
- @gaord — let a client fork a thread at a named turn (#6580), let undo roll back files for the turn it is undoing (#6483), stopped resume and fork from duplicating threads and sessions (#6406), exposed user-defined provider routes to native clients (#6404), and kept a fork going when a turn lost its tool call (#6664).
- @Lstarsky0 — moved the docs/work, legal, digest and FAQ pages onto the dictionary spine (#6405, #6417, #6499, #6574), tightened the Chinese-branching ceiling to 18 (#6403), and made Fleet publish without a two-link window (#6431). Also moved the constitution page onto the dictionary spine and kept its install link in the selected locale (#6733), wrapped diff and tool output at grapheme boundaries (#6829), and translated the context inspector rows twelve packs still shipped in English (#6831). Translated the session-only note after model switches across the complete TUI locale packs (#6875). Translated the route-save receipts (#6884) and
/workspace replies (#6885), brought the Operate descriptions in fourteen packs up to date (#6886), restored lost accents in pt-BR, es-419 and ca (#6888), let semantic_truncate cut between Han and kana (#6887), and removed the unused session-only route-save choice (#6882).
- @aboimpinto — restored a green Linux full-workspace test gate without loosening any test, twice (#6581, #6666). Completed the seventeen-command portable session group, including
/structcopy (#6793).
- @dajiaohuang —
codewhale config set checks a known setting's value against its schema type before saving it (#6568).
- @jayanthvee — reported and diagnosed that killing the npm launcher's
node.exe ends Windows sessions without cleanup, with reproductions and fix directions (#6827).
- @cenab — requested the Tsubasa provider row and supplied its endpoint, key and model values (#6695).
- @BX166 — reported the AICraft provider row missing its key console, docs link and guidance, and supplied the values (#6616).
- @Water-Run — ingested namespaced model-only catalog entries so models present only in the canonical
models map reach the offering list (#6400), and retired the blanket dead-code allowance with its unused feature stages, tightening the budget to match (#6402).
- @wuisabel-gif — designed the
tool_call_after execution-receipt contract and its tests on a reference branch, which landed re-implemented on the current hook seam (#6689, #6713).
- @SparkofSpike — let making room survive a provider request-body limit (HTTP 413) by shrinking, then replacing, inline images for that one summary pass (#6642). Translated seventeen Tier-2 guides and thirteen developer and internal docs into Simplified Chinese, and connected the localized documentation (#6662, #6663); added regression coverage for rejecting unknown website locales before dictionary lookup (#6786); made the pinned prompt header follow the viewport's turn and jump on click (#6830).
See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.
|
