GitHub: v0.9.2

Codewhale is the public product from Shannon Labs. The codewhale

command, npm package, and release-asset names remain lowercase technical

identifiers. The legacy npm package deepseek-tui is deprecated and

receives no further releases. Users coming from v0.8.x legacy deepseek /

deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui

binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \

  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \

  -v codewhale-home:/home/codewhale/.codewhale \

  ghcr.io/hmbown/codewhale:v0.9.2

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Platform
Archive
Install script




Linux x64
codewhale-linux-x64.tar.gz
install.sh


Linux ARM64
codewhale-linux-arm64.tar.gz
install.sh


Android ARM64 (Termux)
codewhale-android-arm64.tar.gz
install.sh


macOS x64
codewhale-macos-x64.tar.gz
install.sh


macOS ARM
codewhale-macos-arm64.tar.gz
install.sh


Windows x64 (installer)
CodeWhaleSetup.exe
NSIS setup


Windows x64
codewhale-windows-x64.zip
install.bat


Windows x64 (portable)
codewhale-windows-x64-portable.zip
—


Windows ARM64
codewhale-windows-arm64.zip
install.bat


Windows ARM64 (portable)
codewhale-windows-arm64-portable.zip
—

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz

cd codewhale-<platform>

./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.


• Extract the archive for your machine: codewhale-windows-x64.zip or
  
  codewhale-windows-arm64.zip


• Run install.bat (copies to %USERPROFILE%\bin)


• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles

sha256sum -c codewhale-bundles-sha256.txt --ignore-missing



# Linux — individual binaries

sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing



# macOS

shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing

shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.2

This is the Codewhale v0.9.2 source candidate. It is not a published release

until the matching tag, packages, checksums, and release assets exist.

Changed — behavior

• 
  

  Legacy model = auto no longer elects a network classifier on its own.
  
  Holding a DeepSeek API key used to silently select deepseek-v4-flash as the
  
  classifier for every Auto turn — a per-turn cost on a route nobody asked for,
  
  and one provider privileged over the rest. Auto now stays local and free
  
  unless an explicit [auto.router] block names a provider and model.

  
  

  If you relied on the implicit default, restore it explicitly:

  
  

  [auto.router]
  
  provider = "deepseek"
  
  model = "deepseek-v4-flash"

  
  

  [auto.router] remains legacy model = auto configuration. It is unrelated
  
  to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by
  
  name from a Fleet file and decides only how hard an already-frozen route
  
  thinks.

  
  

Landed since v0.9.1, not yet released. A cluster of defects found by a

read-through audit of the policy engine, the MCP proxy, the session index,

and the app-server bridge — several of them cases where the wrong outcome

was reached silently, behind a response or a log line that looked fine. The

release also adds opt-in session, reasoning, localization, and inspectability

surfaces; existing defaults remain stable unless an entry below explicitly

says otherwise.

Added

• 
  

  /permissions now lists the active user permission-rule source, each rule's
  
  effective matcher and global/repository scope, and whether that scope applies
  
  in the current workspace. /permissions remove <number> previews deletion
  
  and requires a snapshot-bound confirmation token, so a concurrent edit
  
  cannot move a different rule under the confirmed index. Appends and removals
  
  share one adjacent lock, preserve unrelated TOML formatting and comments,
  
  atomically replace permissions.toml, and reload the live user ruleset
  
  without clearing session-only approvals. /config ask-rules remains a
  
  compatibility entry; rule creation, glob/directory rules, and deny
  
  persistence remain out of scope ( by , by ).

  
  


• 
  

  /lane [list|status|interrupt|restart|resume] — durable Lane control from the
  
  composer, backed by the same executor codewhale lane … calls. codewhale lane interrupt|restart|resume are the matching CLI verbs; lane stop stays as
  
  a compatibility spelling of lane interrupt. Appending @<lifecycle-seq> to a
  
  lane id fences a write to the exact durable generation you observed, so a
  
  concurrent transition is rejected as a conflict rather than acted on ().

  
  


• 
  

  The bundled skill pack now ships a help skill (catalog generation 7). It is
  
  invocation: explicit-only, so it never enters the model's ambient catalogue
  
  and costs no prompt budget. Its body is a routing card that points at the
  
  surfaces this build actually exposes — /help and /help <command>,
  
  /skills and /skills inspect, /config, doctor, and the docs/ tree
  
  when the workspace is a Codewhale checkout — and explicitly forbids pasting a
  
  command list or settings table into context ().

  
  


• 
  

  Locale-routing coverage for the complete bundled catalog across every shipped
  
  locale (en, ja, zh-Hans, zh-Hant, pt-BR, es-419, vi, ko). No
  
  bundled skill ships a localized routing description and none was invented;
  
  the tested contract is deterministic fallback to the canonical English
  
  description, with the rendered catalogue byte-identical across locales.
  
  Exact-tag match, primary-subtag fallback, and English fallback are covered
  
  against a synthetic authored fixture, and the parity test fails if a bundled
  
  skill ever gains localized metadata without source-backed coverage ().

  
  


• 
  

  Approval cards can now remember eligible safe shell and file-write approvals
  
  as exact allow rules scoped to the current repository. Remembered shell
  
  commands use complete-command matching, validated file and patch paths remain
  
  workspace-relative, and dangerous, critical, or repo-law-held requests stay
  
  ineligible and continue to require review.

  
  


• 
  

  tui.header_items (array of strings, optional, default []): an opt-in
  
  header chip showing cumulative session token usage as input / cache-hit /
  
  output. Set header_items = ["tokens"] under [tui] to enable it. The
  
  chip is the only elidable element of the header — the git label, context
  
  meter, and version stamp keep their space, and narrow terminals drop the
  
  chip rather than the baseline chrome. Unknown entries are warned about and
  
  skipped so configs written by newer builds stay loadable by older ones
  
  (; PR , harvested with
  
  co-authorship).

  
  


• 
  

  thinking_default_expanded lets reasoning blocks start open while keeping
  
  Space as the per-block toggle. The setting is persisted, available through
  
  native and runtime configuration, and documented for SSH/tmux accessibility
  
  (issue by by
  
  ; reported by
  
  .

  
  


• 
  

  Session control now includes a sessions rail, shared archive projection,
  
  picker archive controls, and opt-in interactive auto-resume with explicit
  
  handoff behavior. The work closes the remaining session-browsing direction
  
  from for the original report.

  
  


• 
  

  The bundled contributor-onboarding skill can sync contribution context,
  
  select the appropriate gate, and prepare a digest without inflating the
  
  ambient skill catalog. It follows the contributor-navigation request in
  
  .

  
  


• 
  

  Bahasa Indonesia now has a complete repository documentation suite and a
  
  registered website dictionary alongside the shipped TUI locale (PRs by ).

  
  


• 
  

  Reasoning content can keep its rail, italics, cursor, and expansion controls
  
  while disabling only the warm background highlight. The independent setting
  
  is persisted and localized ().

  
  


• 
  

  StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the
  
  two endpoint/billing routes distinct, and localizes the choice across the
  
  complete packs ().

  
  


• 
  

  OpenCode Zen is a separate model-aware API-key provider. Its curated catalog
  
  selects Responses, Anthropic Messages, or Chat Completions per model;
  
  unsupported Gemini and unknown models fail closed, and missing Zen
  
  credentials never fall through to ChatGPT/Codex OAuth guidance. The
  
  implementation from closed PR (snailoniu) is preserved in
  
  the candidate.

  
  


• 
  

  Markdown exports correlate prompts with stable workspace restore-point ids
  
  and say when correlation is unavailable or ambiguous, completing the
  
  remaining restoration/export direction from .

  
  

Fixed

• 
  

  Permission setup now consistently presents the product postures Ask,
  
  Auto-Review, and Full Access instead of leaking the internal never token.
  
  The same resolved sandbox policy now drives execution and UI receipts: Plan
  
  stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access
  
  is actually unsandboxed unless a stricter effective configuration wins.

  
  


• 
  

  Fleet setup no longer stalls when a user explicitly selects a configured
  
  Codex or Grok external-consent route. The selected route is activated and
  
  validated before saving, roster roles open directly on their Model step,
  
  Review saves on the first Enter, and new profiles default to the personal
  
  profile directory that the roster loads on the next session.

  
  


• 
  

  Provider credential dialogs now share one wrapping, secret-safe API-key
  
  surface across every non-OAuth provider. A key already present in durable
  
  storage is reported as configured without rendering it, typing or pasting is
  
  clearly framed as replacement, narrow help text remains visible, and Codex
  
  and Grok OAuth flows remain token-free in this modal.

  
  


• 
  

  Ctrl+O again opens the complete recorded reasoning detail for the selected,
  
  active, or latest reasoning block. The whole-turn Turn Inspector moved to
  
  Ctrl+Alt+O and /turn inspect, removing the shortcut collision while keeping
  
  raw leaf detail and post-flush reasoning discoverable.

  
  


• 
  

  Failed child agents now deliver a distinct high-priority failure receipt to
  
  their owning parent with a sanitized failure class, elapsed work, and a full
  
  transcript handle. Parent-to-child message, follow-up, and interrupt tools
  
  now use one hierarchy-checked mailbox path, and persisted nested completion
  
  envelopes remain safely restorable across instruction-text revisions.

  
  


• 
  

  Background-shell completion events now carry only bounded tails plus a
  
  retrievable exact-evidence handle. Terminal foreground Bash results are
  
  acknowledged at the direct tool-result boundary and are no longer emitted a
  
  second time as background completion artifacts.

  
  


• 
  

  Providerless Fleet and child-agent fixed-model routes now reject only
  
  high-confidence foreign-provider model ids before creating a worktree, while
  
  explicit provider/model pairs, custom and local endpoints, unknown ids, and
  
  aggregator wire-id resolution retain their intended behavior.

  
  


• 
  

  Manual compaction now preserves and reports the supplied provider failure
  
  class instead of replacing it with an opaque generic error. This does not
  
  infer quota exhaustion when the recorded failure does not prove it.

  
  


• 
  

  The ambient jellyfish keep complete, readable silhouettes while animating,
  
  and the website favicon now uses the Signal Current desktop tile instead of
  
  the legacy whale mark.

  
  


• 
  

  ACP JSON-RPC responses preserve numeric request ids for avante.nvim while
  
  retaining the negotiated string-id exception for Zed (PR ).

  
  


• 
  

  Restored shell cells whose job no longer exists stop displaying live
  
  spinners and settle into a truthful stale/no-output state across transcript,
  
  phase strip, and sidebar (PR , closing by
  
  by ). Context-menu hover hit-testing also accounts
  
  for its title row (PR ; reported by ).

  
  


• 
  

  OSC 52 and SSH/tmux clipboard transport run on one bounded background worker
  
  rather than blocking input and rendering on the TUI loop; late transport
  
  failures still surface through the status path (PR ,
  
  closing by by
  
  by , PR ).

  
  


• 
  

  Auto-compaction now defaults on for every known model context window,
  
  including Kimi K3's 1,048,576-token routes. Persisting only an
  
  auto_compact_threshold or auto_compact_threshold_percent now counts as
  
  opt-in intent, while an explicit auto_compact = false remains authoritative.
  
  /config reports the effective state, percentage, and computed token trigger.

  
  


• 
  

  Per-provider context_window overrides are now documented and visible in
  
  /config, provider setup help, diagnostics, and the example configuration.
  
  The effective override consistently drives preflight budgeting, the context
  
  meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their
  
  Coding Plan tier has the smaller window.

  
  


• 
  

  Agent Details now projects status, model, elapsed time, and step counts from
  
  the same row snapshot as the primary agents list, eliminating contradictory
  
  worker state between the two surfaces.

  
  


• 
  

  Composer submission and its hints now share one state machine. Portable
  
  terminals use Enter to queue during a running turn and Enter again to steer;
  
  Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is
  
  no longer advertised as universally available.

  
  


• 
  

  edit_file now matches LF-only model search text against CRLF files,
  
  preserves the file's line-ending style for replacement text, and still
  
  rejects newline-normalized duplicate matches as non-unique ( by .

  
  


• 
  

  /fleet status read the current TUI session's sub-agents while codewhale fleet status read the durable .codewhale/fleet.jsonl ledger — two different
  
  things wearing one name, so a run started by codewhale fleet run never
  
  appeared in the TUI. /fleet status now reads the durable ledger through the
  
  same code path as the CLI; the session view keeps its own name as
  
  /fleet workers (/subagents and n still work). When a workspace has no
  
  ledger, both surfaces report a typed no_fleet_ledger reason instead of an
  
  empty-looking "all clear", and neither creates the ledger as a side effect of
  
  reading it ().

  
  


• 
  

  fleet resume <run-id> accepted any string. An id absent from the ledger
  
  reconciled nothing but still wrote a run-status record keyed by whatever was
  
  typed, and reported no_change. Unknown ids are now refused as not_found
  
  before any durable write ().

  
  


• 
  

  /lane no longer runs Runtime teardown on the TUI composer thread. Reads on
  
  the slash surface skip reconciliation (which probes tmux and takes a lock)
  
  and say so on the receipt instead of implying freshness; lane interrupt is
  
  CLI-only until that work runs off-thread, and reports
  
  surface_not_supported naming codewhale lane interrupt ().

  
  


• 
  

  codewhale lane list --json and lane status --json keep emitting the
  
  LaneRecord shape they always have — the receipt did not replace it. The
  
  human lane status output also regained branch, session, socket,
  
  attach, and log, which the first cut of the shared DTO had dropped
  
  ().

  
  


• 
  

  Deny rules in permissions.toml no longer miss a command because of an
  
  intervening flag: deny matching is token-based with flag-skipping and
  
  backtracking, so a git push rule still catches
  
  git -c foo=bar push. Path matching folds case only on platforms whose
  
  filesystems are case-insensitive, and the default approval branch no
  
  longer proposes the working directory as a network host.

  
  


• 
  

  MCP tool calls run once. A failed call is no longer retried as if it
  
  were a failed lookup, qualified-name resolution collects every match and
  
  reports an ambiguity instead of taking whichever the hash map yielded
  
  first, and registering a server whose name collides with an existing one
  
  after sanitization is now an error rather than a silent overwrite.
  
  The equivalent call-once fix direction came from closed PR .

  
  


• 
  

  The session index survives a torn line: an unparseable entry is skipped
  
  rather than aborting the whole read, appends carry their data through to
  
  disk, and appends and compaction share a lock so a compaction can no
  
  longer race an append into a lost record.

  
  


• 
  

  Edit counts as a write tool for workflow elevation, and the TUI's
  
  write/shell classification now delegates to one shared allowlist rather
  
  than keeping a second copy that could drift.

  
  


• 
  

  A rejected app/config/set stays a no-op. Previously an invalid value
  
  still tore down the cached runtime bridge, killing the child runtime and
  
  orphaning every other in-flight stdio thread behind a response that
  
  correctly reported failure.

  
  


• 
  

  A malformed project config.toml is no longer indistinguishable from
  
  having no project config. Because a project config may only tighten
  
  approval and sandbox policy, silently discarding a broken one dropped a
  
  repository's restrictions back to the looser user defaults; the setup
  
  wizard now says so, naming the file but never quoting its contents.

  
  


• 
  

  An expired lane worktree no longer leaves its branch behind, which made
  
  reusing the same lane name fail with "branch already exists". A branch
  
  still carrying unmerged commits is kept — a TTL lapsing is not consent
  
  to delete someone's work.

  
  


• 
  

  An in-flight thread/message turn can be stopped. The stdio loop keeps
  
  reading while a turn streams, so the new thread/interrupt request (and
  
  shutdown) can reach a runaway turn instead of waiting on the very turn
  
  they were meant to stop.

  
  


• 
  

  Precedence is stated only in the constitution's "Whose word wins" section.
  
  Memory hygiene no longer ships an inverted Tier list that put the
  
  constitution above the user's current request; approval, compaction, and
  
  personality overlays describe behavior without rank vocabulary; and the
  
  authority recap points at the single source rather than restating a second
  
  ladder.

  
  


• 
  

  <turn_meta> carries facts (mode, posture, model, workspace), not mode
  
  doctrine or permission-question essays re-asserted every user message.

  
  


• 
  

  The project context pack (pretty-printed workspace tree) is off by default
  
  and opt-in via [context] project_pack = true. Language law is compressed
  
  while keeping the English-constitution / user-language-reply contract.

  
  


• 
  

  Modal lists and config pickers wrap selection at both ends (Down past the
  
  last row returns to the top). Home-directory resolution prefers
  
  HOME/USERPROFILE via effective_home_dir across remaining call sites so
  
  Windows tests that fake the home env vars match production paths. The
  
  equivalent home-directory sweep came from closed PR .

  
  

Changed

• 
  

  Prefix-cache tool catalog entries store only the SHA-256 digest, not the
  
  joined catalog string. Unused plan-transition validation helpers are removed.

  
  


• 
  

  Settings sections now hold only what they claim ( by by
  
  by — exact repository-scoped
  
  allow grants and cross-platform path semantics (PR ).



• ), complete locale exposure in settings (PR ), and reasoning-effort preservation across automatic model
  
  routing (PR — the configurable
  
  session-token header (PR ).


• .


• , whose contributor commits are preserved in the candidate.


• , duplicate-session fix in PR landed through .


• .


• .


• 
  
  (issue — the Windows CRLF edit_file
  
  reproduction, root-cause analysis, and affected-code anchors in issue — ACP numeric-id compatibility
  
  (PR
  
  and — the expanded-by-default reasoning
  
  setting and its original report (PR ).


• ).


• ).


• ).


• , and
  
  ), MCP call-once behavior
  
  ().


• .


• and — the StepFun/OpenCode subscription-route
  
  request in ,
  
  ,
  
  , and
  
  ), native-tool-token filtering (), optional reasoning highlight (), and export/restore correlation ( for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.