GitHub Release: Hmbown/CodeWhale v0.9.10 (20.08.2026)

Codewhale v0.9.10 is a retention, identity, and product-clarity release: the shell and

transcript can no longer retain unbounded tool output in memory or on disk,

mid-turn history inserts no longer strand in-flight tool rows, every agent

that ran this session is visible from /agents list, the PTY acceptance

lane has a stall watchdog and bounded CI steps, approval outcomes are

durable and fail closed (cyq1017, ). Test

threads get an 8 MiB stack so the lib suite can no longer

abort under load.

Fixed

• First run starts on the welcome screen again. A missing key no longer
  
  skips Welcome and auto-opens the local-provider list: Enter walks to the
  
  calm provider explanation, then Enter opens the picker so a first API key
  
  can be set. Returning missing-key recovery still opens the picker on
  
  launch.


• A foreground bash command that named no timeout is bounded again. The
  
  model-facing bash tool left an omitted timeout_ms at the internal
  
  ceiling (~24.8 days) instead of the 120 s default its own schema
  
  advertises, so a CLI that blocked on an interactive prompt or a hung
  
  network call held the turn open indefinitely — one report sat on a single
  
  unauthenticated CLI call for over two hours with the tool row simply
  
  counting seconds. The advertised default now applies, which arms the
  
  existing recovery: the process is killed and the model is told to rerun
  
  with background=true and poll with action="wait". An explicit
  
  timeout_ms is still honored for genuinely long foreground work, and
  
  background and interactive runs keep their own lifetimes.


• The Extensions (/plugin) Marketplace is no longer a read-only list.
  
  Every recommendation and stored candidate names its truthful state and
  
  primary action — Add, Enable, Configured, or Unavailable — and Enter or a
  
  mouse click runs that action through the existing reviewed /mcp add recommended, /mcp enable, and /plugin install/trust controllers, so
  
  no second trust path exists. Browser Use and Sandbox Runtime stay
  
  honestly Unavailable with their real setup routing instead of implying an
  
  install Codewhale cannot perform.


• The Extensions MCP tab now renders one honest inventory: the header count
  
  and the visible rows derive from the same configured-server set, so
  
  MCP (6) can no longer sit above two rendered rows. Disabled servers
  
  stay visible and labeled disabled instead of silently disappearing, and
  
  configured servers absent from the live snapshot list as not-yet-inspected
  
  with their own explicit reload affordance through the MCP command
  
  controller.


• Installed plugin rows now act on their real state: Enter opens an active
  
  bundle (/plugin show), offers Enable for a trusted-but-disabled bundle,
  
  or routes an untrusted bundle to the existing trust review — through the
  
  same confirmation and persistence controllers as the slash commands.


• Sub-agent handoffs and rosters, background shell jobs, durable tasks,
  
  delayed continuations, and workflow controls are now scoped to the
  
  session that owns them. Records carry immutable root-session ownership,
  
  stale completion-channel payloads are rejected before deduplication,
  
  background work drains and reports only to its owning session, and
  
  legacy ownerless jobs fail closed (; the report's exact JavaScript provenance was not claimed as
  
  reproduced).


• The resolved route envelope now reaches every outbound model call: all
  
  wire dialects and auxiliary calls clamp at the shared transport seam
  
  under one wire/reservation budget, provider input limits are honored, and
  
  switching models on the same protocol no longer inherits the previous
  
  model's limits ().


• First-run continuity: the chosen onboarding provider persists across
  
  restarts, a missing first-run config no longer interrupts the flow, and
  
  the automatic working-agreement checkpoint renders as a standalone setup
  
  handoff instead of regressing the onboarding rail to the full wizard's
  
  4/10 progress.


• Explicitly worded natural-language /goal declarations now create a
  
  durable goal in the provider-neutral engine before model dispatch, while
  
  ordinary tasks and quoted transcripts stay out of goal mode and prose
  
  acknowledgement alone can no longer stand in for goal creation.


• /model now keeps the current Z.ai default (GLM-5.3) visible when an
  
  older installation has an explicit GLM-5.2 route saved. The saved 5.2
  
  route remains exact; choosing 5.3 sends and remembers the distinct 5.3 ID.


• The constitution checkpoint now leads with the bundled balanced agreement;
  
  the default path writes no custom constitution. The startup launch surface
  
  distinguishes read-only Chat from folder-bound, approval-gated Work.


• Tabby and other IME bridges no longer observe a stale visible caret while a
  
  frame diff is being painted; Codewhale hides the cursor during the diff,
  
  restores the canonical composer cell, and only then reveals it again
  
  (BrathonBai, ).


• MCP tools/call images now travel as bounded typed content instead of
  
  leaking base64 through model-visible JSON. Direct and parallel calls share
  
  the same MIME, size, validation, and one-image boundary (PR ).


• Linux npm installs and updates race GitHub Releases against the CNB mirror
  
  at the checksum-manifest layer, then download from the first verified source
  
  without making users wait through a doomed slow-source timeout.


• CODEWHALE_PREFER_BWRAP now applies the documented Linux sandbox override,
  
  and Codewhale-era names own build metadata, hook session/tool-call IDs, and
  
  sandbox child markers. The corresponding DEEPSEEK_* names remain as 0.9.x
  
  compatibility aliases ().


• fix(tui): make the header status mark honour its setting — status_indicator
  
  did nothing for three of its four documented values. The header hardcoded a
  
  leading cw span and asked for a second mark beside the effort chip, then
  
  filtered the second one against the literal "cw"; because cw, the legacy
  
  whale opt-in, and every unknown value all normalize onto that same mark,
  
  the filter discarded them and left off with nothing to turn off. cw,
  
  whale, off, and a typo all rendered byte-identical headers. There is one
  
  mark now and the setting owns it: cw/whale draw the typographic mark,
  
  dots draws the activity frames, off removes it (thejayjetson, ).


• fix(tui): bound what the shell and transcript retain from tool output —
  
  a 1.1 MB Bash call kept over a megabyte resident for up to an hour; raw
  
  streams now cap at 16 MiB in flight and release delivered output, and
  
  retained tool outputs cap at 64 KiB per record / 8 MiB per transcript
  
  ().


• test(tui): break the LazyLock/env-barrier deadlock in the test harness.


• ci: give test threads the 8 MiB stack they need — the lib suite aborted
  
  with SIGABRT under load on the default 2 MiB stack.


• YOLO entry points honor a locked approval policy: --yolo, /mode yolo,
  
  /zidong, and Alt+Y can no longer set Full Access + trust + shell when
  
  config or managed requirements own the posture.


• Terminal PTY tools fail closed without a sandbox backend under a narrowed
  
  filesystem posture, and otherwise start $SHELL -i through
  
  SandboxManager::prepare like bash.


• Skill update refuses to replace a directory that has no .installed-from
  
  marker — same ownership gate plugins already used.


• cp/mv are workspace-safe only when every path operand stays inside
  
  the workspace — Auto-Review no longer auto-allows cp /etc/passwd ..


• Main CI no longer shares one concurrency group per branch: each SHA
  
  gets a verdict instead of a cancelled pending run. A hermetic Safety
  
  gate job runs authorization tests in under 15 minutes (test bankruptcy
  
  restructuring — no tests deleted).


• Config-fixture tests no longer honor lock_test_env as a license to
  
  read a populated ~/.codewhale/config.toml; they need an EnvVarGuard
  
  like settings already did. Safety-gate and CNB workspace tests pin a
  
  hermetic CODEWHALE_HOME. exec_persistent_service is serialized in
  
  nextest and inside the cargo-test binary instead of dropped (, ).


• Background tasks have bounded incremental persistence, durable terminal
  
  reasons, truthful timeout/cancellation receipts, restart recovery, and
  
  interruptible continuous-goal delays ().


• /title once again controls the terminal window title independently from
  
  /rename, survives session save/load, and sanitizes control, bidi, and
  
  zero-width characters (PR ).


• MCP snapshots preserve whether capabilities were advertised by the server,
  
  discovered through the bounded legacy fallback, or not observed ().


• codewhale doctor --probe-search performs an explicit credential-free,
  
  policy-checked transport probe for the selected search provider; ordinary
  
  doctor and JSON output remain offline ().


• npm Linux x64 first-party source selection. The wrapper concurrently
  
  fetches the GitHub Releases and CNB checksum manifests for the exact
  
  package version, locks the first source whose HTTP response and manifest
  
  validate, and downloads binaries only from that source. Explicit
  
  CODEWHALE_RELEASE_BASE_URL / CODEWHALE_USE_CNB_MIRROR=1 still skip the
  
  race; other targets stay on GitHub.


• /workflow <objective> and /workflow run <path> now produce a bounded,
  
  tool-less proposal for review. Only /workflow confirm can launch that
  
  reviewed draft; status, cancel, settings, and the /workflows dashboard stay
  
  host-owned and do not spend a model turn ().


• feat(tui): add command context adapters and migration gate (FEAT-015)
  
  (aboimpinto) — TUI-owned capability facets, a dual-path dispatch seam, and
  
  source-aware CI enforcement so a command slice cannot claim to be migrated
  
  while it still accepts concrete App. Zero production commands migrate in
  
  this slice ().


• feat(web): move docs/constitution and docs/runtime-api onto the dictionary spine (Lstarsky0) — both pages now read copy from the locale dictionaries
  
  instead of inline bilingual literals; another incremental phase of ).


• docs(i18n): complete Tier 1 of Chinese docs localization (SparkofSpike) —
  
  Chinese and Indonesian docs move to docs/zh_hans/ and docs/id/, with
  
  redirect stubs at the old paths for one release cycle ().


• feat(tui): formalize the status-bar color grammar — seven semantic
  
  families live in docs/design/STATUS_BAR_COLOR_GRAMMAR.md and
  
  palette::grammar; header and phase-strip ink resolve through named
  
  ChromeInk slots so chrome cannot invent an eighth meaning or spend
  
  Failure red on a dirty worktree or selected mode. The footer's session
  
  metrics strip resolves through the same inks, and the red reservation is
  
  checked against every selectable theme, not just the whale default;
  
  typed footer toasts resolve through the grammar too.
  
  Repo/worktree chrome stays metadata and still renders when Git names a
  
  location but not a ref ( spec items 1 and 5).


• ci: bound PTY acceptance and add a stall watchdog to the harness —
  
  QA_PTY_STALL_TIMEOUT_SECS aborts a wedged PTY run with a diagnostic;
  
  the isolated PTY step is capped at 15 minutes; Windows NSIS provisioning
  
  gets a bounded retry ( class).

Contributors

• ,
  
  in addition to the Tier 1 Chinese and Indonesian documentation work below.


• while preserving retry, cancellation,
  
  usage, TTFT, steering, and partial-response behavior.


• ).


• ; the harvested
  
  version also makes malformed image fields produce a visible omission receipt.


• ). Thanks also to for identifying the affected
  
  completion surfaces.


• ).


• ).


• ).


• ).


• M-Maciej ().


• cyq1017 (, closes ) — the TUI-owned dependency-injection and migration
  
  infrastructure that makes slash-command extraction safe: seven capability
  
  facets, a dual-path dispatch seam, and source-aware CI enforcement so a
  
  command slice cannot claim migration while it still accepts concrete App
  
  (, which they also filed).


• wuisabel-gif (, the
  
  repo/worktree slice of ) — Tier 1 of the Chinese docs localization:
  
  Chinese and Indonesian documentation moves to docs/zh_hans/ and
  
  docs/id/ with redirect stubs held at the old paths for one release cycle
  
  (, which they also filed).


• Lstarsky0 (, closes ) — docs/constitution and docs/runtime-api follow
  
  the same dictionary spine: 28 inline isZh branches become typed English
  
  and Chinese dictionaries held to key and token parity, while the other
  
  sixteen locales keep the English fallback ().


• ).


• hxfhd ().


• sfdzhmr ().

See for older releases.