GitHub Release: Hmbown/CodeWhale v0.9.8 (20.08.2026)

Fixed

• 
  

  sudo (and su/setuid helpers) work again for wheel-group administrators
  
  who want Codewhale to be able to escalate: the Linux startup hardening's
  
  irreversible PR_SET_NO_NEW_PRIVS flag — inherited by every child process —
  
  is now skippable with CODEWHALE_NO_NEW_PRIVS=0 (). A
  
  stack overflow, allocation failure, or double panic skips the panic hook
  
  and every cleanup guard, which is how a v0.9.7 user's mid-turn exit left
  
  mouse capture leaking SGR sequences into their shell. An
  
  async-signal-safe handler now restores the terminal modes and appends a
  
  one-line cause marker to ~/.codewhale/crashes/last-fatal-signal.log
  
  before re-raising, keeping the honest 128+signal wait status. A SIGKILL
  
  (OOM killer) remains uninterceptable by design.

  
  

Changed

• 
  

  Prompt-cache prefix is pinned for the session. The tool loop no longer
  
  recomposes the system prompt from disk on every model step, so an agent
  
  writing a file no longer busts the provider KV prefix cache mid-turn. The
  
  system prompt and tool catalog are re-composed only on a declared header
  
  change (/model, mode, goal, session resume), which re-pins under a logged
  
  reason; an undeclared change is reported as drift and the original pin is
  
  kept instead of silently becoming the new baseline. Workspace, AGENTS.md,
  
  skills, memory, and goal drift now reaches the model as one bounded
  
  <context_update> user message at the next user turn — a history append,
  
  not a header rewrite. /cache stats shows the pin reason, the last-miss
  
  reason, the undeclared-drift count, and the context-update count. See
  
  , reported and tracked by ). add reads one LOCAL catalog
  
  document in the real published schemas (Kimi, Claude, Codex, or
  
  Codewhale native) — no network, regular files only — and persists it
  
  beside the plugin state with the same hardened, fail-closed store.
  
  list/show render every candidate with per-entry diagnostics,
  
  display-only tiers, and honest install plans that say when Codewhale
  
  cannot fetch a source; install routes through the existing reviewed
  
  installer, so installed bundles still enter disabled and untrusted.
  
  Foreign auto-install policy (Codex INSTALLED_BY_DEFAULT) is visibly
  
  ignored; nothing is auto-installed, auto-trusted, or granted vendor
  
  trust.

  
  


• 
  

  /rc attach now includes an observed owner/name git remote when the
  
  folder has a GitHub, CNB, or Gitee origin, so CWC can label the paired
  
  session. Paths stay off the wire. Reconnect after both this client and
  
  CWC , ).

  
  


• 
  

  Ollama Cloud is a first-class hosted provider (/provider ollama-cloud)
  
  on the official OpenAI-compatible https://ollama.com/v1 route. Local
  
  Ollama stays keyless. The exact released ollama + Cloud URL tuple keeps
  
  a bounded compatibility path across saved sessions, Fleet, and nested
  
  subagents; neighboring remotes stay custom and fail closed against
  
  inherited official credentials.

  
  


• 
  

  Homebrew ships a codewhale formula. brew tap Hmbown/deepseek-tui && brew install codewhale is the install path; brew upgrade codewhale
  
  updates it. The legacy deepseek-tui formula remains a deprecated alias
  
  for one overlap release.

  
  


• 
  

  Terminal tab/window titles now carry the existing saved session name before
  
  the live state (Codewhale, reasoning…, using tool…, done), so parallel
  
  sessions are identifiable at a glance without a second title setting.
  
  /title <name> is a discoverable alias for /rename; both update the one
  
  session name shown in the picker, composer, and terminal tab. Control,
  
  bidi, and zero-width format characters are stripped from the saved name
  
  itself, so /title, /rename, the picker, the Runtime API,
  
  codewhale sessions, and the OSC 0 tab title all carry the same
  
  escape-free text (, Kai Nacke).

  
  


• 
  

  Children (sub-agents and Fleet workers) inherit the session's permission
  
  posture faithfully: Auto-Review's deterministic floor and model guardian
  
  decide a worker's held calls (fail closed when unavailable, never a
  
  prompt); under Ask a held call is raised in the parent's approval UI and
  
  the worker waits visibly; Full Access still fails closed on the safety
  
  floor. Each prompt-less decision is a one-line note in that worker's
  
  transcript (focus mode) and an audit-log record.

  
  


• 
  

  Worker role defaults keep what the role does not intend to withhold:
  
  every built-in role keeps network reads; planner may run read-only
  
  shell probes; custom inherits the parent's write/network/shell posture
  
  and is narrowed only by its explicit tool list or the spawning call.
  
  Read-only roles (scout, reviewer, planner, verifier,
  
  consultant) still never write the workspace. The focused worker's
  
  header states its effective posture from the runtime snapshot.

  
  


• 
  

  /workflow status, /workflow cancel [run_id], /workflow settings, and
  
  /workflow help are answered by Codewhale itself from the run journal and
  
  live run state — no model turn — and /workflow run <path> launches a
  
  checked-in workflow as-is. /config workflow and /config goal explain
  
  the effective tables. The workflow tool now honors the session [workflow]
  
  table (automatic, auto_start_read_only, require_approval_for_writes,
  
  limits) instead of product defaults.

  
  


• 
  

  Goal mode enters as readily as DeepSeek Harness: the agent may create the
  
  session goal when a direct request describes a verifiable multi-turn end
  
  state, and Codewhale shows a one-line Goal set receipt with how to pause
  
  or clear it. Bare /goal shows plain progress (and how to continue when no
  
  turn is running), prints usage on an empty session instead of asking the
  
  model, and /goal help|status are reserved words.

  
  


• 
  

  Whale Teams in the terminal: the six Signal Cut whale identities (Scout,
  
  Patch, Harbor, Echo, Keel, Lantern) appear as species badges on /fleet
  
  roster rows and worker rows, with an identity portrait in the roster detail
  
  pane and a six-state word (Resting, Thinking, Working, Waiting for you,
  
  Blocked, Offline) derived only from the child's real runtime status. Colors
  
  come from the theme tokens, every glyph has an ASCII fallback, and the
  
  working wake animates only under full motion. See
  
  docs/design/WHALE_TEAMS_TUI.md.

  
  


• 
  

  A session metrics strip on the phase row (4 turns · 108 steps │ LLM 11m46s · Tool call 1m52s │ TTFT avg 1.5s · 120 tok/s │ Cache hit 99% │ Input 9.3M), on by default as the session_metrics footer item
  
  (/statusline, [tui].status_items). Every value comes from engine
  
  receipts — turn starts, per-model-call usage with stream time,
  
  time-to-first-token and whole-call time, tool start/complete edges, and
  
  provider-reported cache and input tokens. Cells without evidence are
  
  omitted, never estimated. /status prints the untrimmed line; the phase
  
  row sheds its lowest-value groups to fit the columns it actually has.

  
  


• 
  

  Auto-Review decisions nobody was prompted for are now visible in the
  
  transcript as one-line notes: model-guardian allow/deny verdicts with
  
  their risk tier and stated reason, guardian failures (denied, fail
  
  closed), deterministic policy blocks, and holds Auto-Review denied
  
  without pausing. The audit log keeps the full record. /permissions
  
  ends with the active posture, what it decides on its own versus never,
  
  and the audit-log path. The footer's Esc to interrupt hint is
  
  localized. See docs/design/AUTO_MODE_PARITY.md for the Claude Code /
  
  Kimi Code parity ledger and follow-ups.

  
  


• 
  

  codewhale integrations dsh status|plan|connect|update|launch|disable|enable|remove
  
  connects an existing official DeepSeek Harness (dsh 0.1.0-rc.6, verified)
  
  through Codewhale using only its documented seams: a --patch overlay that
  
  pins the exact Codewhale provider/model/endpoint identity (native
  
  deepseek-official route, or a hand-declared openai-completions route
  
  named codewhale-<provider> for OpenAI-compatible providers), the
  
  Codewhale permission posture exported as DSH_PERMISSION_MODE, and an
  
  append-only receipt. Codewhale writes only under
  
  $CODEWHALE_HOME/integrations/dsh/, never copies API keys or edits DSH
  
  files, never broadens permissions (--allow-full-access only mirrors an
  
  existing Codewhale full-access posture), and reports not-installed /
  
  offline / incompatible / detected / connected / stale-config /
  
  stale-version / disabled honestly. Anthropic Messages and OpenAI Responses
  
  routes are refused as not carriable. The documented DSH plugin path is an
  
  explicit opt-in: install-bundle materializes a Codewhale bundle package
  
  (codewhale-dsh-bundle, MIT notice retained) and installs it with
  
  dsh plugin --profile codewhale add <path> into a dedicated codewhale
  
  profile (pnpm required, reported truthfully when missing; web/headless
  
  untouched), so dsh --profile codewhale alone carries the identity;
  
  update regenerates the bundle patch and remove-bundle reverses it,
  
  leaving the DSH-owned profile directory in place. /setup tools and codewhale doctor
  
  show the read-only detection state; doctor also lists the DSH read-only
  
  credential consent alongside Codex and Grok. The optional --skin export
  
  writes a Codewhale token stylesheet generated from the TUI palette
  
  (Blue Stage dark/light, ombre water column, mode/permission/state colors,
  
  reduced-motion fallbacks); DSH exposes no custom-theme API, so the sheet is
  
  labeled an unsupported overlay and is never injected. See
  
  docs/INTEGRATIONS_DSH.md.

  
  

Fixed

• 
  

  Selecting the google provider kind resolved to the antigravity
  
  TUI identity (and vice versa): the agy provider entry was inserted at
  
  different positions in the config-level enum and the TUI's
  
  discriminant-indexed lookup table. The table now matches the enum, so
  
  provider pickers, sorted display, and kind round-trips are correct.

  
  


• 
  

  The provider picker's key-entry stage accepted typed input and pastes
  
  for OAuth-only providers after antigravity declared OAuth
  
  acquisition; those gates now key off the OAuth acquisition class
  
  instead of a hard-coded provider identity.

  
  


• 
  

  The webhook hook sink no longer panics when its HTTP client fails to
  
  build; it falls back to a default client (, EvanProgramming; complements the cross-process file lock).

  
  


• 
  

  A billed max_tokens stop followed by a transport error fails the turn
  
  instead of continuing into a second request. A clean output-limit stop
  
  still continues. Mid-size context windows keep the ordinary 65K internal
  
  reservation so compaction does not collapse to the 1K headroom floor
  
  when the catalogue documents a matching output ceiling.

  
  


• 
  

  Thinking cycle, /effort, and Settings now walk each model's real ladder
  
  instead of the DeepSeek off/high/max shortcut. Grok 4.6 is
  
  auto/low/medium/high/xhigh (cannot disable); Grok 4.5 is
  
  auto/low/medium/high; first-party DeepSeek keeps a documented low tier.
  
  /effort persists and receipts through the same path as Ctrl+T.

  
  


• 
  

  Google Gemini is its own backend (/provider google) on the official
  
  OpenAI-compatible route with thought-signature capture/replay and
  
  fail-closed replay for thinking models. Antigravity (agy 1.1.13) is
  
  a separate provider: consent-gated read-only import of the official
  
  CLI's login, then a text-only cloud-code stream
  
  (/v1internal:streamGenerateContent). Tools, images, and unknown SSE
  
  shapes fail closed. Gemini 3.7 Flash is not advertised until a live
  
  turn succeeds on this wire. The website 44-count still excludes
  
  Antigravity.

  
  


• 
  

  DeepSeek Flash SSE on macOS no longer turns mid-character HTTP/2
  
  flushes into U+FFFD replacement characters ().

  
  


• 
  

  Fireworks and OpenCode Zen DeepSeek V4 Flash/Pro keep a bundled
  
  family rate when the live control plane is down, so session cost is
  
  not stuck on unverified_live_pricing (). OpenCode
  
  Zen/Go stay first-class rows. Agnes has no published URL, so it has
  
  no preset.

  
  


• 
  

  Privileged release workflows no longer restore rust-cache, sccache,
  
  or npm caches after checking out a caller-supplied SHA (CodeQL
  
  cache-poisoning ). Catalog drift no longer prints raw
  
  bundled/upstream blobs (). The brief v0.9 session-shell side gutter
  
  is gone so expanding a pane rematerializes layout the same way shrinking
  
  does.

  
  


• 
  

  The agent tool schema rejects empty calls.

  
  


• 
  

  The local web client keeps recovered stream gaps closed, user questions
  
  answerable, manual bootstrap access intact, and streamed prose quiet for
  
  assistive tech.

  
  


• 
  

  Website zh-Hans copy now says 宪章, matching the TUI pack ( (Lstarsky0) with that correction.

  
  


• 
  

  The website models page carries a truthful read-only settings preview
  
  built from repository facts; it never implies the site can change local
  
  configuration (, mvanhorn).

  
  


• 
  

  The canonical ultra reasoning effort now maps to each provider's
  
  maximum tier alongside the legacy ultracode alias, instead of being
  
  silently dropped (, buiducnhat).

  
  


• 
  

  Session titles truncate by character count, not byte offset, so
  
  multi-byte titles (CJK, emoji) cut at the intended width and word
  
  boundary instead of past the limit (). The brief v0.9 session-shell side gutter is
  
  gone so expanding a pane rematerializes layout the same way shrinking does.

  
  


• 
  

  The background verifier test drives the current libtest executable
  
  instead of the rustup rustc shim, so the TUI suite no longer depends
  
  on $HOME or holds the process-wide test environment lock across an
  
  async wait (, Isabel Wu).

  
  

Removed

• The source-structure budget ratchet (CI step, checker, baseline JSON).
  
  It measured line counts, not quality: every legitimate feature required
  
  a hand-edited ceiling and the accompanying "review" was self-review, so
  
  it bought ceremony, not protection. Behavior-measuring gates (dead-code,
  
  runtime-contract, persistence-backlog) stay enforced.


• DeepSeek can reuse a key already stored by official DeepSeek Harness
  
  (dsh) after
  
  codewhale auth external-consent --provider deepseek --mode read-only.
  
  Codewhale reads only DEEPSEEK_API_KEY from the exact granted
  
  $DSH_HOME/.credentials.yaml and never writes or refreshes that file.


• The TUI markdown parser now honors CommonMark fence-length rules: a ````
  
  opener is not closed by a shorter ``` line, so > content inside a longer
  
  fence stays literal code instead of escaping into a quote.


• Sub-agents finalize when the parent session id changes, so a closed
  
  session cannot block new children as a live owner ().


• Doctor keeps persisted setup readiness across first-run / update
  
  checkpoints ().


• A /models 2xx probe is a connection check, not model readiness.


• Site layout uses one container, the ticker no longer implies false
  
  provider readiness, and install links stay in the active locale.

Contributors

• EvanProgramming (); session-index JSONL mutex () — session peek hides internal runtime events
  
  (); provider-count follow-ups
  
  (); macOS agy fixture canonicalization (); regenerated website facts harvested and corrected
  
  from ) — read-only models settings preview on the
  
  website ().


• Nhat Bui (); session titles truncated by character
  
  count, not byte offset () — /title and the session name in the terminal
  
  tab/window title, plus the mid-turn title deadlock fix () — Eden AI provider registration, aliases,
  
  EDENAI_API_KEY, and the global/EU endpoints () — background verifier test isolated from
  
  rustup and $HOME ().

See for older releases.