GitHub Release: Hmbown/Codewhale v0.9.4 (08.08.2026)

$ git clone https://github.com/Hmbown/Codewhale.git Clone

Codewhale is the public product from Shannon Labs. The codewhale

command, npm package, and release-asset names remain lowercase technical

identifiers. The legacy npm package deepseek-tui is deprecated and

receives no further releases. Users coming from v0.8.x legacy deepseek /

deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui

binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \

  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \

  -v codewhale-home:/home/codewhale/.codewhale \

  ghcr.io/hmbown/codewhale:v0.9.4

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz

cd codewhale-<platform>

./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.


• Extract the archive for your machine: codewhale-windows-x64.zip or
  
  codewhale-windows-arm64.zip


• Run install.bat (copies to %USERPROFILE%\bin)


• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles

sha256sum -c codewhale-bundles-sha256.txt --ignore-missing



# Linux — individual binaries

sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing



# macOS

shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing

shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.4

Codewhale v0.9.4 ships the release-train harness work: the familiar Fleet

roster/setup face with a clear operator-leader and user/folder scope, a

work strip that keeps actionable agents instead of a permanent archive,

waiting policy that forbids polling without freezing independent work,

calmer tool output and session recovery, account/Workflow-search/

automation/handoff surfaces, a shorter translation-ready website, and

release-blocker fixes across permissions, DeepSeek Responses, SQLite,

File edits, terminal width, and Windows installation.

Added

• 
  

  Memory maintenance: remember gains revise and retire beside the
  
  default append. Both name the exact note they target and both require
  
  the evidence for the change. Append-only memory decays — a correction
  
  sits behind the note it contradicts and both keep reaching the model —
  
  so the model can now keep its own durable notes true instead of only
  
  adding to them.

  
  


• 
  

  An audit trail for durable state the model writes about you. Every
  
  in-place memory edit is journalled to memory/JOURNAL.md, and every
  
  continual-harness refine / remove to a JOURNAL.md beside its state,
  
  each with before, after, and evidence. Harness removal previously left no
  
  record at all even though the entry leaves state entirely, so the journal
  
  is now the only place its content survives.

  
  


• 
  

  A first-run tip that says so: the first time Codewhale saves something
  
  durable it points at /memory, translated into all fifteen complete
  
  locale packs. This state shaped later sessions and nothing ever mentioned
  
  it existed.

  
  


• 
  

  Sub-agent checkpoint resume: agents/followup resumes an
  
  interrupted_continuable child from its checkpoint into a fresh agent loop —
  
  new agent id, original prompt plus the prior conversation tail — when a
  
  runtime is attached, and otherwise keeps queue-only semantics with the
  
  continuation_handle returned; a second followup on the same interrupted id
  
  returns the existing resumed target instead of spawning a duplicate (PR ).

  
  


• 
  

  Progressive fresh-context disclosure: fresh sessions ship a minimal
  
  constitutional kernel — ground truth, user intent and scope, truthful
  
  completion, guarantees in mechanism, and precedence — with procedural
  
  playbooks disclosed on demand, an opt-in project context pack
  
  (project_context_pack_enabled) counted in context reports, and load_skill
  
  catalogue discovery via name="list"; the measured fresh-context budget
  
  drops by roughly 40% (PR , and a test parses the
  
  field names out of that file and asserts set equality with the structs the
  
  serializer uses.

  
  

  This supersedes the roadmap's previous "no Codewhale product telemetry" entry,
  
  which moves from "Ruled out" to an opt-in framing. What stays ruled out:
  
  always-on or silent telemetry, per-keystroke or per-tool-call phone-home, and
  
  any third-party ad or analytics SDK in the runtime binary.

  
  


• 
  

  Registered GLM-5.3 (direct Z.ai) and z-ai/glm-5.3 (OpenRouter) as
  
  selectable GLM routes, with their aliases (glm-5.3, glm-5-3,
  
  zai-glm-5.3, zai-glm-5-3). Z.ai had not released GLM-5.3 as of
  
  2026-08-03 — the ids are registered so they resolve to the Z.ai/OpenRouter
  
  routes instead of being rewritten to another vendor's model, and they will
  
  fail upstream until Z.ai ships the model. Metadata (context, output,
  
  reasoning controls) is inherited wholesale from GLM-5.2 pending official
  
  Z.ai release metadata; pricing is intentionally absent, and GLM-5.2 remains
  
  the default Z.ai model. No third-party gateway roster gained the model:
  
  OpenCode Zen, OpenCode Go, Alibaba Model Studio, and TelecomJS publish no
  
  glm-5.3 entry, so Codewhale advertises none.

  
  


• 
  

  Managed Codewhale account commands (account login, status, logout, and
  
  keys) with browser device flow, profile- and origin-scoped secure sessions,
  
  refresh/revocation, redacted BYOK-vault management, and a token-free Runtime
  
  account receipt. Provider authentication remains separate, and cloud
  
  remains a compatibility alias.

  
  


• 
  

  /automation operator controls to list, inspect, pause, resume, delete, and
  
  run durable automations. Creation remains on the approval-gated
  
  model-visible automation tool.

  
  


• 
  

  A provider-neutral WorkflowSearchSpec authoring and freeze boundary, plus
  
  structured 2–16-candidate experimental search in the best-of-N Workflow
  
  starter. It freezes baseline, route, evidence, evaluator, gate, score, budget,
  
  and review policy before admission; it validates gate/scoring commands but
  
  does not execute or certify them itself.

  
  


• 
  

  The bundled generation-9 handoff skill for compact, decision-ready
  
  continuation across sessions.

  
  


• 
  

  Expanded terminal LaTeX rendering for aligned and matrix environments,
  
  cases, arrays, text/font/accent commands, brackets, symbols, and
  
  command-aware scripts (PR ).

  
  


• 
  

  Agent Plugins v1.0.0: consume, publish, and slugify packaged sub-agent
  
  briefs, with an install/update/uninstall on-ramp in the TUI (PR ).

  
  


• 
  

  /advisor: an opt-in background advisor watcher for live turns (PR ).

  
  


• 
  

  Automation scheduling forms — one-shot ONCE, five-field cron, and honest
  
  watcher modes — created through the approval-gated automation tool
  
  (PR ), child-result
  
  diff-tainting when a claimed diff is not visible to git, per-turn usage
  
  receipts on the exec stream-json stream, and spawn receipts that report
  
  the model each sub-agent actually ran on.

  
  


• 
  

  Transport resilience: sub-agent exec transport retries with a 600 s
  
  default (PR ), persisting interrupted output (PR ), token-counter refresh (PR ), and the Operate completion gate (PR ).

  
  


• 
  

  A persistent update-available chip in the header, with the startup update
  
  check throttled and naming the right command.

  
  


• 
  

  RLM static intent extraction for code blocks (rlm_block_intent.rs)
  
  landed as groundwork for a future code-mode approval flow; it is not yet
  
  wired into the turn pipeline and ships dormant by design.

  
  

Changed

• 
  

  /fleet is the familiar roster/setup face again. The operator row is the
  
  Fleet leader (session model); the header names the selected saved Fleet and
  
  whether it is user-global or folder-scoped. Named-Fleet switching lives under
  
  /fleet fleets (Enter selects in the row's own scope). Session route changes
  
  stay temporary until /fleet save, /fleet save-as, or /model save-default.

  
  


• 
  

  Waiting-for-subagents directions forbid peek/status polling and sleep-as-wait,
  
  but allow independent work that does not depend on a child's result — the
  
  parent no longer freezes mid-turn with useful non-conflicting work available.

  
  


• 
  

  workflow run no longer requires --fleet; a saved Fleet is an optional pin
  
  layer over roles + the session route.

  
  


• 
  

  Homepage and getting-started copy is shorter and scannable across locales,
  
  with dictionary key and {brand} token parity preserved.

  
  


• 
  

  Tool results now render as ordinary bounded previews with real expansion;
  
  storage, retention-ledger, and internal evidence language no longer leak into
  
  normal transcripts.

  
  


• 
  

  Prose wrapping, goal state, modal questions, composer-tail behavior, and
  
  ambient motion now follow one deterministic interface contract across narrow
  
  terminals and fast streams.

  
  


• 
  

  Scout and reviewer Fleet roles gain network access and the bounded
  
  verification surface for real reconnaissance while retaining the no-write,
  
  no-raw-shell security floor.

  
  


• 
  

  Workflow runs may describe up to 1,000 tasks while admitting at most 16 live
  
  tasks at once through the host concurrency gate. Tournament ordering now
  
  supports explicit score-first selection while retaining its cost-first
  
  default.

  
  


• 
  

  Runtime permission compatibility inputs resolve to one live
  
  permission_posture. Auto-Review can proceed without approval or structured
  
  question modals, unresolved holds fail closed, and a call planned under stale
  
  authority is retried after a posture change (PR by ).

  
  


• 
  

  Updated globset to 0.4.19, clap-complete to 4.6.8,
  
  futures-util to 0.3.33, libc to 0.2.189, actions/stale to 11.0.0, and
  
  docker/login-action to 4.5.2. The locked graph also includes the
  
  event-listener 5.4.2 fix for RUSTSEC-2026-0221.

  
  


• 
  

  The progress surface now speaks plainly everywhere: the last user-visible
  
  "Work update is pending" notices say "To-do list", the tool constructor and
  
  the docs name todo_write as the single canonical progress tool, and
  
  work_update, TodoWrite, and todo stay registered as hidden
  
  compatibility aliases so saved transcripts keep replaying.

  
  


• 
  

  Sub-agent and agents/wait waits stay short by default and by cap:
  
  blocking waits default to 30 s and refuse to block past 120 s, because a
  
  blocked wait deafens the session to typed input and settled children
  
  already report back as <codewhale:subagent.done> sentinels.

  
  


• 
  

  Bash action=wait honors timeout_secs (seconds) and bare timeout
  
  (milliseconds) alongside canonical timeout_ms, and block as an alias
  
  for wait, so a habit formed on other wait tools gets the duration it
  
  asked for instead of silently falling back to the 30 s default; the result
  
  metadata reports the real wait_timeout_ms applied.

  
  

Fixed

• 
  

  The memory journal is no longer indexed as memory. It is Markdown in the
  
  memory tree, so the source walk collected it and every retired note
  
  re-entered the searchable set under its before: line — putting the
  
  exact facts a revision had just removed back into the prompt.

  
  


• 
  

  memory_path pointed at an already-native store no longer derives a
  
  second store nested inside it, which silently wrote somewhere other than
  
  the file the user named.

  
  


• 
  

  muse and muse-spark resolved to muse-spark-1.1 in the agent
  
  registry while config had defaulted to muse-spark-1.2, so the CLI and
  
  app-server routed those aliases somewhere the configured default never
  
  pointed. The registry now carries 1.2 and the contributor variant.

  
  


• 
  

  An explicit type=builder (or its implementer alias) plus
  
  write_authority=read_only now fails closed at spawn instead of launching a
  
  labeled write role that silently had only recon tools and then self-BLOCKED
  
  after burning a turn ( by ).

  
  


• 
  

  Model Studio reasoning controls now fail closed on the host rather than on the
  
  provider enum, so a custom base_url no longer receives Alibaba-specific
  
  enable_thinking fields, and qwen3.8-max is no longer sent a thinking
  
  switch it does not accept (PR , closing , PR , harvested from ). Codewhale sends
  
  enable_thinking / preserve_thinking / reasoning_effort only when the
  
  configured base_url is a verified Alibaba Chat Completions host, so
  
  pointing a modelstudio-* provider ID at a custom gateway no longer injects
  
  DashScope's dialect into it. qwen3.8-max and qwen3.8-max-preview are
  
  thinking-only and no longer receive an enable_thinking: false they cannot
  
  honor; preserve_thinking is sent for the models documented to accept it, so
  
  their reasoning trace survives into the next turn; and deepseek-v4* /
  
  glm-5.x map the reasoning tier onto the documented high / max ladder.

  
  


• 
  

  xAI device login now recovers from a config that points at a missing
  
  Codewhale-owned credential generation instead of failing every attempt
  
  with a generic activation error, and finalize failures report the full
  
  error chain ().

  
  


• 
  

  Switching to the Codex provider with no saved model now lands on the live
  
  roster's flagship model instead of a stale static default ().

  
  


• 
  

  Fleet dispatch now rebinds the child client when the resolved profile
  
  model requires a different wire protocol (DeepSeek flash on Responses),
  
  instead of failing deterministically on the worker's first request
  
  ( and ).

  
  


• 
  

  SQLite connections install their busy timeout before locking setup and avoid
  
  rewriting persistent WAL mode on every open, removing the concurrent-open
  
  release-gate failure.

  
  


• 
  

  The Windows installer preserves long current-user PATH values, their
  
  registry type, and unrelated entries across install and uninstall (PR ).

  
  


• 
  

  Shared CI now handles bot-authored issue-link checks, provisions cargo-deny's
  
  toolchain, and fetches the locked test graph before offline runtime-budget
  
  validation.

  
  


• 
  

  Re-quote each linker argument in the Windows OpenHarmony clang launcher so a
  
  spaced SDK path (e.g. the default D:\DevEco Studio\... install) keeps its
  
  --sysroot intact through the final Rust link, and extend the no-SDK release
  
  guard to keep the re-quoting contract (PR ).

  
  


• 
  

  Transcript wheel scrolling under iTerm2: xterm alternate-scroll (DECSET
  
  1007) now stays off while mouse capture is active, so wheel events arrive as
  
  mouse events instead of being converted into arrow keys ().

  
  


• 
  

  A stalled model stream no longer ends the turn as Completed over a
  
  frozen reasoning block: a mid-stream chunk-timeout now counts toward the
  
  stream-error budget, so a stall with nothing streamed retries the request
  
  transparently, and a stall that exhausts the retry budget fails the turn
  
  with the real reason instead of reporting success.

  
  


• 
  

  A finished background shell task now wakes the engine even when no goal is
  
  active: the idle loop starts an ordinary runtime turn so the completion
  
  reaches the model immediately instead of sitting unclaimed until the user
  
  types (a dead provider route claims the completion once and reports where
  
  the output lives instead of re-arming the same error every tick).

  
  


• 
  

  Sub-agent final reports that exceed the summary budget are now spilled to
  
  a session artifact, and the truncation footer names the
  
  retrieve_tool_result ref for the elided middle instead of telling the
  
  model the bytes are unrecoverable; write failures degrade to the honest
  
  no-ref footer.

  
  


• 
  

  An interactive mid-stream network drop after partial output no longer fails
  
  the turn: the partial reply is preserved as a committed assistant message,
  
  a runtime continuation message is appended, and the request is re-issued
  
  bounded by the stream-retry budget.

  
  


• 
  

  Large pasted input is no longer sent to the model twice as inline text and
  
  as a backup .md paste file; the submitted message now carries only the
  
  @-mention so the model reads the file once.

  
  


• 
  

  A builder sub-agent can run ordinary shell writes again. Write claims
  
  outlive the agents that register them, so a workspace accumulated one per
  
  builder that ever ran — six completed agents left four standing claims in
  
  testing — and the shared-checkout gate counted those long-finished children
  
  as live contenders. Every later builder was refused Bash writes with
  
  "cannot prove a bounded file target" and pushed toward worktree isolation,
  
  which puts the work in a checkout the operator never looks at. The gate now
  
  asks the question it meant to ask: is another running child writing in this
  
  shared checkout. Concurrent writers are still gated; a lone builder writes in
  
  the workspace you are actually watching.

  
  


• 
  

  Ctrl-C during the first moments of startup no longer kills Codewhale
  
  outright. The terminating-signal handlers were registered inside the task
  
  that waits on them, and a spawned task does not run until the scheduler
  
  first polls it, so a SIGINT arriving in that window hit the default
  
  disposition — the process died with no exit code, no terminal restore, and
  
  no session record. The handlers are now installed synchronously, before
  
  the telemetry notice and before arming, so the window is closed.

  
  


• 
  

  The documented tool list on the docs site named update_plan and
  
  work_update as coordination tools. Neither is callable by the model —
  
  update_plan replays older Plan artifacts and work_update is a hidden
  
  compatibility alias — so the page listed two tools a reader cannot use and
  
  omitted todo_write, the one they can.

  
  

Security

• Bumped nanoid past (@SparkofSpike) contributed
  
  LaTeX rendering in PR , and delivered actionable File-edit recovery in PR ,
  
  surfaced real shell wait elapsed time in PR .


• .


• .


• .


• .


• .


• .


• , harvested after its base branch
  
  was accidentally deleted during maintainer cleanup.


• , rquickjs bindgen on FreeBSD).


• ).

See for older releases.