GitHub Release: codewhale-hq/Codewhale v0.10.0 (22.09.2026)

Codewhale is the public product from Shannon Labs. The codewhale

command, npm package, and release-asset names remain lowercase technical

identifiers. The legacy npm package deepseek-tui is deprecated and

receives no further releases. Users coming from v0.8.x legacy deepseek /

deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — official GitHub release

New macOS/Linux install (checksummed binaries from this release):

curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.10.0" sh

"$HOME/.local/bin/codewhale" --version

For Windows, use the matching installer or archive below. For an existing

direct install, run codewhale update; it prints the executable path and

keeps newer builds. If the install directory is occupied by a different build,

use the fresh-directory migration in the installation guide.

Secondary packaging — npm and Cargo

npm install -g codewhale

# or build from source

cargo install codewhale-cli --locked

The wrapper downloads the matched codewhale and codew command assets

from this Release. Both contain the same compiled runtime.

Docker / GHCR

docker run --rm -it \

  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \

  -v codewhale-home:/home/codewhale/.codewhale \

  ghcr.io/hmbown/codewhale:v0.10.0

The image exposes the same runtime as both codewhale and codew. The

latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli --locked

The Cargo package installs codewhale. Cargo cannot create a second command

alias from one binary target; users who want the shorter spelling can add a

codew symlink to that installed executable. The npm, Homebrew, archive,

shell-installer, and container channels install both command names directly.

Manual download — platform archives (recommended)

Each archive below contains the same runtime under the codewhale and

codew command names, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz

cd codewhale-<platform>

./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs
  
  codewhale.exe, codew.exe, and codewhale.bat under
  
  %LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
  
  current-user PATH, and creates a Start Menu shortcut that prefers
  
  Windows Terminal (wt.exe) when it is installed.


• Extract the archive for your machine: codewhale-windows-x64.zip or
  
  codewhale-windows-arm64.zip


• Double-click codewhale.bat (not the raw .exe) to launch


• Run install.bat to copy the binaries and launcher to %USERPROFILE%\bin


• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived codewhale-<platform> and

codew-<platform> assets. The seven codewhale-tui-<platform> filenames

attached to v0.9.5 are byte-identical compatibility copies used only to let

already-installed v0.9.4 clients discover and cross this single-binary

transition; current installers do not expose a third runtime. The legacy npm

package deepseek-tui is deprecated and is not republished. For migration

from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles

sha256sum -c codewhale-bundles-sha256.txt --ignore-missing



# Linux — individual binaries

sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing



# macOS

shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing

shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.10.0

Codewhale v0.10.0 brings a redesigned terminal workbench, clearer settings, and

more reliable session and runtime behavior. It supersedes the unpublished

v0.9.14 candidate.

Security

• 
  

  Children never inherit desktop or computer-control tools. Desktop control is
  
  the most machine-wide capability in the catalog, and a verifier child
  
  inherited it by default: on 2026-09-17 one opened the host Terminal and typed
  
  a blocked shell command into the user's live session. A family classifier now
  
  removes those tools when a child's registry is built, so they are neither
  
  eager nor searchable, and execute_full refuses the family at dispatch for
  
  every child role — visibility is a grant, and hiding is not the only defense
  
  (#6296).

  
  


• 
  

  Runtimes can be held to an organization's plugin allowlist. A managed policy
  
  document (managed-policy.json beside state.json, or
  
  CODEWHALE_MANAGED_POLICY_PATH) lists the plugin ids a Runtime may run,
  
  with an allow_unlisted flag and a schema version checked exactly like
  
  PluginStateFile. Enforcement sits inside apply_state, so a plugin
  
  enabled before the policy arrived — or hand-edited to enabled: true —
  
  never comes back enabled, and enable() re-reads the document so a policy
  
  landing after discovery refuses with a reason that names it. A malformed
  
  document fails closed rather than degrading to unenforced. With no policy
  
  present, behaviour is bit-for-bit what it was. This is the enforcement
  
  primitive only; the authority that decides the allowlist is still local,
  
  so it binds a cooperating Runtime, not a hostile one.

  
  


• 
  

  Approving an apply_patch "for the session" is now scoped to the file you
  
  approved. The grouping key that scopes a session grant was built by a second,
  
  weaker patch parser that read only +++ b/ headers and the replace array:
  
  it saw no target at all for the documented apply_patch{path, patch}
  
  override, for --no-prefix diffs, or for delete-only diffs, and collapsed
  
  every one of them to a single shared key. One approval therefore pre-approved
  
  every later patch of that shape, to any file, with no card and no notice. The
  
  key now comes from the same resolver the executor and the permission path
  
  already use, and an input that cannot be resolved gets its own key rather
  
  than a shared one (#6247).

  
  

Added

• 
  

  The statusline's performance readings survive compact mode and are separately
  
  configurable. Measured TTFT and average output rate are kept when space
  
  allows, shedding help text and secondary counts first; the existing metrics
  
  and statusline settings gain individual toggles with a migration that
  
  preserves a legacy single setting, and the picker takes mouse selection and
  
  scrolling.

  
  


• 
  

  Tasks can be given their own run name. NewTaskRequest, TaskRecord and
  
  TaskSummary carry an optional name, stored as given and omitted when
  
  absent, so queues still fall back to prompt-derived titles; a run started by
  
  an automation inherits the automation's name. The tasks tool's schema
  
  extends backward-compatibly and legacy records decode through serde defaults
  
  (APPS-153).

  
  


• 
  

  The offline catalog seeds Xiaomi's MiMo 2.6 family — xiaomi/mimo-v2.6-pro
  
  and xiaomi/mimo-v2.6-flash — so a first boot without network no longer shows
  
  the 2.5 generation. DEFAULT_XIAOMI_MIMO_MODEL stays on mimo-v2.5-pro, and
  
  the rows carry no price because the published rates cover only sk- keys.

  
  


• 
  

  Native memory is a reviewed store, not a model-writable file. codewhale-memory
  
  backs the TUI with SQLite as the authority instead of Markdown, and the
  
  remember tool now only proposes candidates — a model can no longer write
  
  an active memory. /memory and the Runtime API commit through
  
  remember_reviewed, and a Context Lens surface (/v1/memory/lens,
  
  /lens/actions, /events) shows what was kept and why.

  
  


• 
  

  Code mode (Experimental, default off): execute_tools runs a JavaScript
  
  program against a QuickJS host surface so a model can express several tool
  
  calls as one program. Nested calls must be read-only and auto-approved; the
  
  tool is hidden in Plan and refused under worker authority. Enable with
  
  [features] code_mode.

  
  


• 
  

  Two new built-in providers: ZenMux (ZENMUX_API_KEY) and CSDN 星图
  
  (CSDN_API_KEY, Coding Plan quota billing), each with its own key slot,
  
  bootstrap model and catalog rows.

  
  


• 
  

  The Runtime API gained the surface a native client actually needs: jobs with
  
  stdin, kill and cursor reads; context, secrets, git, diagnostics, targets,
  
  LSP and voice routes; GET /v1/commands for the slash-command catalog;
  
  GET /v1/workspace/instructions; account-wide GET /v1/approvals; plan and
  
  to-do inventory; /v1/settings/schema, with POST /v1/config now persisting
  
  every declared settings.toml key rather than a curated allowlist; PTY byte
  
  replay, resize and exit; and tool images as session artifacts.

  
  


• 
  

  Codewhale holds the host's idle-sleep assertion while a turn is in flight
  
  (caffeinate -i on macOS, systemd-inhibit on Linux), so an unattended
  
  machine no longer sleeps mid-run. You will see one child process per turn.

  
  


• 
  

  Skills are reachable in one call. The pinned ## Skills index told the model
  
  to call load_skill, but the tool was deferred behind tool_search, so it
  
  was never in the tool array that instruction was printed beside: using a
  
  skill cost a discovery hop, a name="list" round trip, and a
  
  change:tool_surface re-pin of the whole cached prefix. load_skill is now
  
  eager for the parent and for children — +244B of pinned catalog, measured,
  
  against a re-prefill avoided every time a skill is used — and it takes a
  
  query that searches names and descriptions, so a truncated index no longer
  
  forces pulling the whole catalogue to find one skill. The usage line now says
  
  to load the matching skill by name before starting the work.

  
  


• 
  

  A fast lane the router cannot serve now says so. provider_router_candidates
  
  answers cheap: None for any pair its tables do not know, and a
  
  Faster/Auto child on such a pair used to run at the parent's model and
  
  price with no receipt and no way to tell "single tier by design" from
  
  misconfiguration. The fallback stays — the router must not invent a model —
  
  but the spawn receipt now carries a fallback_note naming the unserved lane,
  
  the same field the pinned-provider fallback already uses. Inherit and
  
  served lanes stay quiet: this reports a fallback, it does not nag.

  
  


• 
  

  The runtime API tells a replayed submission apart from a new admission:
  
  POST /v1/threads/{id}/turns answers 200 with idempotent_replay: true
  
  when the operation key was already used, and 201 for a fresh admission, so a
  
  client that retries after a dropped response can no longer create a second
  
  turn. The flag is absent on a fresh admission, so responses existing clients
  
  already parse are unchanged (#76).

  
  


• 
  

  Event streams resume where they left off: journal frames carry their durable
  
  seq as the SSE event id:, Last-Event-ID is honoured as the cursor when
  
  no explicit since_seq is asked for, and RuntimeCapabilities advertises
  
  event_stream_resume so a client can gate its reconnect controls on the
  
  capability instead of discovering it from a missing id (#76).

  
  


• 
  

  TTFT and average output rate stay visible in the compact working footer when
  
  space allows. /statusline now controls them separately; existing
  
  session_metrics settings still work.

  
  


• 
  

  StepFun’s current coding catalog includes Step 5 Preview, Step 3.7 Flash,
  
  Step 3.5 Flash and its 2603 version, with published reasoning controls and
  
  PAYG rates. Existing Step Plan routing remains subscription-based.

  
  


• 
  

  read responses now always report the file's byte size, line count, and
  
  whether output was truncated, and truncation footers name the total size
  
  alongside the continuation offset — so paging through a large file is
  
  deliberate instead of a surprise (#6283).

  
  


• 
  

  File edits are parse-gated before the write lands: Rust goes through
  
  syn::parse_file for a grammar-exact line:column, and .toml / .json
  
  through the parsers already vendored. An edit is refused only when the file
  
  parsed before and would not parse after — repairing an already-broken
  
  file is the commonest reason to edit source at all, so pre-existing breakage
  
  and new files fail open. The check precedes the write, so a rejection leaves
  
  the file untouched and apply_patch cannot half-apply (#6204, #6206, #6151).

  
  


• 
  

  Rust files that were already rustfmt-clean are re-normalized after an edit,
  
  so the next patch's anchors still match. Hand-formatted files are never
  
  rewritten, and every failure path skips and lets the edit land (#6205, #6151).

  
  


• 
  

  Native clients can finish provider setup without dropping to the CLI:
  
  DELETE /v1/providers/{id}/key clears a Codewhale-owned credential through
  
  the same shared owner as codewhale auth clear, and GET /v1/providers
  
  now carries credentialSource / credentialWritable (plus a reason) so a
  
  client disables its control with a truthful explanation instead of letting
  
  a write fail late. A credential Codewhale does not own — a literal key in a
  
  config file, or an active external consent — refuses both verbs with 409
  
  rather than appearing to succeed against a source that still wins at
  
  request time (#6179).

  
  


• 
  

  The interactive approval card can be bounded: [approval] timeout_seconds
  
  resolves an unanswered card to deny when the window elapses — the same
  
  fail-closed decision the external approval path takes — and the transcript
  
  says the bound denied the call, not the operator. Omitted or 0 keeps
  
  today's unbounded wait, so nothing changes unless you opt in (#6101).

  
  


• 
  

  Transcript drag selection copies Markdown source by default: every cell the
  
  selection touches serializes through the same canonical path Ctrl-Y and
  
  /copy use, joined with blank lines, and the toast names the copied cell
  
  count. A selection that does not cover every touched cell end to end copies
  
  the exact rendered fragment instead: rounding a pinpoint selection out to
  
  whole cells meant copying an entire model message (#6228).
  
  tui.selection_copy_markdown = false keeps the rendered-text payload
  
  (#6156).

  
  


• 
  

  The Runtime API serves the workspace files a native client browses and edits:
  
  GET /v1/workspace/files lists one directory, GET /v1/workspace/files/read
  
  returns a bounded byte window with a whole-file SHA-256 revision, and
  
  PUT /v1/workspace/files writes atomically through the confined opener with
  
  revision-checked overwrites (409 on drift). .git is never served and
  
  symlinks are never followed. A saved session's oversized tool outputs are
  
  served as artifacts at GET /v1/sessions/{id}/artifacts and
  
  GET /v1/sessions/{id}/artifacts/{artifact_id}. (#6163)

  
  


• 
  

  A session that ended mid-turn is no longer invisible to the model. The newest
  
  workspace-scoped session still holding a crash-recovery checkpoint is
  
  surfaced as a one-line ## Prior Session notice in the session-pinned prompt
  
  prefix — metadata reads only, excluding the live session and any session this
  
  process instance created. Clean sessions get no block, so their prefix bytes
  
  are unchanged. Two bounded read-only tools, session_search and
  
  session_get, give the model workspace-scoped recall over the same store
  
  (one-line summaries and an 8-message tail, labeled untrusted user data, read
  
  on the blocking pool). Resuming stays the user's decision: the hint tells the
  
  model to offer a continuation, never to silently take one (#5715).

  
  


• 
  

  codewhale exec --hooks opts a headless run into the same HookExecutor the
  
  TUI builds — global config, reviewed plugin snapshots, and trusted project
  
  hooks.toml. Headless runs previously fired no hooks at all. tool_call_before
  
  can still deny and shell_env still applies; a hook ask resolves
  
  fail-closed without a terminal. Fleet worker subprocesses never opt in, and
  
  permissions.toml typed rules are unchanged (#6099).

  
  


• 
  

  codewhale doctor flags fleet and profile model pins that the provider's own
  
  roster no longer offers. A pin is reported only when a fresh cached live
  
  roster for that exact route exists and omits it — stale, failed, or absent
  
  rosters prove nothing and are counted as unverifiable rather than raising a
  
  false warning. Each row names the route and every owner of the pin; the pin
  
  is surfaced, never rewritten (#6035).

  
  


• 
  

  Background-capable clients can enumerate owned work and watch TUI-visible
  
  conditions: GET /v1/threads/running lists threads with queued or
  
  in-progress turns in one call (one turns scan grouped by thread), and
  
  GET /v1/threads/{id}/notices serves active subagent-terminal,
  
  elevation-needed, and model-notify notices with thread/turn identity,
  
  cleared by ack or — for elevation — when the tool call completes (#6180,
  
  #3757).

  
  


• 
  

  Sub-agent launches adapt to provider throttling: a DynamicGate replaces
  
  the fixed semaphore so launch capacity adjusts at runtime, and a
  
  RateLimitGovernor halves capacity on 429 pressure, pauses admissions
  
  past the threshold, and recovers additively; 429 retries honor
  
  Retry-After with jittered backoff, and quota exhaustion keeps the
  
  failure path (#6055).

  
  


• 
  

  Turns record the mode they ran in, so mixed-mode sessions stay legible
  
  after the fact (#6321).

  
  


• 
  

  Shell spawning refuses NUL bytes in command and cwd before spawn, and
  
  sub-agent runs fall back loudly past credentialless profile provider
  
  pins instead of misrouting silently (#5529, #6318, #6320).

  
  


• 
  

  Children land past a per-step context bound instead of burning
  
  quadratically, and status rows surface live declared-vs-observed writes
  
  (#6189, #6194).

  
  


• 
  

  Queued Agent Mail can be cancelled before delivery, and the TUI
  
  suspend/resume handshake restores on stop and rebuilds on continue
  
  (#6176, #6169).

  
  


• 
  

  MCP connections are supervised: dead servers are probed and reconnected
  
  with transitions reported, and a failed reconnect keeps the last-good
  
  catalog instead of dropping tools (#6187, #6142).

  
  


• 
  

  Web search autodetects Tavily from TAVILY_API_KEY (Firecrawl stays the
  
  default), fleet refusals name the alternative, and verification runs on
  
  a bounded Git fetch plus a merge_tree verify surface (#6298, #6296).

  
  


• 
  

  Fleet authority projects through one ChildGrant, and ModelScope joins
  
  the built-in providers (#5633, #6299).

  
  


• 
  

  Child tool results are capped at capture time, and run
  
  tests/verifiers accept a bounded cwd (#6282, #6294, #6296).

  
  

Changed

• 
  

  SearXNG results rank by the score the instance returns rather than by arrival
  
  order. Integers, floats and numeric strings are accepted; anything else,
  
  including NaN and infinity, becomes 0.0, and rows are stable-sorted descending
  
  before the result cap, so equal scores keep instance order. The docs now spell
  
  out the self-hosting requirement: the separate process must expose
  
  search.formats: [json] — an HTML-only instance answers 403 — and bind to
  
  loopback or a policy-allowed host, with no default instance discovered.

  
  


• 
  

  The bundled skills move to a new generation. social-media and health leave the
  
  shipped pack (phone-export workflows rather than everyday skills), feedback
  
  moves to docs/skills/ beside contributor onboarding, and the exact earlier
  
  body is retained so only unmodified shipped skills upgrade — a skill you have
  
  edited is left in place. Google OAuth scopes and client setup, Photos exports,
  
  forgetting limits, Spotify playback and plugin reload guidance were corrected
  
  in the same pass.

  
  


• 
  

  auto is a declared default, not a guess about your wording. Reasoning
  
  effort no longer maps request vocabulary to tiers (debug/error to Max, search
  
  to Low) and Auto routing no longer infers cheap-versus-big from phrasing:
  
  both resolve the configured default, with [auto] cost_saving as the
  
  explicit opt-in. The same prompt now costs the same thing twice.

  
  


• 
  

  A workflow's shared token budget is opt-in. [workflow] default_token_budget
  
  applied a silent 120,000-token cap across a run and all of its children, and
  
  a fan-out died at the limit with no hand-back; the default is now 0, meaning
  
  no shared cap.

  
  


• 
  

  The shipped deepseek-flash route speaks the Responses endpoint, and xhigh
  
  effort maps to high per the vendor's own table.

  
  


• 
  

  Streamed text is paced at a steady rate rather than inheriting the provider's
  
  SSE chunking, so output reveals at a readable beat instead of in bursts.

  
  


• 
  

  Broadening shell access for a conversation now requires an idle conversation
  
  and rejects a stale-workspace check before it commits. Engines advertise a
  
  thread_shell_consent capability, so an older Engine reads as unsupported to
  
  a native consent client instead of silently accepting.

  
  


• 
  

  One base prompt now serves every host. HEADLESS_BASE_PROMPT was a second
  
  hand-maintained rendering of the same constitution — the drift pattern this
  
  repo forbids by convention — so headless runs compose the same BASE_PROMPT
  
  plus language and output layers that interactive runs do, skipping only host
  
  chrome (execution profile, authority recap). Headless and interactive can no
  
  longer disagree about what the agent is.

  
  


• 
  

  BASE_PROMPT gains a Bearing article, which changes how the agent talks
  
  to you: the user is a peer who gets honesty rather than deference, a blocking
  
  gate is named plainly instead of dressed up as refusal, bad code is called
  
  bad, a crude request is carried out without a lecture, and an apology appears
  
  only when there is something to apologize for — not as punctuation. It also
  
  states that the request is the whole mandate, so the scope law opens with
  
  what is yours to do before it reaches the edge. Every pinned kernel invariant
  
  survives verbatim.

  
  


• 
  

  The ocean reads as animals rather than a mechanism. The school used to
  
  translate as one rigid body — bob phase and tail pose were staggered per
  
  fish, but horizontal position was locked to an exact wedge offset — so each
  
  fish now eases a dot fore and aft of its slot on its own slow period, and the
  
  formation breathes while it travels. Bubble emission and the per-animal
  
  periods are hash-jittered instead of sharing one clock. Amplitude stays an
  
  order of magnitude under the crossing speed, so no fish travels against the
  
  school and facing == velocity still holds by construction. The species list
  
  is unchanged.

  
  


• 
  

  Extensions keeps the exact-content plugin review on the panel: confirming
  
  a bundle's digest re-reads the inventory, so the row you just reviewed
  
  reports its new trust state and offers Enable instead of leaving you in
  
  the transcript with a stale "not reviewed" row.

  
  


• 
  

  Underwater motion ticks at the cadence the frame limiter actually draws
  
  (the atmosphere interval while only the water moves, the authored 80 ms
  
  ocean cadence inside the interactive cap while a turn streams), and the
  
  event loop wakes exactly for the next tick instead of on the next idle
  
  poll. Idle water no longer requests frames it cannot draw or quantizes its
  
  cadence to the poll interval; reduced motion, Ghostty, tmux and the
  
  six-second idle settle are unchanged.

  
  


• 
  

  The launcher keeps the Codewhale mark while balancing its layout above the
  
  composer. A single cursor identifies the selected action; MCP faults retain
  
  their warning color even in compact terminals. Recent-session counts now
  
  read correctly for a single message.

  
  


• 
  

  Model and provider settings use quieter selection surfaces, one focused
  
  cursor, clearer missing-key warnings, compact output limits, and less
  
  repetitive credential detail. Plugin actions use plain labels.

  
  


• 
  

  The terminal opens on Shoreline, the same palette the GPUI client already
  
  uses: warm charcoal field #211F23, a raised plate for panels and the
  
  composer, one blue for action and selection #90B9FF, and the whale's ivory
  
  #F2ECE5 for body text, with 4.5:1 floors on every muted step. The old
  
  saturated navy gradient is not gone — it is a named underwater theme, and
  
  after review it is once again what a fresh 0.10.0 install opens on
  
  (DEFAULT_TUI_THEME); Shoreline is one /theme away. Existing installs keep
  
  whatever theme they have saved (#6222).

  
  


• 
  

  Menu navigation is starting to mean the same thing everywhere. menu_style
  
  already single-sourced how a selected row looks; what a key does was still
  
  reinvented per surface — h/l in the provider picker against Left/Right
  
  in the model picker one screen later, Home/End in one of seven pickers, and
  
  no paging at all in Fleet's detail view. list_nav, which already owned the
  
  wrap arithmetic, now owns the vocabulary too: one vertical axis, one
  
  horizontal axis, and two entry points so a picker with a live filter never has
  
  a letter stolen out of its query. Fleet's detail view adopts it first and
  
  gains PageUp/PageDown and Home/End in both its lists (#6290).

  
  


• 
  

  Reviewed plugin bundles are no longer re-hashed four times per MCP dispatch.
  
  verify_plugin_authority walks and hashes both the reviewed source and the
  
  runtime snapshot, and four separate authority checks ran per tools/call —
  
  eight tree walks. Three of them sat one statement after a
  
  validate_before_use on the same source, so is_ready re-verified what had
  
  just been verified; readiness and authority are now separate, and only the
  
  callers with no preceding check still pay for both. The tool catalog is built
  
  once per turn instead of twice, which also removes a case where the two
  
  assemblies could disagree if authority drifted between them. The digest is
  
  deliberately not cached on (path, mtime, len): the reviewed tree is
  
  user-writable and utimensat(2) lets a same-uid process restore an mtime
  
  after an equal-length rewrite, so a stat-keyed cache would serve a pre-tamper
  
  digest (#6209).

  
  


• 
  

  A sub-agent's completion is read from the manager once instead of polled. The
  
  workflow pump re-read it up to fifty times, sleeping 20ms between attempts,
  
  waiting for a terminal status that was already committed — every publisher
  
  commits the status inside the same &mut self call that wakes the pump, so
  
  the write guard spans both and the first read always sees it. A child the
  
  manager had no record of cost a full second of head-of-line blocking before
  
  failing; it now fails immediately, and says what actually happened instead of
  
  claiming the child "did not report a terminal status within 1s" (#6211).

  
  


• 
  

  MCP protocol negotiation: every surface advertised the original 2024-11-05
  
  revision and the stdio client required an exact match, so newer servers
  
  could not connect. The server and both clients now advertise 2025-06-18
  
  and negotiate over the supported set (2025-06-18, 2025-03-26, 2024-11-05)
  
  — the server echoes the client's revision when it is supported and answers
  
  with the latest otherwise, the stdio client accepts any supported revision,
  
  and streamable HTTP sends the required MCP-Protocol-Version header on
  
  every post-initialize request (#6280, first half).

  
  


• 
  

  Configured MCP servers now connect lazily instead of all at session boot. The
  
  pool owns a connecting set marked at spawn and cleared on resolution or
  
  abort, so "connecting" is no longer inferred as enabled-minus-connected. The
  
  boot pass scopes to the eager set — required servers plus those covered by
  
  tools.always_load / allowed_tools — and a turn naming an unstarted server
  
  spawns its connects alongside, under the existing five-second deadline. A
  
  configured-but-unstarted server now reads as configured on every surface
  
  (session-boot rows, Extensions tab, launch card), never as connecting.
  
  docs/MCP.md documents the lifecycle (#6033).

  
  


• 
  

  The launch card's MCP problems row runs its own remedy. It already printed
  
  /mcp login <name> or /mcp; it now joins the shared paint/click/keyboard
  
  ordering, so Up/Down lands on it and Enter or a click types the printed
  
  command into the composer for you to send. Typing beats copying: no clipboard
  
  dependency over SSH, and you see the command before a second Enter runs it
  
  (#6085).

  
  


• 
  

  Computer Use is the only computer-use product in Extensions and
  
  /mcp recommendations. Cua is no longer suggested as a parallel
  
  desktop-control MCP; enable the first-party computer-use plugin
  
  instead. The bundled plugin is 0.11.2 — macOS beta, with the Windows and
  
  Linux backends experimental and source-only. It carries the per-app consent
  
  ledger, background-by-default control, and a focus lease that refuses rather
  
  than stealing the foreground, alongside get_app_state, focus/get_value
  
  and stop_computer_control. Shared-desktop pointer gestures stay gated, and
  
  arbitrary background dragging remains unavailable.

  
  


• 
  

  The bundled first-party catalog pins marketplace revision
  
  d8640b17f27542e7122c76368724196f92a0af61, so installing Computer Use from
  
  the Extensions listing fetches the same 0.11.2 source the binary already
  
  carries.

  
  


• 
  

  Materializing is not enabling: the built-in bundle is written under
  
  $CODEWHALE_HOME/builtin-plugins on first run but stays NeverReviewed,
  
  so Computer Use is never switched on without an explicit capability review.

  
  

Removed

• The host no longer parses prose into goals. Ten phrasings and a clause
  
  allow-list ("make it your /goal to …") were turned into durable goals before
  
  the provider call; prose now reaches the model, which calls create_goal when
  
  a goal is useful. The deterministic path — a leading /goals <objective> — is
  
  unchanged.

Fixed

• 
  

  A thinking fold is an absolute choice again. The stored bit was relative to the
  
  display preference (folded ^ !(verbose || thinking_default_expanded)), so
  
  every recorded choice flipped meaning the moment a preference changed: turning
  
  thinking_default_expanded on closed a block the reader had explicitly
  
  expanded (#5847). An explicit tri-state intent now records Expanded or
  
  Collapsed outright, and the absence of an entry means untouched, so the
  
  preference baseline decides that cell's default. Space still toggles, and an
  
  untouched cell still follows verbose || thinking_default_expanded.

  
  


• 
  

  A terminal byte-stream cursor past the head is clamped instead of echoed back.
  
  read_since returned a future cursor as next_cursor, so a client that
  
  continued from it skipped every byte the stream produced before reaching that
  
  position — permanently. The start position now clamps to total: a future
  
  cursor reads nothing, is not a gap, and hands back the head.

  
  


• 
  

  Language-server startup is bounded and a failed transport now terminates. The
  
  client waits for successful initialization before sending notifications,
  
  drains stderr without buffering it, bounds request queueing and replies, caps
  
  protocol frames, and fails pending requests when the child transport dies.

  
  


• 
  

  Input no longer freezes for the rest of a turn when the engine's 32-slot op
  
  mailbox is full. The remaining input-path sends no longer await: droppable ops
  
  whose rejection is reported and retryable use try_send (CancelSubAgent,
  
  PreviewOutboundRequest, bang shell input, PurgeContext, and the single-op
  
  settings updates), ops that must land once the UI changed reserve first, and
  
  ChangeMode publishes its live authority even on a full channel. Must-deliver
  
  ordered transitions still await, and say why at EngineHandle::send (#6150).

  
  


• 
  

  The pet's whale is one body again. The same authored point set is checked in
  
  three copies plus four fixtures, and the Rust and TypeScript cores disagreed
  
  on particle positions from frame 0 while agreeing on every channel and
  
  constant — so the v1 fixtures had never matched what Rust produced and the
  
  conformance job had never passed. The bodies and the fixtures are reconciled
  
  and that check now runs green.

  
  


• 
  

  The context meter and the auto-compact gate share one honest estimator. The
  
  status bar inflated ctx % by about half and disagreed with the gate, so
  
  "ctx 82%" could sit beside a /compact that refused to run; displayed
  
  percentages now read materially lower because they are correct (#6297).

  
  


• 
  

  A steer the engine never accepted is queued for the next turn instead of
  
  being shown as held and then silently dropped with no turn and no answer
  
  (#6297).

  
  


• 
  

  Every reqwest client routes through codewhale_release::tls. A bare
  
  Client::builder() panics under rustls with no installed provider; 17 call
  
  sites were swept.

  
  


• 
  

  The bundled OpenAI-compatible hosts have their /provider rows back.
  
  Retiring the ProviderSetupTemplate layer moved SenseNova, Baseten, Groq,
  
  Cerebras, DashScope and Command Code into provider_descriptors.json and
  
  then wired that file to nothing, so six vendors silently lost their picker
  
  rows; AICraft never had one. Each descriptor is a row again, built through
  
  the same named-custom-provider builder a configured host uses, so endpoint,
  
  bootstrap model and "missing <ENV>" reporting all come from one place. A
  
  descriptor whose id or alias already names a [providers.*] entry is
  
  dropped, so a configured row stays the only one. These rows are an
  
  invitation, not a route: they are not is_configured, and only the form's
  
  submit writes anything (#6289).

  
  


• 
  

  A StepFun Step Plan subscription reaches its own catalog. A subscriber's
  
  base_url is https://api.stepfun.ai/step_plan/v1, but only the
  
  pay-as-you-go /v1 host was recognised as official, so the Step Plan host
  
  read as a custom endpoint, the catalog was withheld, and the picker showed
  
  0 bundled and a guessed context window for a route whose console
  
  advertises step-5-preview at 1M context. The model was in the seed the
  
  whole time. All four StepFun hosts — global (.ai) and China (.com), each
  
  with a /v1 and a /step_plan/v1 surface — are now recognised; a host
  
  StepFun does not own stays custom and keyless, since this predicate also
  
  scopes credentials.

  
  


• 
  

  The send cue stopped strobing while you type. [↵] flickered between dim
  
  [·] and bold blue once per character at an ordinary typing pace. The cue
  
  was not lying — Enter really does insert a newline during the ~120 ms
  
  paste-safety window, which every keystroke re-armed — but that window only
  
  exists for terminals that deliver a paste as a burst of ordinary keystrokes.
  
  Ghostty, iTerm2, WezTerm, Windows Terminal and Terminal.app now skip the
  
  heuristic from the first keystroke instead of waiting for proof by paste.

  
  


• 
  

  Shift+Tab sets the permission posture in Plan. Tab cycles the mode and
  
  Shift+Tab cycles Ask/Auto-Review/Full Access, but Plan refused the second
  
  one outright, so the key silently did nothing there and the two axes read as
  
  welded together. Plan's read-only guarantee comes from the mode, not the
  
  posture — authority maps (Plan, _, Bypass) to SandboxPolicy::ReadOnly
  
  and tool_catalog gates every write tool on mode != Plan — so the cycle
  
  now moves the durable Act/Operate baseline while Plan's live policy stays
  
  Suggest, and a toast says the posture lands when the mode leaves Plan.

  
  


• 
  

  A steer delivered mid-turn now clears its pending card. The transcript
  
  showed the message and the model answered it, while the "sending into this
  
  turn" card still listed it as pending: turn_loop commits a steer trimmed,
  
  but the UI handed the engine the untrimmed text and kept that same copy for
  
  matching, so a composer newline made the two differ by whitespace alone and
  
  the steer was never promoted to a transcript cell. The text is trimmed once
  
  at the source that feeds both, so they are the same string by construction;
  
  the match stays an exact ==.

  
  


• 
  

  A Xiaomi MiMo key no longer fails verification with another vendor's 401.
  
  The legacy top-level base_url is a DeepSeek field, and a route without an
  
  endpoint of its own inherited it — so a config carrying
  
  base_url = "https://api.deepseek.com" made that host the MiMo route's
  
  endpoint. The custom-endpoint guard correctly withheld the MiMo credential
  
  from a host the route does not own, and the setup wizard's probe, which
  
  bypassed the guard, sent the key as api-key: — a header DeepSeek ignores.
  
  The result was HTTP 401 Unauthorized: Authentication Fails (governor),
  
  DeepSeek's unauthenticated 401, shown to someone who believed they were
  
  testing their own key. Every layer that reads the root now inherits it only
  
  when the URL belongs to that provider's own official endpoint family;
  
  DeepSeek, which owns the field, is unchanged, and any other host is still
  
  expressible on [providers.xiaomi_mimo] base_url. Key verification
  
  failures now also name the endpoint that was probed, so a wrong endpoint
  
  reads as a wrong endpoint instead of a bad key.

  
  


• 
  

  The Extensions panel can act on the rows it shows. Every plugin now carries
  
  its on/off switch — Space, or e — including one that has never been
  
  reviewed: /plugin enable already routes an unreviewed bundle into the
  
  exact-capability review and only flips the switch once you confirm the
  
  digest, so withholding the control bought no safety and left the shipped
  
  computer-use bundle reading disabled with nothing that could enable it.

  
  


• 
  

  The panel stopped saying "untrusted". A bundle that is waiting on its
  
  capability review now reads needs review — off · needs review when the
  
  switch is off too — and its detail line says what Codewhale is withholding
  
  and which key ends the wait, instead of restating an internal pair of
  
  booleans. Enter's verb on that row is review, not inspect.

  
  


• 
  

  MCP servers say where they live, and mutations write there. Each row is
  
  labelled global, project, or plugin: <name>. Enabling, disabling or
  
  removing a workspace-scoped server previously edited the user's global file
  
  and failed with "MCP server '' not found" on a row the panel had just
  
  offered; the write now lands in the file that declares the server, and a
  
  plugin-contributed server says it is switched off by disabling its plugin.

  
  


• 
  

  The permanent "Plugins · Problems: N" footer chip is gone. It could not be
  
  acted on from the footer, and its count and the Plugins tab disagreed by
  
  construction — the chip counted bundles waiting on a review while the tab's
  
  Problems group lists only registry-level diagnostics, so the rows behind the
  
  number were never the rows you found. A bundle waiting on a review is a row
  
  with an action, and /plugins states it per bundle next to the key that
  
  resolves it.

  
  


• 
  

  The Extensions marketplace no longer advertises what it cannot install.
  
  Browser Use and the sandbox runtime were pinned rows whose only possible
  
  action was unavailable; they are removed, along with the browser-driver
  
  and sandbox-runtime component vocabulary that existed solely to describe
  
  them.

  
  


• 
  

  Configuration parsing keeps the parsed base config boxed, so loading a
  
  profile no longer carries the full Config by value through the
  
  deserializer and overflows a default 2 MiB test-thread stack; the
  
  runtime-store binding test that also overflowed is split into phases and
  
  pinned to that budget so CI's larger stack cannot mask a regression
  
  (#6362).

  
  


• 
  

  Stopping a turn revokes its pending approvals. A late approval cannot resume
  
  the cancelled action or save an automatic approval for later turns.

  
  


• 
  

  Expanding and collapsing selected reasoning now matches its rendered state
  
  when verbose mode and the default-expansion preference are both enabled.

  
  


• 
  

  Branch navigation preserves sibling histories, stable entry IDs and timestamps
  
  through autosave, resume and forks, and synchronizes the selected branch into
  
  the live engine. Thanks to @7jrxt42BxFZo4iAnN4CX for the report (#6367).

  
  


• 
  

  Compaction now writes local diagnostic records for completed passes and
  
  automatic refusals. codewhale metrics reports them with summarizer token
  
  usage; text-mode exec retains its session after attempting compaction.
  
  Historical artifacts are not backfilled. Thanks to @7jrxt42BxFZo4iAnN4CX
  
  for identifying the missing producer (#6368).

  
  


• 
  

  The opening workbench retains the canonical Codewhale mark in a responsive
  
  header while keeping recent-session titles full-width and actions clickable.

  
  


• 
  

  serve --acp no longer ignores the approval posture. The ACP adapter
  
  hardcoded ApprovalMode::Suggest, so --yolo (and any configured
  
  approval_policy) never reached admission: every mutating tool parked
  
  behind a permission request no unattended client answers, and sessions
  
  executed zero tools. Posture now derives from server config — --yolo
  
  pre-approves prompts and flows into the sandbox policy — while hard blocks
  
  (safety floor, repo law, reviewer consult) and the Plan read-only guardrail
  
  stay intact (#6337).

  
  


• 
  

  Plain agent spawns could not resolve. built_in_members() seeded both
  
  general and worker, and the role parse boundary migrates worker to
  
  general, so both canonicalized to the same role — and role:general, the
  
  selector the roster advertises for the default posture, matched two members
  
  and raised Ambiguous every time, permanently. The duplicate built-in is
  
  gone. The legacy name still resolves: general, member:general,
  
  role:general and default all land on the worker posture through the
  
  identity selector rather than through a second member, which is what allowed
  
  the duplicate to be removed (#6244).

  
  


• 
  

  Clicking a path:line in tool output no longer spawns $EDITOR detached
  
  while the TUI still owns the terminal, and no longer spawns one editor per
  
  matching line. The launch goes through the single terminal-handoff path, and
  
  a click is one request to open one file (#6235).

  
  


• 
  

  A write-scope contention refusal now names a remedy that works. The agent
  
  tool's description claimed release was "the remediation a write-scope
  
  contention refusal names"; the refusal did not name it, and pointing back at
  
  it would have been worse, because release only clears claims whose owner is
  
  no longer running while a contention refusal names a live one. The refusal
  
  itself now says to wait for that owner to settle or cancel it (#6272).

  
  


• 
  

  The session picker no longer refuses a saved session whose Runtime store
  
  exists but holds nothing. A force-quit leaves the store on disk, ownerless
  
  and empty, and the switch path refused it because recovery only covered a
  
  missing store. A switch now also adopts a store that is provably empty
  
  (every work directory, plus the event sequence that remembers pruned
  
  appends) and provably unheld (the process-owner lock, which a live
  
  manager holds from open to close), with no automation pinned to its
  
  execution scope — and the save gate treats that shape as abandonable too,
  
  so the repaired binding persists. The first fix was reverted on a race
  
  (emptiness without liveness); this reland checks the lock first (#6207).

  
  


• 
  

  Double-tap Enter now sends every queued follow-up into the running turn,
  
  oldest first. The second Enter used to steer only the most recent message
  
  and leave older ones queued; a failed steer restores the failed message
  
  plus everything unattempted in original order, so nothing is lost or
  
  reordered.

  
  


• 
  

  Only the most recently sent prompt carries the elevated-surface background
  
  now; every older prompt renders on the bare ground. The fill used to sit
  
  behind every user row (striping), then behind none; newest-only keeps the
  
  eye on the turn in play. Sending a new prompt moves the highlight and
  
  un-highlights its predecessor.

  
  


• 
  

  Diff rows tint whole: added/deleted line numbers now share the row's green
  
  / red background instead of sitting bare next to a painted body. Context
  
  rows stay on the bare ground.

  
  


• 
  

  MCP connections are supervised now: a background task notices a dead
  
  server within one sweep, reconnects on the existing backoff ladder, and
  
  reports each transition, so Extensions rows flip with liveness instead
  
  of parking on stale-ready or a silent [reconnect]. Five consecutive
  
  failures park the server with a notice naming /mcp retry; an explicit
  
  retry or a fresh connection resumes watching. Tool calls also retry
  
  once across a dead pipe/socket (not just stale sessions), and a
  
  reconnect that fails reports both errors instead of swallowing the
  
  original (#6187; list_changed catalog refresh stays open).

  
  


• 
  

  A steer the engine never delivered is no longer reported as sent. The runtime
  
  API persisted the steer item as already-Completed and emitted
  
  turn.steered + item.completed the moment the text entered the engine's
  
  mailbox — before the engine decided anything. The engine discards a steer
  
  whose turn has moved on, and an interrupted or failed turn drops whatever it
  
  had queued, so a GUI could show "Guidance sent", clear the composer, and lose
  
  the user's words. The engine now returns a verdict for every steer on every
  
  exit path, the item settles completed or canceled to match, a dropped
  
  steer emits turn.steer_dropped and answers 409 so a client can resend,
  
  and steer_count counts steers the model actually received (#6276).

  
  


• 
  

  <recommended_plugins> suggestions stop nagging: a plugin id is now
  
  injected at most once per engine lifetime, and a plugin whose name a
  
  loaded skill already covers is never suggested — the local skill owns
  
  the domain, so the nudge was noise. Dismissals still apply, and the
  
  fragment stays append-only on the user turn (#6274).

  
  


• 
  

  A canceled automation run now settles with a transcript receipt that names
  
  the cancellation (by request, cancel timeout, or shutdown) instead of
  
  vanishing from the live band silently. The receipt wears attention ink and
  
  never lights the failure demand; the run record keeps the cancellation
  
  reason as its error detail. (#6162)

  
  


• 
  

  A failed workflow run no longer settles silently: its terminal failure
  
  raises a sticky error toast naming the cause (dispatch, schema, or script
  
  errors), alongside the existing panel state (#5528).

  
  


• 
  

  MCP OAuth re-login now forces the provider's consent screen: logout only
  
  clears the local token, so without a prompt the provider silently
  
  re-granted the same account/workspace and a re-login could never change
  
  it. /mcp logout and codewhale mcp logout also say plainly that they
  
  clear local credentials only (#6040).

  
  


• 
  

  Session retention no longer deletes transcripts once the store reaches the
  
  cap: the oldest active session is archived — still openable from the
  
  picker's archived view — instead of being unlinked, and archived records
  
  sit outside the cap until they are pruned (#6136).

  
  


• 
  

  Empty auto-created "New Session" stubs are capped separately (the ten
  
  newest are kept) and can no longer occupy a real transcript's slot in the
  
  session cap (#6137).

  
  


• 
  

  A failed resume or session load is now a durable transcript error instead
  
  of a status line the next footer update replaces, so a resume that cannot
  
  restore its target no longer looks like a silent new session (#6138).

  
  


• 
  

  Compaction no longer retains a tool result whose tool call was summarized
  
  away: an older turn that mixes text with a tool result keeps its text and
  
  drops the orphaned result blocks, which providers reject outright (#6119).

  
  


• 
  

  Automation runs that need a tool approval no longer die as silent
  
  idle-timeout cancels: a pending approval suspends the idle watchdog for its
  
  decision window, and an unanswered window settles the run Failed with the
  
  recorded reason instead of a silent Canceled (#6118).

  
  


• 
  

  /mcp no longer freezes the console while a turn is running: the panel
  
  opens immediately from the last known MCP snapshot with a receipt naming
  
  the wait, and live-pool mutations say their refresh is deferred instead of
  
  parking the UI event loop behind the running turn (#6159).

  
  


• 
  

  MCP OAuth login no longer fails with "Authorization server response missing
  
  required issuer" against servers that implement RFC 9207, such as
  
  Cloudflare's mcp.cloudflare.com. The local callback listener now keeps the
  
  iss parameter from the redirect and hands it to the token exchange so the
  
  callback binds to the discovered issuer; servers that do not send iss
  
  keep working unchanged. (#6157)

  
  

Contributors

• @AdityaVG13 — fixed composer wrapping, tab/caret placement, pasted and editor-returned draft history, painted-column transcript copying, explicit terminal foregrounds, headless user-input tool availability, and engine synchronization after importing foreign sessions (#6369, #6363, #6365).


• @aboimpinto — moved the TUI session-export slice onto shared command contracts (FEAT-025): a session-export contract facet with one shared sanitizer, /export routed through the facet, pinned with baseline-captured goldens and gates (#6096).


• @BX166 — contributed the AICraft provider template and its documentation (#6171). It was closed unmerged, but it is what surfaced the decision to stop special-casing named OpenAI-compatible hosts (#6289).


• @7jrxt42BxFZo4iAnN4CX — reported the session-retention defects behind archive-past-the-cap and empty-session cap occupancy (#6136, #6137), the resume-failure design behind durable transcript errors (#6138), and the gaps behind the opt-in approval timeout (#6101), codewhale exec --hooks (#6099), Markdown drag-copy (#6156), and the browsable, current-aware session picker (#6014); the goal token-budget hard stop (#6013) and the fleet no-progress guard shared with child workers (#6015) landed as first slices of two larger proposals, and the runtime-store session refusal (#6207).


• @Lstarsky0 — reported TUI tests reading machine state instead of hermetic fixtures; the lock_test_env remedy from that report shaped two more hermetic fixes, for the shared UI fixtures and the compaction budget test (#5359).


• @Lujc0523 — reported /hooks edit splitting keystrokes between the editor and the composer, fixed by pausing the TUI input pump inside the editor handoff (#6165).


• @Statter — reported the Gemini /models failure that now surfaces the provider's reason instead of an empty error (#6173).


• @sequico — reported the ACP session/new ids that session/load could not resolve, fixed by minting resolvable session ids (#6174).


• @bevis-wong — reported the mid-run engine freeze behind the bounded turn-end foreground-child join, and the resume path that re-ran identical tool-call repair on every load instead of persisting it (#6184, #6185).


• @gaord — recorded the mode each turn ran in (#6321, harvested), stated the approval posture a task thread starts on (#6386), and rebuilt the runtime-API thread summary in one store pass (#6376).


• @zhuowp — preserved chat roles across compaction, protected user turns on recompaction, and kept the operate contract intact (#6286).


• @h3c-hexin — rate-limit-adaptive subagent launch scheduling: the DynamicGate that replaces fixed spawn pacing under provider throttling (#6055, harvested).


• @asto18089 — co-authored the rate-limit-adaptive launch scheduling work (#6055).


• @yrk111222 — ModelScope provider support, landed through the shared ChildGrant fleet authority (#6299, harvested).


• @xiechimon — capped child tool results at capture time rather than at render (#6294, harvested).


• @VincentCorleone — defined and implemented the weixin-bridge Quick Start so a first run works from the README alone (#6170, harvested).


• @Serendo — fixed the /config theme editor exiting the panel on an arrow key (#6336).


• @yetuge — dropped the retired token_budget field from the subagent documentation (#6335).


• @Water-Run — ingested namespaced model-only catalog entries so models present only in the canonical models map reach the offering list (#6400); translated the local browser client guide into Simplified Chinese (#6401); and retired the blanket dead-code allowance with its unused feature stages, tightening the budget to match (#6402).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.