GitHub Release: codewhale-hq/Codewhale v0.9.12 (05.09.2026)

Codewhale is the public product from Shannon Labs. The codewhale

command, npm package, and release-asset names remain lowercase technical

identifiers. The legacy npm package deepseek-tui is deprecated and

receives no further releases. Users coming from v0.8.x legacy deepseek /

deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — official GitHub release

New macOS/Linux install (checksummed binaries from this release):

curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.9.12" sh

"$HOME/.local/bin/codewhale" --version

For Windows, use the matching installer or archive below. For an existing

direct install, run codewhale update; it prints the executable path and

keeps newer builds. If the install directory is occupied by a different build,

use the fresh-directory migration in the installation guide.

Secondary packaging — npm and Cargo

npm install -g codewhale

# or build from source

cargo install codewhale-cli --locked

The wrapper downloads the matched codewhale and codew command assets

from this Release. Both contain the same compiled runtime.

Docker / GHCR

docker run --rm -it \

  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \

  -v codewhale-home:/home/codewhale/.codewhale \

  ghcr.io/hmbown/codewhale:v0.9.12

The image exposes the same runtime as both codewhale and codew. The

latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli --locked

The Cargo package installs codewhale. Cargo cannot create a second command

alias from one binary target; users who want the shorter spelling can add a

codew symlink to that installed executable. The npm, Homebrew, archive,

shell-installer, and container channels install both command names directly.

Manual download — platform archives (recommended)

Each archive below contains the same runtime under the codewhale and

codew command names, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz

cd codewhale-<platform>

./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs
  
  codewhale.exe, codew.exe, and codewhale.bat under
  
  %LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
  
  current-user PATH, and creates a Start Menu shortcut that prefers
  
  Windows Terminal (wt.exe) when it is installed.


• Extract the archive for your machine: codewhale-windows-x64.zip or
  
  codewhale-windows-arm64.zip


• Double-click codewhale.bat (not the raw .exe) to launch


• Run install.bat to copy the binaries and launcher to %USERPROFILE%\bin


• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived codewhale-<platform> and

codew-<platform> assets. The seven codewhale-tui-<platform> filenames

attached to v0.9.5 are byte-identical compatibility copies used only to let

already-installed v0.9.4 clients discover and cross this single-binary

transition; current installers do not expose a third runtime. The legacy npm

package deepseek-tui is deprecated and is not republished. For migration

from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles

sha256sum -c codewhale-bundles-sha256.txt --ignore-missing



# Linux — individual binaries

sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing



# macOS

shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing

shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.12

Codewhale v0.9.12 puts computer use in the binary, opens two new routes —

Alibaba Model Studio through the data-driven provider table and Concentrate

as an opt-in BYOK Responses gateway — and adds cloud dispatch plus a

config-gated per-session control socket. The shell is the other half of the

release: a new launch card, the work surface docked under the composer, one

focus owner for Tab, tool cells that carry their own state, and fleet as

the public word for the live collective. The complete item-level change

record is retained below the categorized release highlights.

Added

• Computer use ships with the binary. The computer-use plugin — 38 tools
  
  across macOS, Windows, Linux and HarmonyOS, accessibility-first observation
  
  with pixel fallback, screenshots, zoom, screen recording, and registered
  
  remote computers over ssh and hdc — is embedded in Codewhale and written to
  
  $CODEWHALE_HOME/builtin-plugins on first run, so every install channel
  
  carries it. It lists as builtin · not-reviewed and stays disabled until
  
  you review and enable it: shipping it is not consenting to it. The
  
  stdlib-Python computer-use server it replaces is gone.


• Alibaba Model Studio joins the data-driven provider table as an
  
  openai-compatible descriptor: international compatible-mode endpoint,
  
  DASHSCOPE_API_KEY credential, live /v1/models discovery. Qwen 3.8
  
  Flash and Qwen 3.8 Max arrive through the catalog authority — never a
  
  hard-coded id.


• Concentrate: first-class opt-in BYOK Responses gateway with live models
  
  discovery and typed SSE streaming (#5725).


• Cloud dispatch: remote runner offloads coding agent tasks to isolated
  
  cloud sandboxes with machine token auth and structured job tracking
  
  (#5701, #5712).


• Per-session control socket: config-gated [control_socket] table binds
  
  <sessions-dir>/<session-id>/control.sock per running session, exposing
  
  message, interrupt, relaunch, and status JSON-RPC verbs (#5533, #5831).

Changed

• 
  

  Anonymous usage counting is on by default. The 0.9.11 release asked
  
  first; 0.9.12 counts the same aggregate version/platform, session, feature
  
  and error totals unless you turn it off, and says so once at first launch
  
  (policy notice version 5, schema 3, notice_version replacing
  
  consent_version). Every recorded opt-out stays off: a durable
  
  telemetry = false, a decline recorded under the old opt-in notice,
  
  unreadable privacy state, and the CODEWHALE_TELEMETRY=0 / --telemetry false kill switches. Showing the disclosure records only that it was
  
  shown, never an acceptance. codewhale config set telemetry false turns
  
  it off and wipes queued counts; codewhale config set telemetry true
  
  deliberately re-enables it. Nothing new is collected: no conversations,
  
  code, prompts, files, names, model content, credentials, or IP.

  
  


• 
  

  The launch screen is our own card take: a thin top line
  
  ⑂ branch path; a centred bordered card with the whale mark,
  
  Codewhale + version, one announcement line only when it is true (the
  
  no-model warning, or MCP news), and the menu New worktree / Resume
  
  session / Changelog / Quit with their real chords right-aligned. Enter
  
  runs the highlighted entry, Up/Down move it, and typing goes straight to
  
  the composer. The card dissolves on the first keystroke or command
  
  (≤240 ms, instant under reduced motion) (#5826, #5801, #5815, #5286).

  
  


• 
  

  The work surface sits under the composer by default, keeping history
  
  readable and leaving the stage unencumbered (#5809).

  
  


• 
  

  Skills command shapes: FEAT-022 command shapes and retained-host
  
  validation (#5825, #5829).

  
  


• 
  

  After the card dissolves, the working screen shows ⑂ branch path with
  
  ⋮ MCP n/m on the right, the transcript starts with the
  
  ◆ session_start receipt (naming the configured session-start hooks),
  
  and the composer's bottom rule carries model (effort) · permission —
  
  the route's one launch reading. The posture bar and metrics line appear
  
  only once a session exists.

  
  


• 
  

  Vocabulary: fleet is the public term and Pod is retired from copy —
  
  roster, setup, detail, worker-runtime and managed-API messages now say
  
  Fleet (/fleet canonical, /pod alias). The workflow wire accepts the
  
  canonical role spellings (general/explore/planner/reviewer/implement/
  
  test/advisor) with the pre-rename ones kept as load-time aliases, and
  
  serializes canonical names.

  
  


• 
  

  The Operate mode-picker hint is shortened to fit 80 columns.

  
  


• 
  

  The footer always shows the permission posture; when only one chip
  
  fits, the permission chip outranks the mode word (#5796).

  
  


• 
  

  Local Ollama: the header names a model only when the local catalog can
  
  serve it, and says unknown until it knows. The startup mark, web and
  
  app icon carry the new side-view prompt-eye whale (#5795).

  
  


• 
  

  One focus owner: Tab and Shift+Tab work regardless of what is in the
  
  composer; Alt shortcuts survive mid-draft; Ctrl+Tab no longer cycles the
  
  mode by accident (#5798).

  
  


• 
  

  Tool cells carry their own state: a running, failed or warned tool
  
  reads as such in the transcript itself, with per-entry rail dots and
  
  family-coloured glyphs (#5799).

  
  


• 
  

  Web: docs hub with task search, shared empty/loading/error states, an
  
  offline-to-back-online banner, /changelog in every locale, and real
  
  404s with correct metadata (#5743).

  
  


• 
  

  Web: the app's colours come from one file generated from the TUI whale
  
  palette; re-typing a colour by hand fails web CI (#5797).

  
  


• 
  

  Web: a one-way ceiling on isZh branching outside the i18n spine —
  
  the count may only go down (#5805).

  
  


• 
  

  An internal agent handoff doc was removed from the public tree and
  
  .playwright-mcp/ is now ignored (#5800).

  
  


• 
  

  First run paints the composer immediately: the Welcome/language/provider/
  
  trust gates no longer precede the first keystroke. Missing-key and
  
  workspace-trust recovery stay for returning users; language and provider
  
  remain in /setup.

  
  


• 
  

  The canonical whale-tile mark propagates beyond web to the exact-raster
  
  surfaces that can carry it (#5738).

  
  


• 
  

  Dead-code sweep: delete proven-unreferenced helpers (unused builders,
  
  wrappers, and leftover identifiers) and drop stale #[allow(dead_code)]
  
  where the item is production-called or test-exercised. No runtime behavior
  
  change (#5791, #5587).

  
  


• 
  

  Remote-control recovery gives every fresh pre-dispatch attempt a new lease
  
  generation while preserving that generation across its typed start (#5605).

  
  


• 
  

  Public roster language is Pod. /pod is the customer surface; fleet remains
  
  the internal wire, storage, and migration name (#5776).

  
  


• 
  

  Compaction replacement history keeps a bounded last user round (assistant +
  
  tool results) instead of dropping them behind a summary. /context names
  
  the compaction path and /anchor survival. Failed compact still does not
  
  replace live history (#4394).

  
  


• 
  

  Provider catalogs: compatible hosts (Baseten, Groq, Cerebras, SenseNova,
  
  Command Code) no longer compile a frozen model roster. Descriptors name the
  
  wire, URL, and env; live GET /v1/models and a Codewhale-owned catalog
  
  layer are the offering list. Command Code is a catalog/descriptor row, not
  
  a ProviderKind. Catalog presence is not an availability, entitlement, or
  
  provider-acceptance claim (#5783).

  
  


• 
  

  Provider selection no longer probes or adopts an external CLI credential on
  
  ordinary picker use. Reuse requires an explicit "Use external CLI credentials"
  
  choice, exact-path confirmation, and Codewhale-owned revoke (#5772).

  
  


• 
  

  TUI: startup no longer presents an approximate ASCII or block-glyph whale as
  
  the product mark. It keeps the direct Tideline prompt while exact-raster
  
  surfaces remain responsible for the canonical asset.

  
  


• 
  

  TUI: the active-session composer paints the same three-cell [↑] send
  
  target as Startup and clicks it through the existing Enter submit
  
  dispatcher (#5771). Compact/quiet composers still omit the control.

  
  


• 
  

  TUI/CLI: Pod is the public roster surface. User-facing Fleet wording
  
  moves to Pod; durable receipt keys stay compatible (#5776).

  
  

Added

• 
  

  Native ChatGPT sign-in for the openai-codex route: codewhale auth chatgpt opens a browser PKCE flow and stores refreshable tokens in
  
  Codewhale-owned credentials — no Codex CLI install required.
  
  /auth chatgpt-revoke clears them off the event loop (#5784, #5778).

  
  


• 
  

  MCP servers and plugins can be connected self-serve from the session: a
  
  unified auth flow with rotation-safe token handling, a spoken authorization
  
  URL, and catalog refresh when stored credentials stop working (#5747).

  
  


• 
  

  /operate reads match the landed CWC OperateRecord contract: fetching an
  
  absent record returns a truthful not-found view instead of a fabricated
  
  operation, and an empty evidence path is rejected rather than resolving to
  
  the workspace directory (#5703).

  
  


• 
  

  TUI: scheduled automations project into the top strip
  
  (⏱ N scheduled · M running, compact ⏱ N·M) with typed
  
  HistoryCell::Automation receipts when a run this session watched settle.
  
  /automation acknowledges failures. The merged footer does not carry the
  
  work fact (#5748).

  
  


• 
  

  The app-server can listen on a unix domain socket and advertise a
  
  daemon/attach handshake, so a local client can attach to an already-running
  
  engine instead of spawning its own. The socket is created with
  
  owner-only permissions and stale sockets are reclaimed on start. Non-unix
  
  hosts return a typed unsupported-platform refusal; the Windows named-pipe
  
  endpoint is named but not yet implemented (#5749).

  
  


• 
  

  The engine's internal Op/Event types and the wire protocol's Op/
  
  EventMsg now carry a compile-enforced twin for every variant: adding an
  
  engine variant without a protocol counterpart fails the build instead of
  
  drifting silently. Internal durability work — no user-visible surface
  
  change yet (#5751).

  
  


• 
  

  Machine tokens: with CODEWHALE_API_KEY set, the CLI authenticates as the
  
  Codewhale account with no local session file and no browser — the CI
  
  authentication path, with a typed token shape and redaction (#5721).

  
  


• 
  

  Compaction publishes a structured survival contract for session-tree
  
  journal entry types (crates/tui/src/compaction/SURVIVAL_CONTRACT.md) and
  
  fails closed when the last user round, tool results, /anchor text, or
  
  checkpoint receipt would vanish (#4394, #5782).

  
  


• 
  

  Internal: codewhale-config gains RouteAuthoritySnapshot, one immutable
  
  authority that owns a compiled provider catalog together with the route
  
  resolver projected from it, so a picker, a readiness view, and an execution
  
  path can no longer resolve against different catalog snapshots without a
  
  type-level signal. Resolution still goes through the sole resolver; the
  
  returned receipt distinguishes an exact catalog row, a custom-endpoint route
  
  whose provider facts are deliberately not reused, and an allowed
  
  pass-through route with no catalog row. All state is secret-free. No call
  
  site changed and no user-visible behaviour changed yet (#5766).

  
  


• 
  

  Computer session records now count only time a provider actually accepted the
  
  session as active, at per-second granularity. Idle, queued, stopped, and
  
  teardown time are excluded, and a session whose allocation does not match a
  
  standard profile is refused rather than recorded approximately. Covered by
  
  hermetic fixtures; no live provider call and no deploy (#5781).

  
  


• 
  

  Website: the public site moves to the Tideline deep-ocean design language
  
  (dark by default with an opt-in light documentation sheet, palette grounded
  
  in the TUI's WHALE_* tokens) and the new whale brand mark across the favicon,
  
  app icons, web manifest, nav wordmark, and social card (#5573).

  
  


• 
  

  Add codewhale dispatch / /dispatch so a local session can propose a
  
  Codewhale cloud agent against an explicit github, cnb, or gitee remote.
  
  Confirmation is required; missing credentials fail closed; cloud jobs share
  
  the existing /jobs surface as kind=cloud. See
  
  DAYTONA_CLOUD_DISPATCH.md.

  
  


• 
  

  /login reports the Codewhale account session and provider-key next
  
  steps. The internal cloud-agent credential is not user surface: there is
  
  no auth set-slot/auth clear-slot command, no hint, and no completion
  
  entry for it — signing in with codewhale login is the only door.

  
  


• 
  

  Add the Tideline component family from the ratatui translation spec
  
  (#5698's screens, riding the #5699 work-strip layout): hero startup
  
  surface with quick actions and option strip, notifications inbox, merged
  
  footer band, pod ledger, receipt
  
  stream, theme list with motion toggles, live preview, settings rail,
  
  and the left rail — each a standalone render module pinned by 28 new
  
  byte-exact golden buffers. Frame wiring follows the Tideline acceptance
  
  gate; NO_COLOR is now honored by palette depth detection.

  
  


• 
  

  Route Contract Phase 1: RouteResolver is the runtime path for
  
  resolve_runtime_options; codewhale providers export --json ships the
  
  owned descriptor catalog; CLI --provider accepts any catalog route id
  
  (the closed ProviderArg enum is deleted). Catalog layers are
  
  bundled → models.dev → provider /v1/models → config.toml → user, with
  
  policy DENY last and never overridden.

  
  


• 
  

  Add provider-native web search for documented Xiaomi MiMo 2.5 Pro and 2.5
  
  chat routes while keeping neighboring models and custom gateways fail-closed.

  
  


• 
  

  Add structured provider-native web search for exact Z.AI global and Zhipu
  
  China general API routes, using each site's documented search engine value.
  
  Existing open.bigmodel.cn configurations now share Z.AI's official model
  
  namespace and credential scope; unknown model IDs still pass through.

  
  


• 
  

  Add provider-native web search for documented Qwen models on ModelStudio
  
  Token Plan's Responses Harness, without enabling Coding Plan or Anthropic
  
  routes.

  
  


• 
  

  Added /copy to place the latest completed assistant response on the
  
  clipboard without copying tools, system messages, hidden reasoning, or
  
  active partial output (#5668).

  
  


• 
  

  Add provider-native web search for documented DeepSeek V4 routes through the
  
  Responses API, with fail-closed capability gating for compatible custom
  
  endpoints.

  
  


• 
  

  Add provider-native search for exact Moonshot K3 Formula, legacy K2.6
  
  built-in search, and Kimi Code membership /search routes. Treat the exact
  
  Moonshot China endpoint as a first-party direct route.

  
  


• 
  

  Z.ai GLM-5.3-Flash and OpenRouter z-ai/glm-5.3-flash are first-class
  
  picker rows (/model GLM-5.3-Flash). Flash is the faster/explore sibling
  
  of GLM-5.3; the Z.ai default stays GLM-5.3. List price is $0.15/$0.50
  
  per 1M (durable; the 50% promo through 2026-09-09 is not the catalog row).

  
  


• 
  

  Baseten, Groq, and Cerebras are bundled OpenAI-compatible setup templates
  
  ([providers.<id>] kind = "openai-compatible"), not new ProviderKind
  
  variants. /provider fills URL, model, and env from one catalog row.

  
  


• 
  

  MCP manager copy now names the server, the failure, and one recovery
  
  command (The X MCP server requires OAuth reauthentication. Run /mcp login X).

  
  


• 
  

  Settings Advanced exposes clickable MCP Connect, Reconnect, and Diagnose
  
  actions, while Extensions and Problems route recovery through the existing
  
  /mcp login, /mcp reload, /mcp validate, and /plugin validate commands
  
  (#5643, #5655).

  
  


• 
  

  Plugin prompt matching (#5579): sending a task can toast the next review
  
  step when the prompt strongly matches an installed-but-idle plugin or a
  
  marketplace catalog you added (for example a Supabase prompt suggesting
  
  /plugin trust supabase). A live composer CTA offers the same review
  
  command while you type, matching turns append a bounded
  
  <recommended_plugins> user block, and request_plugin_install surfaces
  
  review without installing. /plugin suggest now ranks manifest keywords and
  
  catalog candidates, never auto-installs, and on-disk plugin changes also
  
  nudge /plugin reload between turns.

  
  


• 
  

  Added /import-claude (#5557): reads ~/.claude.json and
  
  ~/.claude/settings.json read-only and renders an explicit, reviewable
  
  migration plan plus a written report. MCP servers route through the
  
  existing /mcp import <name> --approve consent flow, allowlisted env keys
  
  become an unapplied portable bundle for codewhale config import, and
  
  permissions/hooks map to manual follow-ups; secret-shaped values are named
  
  but never echoed or imported.

  
  


• 
  

  Added the managed Chat relay: account-owned Chat commands now execute on the
  
  native runtime thread engine through a new runtime_chat_relay module
  
  instead of a second execution path. Each Chat thread is a dedicated,
  
  isolated runtime thread with an empty model-visible tool allowlist, a
  
  chat-only system prompt, and no workspace, memory, skill, credential, or
  
  local-path context; the active interactive TUI thread is never reused. The
  
  relay keeps one durable state file per scope behind a session-wide owner
  
  lock, binds a saved session permanently to its first remote target, replays
  
  exact duplicate commands from retained results instead of starting a second
  
  inference turn, terminalizes orphaned reservations on restart, and rejects
  
  (never queues into) a busy local Work turn with an immediate retryable
  
  result. Stop commands require the exact run and turn identity, and a worker
  
  aborts on any account or target mismatch during token refresh.

  
  


• 
  

  Added a verified Omarchy/AUR packaging path: packaging/aur now carries a
  
  PKGBUILD template, .SRCINFO renderer and tests, release-candidate
  
  render step, and docs; the live AUR compatibility alias codewhale-tui -> codewhale is preserved, AUR dependencies match the live package, and the
  
  self-updater refuses to fight an Omarchy/package-manager installation.

  
  


• 
  

  Added a Fleet run-wide cost/token usage ceiling (R6, #5567): an accumulator
  
  plus admission gate and alert bound a whole run's spend across workers.

  
  


• 
  

  Added the real provider cache hit rate to /context (C3, DSH #3): the
  
  token-weighted provider-reported rate from the same telemetry /cache
  
  aggregates, plus an honest "no cache telemetry yet" state when nothing is
  
  recorded.

  
  


• 
  

  Added per-step cost movement: TurnUsage receipts are priced as they land
  
  so the live cost surface moves during long agentic turns instead of only at
  
  TurnComplete (#5578), and the footer now honestly shows cost: unknown
  
  when nothing can be priced instead of hiding the line.

  
  


• 
  

  Added the underwater session surface: the ambient water reads session state
  
  from across the room, its animation shape follows live agent activity, and
  
  attention tints are steady (no breathing) with a distinct reading treatment
  
  and no mid-water seam on tall windows.

  
  


• 
  

  Added @path:START-END ranged line mentions (#5550, picker half to follow),
  
  a predictable last-copy backup file for clipboard exports with the path
  
  named when the clipboard fails (#5555), wait on multiple background shell
  
  tasks with until=any|all (#5549, named-kill half to follow), and composer
  
  double-click word / triple-click line selection.

  
  


• 
  

  Added workflow parallel-schema slot partial success (#5583): a slot that
  
  produces a schema-valid partial result no longer fails the whole parallel
  
  branch.

  
  


• 
  

  Added plugin load-failure startup hints (#5579) and OpenRouter app
  
  attribution headers on outbound requests.

  
  


• 
  

  Added codewhale doctor --fix (with --yes for non-interactive consent):
  
  the doctor now computes a concrete repair plan — delete stale .tmp*
  
  leftovers from interrupted atomic writes, tighten secret-store file
  
  permissions to 0600, disable structurally broken (Error-status) MCP
  
  entries through the atomic MCP save path, and scaffold missing user-global
  
  skills/tools/plugins directories — shows it, and applies it only after
  
  explicit consent. Every action is narrowly scoped and idempotent; JSON and
  
  context-JSON modes stay read-only and conflict with --fix (#5552, v1).

  
  


• 
  

  Added /context reporting of the real provider prompt-cache hit rate (C3)
  
  alongside token pressure.

  
  

Changed

• 
  

  Provider-native web search now applies domain constraints before accepting an
  
  attempt, discards generated answers when returned citations violate those
  
  constraints, and preserves the caller's configured/local timeout as an
  
  independent fallback budget (#5681).

  
  


• 
  

  Idle session metrics omit zero facts (0 turns, LLM 0s) until the
  
  runtime has evidence. Working chrome says in the current instead of a
  
  generic working.

  
  


• 
  

  Deleted nine uncompiled runtime_contract/ staging files. Live contracts
  
  remain model.rs and termination.rs.

  
  


• 
  

  The first #5587 dead-code sweep converts audited test-only helpers to
  
  #[cfg(test)], keeping production builds free of test-only APIs without
  
  changing runtime behavior.

  
  


• 
  

  /plugin reload is now discoverable when on-disk plugin bundles change: the
  
  next send and /plugin list nudge once with Run /plugin reload to apply
  
  instead of silently keeping the stale catalog (#5579). Trust is unchanged;
  
  this does not auto-reload.

  
  


• 
  

  Context-pressure warnings and critical alerts now remain visible in sticky UI
  
  status until compaction or explicit dismissal, instead of disappearing into
  
  scrolling turn metadata (#5620).

  
  


• 
  

  The Runtime thread store defaults to a per-session root
  
  ($CODEWHALE_HOME/sessions/<id>/runtime) so multiple Codewhale processes on
  
  one machine no longer share one owner lock (#5630). The exclusive lock is
  
  unchanged; CODEWHALE_RUNTIME_DIR still selects a shared root when that is
  
  intended.

  
  


• 
  

  Session token totals now include display-only per-model-call deltas while a
  
  turn is running, including input/output and cache-class counters; the
  
  authoritative TurnComplete totals still reconcile exactly once (#5581).

  
  


• 
  

  Transcript focus now exposes per-block actions: y copies content, Y
  
  copies the rendered metadata view, Enter opens a fullscreen block pager, and
  
  r opens raw detail; the existing Tasks rail shortcuts remain unchanged
  
  (#5551).

  
  


• 
  

  Provider neutrality (#5588): model resolution of omitted/aliased models is
  
  now provider-relative, OpenAI-native defaults no longer route through
  
  another provider's table, CLI credentials stay provider-scoped, and NVIDIA
  
  credentials no longer leak into the DeepSeek keychain. Neutrality test
  
  matrices exercise several providers instead of standing in with one.

  
  


• 
  

  The workflow engine module was decomposed out of its 3k-line mega-file into
  
  journal, usage, and report modules plus a module directory (#5586
  
  slices 1a/B/C/D), a semantic-free move verified by normalized-content hash.

  
  


• 
  

  Compaction refusals are now always named (#5577): silent holds under context
  
  pressure are gone, the context meter honors the same provider-billed prompt
  
  the trigger uses (T1), and prune outcomes are projected without cloning the
  
  transcript.

  
  


• 
  

  Step budgets now end honestly: an ~80% soft landing nudges the model to
  
  write its final report, and exhaustion grants exactly one bounded
  
  report-on-exhaustion turn instead of dying silently (A1/A2).

  
  


• 
  

  Contributor credit: recognized agent contributors (e.g. Codewhale Agent)
  
  may now carry Co-authored-by trailers; unknown bot/tool trailers are
  
  still rejected by the credit gate.

  
  

Fixed

• 
  

  Fast typing no longer corrupts the composer. The paste-burst heuristic ran
  
  on every session until a real bracketed paste arrived, holding, buffering,
  
  retro-grabbing, and absorbing Enter on timing guesses; it is now
  
  fallback-only (gated off when the terminal provides bracketed paste), the
  
  retro-grab is deleted, and Enter on held command text flushes and submits.

  
  


• 
  

  Ctrl+C works on the pre-session launch menu and speaks everywhere: the
  
  first press arms the two-second exit window with a visible localized
  
  "Press Ctrl+C again to quit" hint (previously silent), the second exits.
  
  The worktree name input keeps Ctrl+C as cancel-input.

  
  


• 
  

  Fresh interactive sessions no longer leave a phantom one-message duplicate
  
  behind. The TUI claimed one session id (Runtime store lock, turn-start crash
  
  checkpoint) while the engine minted a second one; the first SessionUpdated
  
  re-keyed the App, the completion commit cleared only the engine id's
  
  checkpoint, and codewhale --continue later "recovered" the orphaned
  
  checkpoint as a duplicate session instead of the real one. The engine now
  
  adopts the host-owned id at spawn (EngineConfig::session_id) and /clear
  
  mints the next id in the App like /new. A non-TTY --continue no longer
  
  promotes and consumes the crash checkpoint before failing the terminal
  
  check, and the root codewhale --resume <id> / --session-id <id> flags
  
  documented in the operations runbook now parse instead of being swallowed
  
  as a prompt.

  
  


• 
  

  Website: /signin, /signup, and /auth/callback are locale-aware public
  
  routes instead of localized 404s. Sign-in and create-account send the person
  
  to the CWC app; OAuth callbacks hop to app.codewhale.net with the query
  
  intact; /login and /register are aliases. Local CLI use is not presented
  
  as requiring an account (#5767).

  
  


• 
  

  The sandbox read deny-list matches a rule's resolved path as well as its
  
  literal spelling. On macOS /etc and /var are symlinks into /private,
  
  so a read of /private/etc/sudoers walked around the /etc/sudoers rule,
  
  and a rule written against a symlinked directory never fired for the real
  
  path that canonicalize and the process cwd hand back.

  
  


• 
  

  Background shells are first-class work-strip rows (▾ Shells N) you can
  
  open, watch, and cancel by the shell_* id on the row. /jobs cancel all
  
  cancels running shells; it no longer looks up a task named all. The
  
  composer hourglass crumb no longer stands in for a shell surface.

  
  


• 
  

  codewhale logout and /logout now clear the Codewhale account session
  
  and the Daytona secret slot, not only provider API keys. The TUI crate's
  
  leftover login --api-key path no longer claims to save a key.

  
  


• 
  

  Account sessions no longer read the macOS Keychain. Unsigned or rebuilt
  
  codewhale binaries were a new Keychain ACL principal every time, so
  
  codewhale web and the TUI popped a password dialog on start. Sessions
  
  now use ~/.codewhale/secrets/secrets.json (mode 0600), the same store
  
  as provider keys. Extracted from the Keychain-retirement half of #5632.

  
  


• 
  

  Hardened the dispatcher-side config parse the same way: ConfigStore
  
  loads and project-config parsing now deserialize ConfigToml on a
  
  dedicated 16 MiB-stack thread (the guided-setup save path could overflow
  
  a 2 MiB worker stack the same way the TUI's ConfigFile parse did), and
  
  the #5585 setup-confirm toast test runs its runtime on an equally sized
  
  thread instead of overflowing the default libtest stack.

  
  


• 
  

  Fixed detached interactive agents reporting worker usage after the parent
  
  turn ends with the usage missing from the session/live /cost total
  
  (#5597): interactive turns acquire an owner-scoped runtime usage lease,
  
  late usage enters the session cost pool without reopening the sealed
  
  mailbox, and worker/session/reload accounting share one hashed response
  
  identity so retried deliveries stay exactly-once.

  
  


• 
  

  Fixed the sub-agent fiasco class: in-workspace absolute git -C no longer
  
  trips the read-only child shell gate with a coherent bounded gate (#5595),
  
  turn end parks turn-owned children resumably instead of silently cancelling
  
  them (#5596), stale write-claims are released by liveness with coordinate
  
  release (#5562), and the verifier role description matches its real
  
  surface (#5562).

  
  


• 
  

  Fixed workflow responseSchema failure handling (#5583): bounded repair with
  
  typed receipts (kind + attempt), raw-output receipts persisted as artifacts
  
  that survive reload, and failures surfaced instead of null success (#5528).
  
  Degraded owner snapshots no longer project as ordinary Completed runs
  
  (#5582), typed task error kinds enable fail-fast parallel/pipeline (R9), and
  
  /workflow confirm finds the draft despite interleaved messages.

  
  


• 
  

  Fixed the DeepSeek session that never auto-compacted at 842k/1M (#5577): the
  
  exact billed_842k_on_a_1m_window_compacts_despite_a_small_estimate
  
  regression pins the trigger.

  
  


• 
  

  Fixed sandbox escapes and authority gaps: workspace-write tools resolve
  
  hard-linked files before writing (S2, #5569), an opt-in read deny-list
  
  bounds full-disk reads in any posture (S1, #5568), and session grants match
  
  the command family instead of widening the whole tool (R2).

  
  


• 
  

  Fixed provider-transport robustness: non-streaming HTTP requests are bounded
  
  by a read timeout (R4), and Chat-Completions mid-stream error frames surface
  
  instead of hanging (R3). MCP OAuth expiry now reacts to 401/403 with a named
  
  recovery path and login hint instead of looking like a broken server (T4,
  
  #5572).

  
  


• 
  

  Fixed Fleet lifecycle gaps: detached workers are reaped when their manager
  
  dies (R7) and the per-task wall-clock timeout is enforced (R5); the local
  
  Fleet host compiles on non-Unix targets; detached schema repair stays within
  
  the runtime budget.

  
  


• 
  

  Fixed prompt-cache correctness: the tool catalog is fingerprinted in
  
  provider wire order (C1), prefix changes between requests are always
  
  declared (C5) — including the newly named mid-turn change:tool_surface
  
  reasons for deferred-tool admission, tool-search activation, and runtime MCP
  
  tool arrival — and a reasoning-only response stopped at the output limit now
  
  fails the turn honestly instead of re-issuing a request that can only
  
  reproduce the stop.

  
  


• 
  

  Fixed docs/public-surface drift: REBRAND.md no longer presents
  
  api.deepseeki.com as a China fallback (#5564), and the web facts/tool
  
  counts match the repository.

  
  


• 
  

  Heavy pull requests now run the real Linux workspace nextest, doctest, and
  
  lockfile lanes directly on GitHub Actions instead of reporting a green
  
  placeholder while waiting for a branch-specific CNB mirror (#5547).

  
  


• 
  

  Fleet roster members in a selected Fleet now expose a visible edit affordance
  
  and a direct m model-picker shortcut, while the coordinator row remains
  
  read-only (#5604, covers #5589).

  
  


• 
  

  The context inspector now attributes bounded tool-schema cost to the built-in
  
  catalog and each discovered MCP server without changing prompt assembly or
  
  cache behavior (#5553).

  
  


• 
  

  The goal-continuation quiet period ([goal] continuation_delay_seconds,
  
  added in #5508) now applies on every dispatch path. Previously the
  
  within-turn dispatch hook fired the next continuation prompt immediately
  
  whenever a model step ended with the goal still active, so CLI-resumed and
  
  host-managed sessions never observed the configured delay (measured
  
  end-to-start gaps of ~9 s with a 300 s delay configured). The wait now
  
  runs unconditionally inside goal_continuation_message_if_needed,
  
  remains cancellable, and pause/clear/terminal update_goal calls still
  
  cancel a pending pass (#5534).

  
  


• 
  

  Two unit tests no longer depend on process-global environment state that
  
  sibling tests mutate concurrently.
  
  route_budget::tests::v4_trigger_uses_window_percent_when_it_fits_spendable_input
  
  asserted no-override output-budget values while reading
  
  CODEWHALE_MAX_OUTPUT_TOKENS / DEEPSEEK_MAX_OUTPUT_TOKENS without
  
  holding lock_test_env(), so a concurrent writer could flip the value
  
  mid-assertion (the order-dependent full-suite flake).
  
  prompts::tests::system_prompt_prefix_never_leaks_private_content read the
  
  real home via HOME/USERPROFILE, so a machine with
  
  ~/.codewhale/instructions.md leaked its absolute path into the prompt and
  
  failed the no-private-paths assertion unless a sibling's temporary HOME
  
  guard happened to be live. Both tests now hold the env barrier and pin the
  
  variables (the route-budget test removes the overrides; the prompts test
  
  points HOME/USERPROFILE at a scratch dir). Assertions unchanged.

  
  


• 
  

  TUI sessions now apply a subtle OSC 12 cursor accent only on explicitly
  
  supported terminals and restore the terminal default through normal, panic,
  
  and signal cleanup paths (#5554).

  
  

Contributors

• hexin (@h3c-hexin) — provider-native web
  
  search across four routes (#5682, #5683, #5685, #5687), authoritative
  
  edit-last-turn boundaries (#5621), Kimi Code k3-256k (#5622),
  
  post-compaction input-token reporting (#5623), and preserving the scheduled
  
  model selection in automations (#5650).


• 秋月凉梦 (@qiuYliangM) — co-authored the
  
  edit-last-turn boundary fix (#5621), Kimi Code k3-256k support (#5622), and
  
  post-compaction input-token reporting (#5623).


• Isabel Wu (@wuisabel-gif) — live
  
  session token totals (#5624), persisted context-pressure warnings (#5629),
  
  discoverable Fleet roster editing (#5604), the capability-gated cursor
  
  accent (#5599), and /copy for the latest completed response (#5692).


• Paulo Aboim Pinto (@aboimpinto) —
  
  Windows verbatim-path operands preserved through POSIX word splitting
  
  (#5610), the plugins group moved onto the command shapes (#5657), FEAT-022
  
  skills command shapes with retained-host validation (#5825), and FEAT-020
  
  plugin command shapes re-landed on main (#5865).


• Alex Musichen (@musichen) — a stable
  
  DeepSeek heading in the configured-view model picker, keeping every official
  
  catalog model for the active provider visible (#5689).


• @gaord — the GET /v1/fleet/profiles
  
  runtime API endpoint, reusing the FleetManager validation path (#5688).


• Sh1Zuku (@SparkofSpike) — corrected
  
  English documentation inaccuracies and the first zh_hans translations for
  
  the Tier-2 docs (#5613).


• @M-Maciej — goal continuation cadence
  
  (#5591) and the per-session control socket (#5533, #5831).


• Serephus (@serephus) — nixpkgs update
  
  (#5669).


• @whp233 — wire = responses|anthropic for
  
  openai-compatible custom routes and opencode-zen muse-spark (#5716, landed
  
  as #5719).


• Gabriel Degret (@Gabriel-Degret) —
  
  found the reasoning-only retry gap and built the first fix; landed as the
  
  [reasoning_only] retry ceiling with a request-scoped nudge (#5867).


• @huangxianzhan — the
  
  x-opencode-session header for OpenCode Go and Zen gateways (#5868).


• @zhuowp — task origin preserved in job
  
  snapshots (#5869).


• AdityaG (@AdityaVG13) — a ten-commit
  
  performance pass: a zero-copy LaTeX fast path for streaming render,
  
  single-pass token accounting on the per-turn pressure paths, memoized
  
  provider resolution in the catalog cutline, parsing the bundled and
  
  on-disk models.dev catalogs once per process (interactive boot -70%),
  
  adaptive poll cadence for foreground shell completion, and worker caps
  
  across the read-only diagnostic family.


• Nightt (@nightt5879) — isolated remote
  
  recovery lease generations (#5790).


• @yiheng-kkk — replaced stale todo
  
  transcript snapshots so a rewritten todo list renders its current tasks
  
  (#5871, #5873).


• @Lfanxing — Moonshot routes now degrade
  
  incompatible tool definitions per request instead of failing the turn.


• WissssleyL (@Lstarsky0) — moved
  
  docs/subagents and docs/mcp onto the dictionary spine (#5337), with the
  
  metaTitle probe that keeps them there.

Reports and reproductions that shaped this release:

• @slowly247 — reported the Ollama input
  
  budget collapsing to 1,024 tokens on 32K local models (#5820).


• @ronohara — reported the engine stopping
  
  after recoverable network errors, with the reproduction that pinned the
  
  discarded approval (#5769).


• @Lujc0523 — asked for ACP session
  
  configuration of mode and model (#5863).


• @senka9h — reported that serve --acp
  
  lacked session/list and session/load (#5864).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.