tsecurity.de - News Radar & Live Feeds

Redox OS ring buffers project summary

Wed, 28 Oct 2026 17:28:07 +0100

The Redox OS project, which is a Unix-like microkernel-based operating system written in Rust, has published a report on the work that it has done in the last year to implement io_uring-like I/O. Last year, the Redox team received a grant to develop io_uring-like Ring Buffer support at the system task level, as a first step towards ring buffer... Weiterlesen

Tailscale patcht kritische SSH-Forwarding-Lücken mit Root-Zugriff

Wed, 28 Oct 2026 09:58:28 +0100

LONDON (IT BOLTWISE) – Tailscale hat Version 1.104.4 veröffentlicht, um Sicherheitslücken im integrierten SSH-Server zu schließen. Betroffen ist insbesondere das SSH-Forwarding auf Unix-Sockets, bei dem ein erlaubtes Forwarding zeitlich ausgenutzt werden konnte, um Root-only-Ziele wie den Docker- oder den tailscaled-API-Socket zu erreichen. Der... Weiterlesen

HPR4758: Programmable Logic Controls - Episode 6

Wed, 28 Oct 2026 02:54:53 +0100

This show has been flagged as Clean by the host.

01 Introduction

This is the sixth episode in an 8 part series.

In the previous episode we looked at I/O modules, what they are, how they work, and the purpose that they serve in the system.

We also discussed machine safety systems and also claims made by certain people about cyber security and industrial safety.

In this episode we will look at PLC networking, together with a detailed look at one network protocol, Modbus.

03 Types of Networks

PLC networks fall into three broad categories, based on the purpose of the network.

These categories are

• PLC to IO

• PLC to PLC

• and PLC to PC or Personal computer.

There is a great deal of overlap between these, so don't expect them to fall into nice discrete pigeonholes.

04 A Multiplicity of Protocols

Logically, you would think that the advantages of interoperability would be so great that there would be just a few networking protocols and everyone would use them.

The reality is the opposite.

There is such a multitude of protocols that I won't attempt to list them all.

Industrial automation is a market that is firmly in the control of the vendors, not the customers, and the vendors value customer lock in over user benefits.

What I will focus on instead is the technological development over time so you can understand how we ended up where we are today.

I will illustrate this with a few protocols from a few vendors before going into detail on one specific family of networks.

06 Basic Point to Point Serial

The first and most basic networks were simple point to point serial links.

You may argue that a point to point link is not a network, but in this case it is the start of networking with PLC, and one of the most important industrial network protocols today is a direct descendent of one of the early point to point protocols.

These point to point links initially addressed two main issues.

One was that once computers were being used to run the software needed to program PLCs, some means of downloading the program to the PLC and to debug the PLC program was needed, and this took place over a point to point serial link.

The other was that there were various microprocessor driven instruments and devices where it was desirable to allow the PLC to communicate with them in order to obtain readings, adjust set points, and otherwise exchange data.

A serial link was the obvious means of implementing this.

The physical and electrical media were generally RS-232, RS-422, or serial current loop.

09 RS-232

RS-232 should be familiar to most listeners.

The notable characteristic of RS-232 is that the data and control signals were referenced to ground, or "single ended" as this is also known.

While this was simple, it placed limitations on length of cabling and it was somewhat problematic when the PLC and the other device were connected to different power sources and did not have a common ground.

10 RS-422

RS-422 differs from RS-232 in that the signals are differential rather than referenced to a common ground.

Signal lines come as pairs, and it is the difference in voltage within the pair rather than compared to ground which defines the zeros and ones.

This allows for higher data rates, up to 10 mbps at very short distances, and much longer cable runs, up to 1,200 metres, at the cost of lower data rates.

RS-422 also allowed for multiple receivers to be connected to the same wires, although only one driver was permitted.

This allowed for multiple devices to "listen" on the same set of wires, although only one node could "talk".

12 Serial Current Loop or TTY

Some PLCs, particularly Siemens, used a serial current loop instead of RS-232 or RS-422.

This is known as a TTY interface, as it originated with teletypes.

You may be familiar with the term TTY being used to describe terminal windows in unix like operating systems.

This is due to early computers adopting off the shelf teletype equipment to provide operator terminals.

This used differences in current rather than differences in voltage to carry signals.

When 20 mA is flowing, this indicates a "1".

When 0 mA is flowing, this indicates a "0".

Serial current loops can operate reliably over greater distances than RS-232, up to a kilometre at lower data rates.

14 Typical Protocols

An electrical standard such as RS-232 allows for transmitting zeros and ones through a wire.

It does not however define what those zeros and ones mean.

That requires a data protocol.

Each manufacturer tended to come up with their own protocol.

Modicon developed Modbus.

Allen Bradley came up with DF1.

Siemens created 3964R and RK512

Other manufacturers generally each had their own.

I will discuss Modbus in detail later, but won't otherwise go into detail on these protocols here.

16 Multi-drop Serial

Point to point serial, even RS-422 which allowed for multiple receivers, worked, but it suffered from a number of limitations.

The most obvious one is that if you wanted two way communication, you needed a separate cable between each point, and a dedicated communications port or a port multiplexer.

As the system becomes larger and more complex, this becomes unwieldy.

17 RS-485

What would be desirable is a means of allowing multiple serial devices to share a serial communications link.

The solution to this is RS-485.

Like RS-422 this uses differential signalling.

It also allows multiple receivers on the same wires.

Unlike RS-422 however, RS-485 allows for multiple transmitters.

Up to 32 nodes can be connected to the same RS-485 cable.

This limit is determined by the electrical characteristics of the cable and transmitter and receiver chips.

18 New Protocols

PLC manufacturers adapted their existing protocols or came up with new ones.

Allen Bradley adapted their serial DF1 protocol into Data Highway, Data Highway Plus, and Data Highway 485.

Siemens came up with L1, Profibus and Profibus-DP.

19 Master Slave Versus Multi-Master

Many of these networks were strictly master-slave systems.

One node would be designated the network master, and it would poll each of the other nodes, the slaves.

This sort of configuration suited a lot of applications where what was generally wanted was to allow a PLC to act as the network master and poll various other devices located some distance away.

One early application of this was to allow IO racks to be located some distance from the PLC CPU.

This in turn allowed for the IO racks on very large machines to be closer to the devices they are connected to, such as switches or valves or relays, and so reducing the amount of cabling and wiring required.

Further development of this produced IO in the form of blocks that could be mounted directly on the machine without requiring a separate electrical enclosure.

These could even be directly integrated into valve banks, which are collections of valves sharing a common plenum.

However, this had limitations when the goal was to network multiple PLCs together so they can coordinate with each other.

With a strictly master slave system, one of the PLCs would have to be designated as the master and the PLC program would have to handle forwarding of messages between the other PLCs.

The solution to this was a multi-master network.

The physical wiring would still typically be RS-485 or some proprietary variation on it.

The protocol however would have to be adapted to allow for multiple masters.

This was usually some sort of token passing protocol, where the "token", which was a piece of data designating the master, would be passed from node to node so that each node had its turn to temporarily be master.

24 Device Level Networks

The reduction in cables and wires and the resulting cost savings in terms of installation labour meant that there was additional incentive to extend networks down to individual devices such as switches or single valves.

I won't go into a lot of details on these, but instead just mention some common examples.

There were some purely proprietary systems such as Siemens ASI.

There were also a number of systems based on CAN, which stands for Controller Area Network.

CAN comes from the auto industry, and was meant for networking various parts of your car together.

You probably have a CAN network in your car whether you realize it or not.

The industrial automation industry took the off the shelf CAN standards and chip sets and added their own protocols on top to create device level networks.

Some typical examples of his are Canbus and Allen Bradley Devicenet.

27 The Rise of Ethernet

Networking appeared on the factory floor well before it was common in the factory's offices.

This combined with the highly fragmented nature of the industrial automation industry meant that it was difficult to gain economies of scale in manufacturing the networking hardware.

It also meant that each company had to dedicate R&D efforts developing things which duplicated functionality already existing elsewhere.

Meanwhile networking technology was spreading in office environments, and gradually consolidating around Ethernet and TCP/IP.

The huge scale of this market and the well developed standards meant that costs fell significantly due to economies of scale and competition between suppliers.

Seeing this development in the IT industry, automation companies decided to adopt IT networking standards wholesale, at least so far as the physical wiring and the low level protocols were concerned.

They could still use their application level protocols, maintaining vendor lock in.

Some typical examples of these protocols are Siemens Profinet, Allen Bradley Ethernet/IP, and Modbus/TCP, all of which were adaptations of previously existing protocols to operate on Ethernet.

31 Summary So Far

What we have covered so far in this episode is the origins of networking in industrial automation beginning with

point to point serial links,

to multidrop serial master slave networks,

to multidrop serial multi-master networks,

to the adoption of Ethernet.

You should have at this point some idea of the context within which networking operates in industry and what it is used for.

Next we will discuss one specific protocol in some detail, Modbus.

32 Modbus

Background

Modbus was created by Modicon in 1979.

If you recall from previous episodes, Modicon, now part of Schneider Electric, were one of the first companies to develop a PLC.

Modicon published the specification to allow third parties to implement it, making it one of the few truly open royalty free industrial automation standards.

I say "truly open", because the automation industry loves to put the word "open" in their brand names, although to them "open" means applying for a license, being accepted by them, paying royalties or membership fees, and paying for certification as an accepted vendor.

Anyone however can download the Modbus specification, implement it, and do whatever they wish with it.

There are multiple free software implementations of Modbus libraries.

35 Versions or Variants of Modbus

There are several variants of Modbus, differentiated by the physical media or application.

These are

• Modbus RTU

• Modbus ASCII

• Modbus Plus

• and Modbus TCP

36 Modbus RTU

This is the original version of Modbus, and is a point to point serial communications protocol.

The RTU part of the name stands for "Remote Terminal Unit", which is the name for an industrial device which has some sort of serial or network interface and acts as an interface to field instrumentation.

A typical example may be say a flow meter on a pipeline.

This protocol was very widely implemented by third parties.

The serial data format is

• 8 bit binary

• 1 start bit

• 8 data bits, least significant bit first

• 1 parity bit

• 1 stop bit

A 16 bit cyclic redundancy check field is included in the message.

38 Modbus ASCII

Modbus RTU is designed as a serial protocol and has very precise per bit timing specifications.

This meant however that it would not work reliably over radio links servicing things such as water systems, oil fields, and other distributed applications.

Furthermore, Modbus RTU is a binary protocol, and this meant that some values may be interpreted as control codes by the transmitting or receiving hardware.

The solution to this was Modbus ASCII.

This sent data in ASCII format, with each byte converted to two bytes of hexadecimal.

The serial timing restrictions were relaxed to effectively whatever the hardware would tolerate.

The serial format is

• Hexadecimal, ASCII characters 0-9 and A-F

• 1 start bit

• 7 data bits, least significant bit sent first

• 1 parity bit

• 1 stop bit

A colon is used to signal the start of a new message, and a carriage return and line feed pair marked the end of a message.

A longitudinal redundancy check was included as ASCII encoded data and placed just before the terminator characters.

Since Modbus ASCII messages took twice the number of bytes as Modbus RTU, it could only transmit data at half the speed. This meant that the use of Modbus ASCII was limited to just the applications it was meant for, which was radio communication links.

43 Modbus Plus

Modbus Plus is Modbus adapted to work on an RS-485 serial multidrop network.

However, it was never part of the Modbus specification, and was proprietary to Modicon.

I won't bother describing any more of it.

44 Modbus TCP

Modbus TCP is Modbus RTU slightly modified to be tunnelled over TCP/IP, particularly on Ethernet.

This was very widely adopted, and even some of the big vendors who had their own protocols would offer it as an alternative to allow communication with devices they would otherwise not be able to talk to.

Modbus TCP uses port 502.

This is an officially assigned port, and if you look up the official list of TCP ports you will find Modbus listed there as 502, just like HTTP is port 80 and SMTP email is port 25.

The standards committee for Modbus made the very conscious decision to adopt IT industry standards and conventions wholesale as much as possible and just reference those instead of maintaining a unique automation industry set of standards and conventions.

This was for several very practical reasons.

One was that there were very few people involved in standards work and they were looking for ways to reduce the amount of work they needed to do.

The other was that people working in industry found the duplication of vocabulary very confusing and difficult to keep straight as to what in IT terms translated to what in industrial automation speak.

One of the consequences of this is that the master - slave serial communications terms were dropped in favour of the IT networking terms client - server.

As a result of this I will use the Modbus TCP terms in the rest of this episode, as this is the form of Modbus you are most likely to encounter these days.

49 Modbus UDP

This was an unofficial version of Modbus TCP which simply sent the data over UDP rather than TCP.

There was no change to the actual Modbus data format sent.

It was done mainly to show that it could be done.

The supposed advantage was the lower overhead and latency of UDP compared to TCP, but it wasn't enough of an advantage for this to spark much interest.

50 Proprietary Modbus Extensions

Several companies created their own extensions to Modbus, particularly to extend Modbus RTU.

These were only ever used in some niche applications.

One of the most common was Enron Modbus, which was created by the Enron company in the US.

This added a 32 bit data extension to the protocol.

51 Modbus Data Model

The Modbus data model is centred around a PLC style data table.

This is an array of memory and a set of commands to read from and write to that memory.

There are four types of memory

• Discrete Inputs

• Coils

• Input Registers

• Holding Registers

There can be up to 65,536 memory addresses of each of the four types.

Each memory type can have anywhere from zero to the maximum number of elements, it is up to the implementation as to how many addresses to have.

Memory addresses start at 1, so that the number "1" refers to the first address.

Addresses as actually sent over the wire however start at "0".

Discrete inputs and Input registers are read only memory,

while coils and holding registers are read - write memory.

Discrete inputs and coils are single bits.

That is, each address represents one bit of memory.

Input and holding registers are 16 bit words.

When transmitted over the network, words are "big endian".

That means that the upper byte of a word is sent first and the lower byte is sent second.

It is permitted to overlay different types of memory.

For example, the coils memory could be overlaid on the holding register memory, such that for example the first 16 coils are also the first holding register, etc.

57 Modbus Functions

Modbus TCP is a client server protocol.

The client sends a command requesting to read or write memory, and the server responds with either an acknowledgement or with another message containing the requested data or an error code.

Each command is known as a "function".

Each function is referenced to by a number.

I won't list all of the functions, just the most commonly used ones.

A Modbus instance does not need to implement all possible functions, only the ones that it uses.

• Function 1 is "read coils".

• 2 is read discrete inputs.

• 3 is read holding registers.

• 4 is read input registers.

• 5 is write single coil.

• 6 is write single register.

• 15 is write multiple coils.

• 16 is write multiple registers.

The limits on the quantity of data elements which can be used in a single transaction for each command are as follows .

• Function 1 is 1 to 2000

• 2 - 1 to 2000

• 3 - 1 to 125

• 4 - 1 to 125

• 5 - NA

• 6 - NA

• 15 - 1 to 1968

• 16 - 1 to 123

61 Modbus Message Format

The full Modbus message is called the ADU, or Application Data Unit.

Within the ADU is the Protocol Data Unit, or PDU.

The PDU contains the Modbus command and the associated data.

The ADU contains additional information, and can vary depending on the type of Modbus.

I will limit myself to talking about Modbus TCP here.

62 MBAP Header

On Modbus TCP, the PDU is preceded by the MBAP Header, which is the Modbus Application Protocol Header.

It has the following format.

• The first 2 bytes are the Transaction Identifier.

• The second 2 bytes are the Protocol Identifier.

• The third 2 bytes are the Length.

• The next 1 byte is the Unit Identifier.

The Transaction Identifier is simply an integer that will be copied from the client request to the server response.

The client can examine this to match up responses with requests.

This is really only of use if there is a chance that responses may get out of order.

The Protocol Identifier is always zero and indicates the protocol is Modbus.

The length is the number of following bytes, including the unit identifier and data fields.

The Unit Identifier is used for allowing messages to pass between Modbus TCP and serial Modbus, such as Modbus RTU.

For example, a gateway on the Modbus TCP network may have multiple Modbus RTU devices connected to it.

The Unit Identifier in this case would correspond to the serial line address or serial port number of the Modbus RTU unit the request is directed to.

The length field is set by the client in the case of a request, or the server in the case of a response.

All of the other fields are simply copied from the request to the response by the server.

67 Example - Function 1

Here is an example of a Modbus PDU message for function 1, read coils.

The request has the following format.

• The first byte is the function code, in this case it is "1".

• The next two bytes contain the starting address in the range of 0 to 65535.

• The next two bytes contain the quantity of coils, which may be in the range of 1 to 2000.

The response is in the following format.

• The first byte is the function code, in this case it is "1".

• The second byte is the number of bytes of data following.

• Following next is a series of bytes containing the data, with 8 coils packed into each byte, for however many bytes are required.

• Any unused bits in the final byte are padded with zeros.

If there was an error, the response would be in the following format.

• The first byte would be the function code with 128, or 80 in hex, added to it. This effectively sets the high bit in the byte.

• The second byte will contain an error code indicating what the error was. This will be 1, 2, 3, or 4.

71 Exception Codes

In the event of an error in the request, the function code is returned with 128 added to it, setting the high bit.

Valid function codes are all below 128, so any response which begins with 128 or higher indicates an error.

Following the error code will be the exception code.

1 - Function code not supported.

2 - Address out of range.

3 - Quantity out of range, or invalid value (in the case of functions 5 and 6).

4 - Other error.

All possible word values are valid in the case of function 6 (which is write single register), so technically exception 3 cannot occur, but it is in the spec anyway.

As you can see, Modbus TCP is a very simple and well defined application protocol which is well suited to industrial control.

These basic commands will do nearly all of what is required in most applications.

Because this protocol is freely available and easy to implement, it has widespread support, particularly among smaller or specialized vendors.

73 Conclusion

In this episode we took a brief look at PLC networking, together with a detailed look at one network protocol, Modbus.

In the next episode, we will look at

• Personal computers in industry, including specialized hardware,

• SCADA systems,

• HMI systems,

• Test and measurement systems,

This has been the sixth episode in an 8 part series.

Provide feedback on this episode.

fork, exec, wait and exit

Tue, 27 Oct 2026 03:15:53 +0100

This is the english version of a 2007 article. In de.comp.os.unix.linux.misc somebody asked: Are commands in a script executed strictly sequentially, that is, will the next command only be executed when the previous command has completed, or will the shell automatically start the next command if the system has spare capacity? Can I change the... Weiterlesen

GitHub Release: matrix-construct/tuwunel v1.7.1 (05.06.2026)

Mon, 26 Oct 2026 22:57:32 +0100

matrix-construct/tuwunelv1.7.105.06.2026@github-actions[bot]

Tuwunel 1.7.1

June 5, 2026

New Features & Enhancements

A new federation data-fetching service improves reliability in rooms whose history is spread across many servers by locating missing events through concurrent queries. It ranks candidate servers by room-membership popularity and recent reachability, and reuses requests already in flight instead of issuing duplicates. Resolved state for outlier events, fetch and backoff decisions, and per-server reachability ("Peer Status") are now cached persistently, and auth-chain, state, prev-event, and backfill fetches all run through it. Servers that used to re-request the same uncacheable lookups should see far less repeated federation traffic.
OIDC device authorization grant (RFC 8628) lets users sign in on input-constrained devices. The MSC4191 account-management action set is now complete with a deep-linked cross-signing reset, and MSC3861 OAuth 2.0/OIDC is advertised on /versions. The token endpoints and refresh-token lifecycle were reworked, dynamic client registration is opt-in and validates submitted client metadata, and device-scope binding requires PKCE. The OIDC authorization-server chapter of the documentation was expanded to match.
Several additional MSCs land this cycle: MSC3980 (event_fields trimming on /sync), MSC3860 (media download redirects), MSC4311 (origin_server_ts on the stripped create event), MSC1219 (key backup storage conformance), MSC2659 (appservice ping error codes), MSC3550 (403 M_FORBIDDEN allowed on profile lookup), and a stable m.forget_forced_upon_leave capability (MSC4267). MSC4380 invite blocking now also covers invites delivered through /sync and createRoom.
Support-contact discovery gains a PGP field and policy links (MSC4439, MSC4266), graciously contributed by @x86pup. The /.well-known/matrix/support endpoint can now advertise a pgp_key per contact (with raw key material rejected) and link support policies, and multiple support contacts can be configured with validation.
@dasha-uwu added an admin media preview command for debugging URL previews, retired blurhashing, dropped the legacy media-preview redirect, and removed the deprecated server-keys endpoint.
Sliding sync (v5) now retracts departed and left rooms from the list and adds re-invited rooms back, so clients track membership churn without a full resync.
A device may now hold multiple access tokens, for easier rotation and concurrent sessions.
/context can optionally resolve events it has not yet received over federation, and outbound HTTP compression gained per-direction opt-out switches.
An admin command to purge every room containing a given user was added, raised by @winyadepla in (#472).
Documentation for ip_source_trusted_subnets now warns about accidentally including a proxy in the trusted set, courtesy of @BVollmerhaus in (#468).
Diagnostic admin command suites were added for the federation fetcher and Peer Status, and the runtime can dump tokio and getrusage metrics to JSON at exit.

Bug Fixes

A regression introduced with ip_source in 1.6.1 blocked locally-connected appservices and other loopback clients (#465). Loopback peers and trusted-peer subnets now bypass the configured ip_source, including over the Unix-socket listener, and the axum-client-ip dependency was replaced with inlined helpers. Sincere apologies to everyone whose bridges went quiet.
Remote room directory and summary lookups are more resilient over federation: the room-summary fallback now tries every via server (5c99983), and a failed remote publicRooms request now returns a 502 (9a87977).
Thank you @x86pup for reporting in (#466) that a bad unix_socket_path produced an opaque startup failure; listener initialization errors now name the offending path.
!admin query oauth associate replied with an empty message and did nothing, reported by @Vazgen005 in (#467). It now emits a confirmation and accepts a force flag.
@dasha-uwu fixed a compression configuration option that could accidentally disable client-side decompression.
Several federation correctness fixes: the federation lock is now held across the invite residency check to close a join/unban race (add512b); a send_join response that omits state fails over to other servers (9c158d3); each transaction's PDUs are sorted topologically before handling (91218e1); and references outside the auth graph are treated as non-edges during resolution (6643919).
Knock membership is now persisted and a remote re-knock re-drives to reconcile state; per-PDU backfill errors are isolated so one bad event no longer aborts the batch; and thread redaction walks through the redacted target.
Media fetches and URL previews now honor CIDR denylists for the addresses they resolve to (af1266a, 554557c). Buffered outbound responses are size-bounded, and federation key lookups are bounded and backed off.
Configuration handling improved: an unreadable client_secret_file now reports the path and IO error (844f123), matched keys can be excluded from the "unknown to tuwunel" warning (6bbfd0a), and packaged builds no longer drop their malloc_conf tuning (de0eb1d).

GitHub Release: matrix-construct/tuwunel v1.8.2 (17.07.2026)

Mon, 26 Oct 2026 22:57:14 +0100

matrix-construct/tuwunelv1.8.217.07.2026@github-actions[bot]

Tuwunel 1.8.2

July 17, 2026

New Features & Enhancements

URL preview media proxying relays link-preview media through the server, now covering og:video and og:audio alongside images, so the third party sees Tuwunel rather than the requesting client. Nothing is stored permanently: preview media becomes a lazy mxc:// reference fetched from source on demand. A url_preview_user_agent option, with a separate url_preview_media_user_agent, lets previews work for sites that block the default agent. Shipped by @az4521 in (#508), closing their own request for video previews (#394). The preview store is rebuilt on CBOR at the same time, replacing a byte-separated format that could shear fields.
Distribution packaging expands to RPM with a COPR build pipeline (fixes #251) and a SELinux policy module shipped as a selinux subpackage (#412), plus an apt repository published from CI and Debian packaging that adopts an existing conduwuit or Conduit database in place. Courtesy of @x86pup.
Online backups can now be restored and verified, joined by a delete-backups admin command, graciously contributed by @x86pup.
MatrixRTC transport discovery (MSC4143) is served without an access token, so Element Call can find a server's transports; contributed by @basnijholt in (#512).
A container HEALTHCHECK, backed by a new liveness-probe mode, lets orchestrators track readiness, with appreciation to @x86pup.
A dns_servers config option makes the /etc/resolv.conf dependency optional, tip of the hat to @x86pup.
The Synapse-compatible admin API grows again (#38): server-notice endpoints, user redaction and login-as, federation destination management, and media info, purge, and statistics.
Appservice transaction extensions deliver richer data to appservices: device-list changes and one-time-key counts with unused fallback key types (MSC3202), and to-device events (MSC4203). Opened by @dark-collective in (#502) and (#501).
Forward-extremity capping and pruning guards against extremity blowup with a scored prune engine that always leaves a survivor and protects the local server's own leaves, a cap applied on the federation receive path, and admin room commands to list and prune a room's extremities.
Local state derivation for incoming federation events lands in observation mode (#419). The server derives an event's state from local ancestry and calls /state_ids only for physically absent events, running alongside the existing fetch and comparing while the fetched result stays authoritative.
Long admin command output is split across chained reply or thread events, and oversized output is attached as an uploaded file, raised by @grinapo in (#471).
Pushers rejected by the push gateway are now removed, backed by push-gateway conformance tests and UnifiedPush documentation, raised by @NinekoTheCat in (#20).
Support for Matrix v1.18 and v1.19 is declared in /versions.
The max_fetch_prev_events default is raised to 1024.

Bug Fixes

Federation delivery no longer runs hot against a peer that has come back. The per-server backoff gate consulted only the current time bucket, so it re-authorized attempts at every timeout boundary and never honored the computed earliest retry, and a stale set of reachability rows could keep muting a recovered server. The verdict now derives from a server's full failure history, a returning peer clears the whole streak, and the old rows are cleared once on upgrade (da0c3f6, ec049f6). Sincere apologies to anyone whose outbound federation lagged to a server that had recovered.
A proxy or CDN answering a federation request with non-JSON is treated as transient rather than evicting the route outright, and route override eviction is fixed for well-known and SRV-delegated topologies where it was a no-op (b33415d).
Tuwunel refuses to initialize over the remnants of a database that lacks a readable manifest, instead of treating them as obsolete files and deleting them on open (fixes #510). Reported and diagnosed by @ItsLiyua, whose detail on the two parallel database directories localized the cause.
Native OIDC login completes again: the redirect-completion path returned 405 and produced a redirect Chrome refused (fixes #504, #505). Reported by @isniz and @achetronic.
One-time-key counts match Synapse's shape, and an explicit zero count is preserved, so a client whose key pool is drained still sees signed_curve25519 and replenishes instead of starving (007033c, 164b8da). Contributed by @basnijholt in (#511).
A soft-failed inbound event could compute an empty forward-extremity set and, once persisted, remove every leaf and wedge local sends until a remote event arrived; the previous band is now preserved, and a detached non-create local event on an empty frontier is refused rather than silently forking the room (e0f1034, 1f1dea6).
The inbound federation profile query returns 404 M_NOT_FOUND for an unknown user instead of an empty 200 (76ea07f).
The room ephemeral section is always present in /sync responses now, thanks to @x86pup (79bb4af).
An empty device_id is treated as unspecified and a device id is generated (cfe73cb).
A systemd unit no longer sticks in the deactivating state after an in-place admin restart, fixed by @x86pup (68e034d).
Non-Linux builds get several repairs, courtesy of @obodnikov: resource-usage reporting compiles on non-unix and no longer panics in macOS thread usage (#509), Ctrl+C actually shuts the server down on non-unix targets (#507), and platform-gated admin commands compile on every target (#506).
Backup requests that cannot create a backup error instead of reporting success, and backup engine errors propagate rather than being swallowed (f6de800, 9b54209). Credit to @x86pup.
@x86pup corrected documented config defaults that disagreed with the code (bb9dfb2), and the notification_push_path description is set right (e16a3ae).

GitHub Release: matrix-construct/tuwunel v1.8.3 (06.08.2026)

Mon, 26 Oct 2026 22:57:14 +0100

matrix-construct/tuwunelv1.8.306.08.2026@github-actions[bot]

Tuwunel 1.8.3

August 5, 2026

New Features & Enhancements

QR-code login 📲 Take a picture of Element Web with Element X: login instantly. (MSC4108). Rendezvous sessions are served over the MSC4388 transport, with bounded in-memory payloads, a session cap and TTL, and their own rate limit. The native OIDC server grows to meet it, serving account login for the device authorization grant and account management with no identity provider configured at all. Raised by @rjwalters in (#525).
Video thumbnails. A client that uploads a video without a thumbnail left the server nothing to preview, so media_video_thumbnail_command names a program that extracts one still frame for the image thumbnailer to scale and crop. Inspired by @az4521 in (#397) and implemented by @x86pup, who also caps what the thumbnailer will decode at all with media_thumbnail_max_pixels, checked against the image header before any decoder allocates. Requests whose thumbnail would only reproduce the source skip generation entirely, shipped by @lhjt in (#521).
Native journald logging. Under systemd every line landed in the journal at info priority, so priority filtering in journalctl was blind to Tuwunel's warnings and errors. Events are now submitted natively with their severity, target, and source location, under a log_journald option that defaults on. Shipped by @byteflavour in (#534) and extended by @x86pup, whose layer streams the console-formatted line into each entry and records tracing fields under an F_ prefix, so the journal can be filtered by room or event id.
systemd socket activation and configuration reload, courtesy of @x86pup. A socket unit ships for activation, systemctl reload is wired into the Debian and Red Hat units, the Arch unit refreshes its systemd credentials on reload, and a reload now replays the startup command line, so a server started with -c or -O rebuilds the configuration it actually had. TURN and registration secrets are re-read at each use, so rotating either file no longer needs a restart, and an in-place restart strips the activation variables it can no longer honor. Documented alongside.
Android builds work, courtesy of @x86pup. The TLS segment is aligned for bionic's loader, SMTP and client TLS verify against bundled webpki roots, dns_servers becomes a requirement where the system resolver would need a JVM, and jemalloc and rust-rocksdb are advanced for the libgcc fix.
LDAP login hardening from @x86pup. Filter and bind-DN metacharacters in the login localpart are escaped, an empty password is rejected before the bind is attempted, accounts that did not originate in LDAP and deactivated accounts are refused, and error handling, timeouts, and password-file IO are tightened.
Appservices gain third-party network lookup forwarding: the client /thirdparty/* endpoints fan out to every registered bridge, carrying protocol metadata verbatim. One-time keys are proxied ahead of the fallback key and appservice device keys are overlaid across client and federation paths (MSC3983, MSC3984). A stalled transaction is retried after a ping, and appservice users are excluded from user-directory search.
Push badges carry the account-wide unread count, derived across joined rooms at delivery, refreshed on demand, recovered from the queue at startup, and hooked into the read paths that change it. An explicit zero is preserved and only a true opt-out is honored. Reported and diagnosed by @lhjt.
State resolution gets a reworked conflicted-subgraph walker, an event-ID sha256 codec with a matching map hasher, mainline positions read from a map, an auth difference hashed by event ID, and short hashes persisted with their state diffs.
A Matrix Authentication Service provider guide documents the integration end to end, with a startup warning when mas_secret is set but no MAS identity provider is configured.
@dasha-uwu adds a rooms info command, users set-profile-key, and a historical filter on admin query users iter-users, and removes the abandoned MSC4373 EDU-type preference endpoint from the unstable surface.
The room directory admin commands accept a room alias and surface it in public-rooms responses ahead of the canonical alias, while publishing an unknown room is refused. Contributed by @x86pup, who also falls URL previews back to twitter: card tags when the og: values are empty, and newline-delimits list-backups output.
Thank you @Xerusion for documenting Traefik root-domain delegation in (#529), and @byteflavour for raising the btrfs WAL fallocate disk-usage footgun in (#535), now documented.
Compliance status pages for the Complement test families join the documentation, admin query raw flush forces a RocksDB memtable flush, room-scoped policy recovery lands as an admin command, database writes go through atomic batches that watcher notifications take as their single source of truth, the runtime can report tokio scheduler latency histograms, and the pool-thread and cache defaults are relaxed.
Admin rebuild-relation-index and rebuild-thread-index move from !admin server to the debug suite; existing invocations need the new path.

Bug Fixes

Thank you @lhjt for catching in (#515) that appservice-authenticated client requests inferred presence and activity for the user they act as; the exclusion landed in (#517), with activity context passed through the ping arguments behind it.
Reopening the database in-process, which a module reload does, restored the configured backup a second time over everything written since; the restore is now claimed rather than read (cd71003). Separately, the -O loop that sets the restore option ran after the check meant to refuse it, so a database could roll back on every start (8e3e339). Both repaired by @x86pup. Sincere apologies to anyone who restored a 1.8.2 backup more than they meant to.
Public read receipts are monotonic again. A re-posted receipt took a fresh stream position and re-sent the EDU to appservices and over federation; the stored position now gates the write. Reported by @lhjt in (#516), who shipped the first fix in (#518). Private read markers are monotonic too, and the sender's own send is marked read without publishing a receipt for it. The deletion sweep is bounded by the encoded room prefix, which had let it cross into a sibling room whose id merely shared a prefix (7190ab8).
Soft-failed events are handled correctly in three places. A withheld membership or power-level change is kept out of current state instead of being applied locally, which is the outcome withholding it exists to prevent (cb03606). The rejection marker used to reject every later attempt, so an event withheld over a policy refusal could never return once that refusal lapsed; it now expires on the shared upgrade backoff and reports to the origin as withheld rather than failed (5b1fc2d). Policy-server refusals expire after 24 hours (6651f9e), and a corrupt state-after room is contained rather than failing the whole /sync response (b565d92).
Left rooms stay in sync when their cached leave state came from a sibling conduwuit-lineage server, thanks to @x86pup: a lone event object is lifted into a one-element array and anything else read as no cached state. To-device events are handled only for local active or appservice-claimed recipients, so a bridge still receives its own.
Non-unix and BSD builds are repaired again, courtesy of @obodnikov: the signals trace import (#526), the in-place restart import (#527), the cfg(unix) gating that the listener refactor dropped (#528), and the sys/limits nix imports and page size (#536). Device major and minor conversion is fixed for the BSD builds alongside.
Native OIDC against Matrix Authentication Service completes. MAS's policy allowlist rejects any scope past openid and email, so our unconfigured default of openid email profile failed every authorization. Reported by @utop-top in (#530).
Short-id allocation is serialized, so a racing or repeated caller observes the winner's rows instead of minting a second short id for one identity; a repeated event id inside a single batch reached this deterministically (5cff8b8). Room search tokens are purged by shortroomid prefix, in one atomic pass (59d7224, 423fbce).
Keyed mutex entries are reaped on every release path. A contender that never became a guard, through cancellation or a failed try_lock, left its entry in the map forever (a2bac8d).
Federation retry wakes land uniformly across the backoff interval rather than within a fixed three-second jitter, so a cohort of destinations that failed together stops retrying together (2600024). A stale queue wake is rejected, and the resolver's in-flight deduplication is actually awaited, so concurrent lookups for one destination share a single resolution.
@okias reported a broken documentation link in (#522), fixed along with the packaging READMEs, which now use absolute rendered-docs links.
@x86pup landed several more fixes: the admin console is skipped when standard input is not a terminal, appservice response-body read failures are logged, and a failure to notify an appservice of an invite returns a generic error. @dasha-uwu repaired get_all_user_mxcs, which left a trailing user-id record unconsumed and panicked debug builds for any user with uploaded media. Elsewhere, admin debug reports per-column errors instead of panicking on an invalid property name, an unchecked float conversion is guarded, a defaulted listen address that fails to bind is skipped rather than taking the whole listener down, and the RocksDB environment is held in one process-global slot so one database's shutdown cannot strand another mid-close.

GitHub Release: matrix-construct/tuwunel v1.9.0 (06.10.2026)

Mon, 26 Oct 2026 22:56:35 +0100

matrix-construct/tuwunelv1.9.006.10.2026@github-actions[bot]

Tuwunel 1.9.0

August 18, 2026

Important

Read this before upgrading.

The first 1.9.0 boot runs a one-time database migration and does not open the listener until it finishes. Back up your database before upgrading (docs/maintenance.md). The migration repairs short-id records written by earlier releases and clears cached auth chains. Its duration is unknown and scales with the size of the database; a long stretch of high CPU on one core with no new log lines is the migration working, not a hang. Under systemd the service extends its own start timeout while it runs, so systemd will not time it out. Do not stop the server before it finishes. Killing it leaves a partly migrated database that no admin command can check or repair, and the only recovery is the backup you took first.
1.9.0 will not start without a CA bundle. If you run the published standalone binary in a chroot, a distroless image, or a hand-rolled FROM scratch image, install a CA bundle or set SSL_CERT_FILE before upgrading. 1.8.3 started without one. The container image and both packages already include a bundle.

New Features & Enhancements

URL previews are richer and more reliable, shipped by @x86pup. The fetch budget rises from 256,000 to 786,432 bytes, each request gets its own User-Agent, and oEmbed recovers pages that otherwise yield nothing. YouTube links now show their title, channel and thumbnail instead of a bare hostname. Previews remain disabled until at least one url_preview_*_allowlist option is non-empty. See docs/media/url-previews.md.
TLS now uses aws-lc-rs and the platform trust store, courtesy of @dasha-uwu. ring leaves the build, while SMTP, LDAPS, S3 media, client and federation pools share one crypto provider. allow_invalid_tls_certificates now covers LDAP TLS too. Operators running the published standalone binary in a chroot, distroless image or hand-rolled FROM scratch image must install a CA bundle or set SSL_CERT_FILE before upgrading. Unlike 1.8.3, version 1.9.0 will not start without one. The container image and both packages already include a bundle.
Push rules can now match related events (MSC3664), graciously contributed by @x86pup and raised by @OxiOverlord in (#544). The default .im.nheko.msc3664.reply rule is added to every account on upgrade regardless of configuration, so nheko users get reply notifications immediately through client-side evaluation. Server-side evaluation for notification counts and pusher delivery requires msc3664_related_event_match, which defaults to false. The default covers replies; .m.rule.reaction still suppresses reactions, but custom rules can now match m.annotation.
Tuwunel can now rewrite your configuration file. The new command-line regeneration mode and !admin server regenerate-config render the example document from the live schema with your values, canonical option names, and unknown keys preserved under # DEPRECATED, # UNKNOWN or # UNDOCUMENTED. Regenerate and diff to review the result. Nothing is applied or reloaded, and the default output is a new file beside the original. A separate mode emits a clean example. See docs/configuration/regeneration.md.
Migrating a conduwuit-lineage database now preserves account state, with appreciation to @x86pup. On the next boot, passwordless accounts no longer appear deactivated, deactivated accounts remain inactive with their old passwords disabled, and email addresses keep their owners.
!admin query oauth adopt converts a migrated conduwuit-lineage database's OIDC subject map into durable identity associations in one pass. Without it, each migrated user's next login creates a fresh account with a generated localpart.
Thanks to @x86pup, FreeBSD and OpenBSD arm64 build without custom CXXFLAGS, while NetBSD arm64 selects hardware CRC32C at runtime. New guides cover FreeBSD, NetBSD, OpenBSD, RISC-V 64 and 32-bit ARM, each with a verified build and its remaining limits: OpenBSD needs Rust from -current, ARMv6 lacks a working C++ runtime here, and none of the five is covered by CI or ships an artifact.
Nine cache-capacity options that previously read "This item is undocumented" now explain that their values are entry counts, not byte sizes, graciously contributed by @byteflavour in (#541).
Startup now warns when write-ahead log preallocation is enabled on btrfs or ZFS, where it reserves much more disk than the logs use. Raised by @byteflavour in (#535). rocksdb_allow_fallocate still defaults to true; the server warns without changing the engine setting.
Thanks to @x86pup, each account's push ruleset is capped at 10,000 rules, with each serialized rule capped at 1024 bytes. The limits apply only when the ruleset grows; deletes and disables remain unconditional.
force_migration is now hidden from generated configuration. If it is still set at boot, Tuwunel warns and waits fifteen seconds. Tip of the hat to @x86pup.
With appreciation to @x86pup, the .deb and .rpm install checks now resolve their dependencies, and the .deb check confirms that the programs invoked by the unit exist.
Credit to @dasha-uwu for reworking registration-token handling and correcting two admin API responses: deleting a config-file token now returns 403 instead of 500, and updating one returns 403 instead of 404.
RocksDB advances to 11.8.1 and jemalloc to 5.3.1-2. Eleven low-traffic cache columns now share a pool, while five hot columns retain dedicated pools sized by four new options. Failed write-ahead log flushes and syncs are now logged.
Fifteen subsystems moved their multi-row writes into single database transactions, so a related group of rows is either all visible or none.
One option added in 1.8.3 went undocumented. refresh_token_reuse_grace controls how long a rotated refresh token remains valid; setting it to 0 treats any reuse as a compromise. The option is not new, and its behavior is unchanged in this release.
The Matrix Authentication Service guide now distinguishes MAS as a login provider from MAS as a provisioner and lists all twelve provisioning routes.
The reverse-proxy guide now correctly explains that the /_synapse/admin/v1/register pair uses an HMAC over registration_shared_secret, not an admin token. Restrict this path to trusted networks.
Internal Rust API documentation now covers the public surfaces of tuwunel-core and the database crate. Complement gains shared-secret registration and an advanced fork pin. Dependencies also advance, including h2 0.4.16 for RUSTSEC-2026-0258.

Bug Fixes

LDAP logins broken by 1.8.3 work again. That release rejected binds for existing local accounts without LDAP origin, locking out deployments that added LDAP after creating accounts. The gate is reverted (bf1ba04), with only its deactivation check restored (b1eee03). Before upgrading, confirm that [global.ldap] base_dn and filter, or the bind_dn subtree in direct-bind mode when no search runs, resolve only principals allowed to log in as that localpart. If admin_filter is set, a directory entry can now promote an existing local account to admin. Use !admin query users search-ldap on 1.8.3 to check. Sincere apologies to everyone locked out by 1.8.3.
@dasha-uwu removed the LDAP name_attribute option and stopped directory searches by givenName; an entry must put the Matrix localpart in uid_attribute to allow login. A leftover [global.ldap] name_attribute produces no boot warning. Regenerate and diff the configuration to reveal it as # DEPRECATED, then remove it manually.
Push notifications reach gateways again, and failures are now retried. Rejected pushes were counted as delivered and deleted, leaving nothing to retry and permanently sidelining the pushkey. Tuwunel now deletes only accepted events, arms the destination's retry timer, and logs the user, pushkey and error chain on failure. Reported by @xcysy32 in (#543), which remains open pending confirmation. Thanks also to @NekoCWD for separating the proxy case into (#554).
Three related push defects are also fixed: rules combining notify with historical actions the spec says to ignore are accepted; gateway path stripping now matches only at the URL's end; and pushes during shutdown no longer panic.
Thanks to @haydonryan for reporting the stale iOS unread badge in (#538) and fixing it in (#539). Read advances refreshed pushers only when the stored count cleared from nonzero, so a badge left nonzero after server counts reached zero never received the explicit zero. Refresh is now unconditional, bounded by each pusher's record of the last count the gateway accepted. Leaving or being banned from an unread room updates it too.
A one-time migration repairs two kinds of latent database damage on the first 1.9.0 boot. Releases before 1.8.3 could assign two short ids to one identity, leaving state entries that later removal could not cancel. Every release through 1.8.3 also cached auth chains truncated when an ancestor was missing, a normal backfill gap. Those chains are cleared once, and incomplete walks are now marked. A narrower cross-room case is a genuine regression first shipped in 1.5.0 (944f165).
Expect a longer first boot before the listener opens while a clean database performs four full column scans once. The duration is unknown; this was found internally and not reported by a user.
A federation disclosure is fixed. /state, /state_ids and /event_auth looked up an event by id alone, allowing a server that held any event id from a room it had never been in, and could pass the access check on any other room here, to read the first room's state through the second room's URL. Tuwunel now validates the stored event's room, and wrong-room responses are byte-identical to missing-event responses. The issue dates to the server ACL implementation in early 2022.
timestamp_to_event previously ran only an ACL check, letting any server we federate with obtain a real event id from a room it had not joined and satisfying the disclosure's precondition. It now runs the shared access check.
Federated events that authorize at their own position but not against current room state are now soft-failed and re-examined on a widening schedule, as the spec requires, instead of being permanently rejected.
Remote joins and inbound transactions acquired the room-state and federation mutexes in opposite orders, so joining an active room could freeze it until timeout. The order is now consistent everywhere.
The get_missing_events walk now has its own bound, preventing a large response limit from forcing unbounded timeline lookups. Ingest also no longer panics when a signed event's auth_events names a non-state event we already hold; the caught panic previously returned 500.
Element X can again preview or open an unjoined room, fixing the retry-dialog loop reported by @utop-top in (#470). Room v12 ids lack a server name, so an empty hierarchy-root via list prevented federation. It is now seeded from servers recorded on invites. A room with no local invite record and no usable client-supplied via still cannot be previewed.
@dasha-uwu changed remote space-summary fan-out to wait for the first successful response instead of the first completed one.
Thanks to @schlessera for reporting in (#552) that POST /keys/signatures/upload returned 200 with an empty failures map for valid, forged and malformed signatures alike, while storing unverified signatures from arbitrary relationships in other users' keys. Signatures are now verified against the signer's stored public key, only the three relationships defined by the spec are accepted, and every rejection returns a real errcode.
@basnijholt fixed (#537) a sliding-sync room returning to the window after a new message with initial: true but no num_live, causing clients to classify the whole timeline, including that message, as history. MindRoom exposed the bug when agents went silent in idle rooms; both matrix-nio and matrix-js-sdk read the field.
Typing indicators could remain active forever in sliding-sync clients such as Element X, diagnosed by @lhjt in (#519). Explicit stops were filtered out as empty lists, while expiry sweeps ran only during classic /sync. Both paths are fixed.
Servers behind a forward proxy can reach push gateways again, reported by @NekoCWD in (#554). The denylist rejected the proxy's private address before requests left the process, leaving no proxy log. Proxy endpoints named in configuration or the environment are now exempt, with a guard rejecting any destination that merely names the proxy host. Direct requests and locally resolving socks4 and socks5 proxies still filter destinations.
Thanks to @furfy for reporting in (#542) that /forget rejected rooms with no membership event, preventing users from removing admin-pruned rooms from their archive. It now refuses only senders who are still joined, knocked or invited.
@obodnikov repaired non-unix builds again by fixing the journald Unix datagram socket (#547), sysfs storage-device discovery (#548), and a platform-neutral file symlink in media migrations (#549). All three surfaced while building 1.8.3 for Windows; CI still covers no non-unix target.
Media downloads whose Content-Type differed only by case missed all framing and content-security headers, while a type merely mentioning HTML in a parameter wrongly received them. Headers now depend only on the trimmed, case-folded media type. Credit to @x86pup.
Locked-account rejections now return the spec-required HTTP 401 instead of 400, thanks to @x86pup. Separately, remote errors are no longer relayed verbatim: only errors describing the remote room pass through, a remote 401 becomes 400, and all others become 502 with the origin named.
Admin commands prefixed by a space matched neither the command prefix nor the escape check, so they vanished without a reply or log entry. Fixed by @x86pup.
A successful media delete no longer reports failure or aborts startup command lists. The command had returned confirmation through the error path, so success appeared as failure and stopped boot. Also fixed by @x86pup.
Thanks to @isosphere for reporting in (#540) that media delete-range rejected its direction at runtime using flag spellings the parser did not accept. The constraint now lives in the parser and appears in the usage line.
@x86pup raised the report-reason limit from 750 to 2000 bytes.
Logged-out email password resets can complete again. The final step was rejected with M_MISSING_TOKEN before reaching the route because logged-out users have no access token. Element Web then showed "make sure you clicked the link in the email," although they had already done so.
Validated registration email proofs are now single-use, so one verification email creates one account. Reuse required smtp.connection_uri plus either require_email_for_registration or require_email_for_token_registration; all three default to off.
A UIAA short-circuit is removed (c564d9e). With the passwordless sentinel and an OAuth session row, any m.login.password dictionary could satisfy the entire interactive-auth challenge, even for flows with no password stage. This covered password changes, device deletion, deactivation and cross-signing uploads, and required a valid access token for the account.
Under shared history visibility, checks used current membership, hiding all history from users who had left, including their own messages from before departure. Former members can now see history through their latest leave event.
!admin server show-config now masks the OIDC registration access token. Because federate_admin_room defaults to true, the cleartext bearer credential may have reached remote servers whose admins were invited to the admin room. Rotate or unset it, and redact the old message.
Setting that token blocks next-generation auth for every ordinary client, including Element X, because Matrix clients do not send an RFC 7591 initial access token. Startup now warns about it.
Sliding-sync rooms whose payload failed to build no longer advance the cursor and disappear permanently from the connection. Only delivered rooms advance now; each room's payload, receipts, private read marker and account data commit together or not at all.
Rejected federated invites can now be dismissed. Sending the leave retraction previously required resolved room state, so every request failed forever; it now depends only on membership.
A user's own private read marker, room account data and notification-read state no longer affect sliding-sync room ranking or displace another room from the list window.
An identical PUT to /state now returns the existing event id instead of appending a duplicate, so bots that reassert room state on restart stop creating copies. The guard deliberately applies only to joined senders because it returns before authorization; otherwise, a departed author could confirm the current value of any state key they once authored. That matters only with joined or invited history visibility.
Room push rules disabled by the user no longer reactivate in successor rooms after an upgrade, and upgraded rooms no longer become quieter than the user's setting (55a09e6).
Positioning a push rule after the last rule of its kind, or first in an empty kind, no longer panics or returns 500. Any authenticated local user could trigger this through PUT /_matrix/client/v3/pushrules/{scope}/{kind}/{ruleId} with after; fixed in the ruma pin (2de190c11).
Conduwuit media imports no longer treat destination storage failures as success (0282290). Previously, the import counted the failure as skipped and wrote its completion marker, permanently losing the media even though the source rows remained in the same database. This fix prevents future loss but does not repair imports already run on 1.8.0 through 1.8.3, where the marker is already set.
A panicking database write no longer poisons the sequence-counter lock and causes every /sync and new event to panic until restart (92c81ea, b8e2f57).
The appservice registry's spawned-worker load no longer races registration. Before the load finished, a new registration could be reread by its scan, rejected as a duplicate id, and shut down the server (d5207d4).
Invalid client since tokens on purely local /publicRooms queries no longer return a 502 blaming an upstream server that was never contacted. The failure wrapper now covers only the federated path (760dbd3, regression 9a87977 shipped in v1.7.1).
Dynamic client registration now rejects dotless native redirect schemes (cd2c6bd).
/search now limits context to 20 events on either side of each result instead of accepting the client's value without a bound (44632fb).
With bundle_edit_relations enabled, bundled edits no longer expose the sending client's transaction id to other users (c11a2c2). The always-on thread latest_event embed still does and is unchanged.
The container image now includes procps, providing the kill binary required by the documented container reload (276b535).

GitHub Release: crowdsecurity/crowdsec v1.8.2 (26.10.2026)

Mon, 26 Oct 2026 18:15:49 +0100

crowdsecurity/crowdsecv1.8.226.10.2026@github-actions[bot]

Changes

AGENTS.md: clearer guidance on tests (#4713) @blotus
pimp readme (#4701) @buixor

New Features

waf: add RateLimit() helper (#4721) @blotus
[bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor

Improvements

Add cs_features metric (#4770) @blotus
bot detection: add an option to set SameSite=None + Partitioned flag on cookie (#4764) @blotus
exprhelpers: add GetDecisionsSinceCountByScenario (#4756) @tommy-ng0
lapi: optionally limit concurrent decision stream requests (#4747) @tommy-ng0
exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
add cscli bot subcommand (#4666) @blotus
prometheus: add kind label to cs_alerts (#4742) @blotus
lapi: make decisions stream page size configurable (#4733) @tommy-ng0
Fix ValidateChallengeResponse (#4737) @buixor
grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus
grokky : preshot static strings (#4731) @buixor, @Copilot
grokky : ParseInto (#4729) @buixor
bot-detection: add new FlagSubmission() helper (#4727) @blotus
appsec: add an optional category to the request score (#4715) @buixor
apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
fix image link (#4702) @buixor
waf: add SkipProcessing() helper (#4667) @blotus
[bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

fix RateLimit() tests (#4771) @blotus
acquisition/file: don't send half-written lines, or skip the lines after them (#4678) @n1koo, @blotus, @claude
fix(cscli): display human-readable timestamps in local time (#4759) @sep2
waf: use dedicated workers for OOB processing (#4722) @blotus
remove runtime Fatalf calls (#4760) @blotus
waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
docker: read from now if container restarts (#4605) @blotus
splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
metrics: remove series of deleted machines and bouncers (#4712) @somaz94
postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus
buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
challenge: optimize memory usage (#4674) @blotus
syslog: copy buffer before handing it to the datasource (#4690) @blotus
Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

build(deps): bump the gomod group with 5 updates (#4778) @dependabot[bot]
build(deps): bump the github-actions group with 2 updates (#4777) @dependabot[bot]
build(deps): bump certifi from 2026.1.4 to 2026.10.19 in /build/docker/test (#4780) @dependabot[bot]
build(deps): bump the github-actions group across 1 directory with 8 updates (#4766) @dependabot[bot]
build(deps): bump the gomod group with 16 updates (#4767) @dependabot[bot]
build(deps): bump the gomod group with 8 updates (#4753) @dependabot[bot]
fpscanner: use fork (#4761) @blotus
waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]
CI: skip more docker tests on windows (#4728) @blotus
grok: embed grok library instead of having it as a dep (#4725) @blotus
docker datasource: skip tests on windows (#4719) @blotus
agents.md: keep comments to a reasonable level (#4716) @blotus
build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]
build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]
build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]
build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]
build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]
bump to go 1.27 (#4675) @blotus
build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]
build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

Unix Socket vs TCP Loopback Between Containers in One Kubernetes Pod

Mon, 26 Oct 2026 09:44:22 +0100

Test workload: Apache and PHP-FPM as two containers in one pod. PHP 8.4, three configuration profiles, 42.7 million requests in the main runs, plus an optimisation ablation, an overload test and a cross-check on a second VM. The short version Yes, a Unix socket is faster than TCP loopback between two containers in the same pod. Here it is measured... Weiterlesen

Why Linux Uses Forward Slash Instead of Drive Letters

Mon, 26 Oct 2026 01:12:30 +0100

There is no C: drive waiting on a fresh Linux desktop. This guide traces why Unix rooted every volume at one forward slash instead of drive letters, from the 1974 paper to modern mount points. Live Ubuntu 26.04 output from lsblk, findmnt, df, fstab and mount shows the tree absorbing every disk you attach. Weiterlesen

GitHub Release: codewhale-hq/Codewhale v0.10.2 (24.10.2026)

Sat, 24 Oct 2026 23:43:32 +0200

codewhale-hq/Codewhalev0.10.224.10.2026@github-actions[bot]

What's in v0.10.2

Codewhale v0.10.2 adds an animated pet view (/pet on), a live Terminal work
dock, per-chat composer colors (/color) and a one-time note on the first
start after an update that says what changed. It closes three session
data-loss paths and a codewhale web session leak; adds the default Runtime
daemon socket locations to the sandbox deny-list; holds a curl or wget that uploads a
credential; refuses shell commands containing invisible Unicode; keeps the
Linux sandbox working when a hidden credential directory is a symlink; and
reduces idle TUI redraw work. /undo takes back a whole
request, including long and multiline prompts. exec --auto explains its
Full Access default, honors an explicitly stricter sandbox, and saves
tool-enabled runs and their failure receipts. Local runtimes appear during
onboarding, /diff works outside a Git repository, DeepSeek's Responses route
no longer rejects replayed tool history, and contributor fixes improve token
accounting, relay model lists, localized replies and Windows launcher
guidance. Delegated work continues without model-invented turn or time caps,
and independent workflow steps can continue after another child fails.

Install

Recommended — official GitHub release

New macOS/Linux install (checksummed binaries from this release):

curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.10.2" sh
"$HOME/.local/bin/codewhale" --version

For Windows, use the matching installer or archive below. For an existing
direct install, run codewhale update; it prints the executable path and
keeps newer builds. If the install directory is occupied by a different build,
use the fresh-directory migration in the installation guide.

Secondary packaging — npm and Cargo

npm install -g codewhale
# or build from source
cargo install codewhale-cli --locked

The wrapper downloads the matched codewhale and codew command assets
from this Release. Both contain the same compiled runtime.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/codewhale-hq/codewhale:v0.10.2

The image exposes the same runtime as both codewhale and codew. The
latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli --locked

The Cargo package installs codewhale. Cargo cannot create a second command
alias from one binary target; users who want the shorter spelling can add a
codew symlink to that installed executable. The npm, Homebrew, archive,
shell-installer, and container channels install both command names directly.

Manual download — platform archives (recommended)

Each archive below contains the same runtime under the codewhale and
codew command names, plus an install script:

Platform	Archive	Install script
Linux x64	`codewhale-linux-x64.tar.gz`	`install.sh`
Linux ARM64	`codewhale-linux-arm64.tar.gz`	`install.sh`
Android ARM64 (Termux)	`codewhale-android-arm64.tar.gz`	`install.sh`
macOS x64	`codewhale-macos-x64.tar.gz`	`install.sh`
macOS ARM	`codewhale-macos-arm64.tar.gz`	`install.sh`
Windows x64 (installer)	`CodeWhaleSetup.exe`	NSIS setup
Windows x64	`codewhale-windows-x64.zip`	`install.bat`
Windows x64 (portable)	`codewhale-windows-x64-portable.zip`	—
Windows ARM64	`codewhale-windows-arm64.zip`	`install.bat`
Windows ARM64 (portable)	`codewhale-windows-arm64-portable.zip`	—

Unix (Linux / macOS):

tar xzf codewhale-.tar.gz
cd codewhale-
./install.sh

Windows:

For the installer path, run CodeWhaleSetup.exe; it installs
codewhale.exe, codew.exe, and codewhale.bat under
%LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
current-user PATH, and creates a Start Menu shortcut that prefers
Windows Terminal (wt.exe) when it is installed.
Extract the archive for your machine: codewhale-windows-x64.zip or
codewhale-windows-arm64.zip
Double-click codewhale.bat (not the raw .exe) to launch
Run install.bat to copy the binaries and launcher to %USERPROFILE%\bin
Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived codewhale- and
codew- assets. The seven codewhale-tui- filenames
attached to v0.9.5 are byte-identical compatibility copies used only to let
already-installed v0.9.4 clients discover and cross this single-binary
transition; current installers do not expose a third runtime. The legacy npm
package deepseek-tui is deprecated and is not republished. For migration
from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

Full release notes

The full notes exceed GitHub's release-description limit. Read the complete changelog for v0.10.2.

Contributors

Dhruv Singal / @dsingal0 — added Herdr agent state, session resume commands and pane release (#7064).
@shenjackyuanjie — diagnosed and fixed the Windows OpenHarmony CMake generator and CLI hashing-module build failures (#6988, #6989).
@printf033 — replaced the SELinux-denied root-directory anchor of confined-file I/O with an O_PATH walk (Linux-cfg-gated) and a re-materialized final parent, restoring workflow journal, compaction checkpoint and artifact writes on Android/Termux (#6983); reported the Android confined-I/O failure with strace evidence and an on-device reproducer (#6980). Source change; compiled Android and device acceptance remain unqualified.
@aboimpinto — moved config-command parsing and replies onto portable contracts while the host retains effects (#6973).
@henrikdukefoss — added the Standard Compute compatible-host descriptor, with live model discovery and its billing basis kept Unknown (#6985).
@LIghtJUNction — plugin shell install and in-TUI plugin OAuth sign-in (#6950).
@SparkofSpike — live network-policy updates and goal milestone hand-back (#6928, #6930), Windows ampersand classification (#6929), and a relocated Codewhale home including sub-agent state (#6947, #6949). Also removed repeated catalog construction and credential-readiness work from the model picker (#7026), listed what still blocks a session switch (#6948), and fixed custom relay model discovery (#7013).
@dajiaohuang — cache-write token accounting (#6913).
@gaord — embedder telemetry surface support (#6916) and the DeepSeek saved-key marker diagnosis and fix (#6972, #6974). Also gave each Runtime store its own control socket and one driver per workspace (#6924), and added reading and writing a workspace's project trust through the Runtime API (#6959).
@Lstarsky0 — localized profile replies (#6919), workflow gates that block their own role (#6952), proxy-independent MCP loopback checks (#6971, #6975), durable steering/child-approval acceptance checks (#6967, #6966), and an app-server hook log that no longer lands in the project directory (#6921). Also made feedback truncation readable in ASCII-safe mode, added a statusline scroll rail, and removed duplicate clipped descriptions from split-view hotbar setup (#7027, #7028, #7029). Kept nested list indentation in rendered markdown, kept a to-do row's status word when its title is long, and put the approval footer's separators between its hints (#7030, #7033, #7034). Also lined up the provider lists' status column (#6984), brought the /provider description in five language packs up to date (#6922), said Work in the /statusline Mode hint (#7012) and fitted more /statusline items on short terminals (#7025).
@jayanthvee — Windows npm launcher guidance (#6906).
@asto18089 — callback-window reference fix for longer browser sign-in waits (#6865). Also restricted the CNB mirror to the project owner so forks skip it while missing upstream credentials still fail explicitly (#7016, with initial absent-secret handling co-authored by @zhuowp).
@BX166 — reported three provider failure modes measured on AICraft's own traffic: a cold model that reads as a dead connection, a listed model that fails on every call, and a response cut at the output ceiling that reports stop (#6889).
@harryvizcaino-oss — reported the invalid Full Access configuration guidance shown to the Paseo ACP client (#6992).
@rafacouto — reported Linux sandbox mount failures for symlinked credential directories and supplied a standalone bubblewrap reproduction (#7007).
@leoca — fixed the command splitter behind the destructive-command checks so a backslash-escaped quote outside quotes is an ordinary character, as the shell treats it (commit 82a14ee).
@luestr — reported refusals when starting a new session (#6981) and the /undo notice that reported files reverted when only the conversation had been rewound (#6970), and a session that could not be restored after its provider was deleted (#6996).
@zhuowp — found that the Windows shell's Python UTF-8 default was discarded whenever hook variables were applied, and fixed the merge so it survives while explicit overrides still win (#7041), and documented the JSONPath subset the Web tool's fields option accepts (#7046).
@Asteria1028 — asked for /init to write AGENTS.md in the interface language (#6964).
@SakuraNeko — asked for HarmonyOS PC support, which shaped the HarmonyOS install guidance (#1072).
@8sero — reported the TUI crash in non-Latin-script sessions, with the panic signature that located the byte-index slice (#7048).
@SergiuSSoluS — reported queued turns being delivered again after a session was restored (#6978).
@Statter — reported rate-limit retry behavior that informed the bounded current-quota 429 retry fix (#6923), and black-on-black body text on terminals that do not report their background (#7043).
@7jrxt42BxFZo4iAnN4CX — reported oversized-session refusals that informed compaction error preservation and size-limit attribution (#6955), SSE retries capped by the stream-open window (#7045), and a second session that could not be resumed in a busy workspace (#7042).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.

Unix Timestamp Converter That Runs in Your Browser

Sat, 24 Oct 2026 09:57:11 +0200

I still paste Unix timestamps into random converters more often than I want to admit. created_at: 1729000000 exp: 1735689600 The number is fine. The worry is the same every time: does this page upload what I paste? What I needed A tiny converter that: accepts epoch seconds or milliseconds shows UTC (ISO) and local time lets me copy the ISO string... Weiterlesen

PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck

Sat, 24 Oct 2026 01:13:35 +0200

Security NAS Linux / Unix Server/Datacenter Open Source How To. Seit Mittwochabend gibt es die Patches für PHP2Shell, und auf vielen Webservern ... Weiterlesen

GitHub Release: crowdsecurity/crowdsec v1.8.2-rc2 (22.10.2026)

Thu, 22 Oct 2026 11:35:54 +0200

crowdsecurity/crowdsecv1.8.2-rc222.10.2026@sabban

Changes

AGENTS.md: clearer guidance on tests (#4713) @blotus
pimp readme (#4701) @buixor

New Features

waf: add RateLimit() helper (#4721) @blotus
[bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor

Improvements

Add cs_features metric (#4770) @blotus
bot detection: add an option to set SameSite=None + Partitioned flag on cookie (#4764) @blotus
exprhelpers: add GetDecisionsSinceCountByScenario (#4756) @tommy-ng0
lapi: optionally limit concurrent decision stream requests (#4747) @tommy-ng0
exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
add cscli bot subcommand (#4666) @blotus
prometheus: add kind label to cs_alerts (#4742) @blotus
lapi: make decisions stream page size configurable (#4733) @tommy-ng0
Fix ValidateChallengeResponse (#4737) @buixor
grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus
grokky : preshot static strings (#4731) @buixor, @Copilot
grokky : ParseInto (#4729) @buixor
bot-detection: add new FlagSubmission() helper (#4727) @blotus
appsec: add an optional category to the request score (#4715) @buixor
apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
fix image link (#4702) @buixor
waf: add SkipProcessing() helper (#4667) @blotus
[bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

fix RateLimit() tests (#4771) @blotus
database: match the alert ip/range filter on a single decision (#4710) @AdzerKI
acquisition/file: don't send half-written lines, or skip the lines after them (#4678) @n1koo, @blotus, @claude
fix(cscli): display human-readable timestamps in local time (#4759) @sep2
waf: use dedicated workers for OOB processing (#4722) @blotus
remove runtime Fatalf calls (#4760) @blotus
waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
docker: read from now if container restarts (#4605) @blotus
splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
metrics: remove series of deleted machines and bouncers (#4712) @somaz94
postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus
buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
challenge: optimize memory usage (#4674) @blotus
syslog: copy buffer before handing it to the datasource (#4690) @blotus
Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

build(deps): bump the github-actions group across 1 directory with 8 updates (#4766) @dependabot[bot]
build(deps): bump the gomod group with 16 updates (#4767) @dependabot[bot]
build(deps): bump the gomod group with 8 updates (#4753) @dependabot[bot]
fpscanner: use fork (#4761) @blotus
waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]
CI: skip more docker tests on windows (#4728) @blotus
grok: embed grok library instead of having it as a dep (#4725) @blotus
docker datasource: skip tests on windows (#4719) @blotus
agents.md: keep comments to a reasonable level (#4716) @blotus
build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]
build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]
build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]
build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]
build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]
bump to go 1.27 (#4675) @blotus
build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]
build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

CVE-2026-64109 | Linux Kernel up to 6.6.142/6.12.91/6.18.33/7.0.10 Af Unix unix_stream_data_wait len use after free (Nessus ID 369276)

Thu, 22 Oct 2026 00:44:42 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.6.142/6.12.91/6.18.33/7.0.10. This affects the function unix_stream_data_wait of the component Af Unix. The manipulation of the argument len leads to use after free. This vulnerability is referenced as CVE-2026-64109. The attack can only be performed from a local... Weiterlesen

GitHub Release: rustdesk/rustdesk v1.4.9 (06.07.2026)

Wed, 21 Oct 2026 19:05:56 +0200

rustdesk/rustdeskv1.4.906.07.2026@rustdesk

Architecture	Windows	Ubuntu	Mac	Android	Flatpak	iOS	Web
x86-64 (64-bit)	EXE MSI	Download	Download	Universal	Download		Go
AArch64 (ARM64)	EXE MSI	Download	Download	Download	Download	App Store
ARMv7 (32-bit)		Download		Download
x86-32 (32-bit)	EXE (Legacy)

For more downloads (Fedora / Arch Linux / Suse / AppImage): check below please

For the latest features: check out the nightly build

Changelog Changelog Added

Changes

refact: remove feature cli #15524

Fixes

GitHub Release: rustdesk/rustdesk v1.5.0 (02.10.2026)

Wed, 21 Oct 2026 19:05:56 +0200

rustdesk/rustdeskv1.5.002.10.2026@rustdesk

Architecture	Windows	Ubuntu	Mac	Android	Flatpak	iOS	Web
x86-64 (64-bit)	EXE MSI	Download	Download	Universal	Download		Go
AArch64 (ARM64)	EXE MSI	Download	Download	Download	Download	App Store
ARMv7 (32-bit)		Download		Download
x86-32 (32-bit)	EXE (Legacy)

For more downloads (Fedora / Arch Linux / Suse / AppImage): check below please

For the latest features: check out the nightly build

Changelog Changelog Added

Changes

Fixes

GitHub Release: grokability/snipe-it v8.8.0 (30.09.2026)

Wed, 21 Oct 2026 19:05:36 +0200

grokability/snipe-itv8.8.030.09.2026@snipe

Caution

This version of Snipe-IT REQUIRES PHP 8.2.0 or greater, 8.4+ recommended. PHP 8.2 is still in security release support until 31 Dec 2026, but let's not play that game - and some of the new features we're working on will require PHP 8.3+, so... get on that!

Whew! Over 750 commits and 83 merged pull requests since v8.7.2, and enough features we decided to go for a mid-release. So much exciting stuff in this release, check it out for yourself!

📱 Official Snipe-IT Mobile App is in Beta!
🔄 Sync adapters (beta)!!
🎛 Non-Admin Dashboard
🗓 Unified Calendar
🛎 Requestables Overhaul
⛙ Asset Model Merge Tool
📤 Microsoft Graph mailer
💃 OIDC access tokens
🕹 More Bulk Controls
🥺 Deprecations
🎉 Upgrading
🤘Security Rockstars

BUT FIRST...

Join the Community!

Join our Discord! It’s full of great people. We even wrote about it here!
Follow us on Bluesky at @snipeitapp.com
Follow us on Mastodon at hachyderm.io/@grokability
Join us on Reddit (a thing I never thought I'd say) at /r/Snipe_IT
Join us in MacAdmins Slack
Subscribe here on Github for notifications about new releases. (We recommend selecting "Releases" only for most users - this repo can get noisy.)

Okay, onto the new stuff:

📱Official Snipe-IT Mobile App is in Beta!

There are a ton of great unofficial Snipe-IT mobile apps out there, but folks have been clamoring for one that is built in-house so they know it will be maintained by us. Welp, it's finally here, and it is, of course, open source.

If you're up for testing the beta, you can do that here:

If you run into issues or have feature requests, please use the discussions tab in the snipe-it-mobile repo.

🔄 Sync adapters (beta)!!

One of the things we've always been really proud about here is our REST API. We know that you're all using bespoke tools, and the (incredible) Snipe-IT community has come up with some great independent scripts to get info from your MDM/RMM/etc into Snipe-IT. Srsly, we cannot thank you all enough! And you can keep using those if that's what works for you.

If you're looking for something native so that you don't have to maintain a python/powershell integration script in addition to everything else you have to balance, we're so excited to introduce native Sync Adapters.

We're shipping today with 19 built-in adapters for the most commonly requested systems, and also a "Custom HTTP" adapter, which means whatever weird Lua integration script you had running on a Raspberry Pi under your desk just might be able to be retired.

Adapters we're shipping right now:

Addigy
Apple Business Manager
Fleet
Google Workspace
Jamf Pro
Jamf Platform
Jamf School
JumpCloud
Kandji
Kaseya VSA 10
Landscape (Canonical)
Meraki Systems Manager
Microsoft Intune
Mosyle
NinjaOne
osctrl
UniFi
Workspace ONE
Zentral

Documentation on the new sync adapters is available here.

Caution

If you have existing assets, you VERY LIKELY want to CHECK the "Match vendor hosts to existing assets by serial number" box. Skipping that part will create duplicate assets, since your vendor's ID hasn't yet been stored in our system.

In testing this, the most common mixup people have when things aren't syncing as expected is that the asset tag template field was filled in with potentially non-unique variables. Check your logs when you first start to play around with this and adjust as needed.

If we're missing one that makes sense for us to add, just open a feature request and we'll take a look.

🎛️ Non-Admin Dashboard

The dashboard was admin-only for as long as anyone can remember. That's no longer the case. Anyone who can manage at least one type of checkoutable item (assets, accessories, licenses, consumables, or components) or users now gets a dashboard tailored to what they're allowed to see:

Users who don't have permissions will still get redirected to their individual profile where they can only see their own items.

🗓️ Unified Calendar

People have been asking for this for nearly a decade, and it's finally here. We have a new top-level /calendar page that shows every scheduled event Snipe-IT knows about in one place: asset audits, expected checkins, EOL and warranty expirations, license expirations and terminations, user end dates, maintenances, and reservations. A "Today" widget on the dashboard pulls the same feed for a rolling 7-day preview so you know what's coming as soon as you login, and can drill down through "type" selectors on the calendar page itself.

Similar to the non-admin dashboard, users will only see this new icon/page if they have the ability to manage actions or items where we log a calendar event.

🛎️ Requestables Overhaul

Big changes in the checkout-request workflow:

Reservation windows. Requests can carry a start and end date, and those windows show up on the unified calendar. Click a reservation event, get the pre-filled fulfill screen for that specific request.
Reservations with a start or end date are automatically added to the new calendar
Quantity is only required on the types where it actually makes sense.
Calendar events for reservations link to the item's checkout screen

⛙ Asset Model Merge Tool

We knew this was going to be needed, especially with the new sync adapters, since it's very possible to accidentally create new asset models if your mapping isn't just right (marketing model name vs internal model name). This new tool works similar to the user-merge, which lets you pick which is the "real" one, and the "survivor" absorbs the assets and logging of the others.

Screen.Recording.2026-09-23.at.5.18.43.PM.mov

📤 Microsoft Graph mailer

Native support for sending mail through Microsoft Graph, which is the OAuth-based path that Microsoft 365 tenants generally prefer over legacy SMTP AUTH.

💃 OIDC access tokens can hit the API

You can now use OIDC-issued access tokens as bearer tokens against /api/v1. No more workaround of minting a Passport personal-access token separately.

🕹️More Bulk Controls

Categories bulk edit. Same UX as the assets / licenses / users bulk edit flows we shipped in prior releases.
Locations bulk edit. Ditto for locations.

🥺Deprecations

maintenance_type string field on the maintenances API is deprecated. The /api/v1/maintenances/* endpoints now return both the legacy maintenance_type string AND a new maintenance_type_details object (id / name / tag_color). Read maintenance_type_details.name for the same value going forward. The bare string field will be removed in a future major release.

🎉 Upgrading

Same as always: php upgrade.php from your Snipe-IT directory. Full walkthrough at snipe-it.readme.io/docs/upgrading.

Docs note: we're in the middle of updating the docs to reflect all the new features, screenshots, and changes in this release. If you see something in the app that isn't in the docs yet, that's why. We're working through them.

What's Changed

Force Manager 'value' to be string (even though it's an integer) by @uberbrady in #19535
🖼️ Requestable Items: allow bulk fulfillment, replenish from pending, allow more types of items by @snipe in #19539
🎥 Calendar UI by @snipe in #19494
Fixed #18907 - Change default queue, make all notifications queable. by @uberbrady in #19126
Add necessary parts to invoke new 'background' queued mail provider by @uberbrady in #19552
Added location as checkout target for asset history importer by @snipe in #19553
Bumped Boost from v2.5.4 to v2.6.0 by @marcusmoore in #19554
Cap the calendar backfill to 2000 rows per model source by @snipe in #19557
Email Notifications: Made Asset Image size responsive by @Godmartinz in #19561
Testing: Allowed tests to be run in parallel by @marcusmoore in #19565
Fix backup restoration when using a unix socket by @NyCodeGHG in #19558
Added support for sending mail via Microsoft Graph by @SBCV-apegram in #19574
Docker: Allow for overriding of specific apache limits by @misilot in #19576
🎥 Locations: Add bulk edit, improve bulk delete by @snipe in #19577
Tighten up the default configuration for Trusted Proxies. Added Tests. by @uberbrady in #19578
API Transformers: Check individual rows, not just general permissions by @snipe in #19579
Added orphaned file checker console command - Fixed #8898 by @snipe in #19582
Acceptances: Delete pending acceptances when checking in accessory via API by @marcusmoore in #19580
Bumped Boost to v2.7.0 by @marcusmoore in #19581
a11y: Added sr-only on non-tabbed tables by @snipe in #19585
Locations View: Fixed duplicated icon and crossed results by @snipe in #19586
Fixed #18260 - informal variants of locales returned wrong plural translations by @snipe in #19587
Tests: Slightly improve testing speed by @marcusmoore in #19583
🖼️ Importer cleanup and add skip nulls by @snipe in #19588
Clean up unreachable code (via phpstan) by @snipe in #19589
Fix double rollbars by @snipe in #19590
Removed unused label constants by @snipe in #19591
Fixed phpstan complaining about env() outside of config files by @snipe in #19592
Fixed phpstan “will always evaluate to true” errors by @snipe in #19593
Add more relations to delete console command by @snipe in #19599
Fix missing company creation modal by @MatheusGarvao in #19600
Change the 'default' queue back to 'sync' :/ by @uberbrady in #19604
Improve deployment notes for Claude by @uberbrady in #19607
Unified all modals into blade components by @snipe in #19610
add TZe_241_B by @Godmartinz in #19611
Bump crowdin/github-action from 2 to 3 by @dependabot[bot] in #19596
Update AssetModelsController docblocks for route model binding by @darkdi in #19594
API: Fixed sorting by order_number in components endpoint by @marcusmoore in #19613
Wrong format for @andreaci in #19623
Labels: Fixes Default label values from being nulled when switching Label Engines by @Godmartinz in #19619
Added “clone” permission gate by @snipe in #19631
Read SCIM group members as ids instead of hydrating User models by @marcusmoore in #19634
Update to the latest (patched) laravel-scim-server by @uberbrady in #19645
Bumped Boost to v2.8.1 by @marcusmoore in #19632
Fixed stale pending acceptances from various scenarios by @marcusmoore in #19555
Notifications: Fixes #19532 Accepted and Declined notifications are sent to CC emails only by @Godmartinz in #19637
Optional OIDC bearer-token authentication for the API by @rodchristiansen in #19378
Yank out stray \Log::error() lines - whoops! by @uberbrady in #19660
Upgrade Livewire to 4.3.3 by @uberbrady in #19406
Notifications: [FD-57297] Fixes Asset Checkout, Add tests for checkout and checkin webhook notification payloads by @Godmartinz in #19655
🖼️ Added Fleet, InTune, Unifi, Addigy, etc RMM/MDM sync adapters by @snipe in #19628
Better handle incomplete checkouts for non-users by @snipe in #19666
Acceptances: Fixed accepting and declining components by @marcusmoore in #19665
Labels: adds Dymo Labelwriter_30330 by @Godmartinz in #19663
Labels: Fixes #19515 the way the QR text is handled from legacy to New Label Engine by @Godmartinz in #19633
Add checked out to in checkin forms by @snipe in #19678
Fix for unused custom fields being populated by @uberbrady in #19627
Drop the dead duplicate depreciation_min string by @darkdi in #19673
Fixed: Preserve literal angle brackets in info-panel notes by @mrjcap in #19676
Added more info to checkin pages by @snipe in #19683
Fix ABM pagination: read meta.paging.nextCursor, not links.next by @bjhinkle in #19686
Fixed #19518 - added support for SASL LDAP by @snipe in #19556
Labels: [FD-56300] add support for 1D barcode to zebra 18939 by @Godmartinz in #19679
Implement PHPStan result caching in GitHub Actions by @staabm in #19668
Added Ubuntu Landscape adapter by @snipe in #19692
🎥 Fixed #19690 - Added model merge from asset model index by @snipe in #19695
🎥 Added adapters to settings index filter box by @snipe in #19697
Added help text for Iru/Kanji and renamed the adapter by @snipe in #19698
Clean up sync adapter rows on soft-delete and purge by @snipe in #19699
Fixed #19694 - add more built-in fields to AxM adapter by @snipe in #19700
Fixed #19693 - added apple’s built in MDM for AxM adapter by @snipe in #19701
Bulk Checkout: [FD-57246] Fix Select2 Enter handling before AJAX results load by @Godmartinz in #19702
🎥 Improved custom http adapter UI field mapping, adding more logging by @snipe in #19703
🎥Compact extra vendor fields into dropdown widget by @snipe in #19704
Fixed #19670 - better handle S3 files consistently by @snipe in #19706
Better handle detaching groups and users on delete by @snipe in #19711
Fixed RB-22033 - Google SSO callback 500 when the callback URL is hit without a code by @snipe in #19713
Better trap transport errors in cli and cron by @snipe in #19714
Docker: Enable OPcache in Alpine Docker images by @danez in #19712
Switch to blade component for callout on checkout by @snipe in #19716
Categories: Added bulk edit to index by @snipe in #19723
Fixed #12190 - Dashboards for non-admins by @snipe in #19728
Notifications: Fixed cc emails silently failing by @marcusmoore in #19730

🤘Security Rockstars

We've fixed 59 security issues in this release, thanks to the work of these diligent folks who are working every day to keep open source safer for everyone through responsible disclosure and collaboration:

New Contributors

@NyCodeGHG made their first contribution in #19558
@SBCV-apegram made their first contribution in #19574
@MatheusGarvao made their first contribution in #19600
@darkdi made their first contribution in #19594
@mrjcap made their first contribution in #19676
@bjhinkle made their first contribution in #19686
@staabm made their first contribution in #19668
@danez made their first contribution in #19712

Full Changelog: v8.7.2...v8.8.0

XFS Sees Small Performance Optimizations & Bug Fixes For Linux 7.4

Wed, 21 Oct 2026 13:16:00 +0200

submitted by /u/unixbhaskar [link] [comments] Weiterlesen

GitHub Release: wazuh/wazuh v4.14.10-rc1 (21.10.2026)

Wed, 21 Oct 2026 11:26:18 +0200

🛡️ Security Fix wazuh/wazuhv4.14.10-rc121.10.2026@jotacarma90

What's Changed

Bump 4.14.10 branch by @wazuhci in #39241
Stop buffering request bodies before authentication in the API access logger by @jotacarma90 in #39403
Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39442
Add macOS support to disable-account, which silently failed on every Darwin endpoint by @hernanvalenzuela in #39463
Report password expiration date and max change interval on macOS by @rjcausarano in #39466
Report the actual Windows release and build in the OS inventory after an in-place upgrade by @nbertoldo in #39547
Re-enable FIM whodata integration tests in the Linux and Windows agent workflows by @MAnDumu in #39582
Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39605
Mask sensitive values in the per-agent active configuration endpoint by @jotacarma90 in #39609
Do not follow symbolic links when compressing a file into a gzip archive by @Miguevrgo in #39476
Detect promiscuous interfaces in rootcheck without invoking a shell by @nbertoldo in #39622
Fix heap buffer underflow when the GCP wodle output has empty log segments by @Darioortegaleyva in #39606
Apply the centralized force_reconnect_interval on agent hot reload without a restart by @Darioortegaleyva in #39573
Fix size read/write in FIM diff generation by @MAnDumu in #39619
Capture the macOS ULS timestamp only from long enough lines by @Miguevrgo in #39327
Validate the path and index field types in the wazuh-db FIM save2 handler by @jotacarma90 in #39709
Resolve Coverity copy-instead-of-move findings in sudoers alias parser by @Darioortegaleyva in #39629
Backport the whodata symlink path-resolution fix to 4.14.10 by @Darioortegaleyva in #39736
Fix wazuh-syscheckd segfault on first scan when inotify cannot be initialized by @Darioortegaleyva in #39707
Remove duplicated CR in print_out on Windows by @Miguevrgo in #39662
Correct osd handling in parse_agent_update_msg (4.14.10) by @jepalfer in #39614
Resolve logcollector monitored paths one component at a time and check each entry before reading it by @lchico in #39649
Apply the configuration permissions to the shared directory by @Nicogp in #39734
opasswd.old check Fix in Multiple SCA files by @IsExec in #39762
Remove agent leftovers on Solaris 10 and AIX package removal by @Miguevrgo in #39807
SCA: two checks in cis_debian10.yml are logically inverted since the 4.10.0 policy rewrite by @IsExec in #39768
Fix MTA check in multiple SCA files by @IsExec in #39771
Extend configuration masking to credential fields and group files by @ignaciogalle12git in #39706
Match XML tags with whitespace or attributes when masking config by @jepalfer in #39663
Fix run_as authorization-context regex not requiring a full match on $-anchored expressions by @MiguelazoDS in #39770
Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39843
Bound the memory logcollector uses when reading a very long line with multi-line-regex by @cborla in #39800
Validate agent names in delete_diff by @jepalfer in #39723
Rehash legacy password hashes by @Antoniogm03 in #39664
Stop the macOS ULS reader once logcollector shutdown starts by @Miguevrgo in #39748
Harden Windows network-path detection to treat forward slashes as separators by @nbertoldo in #39796
Read only regular files of bounded size from user profiles in the browser extensions inventory by @cborla in #39802
Keep syscollector process and port inventory complete when a collected name is not valid UTF-8 by @Darioortegaleyva in #39956
Read only regular, bounded-size metadata files in the PyPI and npm package inventory by @anromerom in #39860
Fix one-byte buffer overflows in whodata, SQL log readers and FIM config by @Darioortegaleyva in #39705
Refresh deb amd64 agent checkfiles sizes for 4.14.10 by @rjcausarano in #40004
Keep the browser extensions inventory complete when extension metadata files contain unexpected values by @rjcausarano in #39931
Check each junction and symbolic link on a Windows logcollector monitored path before reading through it by @lchico in #39781
Update SCA ID for Debian 13 by @IsExec in #39995
Widen the multigroup group_hash to a 32-character SHA-256 prefix by @Antoniogm03 in #39773
Fix macOS source upgrade creating a second agent instead of updating a pre-4.14.9 package install by @rjcausarano in #40005
Read Linux users' last login from lastlog and lastlog2, and count btmp failures since it, instead of reporting only open sessions and a hardcoded zero by @anromerom in #39728
Harden how active responses and execd write the active-response log by @cborla in #40017
Improve merged file handling by @jr0me in #39792
Fix users inventory dropping the sudo role when a later sudoers rule excludes the user by @anromerom in #40081
Fix malformed regex rules and per-item matching in run_as authorization-context rules by @MiguelazoDS in #39855
Multiple SCA checks fix by @IsExec in #40102
Fix host-deny active response removing unrelated hosts.deny entries via substring match by @Darioortegaleyva in #39905
Refresh deb amd64 checkfiles sizes of four active-response binaries that grew a page on 4.14.10 by @rjcausarano in #40139
feat(remoted): report TCP connections not yet tied to an agent by @MiguelazoDS in #39799
Open report_changes snapshots through the vetted path walk by @Miguevrgo in #40110
Resolve netsh.exe, route.exe and reg.exe from the system directory instead of searching PATH by @hernanvalenzuela in #39946
fix(gcp): raise Cloud Storage log rules above alert threshold by @AwwalQuan in #40154
fix(analysisd): reject unsafe hostnames in doDiff's diff path by @MiguelazoDS in #40132
Hash the bytes logcollector reads so restarts do not resend files with NUL bytes by @anromerom in #40134
Resolve the manager hostname in wazuh-agentd only after daemonizing, so it no longer crashes at startup on macOS 26 by @rjcausarano in #40133
Extend the vetted logcollector path walk to AIX 6.1, HP-UX and Solaris 10, and close the in-place junction toggle race on Windows by @lchico in #40019
Stop buffering and JSON-deserialising request bodies before authentication (4.14.10) by @jepalfer in #39744
disable force by default in POST /agents when the force object omits enabled by @Antoniogm03 in #40158
Quote numeric strings in wazuh-db list parameters by @Antoniogm03 in #40161
Wait for the real readiness signal in flaky authd integration tests by @Antoniogm03 in #39922
Remove the Solaris keepalive and socket timeout warnings and bound blocked TCP send and handshake receive on Solaris 10 agents by @lchico in #40103
Stop Solaris 11 SPARC agent daemons from aborting on C++ exceptions by loading a single libgcc_s by @lchico in #40140
Fix auditd decoders taking the wrong key and over-capturing res on combined events by @anromerom in #40196
Keep the API login attempt window fixed from the first attempt by @Antoniogm03 in #40232
Merge 4.14.9 into 4.14.10 by @TomasTurina in #40267
Redact the Authorization header before request headers are written to the debug2 log by @jepalfer in #40233
Fix memory-safety, authorization, and wodle/integration input-handling issues in manager components by @MiguelazoDS in #40010
Prevent the Windows syscollector from reaching network paths read from user registry hives by @Darioortegaleyva in #40113
Harden how the macOS installer trusts the /tmp/wazuh_envs deployment variables file by @fcontrerasc in #40248
Bound the Solaris 10 agent receive loop with poll() when SO_RCVTIMEO is unsupported by @lchico in #40247
Limit rule tree growth during ruleset loading in wazuh-analysisd by @matigarciadev in #40182
Fix macOS syscollector users inventory leaking OpenDirectory queries and Mach ports by @Darioortegaleyva in #40327
Resolve Coverity auto-copy finding in the syscheckd eBPF whodata name lookup by @lchico in #40330
Fix duplicated Azure Storage events from hourly append blobs by @MAnDumu in #40177
Move the rejection sample id instead of copying it in the indexer connector by @jotacarma90 in #40318
Remoted flaky tests by @jepalfer in #40160
fix(analysisd): load logtest config before the getconfig socket starts by @MiguelazoDS in #40273
Keep the shared modules socket client reconnecting after a half-closed or reset peer by @ignaciogalle12git in #40234
Lru cache cancels permission check by @jepalfer in #40181
Fix the vulnerability outbox queue stalling and the stale findings left by re-scans by @Antoniogm03 in #40054
Skip systemd not-found placeholder units in the services inventory by @hernanvalenzuela in #40344
Fix wazuh-modulesd crash on malformed legacy Berkeley DB RPM package headers by @lchico in #40368
Fix the CentOS 5 legacy agent build broken by O_CLOEXEC in data_provider by @cborla in #40390
Refresh stale wodle and internal_options sizes in the Linux agent checkfiles baselines by @cborla in #40386
Stop leaving an empty ossec-DD.json.gz after install or upgrade with JSON logging off by @nbertoldo in #40389
Log a child process that already exited at debug level when stopping wazuh-apid and wazuh-clusterd by @jotacarma90 in #40364
Stop masking http-request download failures in make deps (4.14.10) by @Darioortegaleyva in #40365
fix(monitord): compress rotated archive and alert logs when they roll over more than once a day by @MiguelazoDS in #40148
Encode the pipe and backslash of the URL sent by wurl_request by @Antoniogm03 in #40357
Build wazuh-keystore with the Linux hardening flags by @Antoniogm03 in #40240
Keep logcollector read positions when the status file is large and stop resending UTF-16 files on restart by @anromerom in #40392
Backport the AWS late-arrival marker to 4.14 and keep its window in the database by @cborla in #40428
Report the RHEL base release as the operating system version on RHCOS nodes by @nbertoldo in #40426
Remove obsolete authd timeout_seconds and timeout_microseconds options by @jepalfer in #40340
Keep AWS integration tests within the credential lifetime by not re-running the suite per module by @Darioortegaleyva in #40407
Add a directory depth limit to the rootcheck system scan by @Darioortegaleyva in #40459
Validate agent upgrade write chunks and escape rsync no_data range filter by @hernanvalenzuela in #40379
Fix snort-full alerts split per line on Unix and sent without the alert on Windows by @Darioortegaleyva in #40056
Delimit macOS Unified Logging events by their JSON structure by @Darioortegaleyva in #40387
Check file type on the opened descriptor in content checks by @Nicogp in #40490
Fix whodata device path buffer sizing on Windows by @hernanvalenzuela in #40470
Apply the logcollector remote_commands setting to socket outputs in the centralized configuration by @cborla in #40477
Close local request clients and route sync messages by header by @nbertoldo in #40472
Report the old name on FIM eBPF whodata renames and read the 6.18 renamedata layout by @Miguevrgo in #40452
Return ISO8601 input unchanged in timestampToISO8601 and make its test timezone independent by @Antoniogm03 in #40453
Fix flaky AWS custom bucket test by sending the S3 notification to the queue directly by @Darioortegaleyva in #40405
Restore the FIM warning for file names that are not valid UTF-8 by @Darioortegaleyva in #40513
Remove the Audit plugin configuration when who-data is not enabled by @Miguevrgo in #38763
Bump 4.14.10 branch by @wazuhci in #40549

Full Changelog: v4.14.9...v4.14.10-rc1

OpenBSD 8.0 Released

Tue, 20 Oct 2026 22:03:35 +0200

OpenBSD 8.0 has been released with major virtualization and hardware upgrades, including support for up to 64 vCPUs per VM, Intel Arc graphics, ARM64 hibernation, and expanded RISC-V support. Linuxiac points out that it marks the "61st release of the security-focused Unix-like operating system." From the report: Several fixes improve compatibility... Weiterlesen

BSD Release: OpenBSD 8.0

Tue, 20 Oct 2026 10:19:42 +0200

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Theo de Raadt has announced the release of OpenBSD 8.0, the latest stable build of the project's free, multi-platform 4.4BSD-based UNIX-like operating system. As usual, the new release brings a large number of improvements and new features: "We are pleased to announce the official... Weiterlesen

CVE-2022-50234 | Linux Kernel up to 6.0.2 af_unix unix_gc privilege escalation (Nessus ID 265161 / WID-SEC-2025-2053)

Tue, 20 Oct 2026 10:18:46 +0200

A vulnerability was found in Linux Kernel up to 5.4.219/5.10.149/5.15.74/5.19.16/6.0.2. It has been classified as critical. Affected by this issue is the function unix_gc of the component af_unix. The manipulation leads to privilege escalation. This vulnerability is documented as CVE-2022-50234. The attack requires being on the local network.... Weiterlesen

Today I learnt UNIX timestamp is not unique

Tue, 20 Oct 2026 10:10:37 +0200

I’ve always thought of a UNIX timestamp as a clock that gives 1 tick per second (or 1 billion ticks if you want nanosecond precision). So each second has 1 timestamp, like a primary key in a database, whereas human time is how we name each tick in a more human-friendly way, like 20 Oct 2026 10:15:10 AM. Recently, following the news of the leap... Weiterlesen

CVE-2026-98394 | Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 af_unix unix_stream_read_generic resource consumption (WID-SEC-2026-3951)

Mon, 19 Oct 2026 13:55:46 +0200

A vulnerability was found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 and classified as problematic. This affects the function unix_stream_read_generic of the component af_unix. The manipulation results in resource consumption. This vulnerability is known as CVE-2026-98394. Attacking locally is a requirement. No exploit is available. It... Weiterlesen

Claude klärt die Herkunft der NIST-ECDSA-Kurvensamen: Unix-Timestamp statt Hash

Sun, 18 Oct 2026 07:50:16 +0200

LONDON (IT BOLTWISE) – Claude hat die lang umstrittene Herkunft der Samen (Seeds) für mehrere NIST-ECDSA-Kurven rekonstruiert. Die kryptografisch relevanten Parameter gehen demnach nicht aus einem Hash „geheim“ erzeugter Passphrasen hervor, sondern aus dem lrand48-Zufallszahlengenerator, initialisiert mit einem Unix-Timestamp. Für P-256, P-384,... Weiterlesen

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Sat, 17 Oct 2026 13:18:56 +0200

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds for five NIST elliptic curves in under 30 minutes, addressing a cryptographic mystery spanning roughly 25 years. Its October 16 report attributes the seeds to a standard C pseudorandom number generator initialized with Unix timestamps,... Weiterlesen

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Sat, 17 Oct 2026 11:16:03 +0200

macOS nicht mehr „zertifiziertes UNIX“? Apple-System von der Liste der Open Group verschwunden

Sat, 17 Oct 2026 08:44:55 +0200

Von A/UX bis Server.app – die Geschichte der Apple-Server. 12.06.19 · 2 Kommentare · Apples Engagement für Open Source: Apple tritt Cloud Native ... Weiterlesen

[$] Recent and future changes to the Linux NFS server

Fri, 16 Oct 2026 18:01:06 +0200

The NFS network filesystem protocol has a long history on Unix-like operating systems (and beyond). NFS is still evolving, though, and implementations need to keep up. At the 2026 Linux Plumbers Conference, NFS developer Jeff Layton gave an overview of recent enhancements to the Linux implementation, along with some hints for what will be coming... Weiterlesen

Today's Steam Beta Makes The Linux Client A 64-bit App

Fri, 16 Oct 2026 04:55:51 +0200

submitted by /u/unixbhaskar [link] [comments] Weiterlesen

HPR4747: UNIX Curio #13 - Replacements for cat

Thu, 15 Oct 2026 09:42:17 +0200

This show has been flagged as Clean by the host.

This series is dedicated to exploring little-known—and occasionally useful—trinkets lurking in the dusty corners of UNIX-like operating systems.

Thirteen is one of my favorite numbers, so I am going to use this episode to indulge myself. As part of UNIX Curio #8 ( HPR episode 4657 ), I went on a little flight of fancy and suggested that the comm utility could be used in place of cat . On further reflection, I realized that there are quite a few utilities that can do that job, almost. This episode is the result of me investigating how many possible ways there are to replace that functionality with standard utilities. Imagine that some prankster has deleted the cat utility from your machine, and you need a way to restore that capability without re-installing it.

I should warn you that as opposed to the rest of the series, this episode will not focus heavily on obscure tools, and it is unlikely the examples given will be very useful. Also, I am not going to dive into the history of any of these commands. However, you might still learn something, and it could be a little entertaining to hear about the ways some utilities can be twisted to this purpose.

Let's start by reviewing what the functionality of cat [1] is. Under POSIX, all it does is read the data provided on standard input or from each file named as an argument, and writes it to standard output. Briefly, it con cat enates all of the entries. The only option required by the standard is -u , which causes cat to write data without any delay (if that option were not given, the program could choose to buffer the data). While many implementations offer additional options that modify the output, I am going to completely ignore them and just focus on that one job. The files named as arguments are processed in the order in which they are named. One or more of these can be - , in which case cat will use the data provided on standard input and then continue to the next file in the argument list. I will actually narrow things even further and allow discussion of cases where only one file is involved, or where cat is reading from standard input via redirection from a file.

I will start off with the TL;DR conclusion—none of the standard utilities are able to fully duplicate its functionality on their own. Some of them come close, but can't quite be relied on in all respects. One important reason for this lies with the POSIX definition of a text file [2]. This is a file treated as being separated into lines, divided by newline characters. There are three limitations: none of the lines can contain a NUL byte (value 0), the lines cannot exceed the maximum line length defined by the system (required to be at least 4096 bytes including the trailing newline), and the file must end with a newline character. (The last rule is implied by the definition of "line" , which states a newline must appear at the end of a line.) It might seem strange, but a text file may contain non-ASCII data; the only restriction on the values of bytes is that they cannot be NUL. Many of the standard utilities are only required to operate on text files and therefore cannot necessarily be relied on to handle arbitrary data. While a particular implementation might not have these limitations, there is no guarantee of that. I should note that both cut and paste are only required by POSIX to operate on text files, but with the exception that the lines can be of any length.

In addition to cat , the only utilities covered in this episode that are required by POSIX to handle any arbitrary file are dd , tail (when used with the -c option), tee , tr , and uuencode . The wording for the compress utility does not specifically say it must handle any file, but in practice I think this is true. However, all of these utilities have at least one limitation of their own: they cannot handle more than one file or they can only operate on standard input. Some other utilities are able to deal with multiple files, standard input, or both, but those are only required to operate on text files. In practice, this typically means that if an input file does not end with a newline character, the program will add one to the output, destroying the idea that the output of cat should be identical to the input.

Let's start with the least-capable options and work our way towards those that could serve as closer drop-in replacements. The first candidate is a utility that I thought might be persuaded to work, but it doesn't quite. This is nl , a command used to number lines of files or standard input [3]. It normally prints the content of this input and, on the left, prints the number of each line. It is possible to turn off the numbering, and to set the separator between the numbers and the text to a null string. However, it does not seem to be possible to have absolutely nothing appear in front of each line. The POSIX specification states that the -w option can be given to define how many characters to the left of each line will be reserved for the line numbers—while the default value is six, it says nothing about what values must be accepted. I tested several implementations (specifically, from GNU, FreeBSD, NetBSD, and OpenIndiana, which is an open-source derivative of System V) and none of them allow setting the width of the space for line numbers to be less than one. Even if it were possible to remove the preceding space entirely, POSIX only requires nl to accept one file argument and to operate on text files, so it would still be limited.

In the examples for this episode, myfile is used to represent the name of the file being operated on. The text myfile ... means a filename possibly followed by other filenames (with no limitation on the number). The nl example below prints a single space in front of each line.

nl -b n -s "" -w 1 myfile

Next up are methods that actually work, but are only usable with standard input. When combined with input redirection from a file, they can accept a single file and send it to standard output. The read utility [4] takes a line of input and assigns it to a shell variable. It requires a little help, however—it can't output what it reads, so it has to be paired with something like echo or printf . Because it reads input one line at a time, it needs to be used in a loop to read the entirety of the data. In addition, the IFS shell variable must be set to a null string to prevent read from doing field splitting; we don't want it to modify the data being read at all. The shell loop while IFS="" read -r foo; do echo "$foo"; done < myfile will do the job, except that read is only required to handle text files. It is not clear to me whether POSIX allows the shell to have a limit on how much data can be stuffed into a variable; if it does, that could be a problem even if your implementation of read can handle lines longer than the maximum length.

The tr utility [5] is another one that only works with standard input. It takes the input, replaces any characters in the first string argument with the corresponding characters in the second string argument, and sends the result to standard output. If the first and second strings are the same, such as tr a a < myfile , it will behave like cat .

The tee command [6] also fits into this category. It copies standard input to standard output, just like cat does. It also sends a copy to any filename arguments given. If none of these are present, it just passes the data through untouched. You could use tee < myfile to print a file. Be careful, however, not to enter your filename as an argument (as in tee myfile ), as that will cause it to be overwritten! The good news with both tr and tee is that they aren't limited to working with text files.

Let's now consider a couple of options that only work on a file, not with standard input. In addition, they can only handle one single file. This might seem to defeat the purpose of cat , which can combine multiple files, but cat is often used with only one file. These are ed [7] and ex [8], two text editors. By feeding them the right command sequence on standard input, they can be convinced to output the entire file and then exit. The appropriate invocations would be printf '%s\n' '1,$p' Q | ed -s myfile and printf '%s\n' '1,$p' 'q!' | ex -s myfile . The POSIX specification for ex indicates that more than one filename can be given as an argument. I attempted to take advantage of this with the command line while true ; do printf '%s\n' '1,$p' 'n!' ; done | ex -s myfile ... , which should print the first file named as an argument to standard output and move to the next one. In my reading of the specification, once the last file has been printed, the n! command (meaning "next") should result in an error, causing the program to exit. However, the implementations that I tested don't exit and just stay on the last file, printing it out endlessly. Perhaps I'm misunderstanding how ex works, but regardless, both it and ed are only required to handle text files, so can't completely serve in place of cat anyway.

The following category of replacements is capable of using either standard input or a file, but they can only work with one file. Let's start with comm [9], which was responsible for me exploring this question. The command comm myfile /dev/null will send myfile to standard output. If you want to use standard input instead of a file, you need to replace the first filename with a hyphen (as in comm - /dev/null < myfile ). The paste utility [10] works similarly. It can only be used with one file because if more are given, it will try to interleave the lines of these files together. Another possibility is tail [11]. When used with the -c +1 option, it outputs the entirety of the file. Unlike other implementations I tried, the NetBSD version of tail is capable of taking multiple filenames as arguments. However, in that case, it precedes the content of each file with the filename like head does, so doesn't produce a clean copy. The sort utility [12] used with the -m option, which I talked about in UNIX Curio #11 ( HPR 4687 ), can also do the job. All of these are only required to handle text files by POSIX except tail , which must handle any arbitrary file when the -c option is used.

One more utility that can take either one file or standard input is dd [13]. It is a bit different from these others in a couple ways. First, it writes statistics about the data processed to standard error, so you would need to redirect that to /dev/null to replicate the behavior of cat . To use standard input, no arguments are needed. The syntax for arguments is unusual compared to other UNIX utilities; for this purpose, dd if=myfile 2>/dev/null would be the command to use.

The compress [14] and uuencode [15] utilities are in the same category, but do a lot more processing on the data along the way. The purpose of these is described respectively in UNIX Curios #7 ( HPR 4647 ) and #1 ( HPR 4587 ). Their output can be piped into a corresponding uncompress or uudecode utility to get back the original data and send it to standard output. The two commands would be compress -c myfile | uncompress -c and uuencode myfile /dev/stdout | uudecode —if you wanted to use standard input instead, just omit the filename arguments. I should point out that when I tested the uuencode method on FreeBSD 15.0, it didn't work; however, it did work on NetBSD 10.1 and OpenIndiana 2025.10.

Next, we have two possibilities that come very close, but don't quite behave exactly like cat . They send to standard output either the files named as arguments in order, or, if there are none, standard input. However, POSIX does not require them to take a hyphen as an argument, representing standard input. First up, we have sed [16]; when called with an empty script (as in sed "" myfile ... or sed :a myfile ... ), it just prints out the contents without any transformations. The grep utility [17] works the same way—when given an empty regular expression (as in grep "" myfile ... ), it treats that as matching anything and prints each line of input to standard output.

Finally, we have arrived at the utilities that can fully replace cat , albeit only for text files. They can be given one or more files, including a hyphen representing standard input, and will output them in the order they are given as arguments. If no filename arguments are given, they just use standard input instead. Starting out, we have awk [18]. While an empty pattern matches every line of input and an empty action prints the entire line, POSIX states that if both the pattern and action are empty, the utility is to simply exit without reading or writing anything. Therefore, we need to at least provide a pattern or an action—a pattern, as in awk "/.*/" myfile ... , can be shorter. Another one that has the capabilities is cut -b 1- myfile ... [19]. However, as noted earlier, these will add a newline character if the input doesn't already end with one, so they aren't exact replacements.

I was hoping that a simple invocation of one of the standard utilities could be used in place of the cat program that our prankster has deleted; however, I think I've demonstrated that isn't possible. Let's return to those utilities that can handle arbitrary files, but can't take more than one at a time. It would be possible to write a shell script to manage any options and arguments, then use the utility to do the actual work of sending through the data file by file. In my view, tail would be the best fit because it can take a bare filename as an argument and, unlike dd , uses the standard syntax for UNIX utilities.

The following script does just that—unfortunately, it is not really something simple that could be typed in from memory. So probably it would be easier in most situations to just re-install cat on your system instead of looking up this script, typing it in, and saving it where cat used to be.

#!/bin/sh
# Exit if any option other than -u is given; 'getopts' will issue an error
# message.  We don't actually do anything different if -u is given.
while getopts u catopt
do
  if [ "X$catopt" != "Xu" ]
  then
    exit 1
  fi
done

# Reset the positional parameters to remove any options given.
shift $(($OPTIND - 1))

case $# in
0)
  tail -c +1
;;
*)
  for fname
  do
    case "$fname" in
    -)
#      Single hyphen represents standard input, same as with no arguments.
      tail -c +1
    ;;
    *)
#      The -- ensures that $fname will be treated by 'tail' as an argument,
#      not an option.
      tail -c +1 -- "$fname"
    esac
  done
esac

It might be tempting to implement this substitute as an alias or a shell function rather than as a script, but those only exist in the current shell execution environment (and its subshells) and are not inherited by utilities and scripts run by you or others. So the easiest way to get it to be used by other scripts such as cron jobs would be to save a copy of it on your system where cat normally lives, making sure that the "execute" file mode bits are set .

There are certainly other widespread tools, such as Perl, that could also be used in place of cat . However, I wanted to focus only on utilities that are so ubiquitous that they appear in the POSIX standard. It should be noted that even some of these, such as compress and uuencode , aren't always present on modern systems.

References:

Cat specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/cat.html
Definitions: Text File https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_403
Nl specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/nl.html
Read specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/read.html
Tr specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/tr.html
Tee specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/tee.html
Ed specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/ed.html
Ex specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/ex.html
Comm specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/comm.html
Paste specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/paste.html
Tail specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/tail.html
Sort specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/sort.html
Dd specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/dd.html
Compress specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/compress.html
Uuencode specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/uuencode.html
Sed specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/sed.html
Grep specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/grep.html
Awk specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/awk.html
Cut specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/cut.html

Provide feedback on this episode.

KDE Plasma 6.8 released

Thu, 15 Oct 2026 09:41:02 +0200

Version 6.8 of the KDE Plasma desktop has been released. The The KDE project has timed the release to coincide with the 30th anniversary of Matthias Ettrich's email announcing the project: Unix popularity grows thanks to the free variants, mostly Linux. But still a consistent, nice looking free desktop-environment is missing. There are several... Weiterlesen

GitHub Release: crowdsecurity/crowdsec v1.8.2-rc1 (13.10.2026)

Thu, 15 Oct 2026 09:31:45 +0200

crowdsecurity/crowdsecv1.8.2-rc113.10.2026@sabban

Changes

AGENTS.md: clearer guidance on tests (#4713) @blotus
pimp readme (#4701) @buixor

New Features

[bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor

Improvements

exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
add cscli bot subcommand (#4666) @blotus
prometheus: add kind label to cs_alerts (#4742) @blotus
lapi: make decisions stream page size configurable (#4733) @tommy-ng0
Fix ValidateChallengeResponse (#4737) @buixor
grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus
grokky : preshot static strings (#4731) @buixor, @Copilot
grokky : ParseInto (#4729) @buixor
bot-detection: add new FlagSubmission() helper (#4727) @blotus
appsec: add an optional category to the request score (#4715) @buixor
apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
fix image link (#4702) @buixor
waf: add SkipProcessing() helper (#4667) @blotus
[bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
docker: read from now if container restarts (#4605) @blotus
splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
metrics: remove series of deleted machines and bouncers (#4712) @somaz94
postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus
buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
challenge: optimize memory usage (#4674) @blotus
syslog: copy buffer before handing it to the datasource (#4690) @blotus
Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]
CI: skip more docker tests on windows (#4728) @blotus
grok: embed grok library instead of having it as a dep (#4725) @blotus
docker datasource: skip tests on windows (#4719) @blotus
agents.md: keep comments to a reasonable level (#4716) @blotus
build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]
build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]
build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]
build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]
build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]
bump to go 1.27 (#4675) @blotus
build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]
build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

radare2 — Updated!

Thu, 15 Oct 2026 09:31:36 +0200

UNIX-like reverse engineering framework and command-line toolset Weiterlesen

GitHub Release: NousResearch/hermes-agent v0.22.1 (15.10.2026)

Thu, 15 Oct 2026 09:15:00 +0200

NousResearch/hermes-agentv0.22.115.10.2026@ethernet8023

Hermes Agent v0.22.1 (rc.5-v0.22.1)

Release Date: October 14, 2026

This is a patch release, with a handful of fixes for the Windows Store, plugin updates, and more.

✨ Features

Agent): add nemotron super 3.5 default parameters (c59d2994) — @elisam0
Cli): add curated model list at the top in the model picker list (e6835fd3) — @elisam0
Plugin-catalog): add hermes-lang-ko — Korean Desktop language pack (e5f49b6a) — @dandacompany
Plugin-catalog: add hermes-lang-pt-br (Brazilian Portuguese language pack) (0169e80c) — @StudioCodeAI
Plugin-catalog: add teamorouter (TeamoRouter model providers) (ef223406) — @2867297362mjb-sketch
Plugin-catalog): add author-feed (5f6d6836) — @TakeshiTGAL
Plugin-catalog): bump aux-ledger to 1.4.0 (6048066e) — @olric3015
Plugin-catalog): add the wait-ledger catalog card (77cb58e5) — @olric3015
Plugin-catalog): add wait-ledger (97e65322) — @olric3015
Community plugin: lightningai + lightningai-rate-limit (07515466) — @dinosauria123
Catalog: add Hermes AAC 0.1.0 at reviewed exact source pin (7c9adda8) — @TREE-Ind
Plugin-catalog): add openinvest (b6e86101) — @longsizhuo
Catalog: add hermes-agent-mixer (v0.2.0 @ 04c4e13) (2e7e3859) — @Sahil-SS9
Plugins): move Kumiho Memory to memory catalog shelf (46f95e08) — @kaveone
Add canonical group attachment controls (4673f17c)
Consume event-bound hosted files through canonical admissions (e87bd098)
Connect Desktop groups to canonical driver controls (3c2c9d47)
Transport hosted producers through authenticated owner sockets (51189b05)
Retain hosted room work evidence across authority changes (0af2c714)
Route hosted room workers through session authority (bd22e0f9)
Wire canonical hosted group controls (fa2179bb)
Gateway): resolve --resume and -c <title> [--create-if-missing] in the authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>11a83ad4</code></a>)</li> <li>Retain terminal identity tombstones during history retirement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ba435291</code></a>)</li> <li>Route native CLI and ACP actions through prepared controls (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>27b0f7f2</code></a>)</li> <li>Publish real prepared compression in the mutation receipt transaction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b6540276</code></a>)</li> <li>Prepare and atomically publish local model changes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7e7fa7c6</code></a>)</li> <li>Commit independent local branch policy and route atomically (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f98eaec1</code></a>)</li> <li>Project managed tool progress without private arguments or results (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>61ccd894</code></a>)</li> <li>Bridge managed worker approvals clarification and stop (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a0b5118f</code></a>)</li> <li>Launch admission-owned tool workers from the ordinary daemon (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>510e32be</code></a>)</li> <li>Enforce safe defaults at bare agent construction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1eeac867</code></a>)</li> <li>Suppress rules skills and memory readers in private safe workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>25cda66a</code></a>)</li> <li>Bypass plugin providers and hook execution in safe workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>33921e6f</code></a>)</li> <li>Bind immutable private worker config before runtime imports (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4cc3f420</code></a>)</li> <li>Expose verified canonical ACP editor MCP attachment (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1bda56a1</code></a>)</li> <li>Rebind exact editor MCP credentials on canonical ACP resume (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5bfa2f2c</code></a>)</li> <li>Borrow editor MCP configurations with frozen session manifests (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>394f00f6</code></a>)</li> <li>Isolate execution-owned MCP registry overlays (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>96e4d296</code></a>)</li> <li>Commit local reset targets with runtime mutation receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>821137c3</code></a>)</li> <li>Expose profile-scoped Bot relay mailbox RPCs on the authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>792aa35a</code></a>)</li> <li>Migrate queued Bot mailbox identities without replaying claims (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>af49e2fc</code></a>)</li> <li>Send local Bot DMs to the discovered canonical authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>47ba694e</code></a>)</li> <li>Admit identified Bot Chat relay deliveries through session authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>998df8cc</code></a>)</li> <li>Reserve exact owner-started admission worker claims (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fbdfd46d</code></a>)</li> <li>Expose authenticated owner mutation snapshots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d6331c48</code></a>)</li> <li>Freeze ACP tool policy and bind execution-owned edit consent (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e2f5cfc6</code></a>)</li> <li>Reserve hosted API identities through the authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6b278ca4</code></a>)</li> <li>Admit API runs before acknowledging execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f2d9cea3</code></a>)</li> <li>Run bound API turns on the shared cached agent (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dea4f0c5</code></a>)</li> <li>Restore server-bound API session identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>76532ae1</code></a>)</li> <li>Retain claim-fenced structured admission results (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>262e0ebf</code></a>)</li> <li>Compose worker compression lifecycle and delegation persistence (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6c57ad37</code></a>)</li> <li>Publish committed worker completions through authenticated owner bridge (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d94ccc2d</code></a>)</li> <li>Fence delegation receipts with shared worker sequence and epoch (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>be85ca24</code></a>)</li> <li>Route registered worker delegation writes through durable outbox (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1ee6545f</code></a>)</li> <li>Add execution-bound delegation ledger operations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8128e88f</code></a>)</li> <li>Persist worker titles activity and route sidecars with receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>235e4f12</code></a>)</li> <li>Add assignment-fenced worker constructor and finalization handlers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b7de5a8e</code></a>)</li> <li>Atomically compact and advance worker transcript assignments (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c2e77eba</code></a>)</li> <li>Preserve worker history and cache lineage identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e63e1101</code></a>)</li> <li>Add receipted worker compression guards and leases (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d51afe4c</code></a>)</li> <li>Route REST imports and deletion through mutation receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2cdd103d</code></a>)</li> <li>Route REST sidebar edits through the shared authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eb329d21</code></a>)</li> <li>Coordinate shared mutations and publish committed revisions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eb42a002</code></a>)</li> <li>Reuse transactional rewind with generation and receipt fences (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6777ffa4</code></a>)</li> <li>Import session histories atomically with retry receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b9194595</code></a>)</li> <li>Fence destructive deletion without erasing runtime obligations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e5249c9a</code></a>)</li> <li>Commit sidebar edits with canonical mutation receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0b1b8e0f</code></a>)</li> <li>Project execution-owned approvals to ACP viewers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>97a24c10</code></a>)</li> <li>Attach ACP transport to canonical session execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8dd92a30</code></a>)</li> <li>Persist assigned worker prompt context and usage anchors (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c6540cb9</code></a>)</li> <li>Admit local automation through owner durable FIFO (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1642b339</code></a>)</li> <li>Queue due gateway heartbeat ticks through canonical admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ab44af2c</code></a>)</li> <li>Admit trusted gateway completions to the durable session FIFO (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7cd1b000</code></a>)</li> <li>Fence worker terminal receipt after sequenced durable writes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>21a48aea</code></a>)</li> <li>Authenticate live worker persistence and explicit restart adoption (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9d7d7e2a</code></a>)</li> <li>Receipt worker main and auxiliary usage in canonical transactions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9d896c49</code></a>)</li> <li>Atomically receipt structured worker transcripts and turn leases (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2abe47de</code></a>)</li> <li>Dispatch bound local slash commands through gateway handlers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b0377e92</code></a>)</li> <li>Share authenticated canonical slash discovery with legacy catalogs (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fcf50e03</code></a>)</li> <li>Authenticate native HTTP through private daemon grants (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>75764b2a</code></a>)</li> <li>Commit local creation policy and restore cold authority routes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>aa2624ba</code></a>)</li> <li>Attach Desktop local launches to canonical gateway (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9c40ddcf</code></a>)</li> <li>Bind Ink sessions and controls to canonical authority envelopes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a2d9e258</code></a>)</li> <li>Attach Ink local transport through canonical gateway bootstrap (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>08f628f9</code></a>)</li> <li>Route normal classic and one-shot launch through the gateway (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>35510459</code></a>)</li> <li>Add transport-only classic gateway client and option validation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6ed03be9</code></a>)</li> <li>Apply local launch policy through real gateway turns (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>080c5da6</code></a>)</li> <li>Define frozen local session launch policy (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>81ed9712</code></a>)</li> <li>Route revision-checked session metadata through gateway (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>17ddbe44</code></a>)</li> <li>Expose scoped local session metadata and document compatibility (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>52c354ff</code></a>)</li> <li>Create gateway-owned local sessions through authenticated controls (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>42967cdd</code></a>)</li> <li>Recheck native Discord membership before durable admission and claim (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc0cd5c9</code></a>)</li> <li>Boot authenticated session authority in ordinary gateway (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c3bf62eb</code></a>)</li> <li>Share live clarification controls across attached viewers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9c474378</code></a>)</li> <li>Stream canonical gateway execution events to shared observers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>40d9b4c7</code></a>)</li> <li>Reauthorize multiplex native connector provenance (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>244bff73</code></a>)</li> <li>Share generation-fenced approvals across gateway viewers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5e2afdae</code></a>)</li> <li>Retain native media and context before durable admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ef447482</code></a>)</li> <li>Replay authority events from atomic subscription watermarks (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d24dc3fa</code></a>)</li> <li>Recover committed native text without replaying unknown turns (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>78646003</code></a>)</li> <li>Execute attached websocket turns on the messaging live agent (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>47fbfd4c</code></a>)</li> <li>Add revision-fenced runtime rename and archive receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5878e565</code></a>)</li> <li>Fence typed worker persistence with atomic replay receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7cc69d29</code></a>)</li> <li>Import drained legacy admissions atomically with unknown recovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>124dfa7c</code></a>)</li> <li>Centralize durable session admissions in canonical storage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0695b12b</code></a>)</li> <li>Keep declined gateway wizard starts unmanaged (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7500930d</code></a>)</li> <li>Require explicit consent for gateway service setup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>16d6b7da</code></a>)</li> <li>Restrict runtime bootstrap peers and bound native pipe I/O (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d3ccac14</code></a>)</li> <li>Compose the existing API into the gateway event loop (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bac47874</code></a>)</li> <li>Distinguish unavailable gateway owners from absent runtimes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e903841c</code></a>)</li> </ul> <h2>🔧 Improvements</h2> <ul> <li>Profiles): build the seed routing view once; expand <code>enabled</code> too (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>311155fa</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@kshitijk4poor</a></li> <li>Update nemotron super 3.5 name (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3224993a</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@elisam0</a></li> <li>Hermes_cli): update nemotron 3.5 name (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>108ae4e7</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@elisam0</a></li> <li>Catalog: re-pin showly to the build without the upstream self-update check (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6462f64a</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@slchris</a></li> <li>Catalog: update Model Router to v0.4.3 native preferences (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6a097ee9</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@metamindedu</a></li> <li>Keep native MCP revision scoped to frozen tool settings (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>53d17f1c</code></a>)</li> <li>Cron bot-chat delivery has no local CLI fallback lane (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5d87060e</code></a>)</li> <li>Retire bot execution discovery from viewer notification pollers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c8ae25cd</code></a>)</li> <li>Make default ACP construction authority-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c423a431</code></a>)</li> <li>Remove obsolete updater sidecar deletion path (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>58895653</code></a>)</li> <li>Remove retired local serve launch imports (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5702f9df</code></a>)</li> <li>Extract ordinary gateway bootstrap lifecycle (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3c0f1e01</code></a>)</li> <li>Freeze shared session authority interface contract (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1af74c27</code></a>)</li> <li>Extract TUI session registry and agent factory seams (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a38ca908</code></a>)</li> <li>Separate gateway agent acquisition from native progress (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0f3a4fb2</code></a>)</li> <li>Extract gateway turn preparation and persistence phases (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6e8de80a</code></a>)</li> <li>Move gateway service wizard into setup sibling (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f0b35a98</code></a>)</li> <li>Extract gateway setup service orchestration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>02d0307c</code></a>)</li> <li>Remove extracted runner initialization bodies (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4b1379fb</code></a>)</li> <li>Extract gateway bootstrap and writable initialization phases (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0c287340</code></a>)</li> <li>Extract standalone web application lifespan (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f38f2444</code></a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Compression): fallback summaries, multiline setup notes and parallel loads keep skill markers right (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>297552a9</code></a>)</li> <li>Compression): a slash-skill body's example paths stay out of the anchor index (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d6020828</code></a>)</li> <li>Compression): small and slash-invoked skills keep their reload marker across compaction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>71e815de</code></a>)</li> <li>Desktop): update notes keep full text, re-read merged PRs per check, respect custom branches (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f2a93db9</code></a>)</li> <li>Mcp): preserve server deadlines through outer tool execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f30020ed</code></a>)</li> <li>Plugins): honor portable per-server call deadlines (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fcc170b7</code></a>)</li> <li>Agent): rewrite split tool ids before Mistral sees them (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b33ed359</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@xxxigm</a></li> <li>Profiles): align model seed with provider resolution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5fee8d77</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@helix4u</a></li> <li>Profiles): inherit canonical and legacy custom endpoints (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2d3e75aa</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@helix4u</a></li> <li>Drop the VPN/proxy advice from the CDN-block message (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>300228d2</code></a>)</li> <li>Catalog): re-pin Agent Mixer after maintainer review (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4297a692</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Sahil-SS9</a></li> <li>Pin Activity v0.2.1 public credential routes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3dac1f07</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@hassan-kamel</a></li> <li>Plugin-catalog): update switchbot-control to d0e6f77 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c4bf61b1</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@TakeshiTGAL</a></li> <li>Doctor): clarify Docker npm audit remediation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e21caa27</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@KoNit-K</a></li> <li>Deps): bump the WhatsApp bridge lock past its npm-audit findings (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>231cb757</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ethernet8023</a></li> <li>Tui): retain native legacy history in canonical session picker (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2171365a</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@unsupportedpastels</a></li> <li>Tui): the banner shows main's 8-character session label for a canonical id (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2c979900</code></a>)</li> <li>Gateway): a local process completion persists as a process_complete card (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ff770cb7</code></a>)</li> <li>Runtime): persist diagnostic automation category through replay (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bdac7911</code></a>) — David Dudok de Wit</li> <li>Gateway): retire bot receipt tasks with authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d50b2eda</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): persist operator provenance for native recovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c51049aa</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Cli): preserve blocking controls in finite output (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>954638ed</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): isolate malformed bot receipt schemas (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4be62f9c</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Acp): clean up deferred cancellation lifetime (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>89dac620</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): close remaining unified-runtime review gaps (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>83cdc63a</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): isolate bot receipts and keep headless cron no-spawn (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cdf36315</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): recover mixed local queues and retire failed hot serves (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f4fd982b</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): terminate replay gaps and retain ACP cancels (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>37662b16</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Gateway): route local ticket bootstrap through control owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>996d9beb</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Desktop): a transcript reconcile skips a runtime mid-switch to another session (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>09aafcea</code></a>)</li> <li>Gateway/stream): a failed overflow head send no longer spins the event loop (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f0d9bd2f</code></a>)</li> <li>Gateway): <code>profile</code> on our own home is stripped only for the closed session verbs (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2c5b0af5</code></a>)</li> <li>Gateway): <code>gateway ensure</code> starts on a systemd host whose user bus is unreachable (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>82db702f</code></a>)</li> <li>Desktop): a session routed onto a new socket re-attaches before it submits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>307dac20</code></a>)</li> <li>Desktop): a registry-connection hover prewarms that connection's gateway (main <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#89756</a> port) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#89756</a>)</li> <li>Bot-relay): a relayed dm targets only live profiles (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#99392</a> on the authority door) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#99392</a>)</li> <li>Gateway_chat): one-shot refuses an unknown-blocked session; stream-json always closes with a result (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>08b6ebd0</code></a>)</li> <li>Tui_gateway): projects RPCs answer from the scan cache when a profile's state.db was never initialized (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>372ec7fc</code></a>)</li> <li>Cron): Bot Chat delivery creates the missing Bot Chat instead of failing the run (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>364a0e22</code></a>)</li> <li>Seed-copy compensation discards the row without the retirement fence (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>44212c5a</code></a>)</li> <li>Gateway): exact mutation retries repair the runtime projection (X11, reported by <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Xipong</a>) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c1ee9286</code></a>)</li> <li>Desktop): preserve accepted input and clarify persistent-work Quit (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f8e234ed</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@dokterdok</a></li> <li>Desktop): drop pool-limit notification wiring main added after the pool subsystem was removed (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c3632fcc</code></a>)</li> <li>Runtime): owner scope is multiplex-only; foreign LOCAL sources fail closed; primary = launch home (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a37550b9</code></a>)</li> <li>Type session creation identity with merged onboarding options (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0948ffc9</code></a>)</li> <li>Preserve main lifecycle and discovery behavior after extraction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b186879a</code></a>)</li> <li>Preserve webhook delivery profile and snapshot scoped home (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8fe3d198</code></a>)</li> <li>Retain per-admission bot and API authors (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>61f75a77</code></a>)</li> <li>Recover mixed-clock sessions and compose runtime test listeners (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9e747d7f</code></a>)</li> <li>Preserve hosted image admission and execution across owners (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2672b820</code></a>)</li> <li>Gateway): restore hosted image attachments natively (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bdfe8a50</code></a>)</li> <li>Desktop): preserve profile target during reconnect (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ddf8bec7</code></a>)</li> <li>Restore durable hosted group sends before enabling input (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d3162155</code></a>)</li> <li>Translate canonical hosted group controls in all desktop locales (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>29e27af5</code></a>)</li> <li>Desktop): journal canonical group sends before admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3d1cb4e0</code></a>)</li> <li>Integrate hosted attachment admission hooks (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c094d91e</code></a>)</li> <li>Transfer hosted input bytes through task-scoped owner attestation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>519e1101</code></a>)</li> <li>Bind hosted owner transport to exact destination home (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9035ef9a</code></a>)</li> <li>Minimize retained webhook destinations and preserve legacy receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c6456808</code></a>)</li> <li>Capture peer ACK evidence and trim unused file catalog helpers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c86dd71b</code></a>)</li> <li>Publish hosted file shares with cursor-fenced retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>49e27d8b</code></a>)</li> <li>Run hosted rooms through independently owned profile daemons (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>53a260ac</code></a>)</li> <li>Fence hosted discard and prevent unknown retry generations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3cde0092</code></a>)</li> <li>Explicitly discard exact hosted unknown executions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>864c34f3</code></a>)</li> <li>Preserve hosted room ownership during service shutdown (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bfa8022d</code></a>)</li> <li>Durably recover webhook destinations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d207fd64</code></a>)</li> <li>Recover native admissions after ordinary adapter startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>70659676</code></a>)</li> <li>Carry finite execution policy through canonical admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9edd28e6</code></a>)</li> <li>Join finite gateway chat delegations in the admitted turn (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5977ef75</code></a>)</li> <li>Resolve managed Node in native ticket probes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ee9030bd</code></a>)</li> <li>Preserve manual compression settings and session identity (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9fa0b6aa</code></a>)</li> <li>Prevent duplicate cron alerts after durable delivery handoff (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>47e3bb25</code></a>)</li> <li>Preserve cron delivery silence and incident acknowledgements (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0c7f676e</code></a>)</li> <li>Bound canonical cron owner store acquisition (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>61759b57</code></a>)</li> <li>Restore canonical desktop image thumbnails safely (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4d5db820</code></a>)</li> <li>Restore prepared desktop image drafts after restart (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5034ee3a</code></a>)</li> <li>Route lost prompt discard to its session owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>566872a8</code></a>)</li> <li>Preserve newer replies across delayed redirect receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ac30b57a</code></a>)</li> <li>Retry transient desktop busy policy reads (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>82098e63</code></a>)</li> <li>Keep desktop streams intact when corrections are refused (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3c886973</code></a>)</li> <li>Connect recovery and owner projection routes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cfa5c152</code></a>)</li> <li>Discover private gateway sockets across native temp roots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>de66df14</code></a>)</li> <li>Expose owner-scoped ancillary session reads (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>61ace21a</code></a>)</li> <li>Stage canonical remote images in the authorized owner cache (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>baaa4464</code></a>)</li> <li>Project native config and model inventory from canonical owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1064971e</code></a>)</li> <li>Preserve Kanban board discovery and unknown owner attempts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>90e2b2eb</code></a>)</li> <li>Reconcile canonical cron receipts into durable delivery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c1172b1a</code></a>)</li> <li>Preserve admitted images and async usage in managed workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4abbb3f9</code></a>)</li> <li>Share static-token session ownership across HTTP and WebSocket (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>56e344e5</code></a>)</li> <li>Connect canonical cutover repairs across owner and clients (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c8f8d9ae</code></a>)</li> <li>Restore scoped canonical busy and correction controls (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>daa01697</code></a>)</li> <li>Isolate authenticated gateway owners by provider and issuer (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6b8a6d4c</code></a>)</li> <li>Bootstrap Windows desktop tickets through validated Python pipes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f8ba25a9</code></a>)</li> <li>Submit Desktop images through canonical admissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c93382c0</code></a>)</li> <li>Preserve desktop busy correction intent on rejection (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b3cca0f3</code></a>)</li> <li>Keep canonical RPC refusals out of Desktop resume recovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9ba2582b</code></a>)</li> <li>Keep unbound Ink drafts instead of claiming memory-only admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>07588b5e</code></a>)</li> <li>Honor non-idempotent canonical busy control acknowledgements (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>01e4829c</code></a>)</li> <li>Stage clipboard images on the Ink client host (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>179a8473</code></a>)</li> <li>Scope Ink config hydration and prompt model mutations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>798c3926</code></a>)</li> <li>Retain disconnected Ink input and canonical control receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1a5bae9b</code></a>)</li> <li>Stage and retain canonical Ink image submissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>33622c04</code></a>)</li> <li>Route Ink session controls through canonical authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bf0b25a9</code></a>)</li> <li>Preserve Kanban execution PID and durable worker outcomes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d4fd07d2</code></a>)</li> <li>Route claimed Kanban tasks through trusted owner admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5aeba055</code></a>)</li> <li>Admit agent cron runs through the canonical owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cdbe8c35</code></a>)</li> <li>Forward A2A profile tasks through session authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4e3a6bdb</code></a>)</li> <li>Project ACP cancellation and failed admissions accurately (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>03c0efc8</code></a>)</li> <li>Preserve API content identity history and terminal outcomes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f48d0956</code></a>)</li> <li>Fence legacy history claims and follow Bot reset targets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f88f8615</code></a>)</li> <li>Adopt legacy local history through trusted session owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cb748e7a</code></a>)</li> <li>Record physical admission assignment before later compression (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7b9dc454</code></a>)</li> <li>Classify managed worker errors and verify compression restart (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4bbbb90f</code></a>)</li> <li>Preserve worker compression admission identity (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>588c609c</code></a>)</li> <li>Refresh worker row identities after compression (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e19f05ff</code></a>)</li> <li>Preserve managed transcript lineage and settle after worker finish (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ec0ebf80</code></a>)</li> <li>Cli): keep Termux startup hints out of gateway policy (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>31dc5078</code></a>)</li> <li>Service suffix follows main profile-root rule; drop in-process cli.main tests (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0ea5a879</code></a>)</li> <li>Canonical delivery feeds attachment results to record_delivery; log failed turns (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>19ca1e85</code></a>)</li> <li>Managed worker outbox directory is a portable spelling of the execution id (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4a08032d</code></a>)</li> <li>Owner verifies managed worker identity through interpreter trampolines (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e8fbefb2</code></a>)</li> <li>Refuse /v1/runs on a natively owned session with a bounded 409 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>809fec15</code></a>)</li> <li>Commit execution results with terminal settlement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>43348a03</code></a>)</li> <li>Replay canonical relay envelopes until terminal reply acknowledgement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8dfd7add</code></a>)</li> <li>Keep bot relay discovery and outbox in sender profile (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>437e3d85</code></a>)</li> <li>Isolate desktop bot relay sender and target profile routes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4f75b6aa</code></a>)</li> <li>Recover bot mailbox receipts and migrate queued inputs at owner startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>76a60441</code></a>)</li> <li>Recover bot replies from exact committed admission results (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a5ea5b21</code></a>)</li> <li>Retain identified desktop bot deliveries until settlement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e1734e7d</code></a>)</li> <li>Pause managed admission followers when the owned worker is lost (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e6077ecc</code></a>)</li> <li>Prevent scoped secret rehydration in bypass workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1ff3d877</code></a>)</li> <li>Preserve hosted API source during peer persistence (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>06a9516c</code></a>)</li> <li>Return explicit unknown execution on API crash retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f26c5c43</code></a>)</li> <li>Recover committed API queue when its adapter reconnects (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8ef9fbe8</code></a>)</li> <li>Resolve API prompts through canonical pending controls (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f35358a6</code></a>)</li> <li>Preserve pre-editor credential identity and native control coverage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8e3b3a0c</code></a>)</li> <li>Defer editor MCP schema changes until a new session (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>be748101</code></a>)</li> <li>Bind imported history control in its receipt transaction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f40dc17b</code></a>)</li> <li>Prevent import from reusing retired runtime identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0a55e373</code></a>)</li> <li>Retire local physical lineage and cache affinity on deletion (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a1d47945</code></a>)</li> <li>Authorize cold history mutations without execution rebinding (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>529fb127</code></a>)</li> <li>Retire native session routes with deletion receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>10b155bf</code></a>)</li> <li>Retire the legacy Bot mailbox producer and inference drain (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ee09dad4</code></a>)</li> <li>Retain immutable Bot relay reply receipts on exact retry (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>391517b7</code></a>)</li> <li>Refuse Bot delivery instead of starting a competing runtime (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>03f5d843</code></a>)</li> <li>Migrate worker rotation automation inside owner publication (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6fce9f77</code></a>)</li> <li>Bind registered worker ledger before agent discovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>56586998</code></a>)</li> <li>Release original worker turn lease after rotation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ce8b1171</code></a>)</li> <li>Preserve REST mutation success response shape (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c1882a69</code></a>)</li> <li>Require exclusive maintenance for legacy bulk session writes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7323773c</code></a>)</li> <li>Fence persisted bot visibility without activating profiles (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7fab399a</code></a>)</li> <li>Retain dashboard mutation identity across uncertain replies (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>20dd6813</code></a>)</li> <li>Prepare desktop session edits from owner snapshots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c01a625c</code></a>)</li> <li>Preserve import validation with real authority fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>83b87b01</code></a>)</li> <li>Reject coerced session mutation counters and flags (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>927ca964</code></a>)</li> <li>Anchor V4A editor approval paths to session cwd (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>490453f7</code></a>)</li> <li>List canonical ACP sessions under their frozen workspace (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3c79ac4e</code></a>)</li> <li>Resolve ACP edit previews against execution cwd (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>85ce5418</code></a>)</li> <li>Project canonical editor diffs and frozen cwd to ACP (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>45aee742</code></a>)</li> <li>Release ACP transport without client MCP discovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>92d97ba8</code></a>)</li> <li>Steer API runs through the current authority claim (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a69efa90</code></a>)</li> <li>Fence API run cancellation to its durable admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f67f19fb</code></a>)</li> <li>Replay durable API results across HTTP delivery modes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cbcad6fb</code></a>)</li> <li>Retain recoverable worker title conflicts as durable outcomes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b7d14c75</code></a>)</li> <li>Preserve worker compression pre-publication flush annotations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dbe08962</code></a>)</li> <li>Retain worker compression cleanup authority after rotation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>36d5b639</code></a>)</li> <li>Accept real worker compression handoff markers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e98a036a</code></a>)</li> <li>Preserve live delegate tasks during parent deletion (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b0f792ac</code></a>)</li> <li>Fence ACP controls and expose the read-only catalog (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d304b025</code></a>)</li> <li>Keep ACP session catalog read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b117521c</code></a>)</li> <li>Bind API storage to its selected runtime authority (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c812ec71</code></a>)</li> <li>Preserve webhook duplicate responses with real route admission fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>253f9b5e</code></a>)</li> <li>Fence webhook finalization by admitted session and generation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ca2211f0</code></a>)</li> <li>Durably admit authenticated Graph notifications before acknowledgement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e8e17493</code></a>)</li> <li>Retain relay deliveries until canonical admission commits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e75bc52f</code></a>)</li> <li>Acknowledge webhooks only after durable native admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9d9e4789</code></a>)</li> <li>Restore worker compressor guards before agent construction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>84ccae21</code></a>)</li> <li>Refuse unregistered child and cron persistence in compute workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2ee0725c</code></a>)</li> <li>Keep registered compute imports out of owner delegation recovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7eecdcf2</code></a>)</li> <li>Retain distinct repeated watch notices in local consumers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0c42619c</code></a>)</li> <li>Refund legacy notification claims refused by admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d5b332ed</code></a>)</li> <li>Give watch events stable owner-bound automation identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>135730d1</code></a>)</li> <li>Validate gateway launch options before first-run config checks (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bec94623</code></a>)</li> <li>Restore first-run guidance before gateway admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>351b8eb4</code></a>)</li> <li>Retain partial-update diagnostics at canonical CLI launch (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a6376f0e</code></a>)</li> <li>Preserve runtime authority across updater snapshot restores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8a8a1372</code></a>)</li> <li>Refuse unowned automation without spending sibling retry budgets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d6635ffe</code></a>)</li> <li>Retain completion batch siblings across durable handoff retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0307a33f</code></a>)</li> <li>Keep named launch keys and endpoints separate from profile defaults (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>219ed58f</code></a>)</li> <li>Redact and recover credential-bearing terminal projections (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>478d9b73</code></a>)</li> <li>Resolve configured local routes from frozen provider policy (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e02cc03a</code></a>)</li> <li>Retain startup consent on top-level one-shot launches (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ecb0afa6</code></a>)</li> <li>Enforce startup cost and data consent before gateway admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4dcf234d</code></a>)</li> <li>Retry local creation without binding replacement credentials (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>12899b65</code></a>)</li> <li>Recover frozen local config credentials from their profile source (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f1da7833</code></a>)</li> <li>Keep configured credentials out of frozen policy receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2f6fb46b</code></a>)</li> <li>Keep explicit local launch keys in authority memory only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>32d512fb</code></a>)</li> <li>Freeze local CLI reasoning and execution launch options (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d0954a9e</code></a>)</li> <li>Preflight canonical epoch before restoring profile snapshot files (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>610a97ea</code></a>)</li> <li>Retain explicit verified deletion after read-only export migration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>23456236</code></a>)</li> <li>Recover fresh and historical session row layouts by identity (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9c681b2d</code></a>)</li> <li>Explain safe transcript salvage when canonical restore is refused (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c559236f</code></a>)</li> <li>Preserve structured Unicode through worker payload and receipt encoding (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f56e660e</code></a>)</li> <li>Pause workers on outbox I/O failure and preserve local lease waits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>23b54921</code></a>)</li> <li>Freeze retry journals and retain exclusive worker outbox ownership (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a8c163af</code></a>)</li> <li>Attenuate worker reconnect tickets to execution operations (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e7cd5f93</code></a>)</li> <li>Install relay trust only after provenance verification (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>90f107f2</code></a>)</li> <li>Keep relay reader live during canonical busy delivery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4485fb73</code></a>)</li> <li>Admit relay inputs with verified connector provenance (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8fe258cc</code></a>)</li> <li>Keep retained process lineage lookup read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bf9cf5c2</code></a>)</li> <li>Retain corruption restore for non-runtime SQLite stores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ad354c28</code></a>)</li> <li>Preflight all restore destinations and preserve import warning parity (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f1b4f6e3</code></a>)</li> <li>Preserve runtime epoch floors across older backup restores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7fd8082e</code></a>)</li> <li>Fence canonical recovery output and report excluded runtime state (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>43f62e7a</code></a>)</li> <li>Exclude restore and import with canonical runtime ownership (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4dce8f7e</code></a>)</li> <li>Keep dashboard session browsing read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>af4599c1</code></a>)</li> <li>Preserve loop liveness witnesses for long gateway homes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ae92d198</code></a>)</li> <li>Retain newer composer scope across delayed queue acknowledgements (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4b39a5fd</code></a>)</li> <li>Keep native steer fallback on canonical queue admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>35255f5c</code></a>)</li> <li>Admit native busy slash kickoffs through canonical submit (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6bef46ea</code></a>)</li> <li>Reconcile queue input IDs with canonical admission identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a877aa6e</code></a>)</li> <li>Preserve active turn ownership during canonical queue admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a131bf4a</code></a>)</li> <li>Route native composer Queue through existing admission submit (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4ce95d5f</code></a>)</li> <li>Authenticate native desktop file downloads per attempt (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>28741ef8</code></a>)</li> <li>Scope stable execution identity to canonical local sources (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c3aa2e5c</code></a>)</li> <li>Reject foreign local receipts inside lineage publication (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1ffba2ac</code></a>)</li> <li>Retain local admission ownership across transcript rotation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>42ee0d34</code></a>)</li> <li>Publish shared queue changes to attached viewers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fb02973f</code></a>)</li> <li>Retain public queued input identity in shared snapshots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>37332c17</code></a>)</li> <li>Expose profile-bound setup readiness on canonical sessions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>971c3c95</code></a>)</li> <li>Normalize canonical prompts before named desktop listeners (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9a2a30a6</code></a>)</li> <li>Fence canonical desktop RPC metadata edits with revision receipts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ce3037dc</code></a>)</li> <li>Bind desktop create retries to the explicit draft intent (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c69bb4db</code></a>)</li> <li>Retain desktop update and profile gates before canonical ensure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a7821f63</code></a>)</li> <li>Adapt desktop native sessions to canonical identities and controls (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d1546a54</code></a>)</li> <li>Authenticate native desktop HTTP with fresh private tickets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dd8b9f38</code></a>)</li> <li>Preserve native HTTP profile selectors across JSON contracts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eaad737e</code></a>)</li> <li>Retain source-free authority control projections (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3546eb41</code></a>)</li> <li>Preflight durable local policy before claiming queued work (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d98dd743</code></a>)</li> <li>Publish canonical Ink readiness only after discovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>653889ef</code></a>)</li> <li>Hydrate canonical Ink history independently of live events (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>971ff7f3</code></a>)</li> <li>Carry native ticket through WebSocket subprotocol negotiation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7fe8c72c</code></a>)</li> <li>Correlate canonical Ink receipts with prepared input identities (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3dfb7d50</code></a>)</li> <li>Scope one-shot output to its admitted turn and retain direct query aliases (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>17155e73</code></a>)</li> <li>Preserve gateway toolset policy and reject resume source overrides (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6feaafcc</code></a>)</li> <li>Reject fresh session registration while gateway drains (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a67637cc</code></a>)</li> <li>Separate clarification permission from execution control (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>66bc2861</code></a>)</li> <li>Stamp authenticated legacy clients before shared session admission (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4be08ae5</code></a>)</li> <li>Preserve scoped bootstrap grants in shared session connections (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b699e0e9</code></a>)</li> <li>Keep forged local profiles out of messaging authorization fallback (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d379d6cc</code></a>)</li> <li>Retain queued inputs when shutdown crosses authorization awaits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>733dde1c</code></a>)</li> <li>Reload transport role policy after Discord membership awaits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>43ae9e9a</code></a>)</li> <li>Retain native trust fields for validation when freezing ingress (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>53aadf44</code></a>)</li> <li>Fence native authorization yields against identity and FIFO changes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6ef8b38d</code></a>)</li> <li>Report malformed installed plists without leaking parser failures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1b55d964</code></a>)</li> <li>Resolve installed names from the requested profile root (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>258049b3</code></a>)</li> <li>Reject unbound launch wrappers and nonregular service definitions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1dd6268b</code></a>)</li> <li>Preserve task XML encoding and document service binding refusals (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7b904f95</code></a>)</li> <li>Bind loaded launchd jobs and scheduled task XML before start (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1ce0d11e</code></a>)</li> <li>Verify effective systemd profile and account before ensure starts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>efadac8d</code></a>)</li> <li>Stop bootstrap background workers after listener failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6716636f</code></a>)</li> <li>Withdraw gateway readiness when the session listener exits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>57ec2718</code></a>)</li> <li>Keep readiness and cleanup fenced across runtime shutdown (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>82ff0592</code></a>)</li> <li>Retain browser authentication and withdraw native ingress on drain (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5da456be</code></a>)</li> <li>Export sessions without mutating canonical storage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ae82c1a2</code></a>)</li> <li>Keep native segment sentinels out of canonical text deltas (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>caae4af5</code></a>)</li> <li>Keep launcher YOLO out of shared gateway policy (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>628d702c</code></a>)</li> <li>Align profile reservations with bootstrap permissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>87ba34fd</code></a>)</li> <li>Reject FIFO gateway metadata without blocking discovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5b0f0276</code></a>)</li> <li>Bind fresh ordinary admissions while preserving exact legacy retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e5f39ada</code></a>)</li> <li>Preserve ordinary native retry fingerprints through callback migration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6083e9ed</code></a>)</li> <li>Refuse unrouted profile claims in native callback snapshots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>99c923bc</code></a>)</li> <li>Preserve authority ownership through scoped adapter callbacks (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>42ce26af</code></a>)</li> <li>Retain trusted ordinary native callback provenance (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1d4dab77</code></a>)</li> <li>Omit retired approvals from gateway attach snapshots (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e7ee1d67</code></a>)</li> <li>Deny controls after gateway execution settlement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a064afdd</code></a>)</li> <li>Reject approval publication from retired gateway workers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>295bc0f5</code></a>)</li> <li>Retain legacy session writers during reader migration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>82dfb85d</code></a>)</li> <li>Keep session lists and statistics read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1a1ad945</code></a>)</li> <li>Resolve terminal breadcrumbs without opening a session writer (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>73238088</code></a>)</li> <li>Share read-only insights reporting with interactive CLI (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9cd5d6dd</code></a>)</li> <li>Generate CLI insights without initializing session storage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>680937a6</code></a>)</li> <li>Keep resume lookup and TUI exit metadata read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>617be2da</code></a>)</li> <li>Keep status session inspection read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ca77b197</code></a>)</li> <li>Bind shared authority when starting gateway API (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>11958d46</code></a>)</li> <li>Refuse redirected native media publication (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e924cf98</code></a>)</li> <li>Preserve legacy native text admission retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ca226b68</code></a>)</li> <li>Rotate authority replay epoch on concurrent eviction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a9de35d2</code></a>)</li> <li>Isolate authority execution from slow observers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>aab36dc6</code></a>)</li> <li>Keep authority subscriptions stable across repeated resume (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8c889765</code></a>)</li> <li>Admit busy messaging text into the canonical durable FIFO (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eae6194b</code></a>)</li> <li>Preserve surrogate request identity while sanitizing worker text (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bb90f4b8</code></a>)</li> <li>Replay committed worker receipts after terminal settlement (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>203b3f4f</code></a>)</li> <li>Retain transcript closure guard for worker appends (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>71f835b6</code></a>)</li> <li>Revoke workers when resolving unknown admissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d7089f75</code></a>)</li> <li>Align runtime mutation receipts with canonical wire contract (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e6b1dc06</code></a>)</li> <li>Fence ancestor revisions when runtime titles transfer (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>62aef795</code></a>)</li> <li>Fence worker persistence when its admission settles (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e3bfe640</code></a>)</li> <li>Transfer admitted claims atomically during worker adoption (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>341aed41</code></a>)</li> <li>Preserve legacy execution generations through admission import (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c45d2e5c</code></a>)</li> <li>Restore Ink pending inputs after cold durable resume (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>34fb13a1</code></a>)</li> <li>Preserve Ink slash attachments and reconcile stale images (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dbc7ffa8</code></a>)</li> <li>Reconcile Ink replay receipts with current execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8a589010</code></a>)</li> <li>Settle desktop receipts on recovered runtime and tidy composed probes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1ad31afa</code></a>)</li> <li>Retire desktop Stop for newer owner executions and fence old output (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>926d097d</code></a>)</li> <li>Settle terminal desktop admission receipts without stopping live turns (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d89a90e1</code></a>)</li> <li>Fence same-call desktop legacy admission retries (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>41b017f1</code></a>)</li> <li>Never resend ambiguous Ink legacy admissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5681c7d4</code></a>)</li> <li>Emit structured CLI parse failures only once (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1d4d2b2d</code></a>)</li> <li>Bound gateway probes and structure ensure parser errors (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ad1099d6</code></a>)</li> <li>Discover the gateway private fallback socket directory (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c804d40b</code></a>)</li> <li>Retain runtime locks while scheduler threads survive cleanup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>954d5e99</code></a>)</li> <li>Retain gateway ownership through exit-state persistence (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d465ad0d</code></a>)</li> <li>Reserve all gateway profiles before writable initialization (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c941b0e6</code></a>)</li> <li>Keep standalone session search read-only (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0e7c0588</code></a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>Agent): use the released model name Nemotron 3.5 Super VL (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>79651b71</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@j-nolan</a></li> <li>Env): add NVIDIA NIM to .env example (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3dd96101</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@elisam0</a></li> <li>Providers): use a non-cloud example key for local NIM (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>da463310</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@rroverin</a></li> <li>Rollback section the downgrade refusals link to; regenerate the command-parity table (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>97ec76fa</code></a>)</li> <li>Gateway): describe the messaging pause notice and /reset escape (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6cdf7815</code></a>)</li> <li>Explain ambiguous legacy A2A recovery boundary (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>22a8154f</code></a>)</li> <li>Cli): classic chat resolves --resume <title> and -c <title> --create-if-missing at the gateway; bare -c stays refused (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c6c4161c</code></a>)</li> <li>Gateway): document prompt.submit attachments and the ACP media path (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e3d60eed</code></a>)</li> <li>Desktop): gateway-owned queue and the Discard control for a turn lost during restart (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>101be7d7</code></a>)</li> <li>Explicit /model rewrites the system prompt Model line once (single cache-prefix miss) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ef813b35</code></a>)</li> <li>/new rebinds only the invoking view of a shared session (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6be1de8d</code></a>)</li> <li>API runs and X-Hermes-Session-Id cannot bind a session owned by another surface (409 permission_denied) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>789caca2</code></a>)</li> <li>Dashboard session delete fences, tombstones, and offline-only bulk maintenance (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>46c50515</code></a>)</li> <li>Explain canonical editor MCP ownership and cold reattachment (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fcc978bd</code></a>)</li> <li>Distinguish canonical Bot admission from retired UI ownership (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2d22a7cd</code></a>)</li> <li>Record worker lifecycle hooks proofs and remaining integration gates (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3dae322e</code></a>)</li> <li>Record isolated worker inference proof and remaining migration gates (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>b762d80c</code></a>)</li> <li>Distinguish admission recovery from producer replay proof (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bc3bcaff</code></a>)</li> <li>Delimit verified worker substrate coverage and rollout blockers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f22754e8</code></a>)</li> <li>Inventory exact worker persistence consumers before substrate (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0e30eb6a</code></a>)</li> <li>Define stable local lineage and paused fork recovery (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>757f19f4</code></a>)</li> <li>Define native HTTP trust and primary-profile scope (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a8a6b02c</code></a>)</li> <li>Document local crash recovery contract and replay limits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>375fce55</code></a>)</li> <li>Describe settled Ink recovery and native lifecycle probes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2dc2e740</code></a>)</li> <li>Define Desktop gateway ownership and private ticket boundary (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f0ff6c57</code></a>)</li> <li>Distinguish native policy proof from remaining classic CLI parity (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>256cab2b</code></a>)</li> <li>Publish supported local creation policy and recovery boundary (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0400a5ef</code></a>)</li> <li>Explain gateway ensure readiness and service consent (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a272e8df</code></a>)</li> </ul> <h2>🧪 Tests</h2> <ul> <li>Relay): the OpenAI-stream e2e no longer self-deadlocks when the stream is buffered (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6e84ce66</code></a>)</li> <li>Gateway): the authority stream probe waits for the idle session.info (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>56b9691c</code></a>)</li> <li>Gateway): align SSE prepare cleanup with retained streams (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c0230ca5</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a></li> <li>Desktop-core): capture the Electron PID before quit for the orphan census message (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2cf48e0c</code></a>)</li> <li>Gateway): the unserve runner stub carries the reservation our release step shrinks (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5fdb477b</code></a>)</li> <li>Cold-profile archive/unarchive through one multiplexing gateway is an acceptance case (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dfbb9142</code></a>)</li> <li>Seed-compensation fake uses discard_unadmitted_session; hosted auth probe waits are load-tolerant (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc1eab12</code></a>)</li> <li>Gateway): managed-worker first-inference wait tolerates a saturated 40-worker runner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>57c95771</code></a>)</li> <li>Tui): slash-attachment composer assertions wait for the journaled clear (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d5950d72</code></a>)</li> <li>Patch origin API probe in banner ancestry fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cdf4eda7</code></a>)</li> <li>Migrate authored bot fixtures to canonical transport (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>37d7834e</code></a>)</li> <li>Verify webhook receipt observation and composed HTTP startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a5a0da66</code></a>)</li> <li>Exercise authenticated hosted room Stop and approval (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7a6b2961</code></a>)</li> <li>Use system Python for the stdlib-only ticket bridge (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3394ef4c</code></a>)</li> <li>Preserve Kanban policy and cron cleanup owner invariants (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e1b6f10b</code></a>)</li> <li>Align Kanban scope fixtures with owner worker client (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ea2342d4</code></a>)</li> <li>Observe relay completion and cron guard at owner seams (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>625bb379</code></a>)</li> <li>Drain durable cron failure deliveries before asserting sends (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9b753d3b</code></a>)</li> <li>Migrate cron guards and context fixtures through owner execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7080a488</code></a>)</li> <li>Restore cron owner configuration and session invariants (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c08349cf</code></a>)</li> <li>Exercise cron provider and workdir paths through owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9fde59d3</code></a>)</li> <li>Migrate cron lifecycle invariants to canonical owner execution (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e4a2d476</code></a>)</li> <li>Retain queued input identity after session list loading (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2671381d</code></a>)</li> <li>Exercise native Electron gateway HTTP and WebSocket tickets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>45c6c8de</code></a>)</li> <li>Verify busy acknowledgements and document Ink recovery limits (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>59a90b4d</code></a>)</li> <li>Cover canonical Ink image composer and startup handoff (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>65635634</code></a>)</li> <li>Verify native legacy resume and compression cutover (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>90052b33</code></a>)</li> <li>Prove admission-backed automatic compression retry (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3ec0ea59</code></a>)</li> <li>Gate the Discord role probe on the real distribution, not the conftest mock (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>19feada0</code></a>)</li> <li>Acp): live editor image prompt reaches the loopback model as an image_url part (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>993a63f0</code></a>)</li> <li>Native suite finds the managed worker by owner ancestry, not bare ppid (venv trampoline) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9e335738</code></a>)</li> <li>Trampoline reap check waits for the owner's bounded close instead of racing the terminal commit (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc2cdbe2</code></a>)</li> <li>Desktop): move the token download-transport invariant beside the extracted function (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ff662b6b</code></a>)</li> <li>Exercise safe identity suppression through real prompt assembly (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cccb516c</code></a>)</li> <li>Verify reserved admission claims through worker handlers (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>107af6fc</code></a>)</li> <li>Isolate and reap owned Kanban systemd scopes (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3776709d</code></a>)</li> <li>Prove rotated worker survives owner kill and adoption (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8459b140</code></a>)</li> <li>Prove fresh ACP handoff and cold canonical restoration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>56f62381</code></a>)</li> <li>Verify per-admission API usage on the ordinary daemon (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>35d9eb2f</code></a>)</li> <li>Prove shared API FIFO on the ordinary daemon (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e721121f</code></a>)</li> <li>Prove registered worker terminal execution without canonical SQLite opens (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e31b96bc</code></a>)</li> <li>Exercise worker lifecycle and stale callbacks through ordinary owner (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5038cf75</code></a>)</li> <li>Verify worker rotation claim and lost-ack replay over daemon (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>17cf264f</code></a>)</li> <li>Verify native ACP approval and wrong-profile refusal (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d157534a</code></a>)</li> <li>Verify local automation stays nonhuman and cache stable (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ef071dd3</code></a>)</li> <li>Prove local completion recovery after owner kill (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9afff7e9</code></a>)</li> <li>Follow canonical CLI launch in startup guard fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>34b9aad1</code></a>)</li> <li>State): keep FTS migration fixtures on historical versions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>21baec51</code></a>)</li> <li>Document recovery limits and verify consented gateway launches (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ddc1b0a1</code></a>)</li> <li>Refuse unauthenticated credential launch over ordinary daemon websocket (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9b0d7861</code></a>)</li> <li>Deny credential-bearing creation to restricted principals (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2d2fdff9</code></a>)</li> <li>Verify frozen CLI iteration limits through actual tool rounds (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc37de8b</code></a>)</li> <li>Prove concurrent CLI launch wire and restart credential isolation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>84e86a87</code></a>)</li> <li>Own canonical daemon in completed-process CLI integration (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6c8f0fd8</code></a>)</li> <li>Keep simulated HEAD updates off the live runtime fleet (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>7b8fdfa8</code></a>)</li> <li>Seed owner database for dashboard parameter validation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2af3bfd4</code></a>)</li> <li>Initialize owner store for dashboard refresh success (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a1811942</code></a>)</li> <li>Isolate service ordering fixture home (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3b42e697</code></a>)</li> <li>Seed gateway status through real read-only storage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6af1ac81</code></a>)</li> <li>Exercise CLI exports against real read-only session storage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>96782704</code></a>)</li> <li>Prove pending worker usage survives real owner outage and adoption (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>58bcc3ec</code></a>)</li> <li>Verify live relay replacement and websocket revocation fences (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>89567476</code></a>)</li> <li>Reject relay trust installation from an invalid seal (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>80d677d2</code></a>)</li> <li>Reproduce relay busy ingress blocking outbound acknowledgements (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>73bf2c66</code></a>)</li> <li>Reproduce authenticated relay native admission rejection (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0bbe3740</code></a>)</li> <li>Preserve destination lock identity after offline import (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ef1fe3de</code></a>)</li> <li>Verify separate-output recovery against active daemon source (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc96119b</code></a>)</li> <li>Expose epoch reuse and service revival after refused import (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>dbb1e531</code></a>)</li> <li>Reproduce live restore deleting active authority admissions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3a0111ee</code></a>)</li> <li>Align search fixture with owner-initialized session stores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e2a853ba</code></a>)</li> <li>Cover encoded socket limits with direct control paths (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>34407c9e</code></a>)</li> <li>Reproduce missing loop witnesses in long-home daemons (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>36649795</code></a>)</li> <li>Configure a restorable model for token session creation (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bcf39bfb</code></a>)</li> <li>Verify ordinary daemon replay and release fixture stores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e8f57b7f</code></a>)</li> <li>Supply real session stores to gateway authority fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e3d23087</code></a>)</li> <li>Verify ordinary daemon slash actor isolation and handler scope (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3cdf25cb</code></a>)</li> <li>Verify native download boundaries and document transport scope (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c8620011</code></a>)</li> <li>Prove local rotation and reset across cold daemon restarts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>af3f2dfe</code></a>)</li> <li>Compare discovery on real legacy serve and canonical daemon sockets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5d1d1ee0</code></a>)</li> <li>Reproduce missing canonical command discovery over ordinary daemon WS (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>659632c3</code></a>)</li> <li>Scope private Unix ticket fixture to supported native hosts (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ca3e4b64</code></a>)</li> <li>Keep native protocol fixtures within their runtime type boundary (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>da98497c</code></a>)</li> <li>Verify canonical receipts retire the native private-file journal (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5bd5a8d6</code></a>)</li> <li>Verify native HTTP selectors against real sibling profiles (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f6ef1ea4</code></a>)</li> <li>Prove cold local recovery through separate authenticated daemons (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>041d9ee7</code></a>)</li> <li>Exercise native Stop through the Python Ink launcher (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c75e0cdd</code></a>)</li> <li>Verify native Ink Stop acknowledgement and fresh follow-up (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d0ad8324</code></a>)</li> <li>Exercise fresh Ink launch through the real Python launcher (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8b727f4a</code></a>)</li> <li>Verify actual native clarification answer on model wire (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cc4ad0d1</code></a>)</li> <li>Require native Ink reconnect to render settled history (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eecaba42</code></a>)</li> <li>Initialize replay fixture with explicit runtime admission state (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>014b3ea4</code></a>)</li> <li>Retain native reconnect output for intermittent Ink failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f454485d</code></a>)</li> <li>Verify native CLI cwd execution against the policy-enabled daemon (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>db2bdf31</code></a>)</li> <li>Prove native gateway approvals survive CLI detach and invalid choice (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a0c361ae</code></a>)</li> <li>Prove concurrent local policy isolation on provider wire (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>15052599</code></a>)</li> <li>Verify metadata retries through ordinary gateway sockets (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0d5d548f</code></a>)</li> <li>Execute fresh sessions through ordinary gateway startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ae19a6e0</code></a>)</li> <li>Prove fresh local clarify survives complete viewer detachment (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1044867b</code></a>)</li> <li>Preserve Discord direct pairing and scoped DM grants (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>144c86c7</code></a>)</li> <li>Retain startup exit contracts with real authority stores (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a126b4cc</code></a>)</li> <li>Verify excluded observer prefix against canonical replay (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cacd4d22</code></a>)</li> <li>Retain live gateway bootstrap readiness probe (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>29167522</code></a>)</li> <li>Exercise shared approvals through production API startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>118b34ac</code></a>)</li> <li>Verify native runtime ownership and execution-time secret refresh (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>234f1278</code></a>)</li> <li>Exercise approval rendering through initialized turn runners (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>76efc227</code></a>)</li> <li>Verify CLI readers alongside an active SQLite writer (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>ee23996c</code></a>)</li> <li>Retain real CLI reader A/B harness (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>bcc03ee8</code></a>)</li> <li>Preserve insights cleanup coverage with absent-store fast path (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eae783bc</code></a>)</li> <li>Exercise shared turns through production API startup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0cfe5a2f</code></a>)</li> <li>Retain authority backpressure execution receipt (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>47ce83d6</code></a>)</li> <li>Retain real-process read-only search A/B probe (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>551ccfca</code></a>)</li> <li>Require complete shared gateway acceptance receipt coverage (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d853d145</code></a>)</li> <li>Retain gateway source invariants across sibling extractions (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e1df5d12</code></a>)</li> <li>Follow production methods across gateway turn extraction (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>04cef1e9</code></a>)</li> <li>Reap truncation fixture worker before restoring bindings (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d6d8af93</code></a>)</li> <li>Trace borrowed SQLite readers in search projection invariant (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>fa572cbe</code></a>)</li> <li>Verify runtime schema upgrades and genuine SQLite full rollback (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1769e803</code></a>)</li> <li>Reproduce Ink receipt-only retry busy latch (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1c144c98</code></a>)</li> <li>Reproduce desktop receipt stop and legacy timeout races (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>02e0ab74</code></a>)</li> <li>Verify gateway service consent across import and setup (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4ecf5975</code></a>)</li> <li>Make unreserved profile snapshots explicit in multiplex fixtures (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a72ed0a5</code></a>)</li> </ul> <h2>🏗️ Infrastructure</h2> <ul> <li>Release): admit stable releases from release/* branches, not just main (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>9686d55c</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ethernet8023</a></li> <li>Plugins): pin birkin-mnemosyne to core 0.7.1 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e216cd74</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ashmoonori-afk</a></li> <li>Catalog): review disclosure for huddo (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>85d27a51</code></a>)</li> <li>Map contributor email for StudioCodeAI (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c708b34f</code></a>)</li> <li>Plugin-catalog): update Telegram Client to 1.3.1 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>27aaade9</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@guberm</a></li> <li>Plugin-catalog): bump Gmail to v1.0.20 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c6ac0565</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@guberm</a></li> <li>Kiwi): bump pin to kiwi@0.12.5, plugin v1.2.2 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a08f5894</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@harrylabsj</a></li> <li>Lightningai-rate-limit to v1.1.0 (wall-clock aligned window) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e28d64e8</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@dinosauria123</a></li> <li>Map contributor email for TREE-Ind (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>71f78b3f</code></a>)</li> <li>Catalog): review disclosure for hermes-aac (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>0567d017</code></a>)</li> <li>Catalog): review disclosure for openinvest (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c179b286</code></a>)</li> <li>Map contributor email for Sahil-SS9 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d8b5bd8a</code></a>)</li> <li>Catalog): review disclosure for hermes-agent-mixer (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a98cc310</code></a>)</li> <li>Update Activity catalog to v0.2.0 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>908c525d</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@hassan-kamel</a></li> <li>Catalog): showly reviewed disclosure + requires_hermes >=0.21.6 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2ee820e7</code></a>)</li> <li>Catalog): review disclosure for nexus (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1a5f5c7b</code></a>)</li> <li>Catalog): review disclosure for kumiho-memory (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>63da5f7b</code></a>)</li> <li>Catalog): review disclosure for model-router (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>92790c6d</code></a>)</li> <li>Catalog): review disclosures for anatomy-museum, agent-janitor (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>560b2507</code></a>)</li> <li>Js): lint after the main merges: drop the unused watchdog import, order a test import, stub gw on the steer ctx (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1b78a417</code></a>)</li> <li>Retrigger CI (zero-job dispatch failure, auto-heal) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d056a624</code></a>)</li> <li>Give area detection its sparse checkout and retry budget (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>8824ac96</code></a>)</li> <li>Retrigger CI (zero-job dispatch failure, auto-heal) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2cbeac1f</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>254432b2</code></a>)</li> <li>Retrigger (dispatch window) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1e398140</code></a>)</li> <li>Retrigger (dispatch window) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>40b17a25</code></a>)</li> <li>Retrigger (dispatch window) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5e198b8b</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f6dd9025</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>911b559e</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4ff21ecd</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c37453e7</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cb296788</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>346615f3</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>1e4edefa</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f3d4105f</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>73d9e413</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c7fcc65c</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>4892e1d4</code></a>)</li> <li>Retrigger after 0-job workflow startup failure (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2cb84f43</code></a>)</li> <li>Retrigger after lost push event (0 runs on <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">19ca1e8</a>) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c86b415d</code></a>)</li> <li>Trim native HTTP helper imports (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>25fd73b6</code></a>)</li> </ul> <h2>📦 Other Changes</h2> <ul> <li>Repin hermes-insight to afb08fb (1.0.2) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>51e663da</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@BrokeSkill</a></li> <li>Plugin-catalog: bump huddo to 0.9.0 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>eeacc00a</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@hellohanchen</a></li> <li>Plugin-catalog: re-pin hermes-lang-pt-br to 7548ff1 (pack verifier + CI) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>82fbd41f</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@StudioCodeAI</a></li> <li>Plugin-catalog: re-pin hermes-lang-pt-br to 69efb2f (credits/timeline README) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2c20d9a3</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@StudioCodeAI</a></li> <li>Catalog: bump speechify to 0.1.1 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>3a5b9e84</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokeshm24</a></li> <li>Catalog: re-pin qdrant-memory to 0.2.1 (e14adc06) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>720552bb</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@cnkang</a></li> <li>Catalog: repin Hermes AAC 0.1.1 SDK-only reduced features (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>473e2847</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@TREE-Ind</a></li> <li>Plugin-catalog: openinvest re-pin to 106e5ba (bounded backend deps, 0.41.6) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6cc9a434</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@longsizhuo</a></li> <li>Plugin-catalog: openinvest re-pin to 3a0c816 (review fixes, backend 0.41.4) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>00c311c8</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@longsizhuo</a></li> <li>Plugin-catalog: openinvest re-pin to 3e1a9d7 (review fixes) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>cb223633</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@longsizhuo</a></li> <li>Plugin-catalog: bump plan-mode to 0.4.4 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>2a5617f8</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@100yenadmin</a></li> <li>Plugin-catalog: bump plan-mode to 0.4.3 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>6fafdd4f</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@100yenadmin</a></li> <li>Catalog: pin the Showly community plugin (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>5da3156c</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@slchris</a></li> <li>Catalog(nexus): repin the sha to 4392e6d — /embed and /mcp demand a per-installation key (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>64425a06</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Neboy72</a></li> <li>Plugin-catalog: bump account-pool to 4.0.2 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>e5d2cebe</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@roqianjas</a></li> <li>Plugin-catalog: bump alans-way and alans-way-computer to 0.21.5 (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>a8d61e30</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@capthvnsen</a></li> <li>Plugin-catalog: nvidia-app + nvidia-broadcast pin -> 729e25c (first-run setup when the app side is not ready) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>f18948e4</code></a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@alt-glitch</a></li> <li>Catalog: agent-janitor (from <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#137875</a>) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#137875</a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ZidoCode</a></li> <li>Catalog: anatomy-museum (from <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#138166</a>) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#138166</a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@danrudy33</a></li> <li>Catalog: secure-env-ingress (from <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#132272</a>) (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">#132272</a>) — <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@web3blind</a></li> <li>Style: align canonical group controls with Desktop lint rules (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>c8d8900d</code></a>)</li> <li>Style: normalize verified queue admission imports and spacing (<a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer"><code>d3ad7a90</code></a>)</li> </ul> <h2>👥 Contributors</h2> Thank you to everyone who contributed to this release! <ul> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokee86</a> (11 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@dokterdok</a> (6 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@elisam0</a> (5 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@longsizhuo</a> (4 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@100yenadmin</a> (3 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@StudioCodeAI</a> (3 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@olric3015</a> (3 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ethernet8023</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@helix4u</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@guberm</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@TakeshiTGAL</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@dinosauria123</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@TREE-Ind</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Sahil-SS9</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@hassan-kamel</a> (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@slchris</a> (2 commits)</li> <li>David Dudok de Wit (2 commits)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@xxxigm</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@kshitijk4poor</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@j-nolan</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@rroverin</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@BrokeSkill</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@dandacompany</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ashmoonori-afk</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@hellohanchen</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@2867297362mjb-sketch</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Lokeshm24</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@harrylabsj</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@cnkang</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@Neboy72</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@kaveone</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@roqianjas</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@capthvnsen</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@alt-glitch</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@metamindedu</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@ZidoCode</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@danrudy33</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@web3blind</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@KoNit-K</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@unsupportedpastels</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@abundantbeing</a> (1 commit)</li> <li><a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">@utkubakir</a> (1 commit)</li> </ul> Full Changelog: <a href="https://tsecurity.de/weiterlesen/1000048772/4271510/github-release-nousresearchhermes-agent-v0221-15102026/" target="_blank" rel="noopener noreferrer">v0.22.0...rc.5-v0.22.1</a></div></div> </article> <article> <h1>Linux- und Unix-Desktop KDE feiert 30. Geburtstag</h1> Thu, 15 Oct 2026 09:00:30 +0200 Vor 30 Jahren begann die Arbeit an der Desktop-Umgebung KDE. Das Jubiläum feiert das Team mit Partys, einer größeren Spendenaktion und einem Wettbewerb. <a href="https://tsecurity.de/weiterlesen/1000047779/4270517/linux-und-unix-desktop-kde-feiert-30-geburtstag/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Markt für Server-Betriebsumgebungen bis 2035: Cloud-Native und KI treiben das Wachstum</h1> Mon, 12 Oct 2026 22:31:02 +0200 Aktueller Trend: moderates Wachstum, Übergang zur hybriden Cloud. Wichtige Trends: Migration von älterem Unix und älteren Windows-Server-Versionen zu ... <a href="https://tsecurity.de/weiterlesen/1000046766/4269504/markt-fuer-server-betriebsumgebungen-bis-2035-cloud-native-und-ki-treiben-das-wachstum/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>HPR4741: HPR Community News for September 2026</h1> Mon, 12 Oct 2026 22:07:08 +0200 This show has been flagged as Explicit by the host. <h2>New hosts</h2> Welcome to our new hosts: <ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trurl</a></li> </ul> <h2>Last Month's Shows</h2> <table> <tr> <th>Id</th> <th>Day</th> <th>Date</th> <th>Title</th> <th>Host</th> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4717</a></td> <td>Tue</td> <td class="shrink">2026-09-01</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Visit with a blind Ham operator</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Archer72</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4718</a></td> <td>Wed</td> <td class="shrink">2026-09-02</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Programmable Logic Controls - Episode 2 </a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4719</a></td> <td>Thu</td> <td class="shrink">2026-09-03</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">How to use a multimeter, introduction and basic usage</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">number9</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4720</a></td> <td>Fri</td> <td class="shrink">2026-09-04</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Robert A. Heinlein: Earlier Novels</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4721</a></td> <td>Mon</td> <td class="shrink">2026-09-07</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Community News for August 2026</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Volunteers</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4722</a></td> <td>Tue</td> <td class="shrink">2026-09-08</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Show and tell: AI tropes</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trollercoaster</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4723</a></td> <td>Wed</td> <td class="shrink">2026-09-09</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">friedcamp interviews part 3: The fried telephone system</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4724</a></td> <td>Thu</td> <td class="shrink">2026-09-10</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Beer Garden 19 - Lager</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4725</a></td> <td>Fri</td> <td class="shrink">2026-09-11</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Beer Garden - Tasting and reviewing beers</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4726</a></td> <td>Mon</td> <td class="shrink">2026-09-14</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trurl's intro show</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trurl</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4727</a></td> <td>Tue</td> <td class="shrink">2026-09-15</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">friedcamp interviews part 4: The free Lantern</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4728</a></td> <td>Wed</td> <td class="shrink">2026-09-16</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Programmable Logic Controls - Episode 3 </a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4729</a></td> <td>Thu</td> <td class="shrink">2026-09-17</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Living under a rock</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">MrX</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4730</a></td> <td>Fri</td> <td class="shrink">2026-09-18</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Playing Civilization VI Part 1</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4731</a></td> <td>Mon</td> <td class="shrink">2026-09-21</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">A Website Hacked</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Lee</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4732</a></td> <td>Tue</td> <td class="shrink">2026-09-22</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Webp</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Klaatu</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4733</a></td> <td>Wed</td> <td class="shrink">2026-09-23</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Static Adict Episode 1: Pulse Demon</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">TheDUDE</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4734</a></td> <td>Thu</td> <td class="shrink">2026-09-24</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Beer Garden 20 - TuxJam Half-cut Special</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4735</a></td> <td>Fri</td> <td class="shrink">2026-09-25</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4715 :: friedcamp interviews part 5: Yvon Masyn</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4736</a></td> <td>Mon</td> <td class="shrink">2026-09-28</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">How to replace the battery in a car key fob</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Ken Fallon</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4737</a></td> <td>Tue</td> <td class="shrink">2026-09-29</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Keep spare parts for Ethernet run</a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Archer72</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">4738</a></td> <td>Wed</td> <td class="shrink">2026-09-30</td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Programmable Logic Controls - Episode 4 </a></td> <td><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a></td> </tr> </table> <h2>Comments this month</h2> <h3>Past shows</h3> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4673</a> (2026-07-01) "First contact conversation" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Archer72</a>. </li> <ul> <li>Dave Lee (thelovebug) said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Baofeng naming conventions</a>" (2026-09-16 07:07:02) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4677</a> (2026-07-07) "UNIX Curio #10 - Checksums and Hashes" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Vance</a>. </li> <ul> <li>Cli said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Systemd Topics</a>" (2026-09-13 05:19:58) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4702</a> (2026-08-11) "MakeACopy is an open-source document scanner app for Android" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Ken Fallon</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">What's not to like? </a>" (2026-09-09 21:55:48) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4709</a> (2026-08-20) "Peertube: my two penneth" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kevie</a>. </li> <ul> <li>Kevie said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">links</a>" (2026-09-08 08:15:24) </li> </ul> </ul> <h3>This month's shows</h3> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4718</a> (2026-09-02) "Programmable Logic Controls - Episode 2 " by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a>. </li> <ul> <li>Trey said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">OpenPLC</a>" (2026-09-02 22:40:23) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Reply to Trey on OpenPLC</a>" (2026-09-03 16:05:35) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4719</a> (2026-09-03) "How to use a multimeter, introduction and basic usage" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">number9</a>. </li> <ul> <li>Ken Fallon said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Thanks !</a>" (2026-09-03 07:43:52) </li> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Thanks! Quite interesting!</a>" (2026-09-03 09:49:32) </li> <li>Trey said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Excellent episode</a>" (2026-09-03 12:52:57) </li> <li>xmanmonk said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Great show!</a>" (2026-09-03 19:14:51) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Fluke Meters</a>" (2026-09-03 22:39:30) </li> <li>brian-in-ohio said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">welcome</a>" (2026-09-06 12:54:51) </li> <li>Kevin O'Brien said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Endorsing comment</a>" (2026-09-06 14:25:11) </li> <li>Jim DeVore said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">I learned a few things!</a>" (2026-09-07 21:15:48) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4721</a> (2026-09-07) "HPR Community News for August 2026" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">HPR Volunteers</a>. </li> <ul> <li>Th3Dud3 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Sorry for getting your name wrong Kevie</a>" (2026-09-09 16:27:10) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4722</a> (2026-09-08) "Show and tell: AI tropes" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trollercoaster</a>. </li> <ul> <li>Trey said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">This is so true</a>" (2026-09-08 10:57:10) </li> <li>Steve Barnes said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re: This is so true</a>" (2026-09-08 20:13:53) </li> <li>Ben said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Great text</a>" (2026-09-10 21:08:25) </li> <li>Antoine said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">AI writes very well</a>" (2026-09-11 00:11:36) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re: This is so true</a>" (2026-09-12 08:10:11) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re: Great Text</a>" (2026-09-12 08:25:13) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re: AI writes very well</a>" (2026-09-12 22:45:17) </li> <li>Antoine said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re #7 - Brazilian ... logic?</a>" (2026-09-13 15:09:10) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">cool ep</a>" (2026-09-13 20:05:22) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Re: cool ep</a>" (2026-09-15 17:50:02) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4723</a> (2026-09-09) "friedcamp interviews part 3: The fried telephone system" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a>. </li> <ul> <li>Cli said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Background noise.</a>" (2026-09-13 05:22:10) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Dial telephones</a>" (2026-09-26 21:15:53) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4724</a> (2026-09-10) "HPR Beer Garden 19 - Lager" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Kevie</a>. </li> <ul> <li>Gan Ainm said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Märzen</a>" (2026-09-14 15:32:33) </li> <li>Th3Dud3 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">The reason why the USA uses Adjuncts in our Lager</a>" (2026-09-14 18:07:03) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4726</a> (2026-09-14) "Trurl's intro show" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Trurl</a>. </li> <ul> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hello!</a>" (2026-09-15 23:22:59) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4732</a> (2026-09-22) "Webp" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Klaatu</a>. </li> <ul> <li>Henrik Hemrin said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Now I will consider webp as an alternative.</a>" (2026-09-26 17:16:21) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4733</a> (2026-09-23) "Static Adict Episode 1: Pulse Demon" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">TheDUDE</a>. </li> <ul> <li>brian-in-ohio said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">good show</a>" (2026-09-23 14:44:12) </li> <li>Antoine said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Never listened about</a>" (2026-09-23 22:41:53) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">hpr4736</a> (2026-09-28) "How to replace the battery in a car key fob" by <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Ken Fallon</a>. </li> <ul> <li>Lee said: "<a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Replacing battery</a>" (2026-09-29 20:24:03) </li> </ul> </ul> <h2>Mailing List discussions</h2> Policy decisions surrounding HPR are taken by the community as a whole. This discussion takes place on the <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Mailing List</a> which is open to all HPR listeners and contributors. The discussions are open and available on the HPR server under <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Mailman</a>. The threaded discussions this month can be found here: <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">https://lists.hackerpublicradio.com/pipermail/hpr/2026-September/thread.html</a> <h2>Events Calendar</h2> With the kind permission of LWN.net we are linking to <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">The LWN.net Community Calendar</a>. Quoting the site: <blockquote>This is the LWN.net community event calendar, where we track events of interest to people using and developing Linux and free software. Clicking on individual events will take you to the appropriate web page.</blockquote> <a href="https://tsecurity.de/weiterlesen/1000046164/4268902/hpr4741-hpr-community-news-for-september-2026/" target="_blank" rel="noopener noreferrer">Provide feedback on this episode</a>. </article> <article> <h1>USENIX: OSDI '26 - Incr: Faster Re-Execution via Bolt-On Incrementalization</h1> Mon, 12 Oct 2026 22:00:03 +0200 YouTube Video<div class="youtube-description">OSDI '26 - Incr: Faster Re-Execution via Bolt-On Incrementalization Yizheng Xie, Evangelos Lamprou, Jerry Xia, and Nikos Vasilakis, Brown University While most software development is incremental, most execution environments are not: even small program modifications fail to take advantage of prior executions, at worst requiring full re-execution of all computational stages in the modified program. Such full re-execution decelerates software development and debugging, especially in dynamic polyglot environments such as the Unix and Linux shell. This paper presents Incr, a system that accelerates the re-execution of unmodified shell programs by automatically incrementalizing their execution. Incr analyzes and tracks interdependencies to detect and store key intermediate results, reusing them on subsequent re-executions whenever possible. Incr’s effect analysis supports correct re-execution even for non-idempotent computations, and several static and dynamic optimizations reduce the runtime and storage overheads of incrementalization. Applied to diverse real-world scenarios, Incr accelerates re-execution by an average of 34.2× and a maximum of 373.3×—all while requiring no developer annotations or code modifications and remaining behaviorally indistinguishable on over 10,000 test cases. View the full OSDI '26 program at https://www.usenix.org/conference/osdi26/technical-sessions</div> </article> <article> <h1>GitHub Release: wazuh/wazuh v5.0.0-rc1 (05.10.2026)</h1> Mon, 12 Oct 2026 21:50:05 +0200 <div class="github-feed-entry"><div class="github-feed-badges">🛡️ Security Fix <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">wazuh/wazuh</a>v5.0.0-rc105.10.2026@wazuhci</div><div class="github-feed-changelog"><h2>[v5.0.0]</h2> <h3>Manager</h3> <h4>Added</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38260</a></td> <td>Added HTTPS communication between Wazuh agents and the manager: a new HTTPS transport, protocol, and control plane (connection, configuration, statistics, task dispatch, remote upgrade, and event ingestion) replacing the legacy MQ/DGRAM-based agent-manager protocol end to end.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31295</a></td> <td>Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The <code>cluster.disabled</code> configuration option has been removed.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33269</a></td> <td>Added stateless metadata enrichment in <code>remoted</code>, centralizing event metadata handling for stateless messages and removing the dependency on <code>wazuh-db</code> for that ingestion path.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33493</a></td> <td>Added Engine enrichment support: IOC matching, GeoIP lookup, and event filters.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34477</a></td> <td>Added Engine adaptation tier 2: raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35623</a></td> <td>Added CVSS v4.0 support to the Vulnerability Scanner.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35771</a></td> <td>Added Engine metrics collection, normalization, and indexing pipeline.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36000</a></td> <td>Added new CVE 5.0 schema fields to the Vulnerability Detector content model.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35579</a></td> <td>Added manager watermarks.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37052</a></td> <td>Added byte-based capacity limits to wazuh-manager-remoted.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37706</a></td> <td>Added default API role mappings for the indexer users wazuh-admin, wazuh-readonly and wazuh-demo.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38023</a></td> <td>Added the <code>POST /config</code> HTTPS endpoint, which receives an agent's reported configuration and indexes it into <code>wazuh-agent-config</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38024</a></td> <td>Added the <code>POST /stats</code> HTTPS endpoint, which persists the statistics an agent reports as one document per agent in the <code>wazuh-agent-stats</code> index, replacing the previous report on every push.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38007</a></td> <td>Added legacy <code>remote_upgrade</code> task delivery in <code>remoted</code>: a polling thread pushes pending Task Manager tasks to connected agents older than v5.0.0 over their existing session using the legacy six-step WPK push, gated on <code>remoted</code>'s HTTPS <code>verification_mode</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38157</a></td> <td>Added installation-time variables to customize the default <code><remote></code> configuration on source, DEB, and RPM manager installations.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38553</a></td> <td>Added the <code>PUT /agents/scan/vulnerability</code> endpoint to trigger an on-demand vulnerability scan for one agent, a list of agents, or all agents.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Added recurring manager tasks to the Task Manager: the agent disconnection sweep, the deletion of long-disconnected agents, and manager log rotation now run as durable, retried tasks inside <code>wazuh-manager-modulesd</code>. Their resolved settings are reported by <code>GET /manager/configuration/wmodules/wmodules</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38862</a></td> <td>Added a warning logged by <code>wazuh-manager-apid</code> on every start for each API default user (<code>wazuh</code>, <code>wazuh-wui</code>) whose password is still the one shipped with the package, pointing at <code>bin/rbac_control change-password</code>. The API starts either way.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38992</a></td> <td>Added the <code>remote.https.ca_certificate</code> option, naming the CA that signs the HTTPS agent listener certificate (default <code>etc/certs/root-ca.pem</code>), and the unauthenticated <code>GET /cacerts</code> endpoint that serves it: <code>200</code> with the PEM, <code>404</code> when the file is missing, <code>503</code> (<code>ca_mismatch</code>) when it does not sign the served certificate. <code>wazuh-manager-remoted</code> now evaluates its listener certificate at start and every 24 hours — a WARN under 30 days to expiry, an ERROR once expired or when the CA and the certificate diverge — and exposes <code>remoted.cacerts.*</code>, <code>remoted.server.tls.cert_expiry_days</code> and <code>remoted.server.tls.ca_matches_leaf</code>, projected by <code>GET /cluster/{node_id}/daemons/stats</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38993</a></td> <td>Added enrollment tokens: an operator mints a token on the master (<code>wazuh-manager-authd --create-enrollment-token --address <host></code>, or <code>POST /agents/enrollment-tokens</code> with the new RBAC actions <code>enrollment_token:create/read/delete</code>) that names the manager, pins its CA and carries a one-time-issued credential; a new agent pastes it and enrolls over <code>POST /enroll</code> on port 1517 with a <code>wazuh-enroll+jwt</code> bearer whose <code>kid</code> is the token id, without the shared enrollment password. Tokens have a TTL, an optional use cap and a description, are listed and revoked from the CLI or the API (<code>GET</code>/<code>DELETE /agents/enrollment-tokens</code>), live in <code>etc/enrollment_tokens.json</code> (written by the master only, replicated to the workers by the cluster like <code>client.keys</code>), and are refused with <code>9022</code>/<code>9023</code>/<code>9024</code> (<code>403</code> on <code>/enroll</code>) when unknown or revoked, expired, or out of uses — a revoked token may equally be refused earlier, as <code>remoted</code>'s uniform <code>401</code>, when its own replica already knows: both answers are correct and which one an agent sees depends on who notices first.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38993</a></td> <td>Added a per-agent re-enrollment secret: every enrollment answers a fifth field, <code>reenroll_secret</code> (64 hex chars, stored in <code>global.db</code> only, never in <code>client.keys</code>), and an agent that presents a <code>wazuh-enroll+jwt</code> bearer whose <code>kid</code> is its own id, signed with the key derived from that secret, keeps its id and receives a fresh key and a fresh secret — no deletion, no indexer purge (<code>global set-agent-credentials</code>). The master verifies the bearer (<code>9026</code>/<code>9027</code>/<code>9028</code>) with the same clock window as remoted (<code>remoted.jwt_max_age</code>/<code>remoted.jwt_clock_skew</code>). There is no upgrade path for a <code>global.db</code> created before the column: that database is recreated, and rebuilding its agent rows from <code>client.keys</code> does not restore the secrets — <code>client.keys</code> never held them — so those agents must enroll again.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38994</a></td> <td>Added the RBAC action <code>cluster:read_secrets</code>, now the only thing that returns the enrollment password and the cluster key in clear through <code>GET /cluster/local/config</code> and the two node configuration endpoints. Until now any caller allowed to write the configuration (<code>cluster:update_config</code>) could read those values as a side effect, and the disclosure left no record: it is now granted by the new default policy <code>secrets_read</code>, held only by <code>administrator</code>, and checked against the node that answers -- a grant over one node does not uncover another's -- and every disclosure is logged as <code>secret_read</code> with the user and the fields, never the value, in <code>api.log</code> for the local read and in the answering node's <code>cluster.log</code> for the forwarded ones. <code>cluster_admin</code> and <code>wazuh_indexer_admin</code> no longer see them in clear, and an <code>rbac.db</code> created before this change does not receive the new policy, so its <code>administrator</code> sees the values masked until the database is recreated or the policy is added. The masking also fails closed: a failure while masking now fails the request instead of returning the unmasked payload.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38994</a></td> <td>Added <code>wazuh-manager-authd --purge-enrollment-tokens [--all] [--force]</code> and `DELETE /agents/enrollment-tokens?status=dead</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39319</a></td> <td>Added CA bundle rotation to <code>wazuh-manager-remoted</code>: <code>etc/certs/root-ca.pem</code> may now carry more than one CA behind a <code>##</code> publication block (<code>Publication</code>, <code>Content-SHA256</code>, <code>Updated</code>, <code>Written by</code>) that remoted parses and vouches for — recomputing the hash over the certificates it read and checking that the served leaf CHAINS to one of them (a real <code>X509_verify_cert()</code> validation: the leaf's own issuer, self-signed, <code>CA:TRUE</code> and within its validity window — a CA that merely signs the leaf is refused, and so is the <code>GET /cacerts</code> request, with <code>503 ca_mismatch</code>), at most 6 certificates and 8191 bytes — before advertising it; an unvouched or unpublished bundle is still served, only announced as <code>0</code>. <code>POST /control</code>'s <code>notify</code> response gains <code>ca_generation</code> (the vouched publication, <code>0</code> unpublished, <code>null</code> no servable bundle) and every <code>GET /cacerts</code> <code>200</code> carries a matching <code>Wazuh-CA-Generation</code> header, so an agent can confirm a refresh landed the rotation <code>notify</code> announced. A private record under <code>var/run/remoted-ca-bundle/</code> remembers the last bundle served and logs once per change (first publication, a plain file replacing a published one, the block stripped, a block present but refused by a guard), never distributed. A 4.x agent upgraded past v5.0.0 now receives over the legacy WPK channel only the CA that the currently served leaf chains to, re-serialised as a single certificate, instead of the raw configured file. Adds the <code>bin/wazuh-manager-certs</code> CLI, the bundle's only writer: <code>inspect</code>/<code>check</code> read and validate it without touching it; <code>add</code>/<code>remove</code>/<code>prune-expired</code>/<code>stamp</code> publish a new generation under an exclusive lock and an atomic write, each refusing on a cluster worker; and <code>--from-master</code> lets a worker pull its master's published bundle over HTTPS, verified against its own bundle, under the generation the master announced — repairing a bundle that announces that generation without carrying its certificates, instead of reporting it as up to date.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39109</a></td> <td>Added <code>tools/migration/wazuh-migrate-identity.py</code>, which carries a 4.x manager's agents, groups, group configuration, enrollment password and API users into a fresh 5.0 installation. It reads the identity out of the stopped 4.x manager's files and recreates it on the 5.0 manager through the manager's own API, so the manager validates every agent and group and writes <code>client.keys</code> and the registry itself, then compares the result against what it carried.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Added a credential resolution ladder, run from <code>postinst</code>/<code>%post</code>/<code>install.sh</code> at installation and again from <code>wazuh-manager-control start</code>, which is what the systemd unit runs. For each credential it takes, in order, what is already in the manager's own store, then a key set in <code>/etc/wazuh/credentials.env</code> or the environment (the environment wins), then -- only for what the manager owns -- a generated value published back to that file. It owns <code>WAZUH_MANAGER_API_PASSWORD</code> and <code>WAZUH_MANAGER_WUI_PASSWORD</code>, seeded into <code>rbac.db</code> through stdin and never argv; it only consumes <code>WAZUH_INDEXER_MANAGER_PASSWORD</code>, which it stores in its keystore and never generates or publishes. The installer always exits <code>0</code> and checks nothing, because the answer changes between the two moments and only the answer at start matters. An unresolved or invalid credential leaves the unit <code>failed</code> with every missing key named in the journal, and no value is ever printed.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Added TLS certificate issuance to that ladder, at installation only: neither a service start nor a package upgrade re-examines, re-anchors or reissues the pair, because issuing one is a signature rather than a lookup and re-deriving the chain would make <code>$WAZUH_CA_DIR</code> a standing dependency of the manager. A pair replaced out of band therefore survives both untouched. The contents of <code>$WAZUH_CA_DIR</code> -- not a mode flag -- select between minting a bootstrap CA, issuing from the CA found, keeping a pre-issued pair, and issuing nothing when an anchor carries no private key, so a host never given a CA key cannot sign. <code>WAZUH_MANAGER_CERT_SANS</code> and <code>WAZUH_MANAGER_REMOTED_CERT_SANS</code> set the subject alternative names; when unset, the agent listener's leaf carries every global-scope address of every interface, whether or not it is on the default route, while link-local and host scope are excluded. A manager left without certificates is still caught before any daemon runs, by the configuration validator's <code>(1244)</code> verdict naming the file.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Added the tooling the ladder needs: <code>bin/rbac_control seed</code>, <code>wazuh-manager-keystore -g</code> (prints a stored value and exits non-zero when the key is unset), <code>bin/wazuh-manager-resolve-credentials --clear</code> (removes every credential the manager owns or stores, for an image whose <code>postinst</code> baked them into a layer every container would share), and <code>USER_RESOLVE_CREDENTIALS</code> in <code>install.sh</code>, set to <code>n</code> by both packaging recipes because they stage a tree they copy into the package. The shared half of the ladder -- the credentials file format, its locking convention, password generation and the CA -- is <code>wazuh-credentials.sh</code>, owned by <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">wazuh-installation-assistant</a> and downloaded by <code>make deps</code> rather than vendored, since the manager, the indexer and the dashboard must agree on it exactly. The manager packages now declare <code>openssl</code>, <code>iproute2</code>, <code>hostname</code>, <code>gawk</code>, <code>util-linux</code>, <code>diffutils</code>, <code>grep</code>, <code>sed</code> and <code>findutils</code>.</td> </tr> </tbody> </table> <h4>Changed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Changed the Server API default users so they no longer ship with a password: <code>users.yaml</code> carries none, and <code>wazuh</code> and <code>wazuh-wui</code> are seeded with the value supplied to the credential resolver or, failing that, with a freshly generated 32-character password per installation -- so two clean installations never share a credential, and a deployment that bypasses the resolver is still unique. An already-seeded <code>rbac.db</code> is never reseeded, so upgrades change no credential; <code>rbac_control factory-reset</code> now regenerates rather than restoring <code>wazuh</code>/<code>wazuh</code>. The start-up warning added in <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38862</a> goes with the defaults it detected.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Removed the built-in <code>wazuh-manager</code>/<code>wazuh-manager</code> indexer credential: the indexer connector no longer falls back to it when the keystore is empty, and <code>queue/sockets/keystore.sock</code> no longer answers the literal <code>wazuh-manager</code> for a key nobody set. Both made "not set" indistinguishable from "set to a password everyone knows"; an absent credential is now an error the resolver reports by name before any daemon starts.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Changed the manager to be installed neither enabled nor started, by the packages and by <code>install.sh</code> alike -- <code>systemctl enable --now wazuh-manager</code> is the documented step, because the manager needs credentials it cannot always resolve at install time and a unit enabled without being started only produces a failed unit at the next reboot. The install-time certificate <code>NOTICE</code> is gone with it, replaced by the resolver's own verdict at the moment it either issues the pair or reports that it could not. <code>wazuh-manager-remoted</code> and <code>wazuh-manager-authd</code> no longer end their TLS preflight errors with "wazuh-manager does not generate TLS certificates": the hint now points at ownership and mode, which is what that error almost always means. Removal takes the manager's own keys out of the shared credentials file -- on a DEB <code>purge</code>, and on any RPM erase, rpm having no removal that keeps configuration -- and the last component out removes the file, the CA directory and <code>/etc/wazuh</code>, "last" being asked of the package manager rather than inferred from the file's contents.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Changed <code>wazuh-manager-apid</code> to refuse to start when <code>api/configuration/security/rbac.db</code> is absent or empty, instead of creating it. Creating it there seeded the two default users with generated passwords published nowhere -- not to <code>/etc/wazuh/credentials.env</code>, not to the log -- so the API came up and nobody could authenticate against it, with no record of the credential on the host. The database is the credential resolver's to create, through <code>rbac_control seed</code>, and <code>wazuh-manager-control start</code> resolves credentials before any daemon runs; error <code>2012</code> now names that step. <code>rbac_control factory-reset</code> still recreates it.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39554</a></td> <td>Changed the Server API password rule to PCI DSS v4.0 requirement 8.3.6: 12 to 64 characters with at least one letter and one digit, from any printable ASCII except the space, no longer requiring both cases and a symbol -- it has to accept what rotation tools and other clients send. A value supplied to the credential resolver is held to the stricter rule the three components share for <code>/etc/wazuh/credentials.env</code>: the same 12 to 64 length, drawn only from <code>A-Z a-z 0-9 . , _ + : @ % ^ = ~ -</code>, with a lowercase letter, an uppercase letter, a digit and a symbol. That set is a subset of the API's and every class it requires satisfies the API's, so a value accepted at installation is never one the Server API rejects at rotation. Generated passwords meet both by construction.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38842</a></td> <td>Changed the RBAC action required by <code>GET /agents/{agent_id}/key</code> from <code>agent:read</code> to the new <code>agent:read_secrets</code> action, so a role that can list agents no longer exports the pre-shared key needed to impersonate them. The new action applies to an <code>rbac.db</code> seeded from the defaults — a fresh installation or a <code>rbac_control factory-reset</code>; a database preserved across a package upgrade keeps the policies it already had, and on such a box the endpoint is denied for every role until the database is reseeded. The action lives in the <code>secrets_read</code> default policy next to <code>cluster:read_secrets</code>, so on a seeded database <code>administrator</code> is the only built-in role that can export an agent's key: <code>agents_admin</code> and <code>wazuh_indexer_admin</code> keep every other agent operation through <code>agents_all</code> but lose key export, as do <code>readonly</code> and <code>agents_readonly</code>. Provisioning does not change: <code>POST /agents</code> still returns the key of the agent it creates under <code>agent:create</code>, and minting an enrollment token is unchanged, so only re-reading an existing agent's key needs <code>administrator</code>. Every key read is now recorded as a <code>secret_read</code> audit line naming the caller and the agents served. Custom policies that grant <code>agent:read</code> must add <code>agent:read_secrets</code> explicitly to retain key export.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38863</a></td> <td>Updated the bundled MITRE ATT&CK Enterprise dataset from v18.1 to v19.2 (new tactic TA0112 Defense Impairment, tactic TA0005 renamed to Stealth, 23 new and 17 revoked techniques). The database is generated at installation time; existing installations are not migrated.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38816</a></td> <td>Replaced the manager's pseudo-XML configuration parser with a schema-validated strict-XML loader (<code>shared_modules/manager_config</code>): every consumer — the C daemons, the engine, the control script, the Python framework and the API — reads the same effective document; any daemon's <code>-t</code> and the new <code>bin/wazuh-manager-conf validate|get|dump</code> CLI validate the whole file (including the installed schema copy <code>etc/wazuh-manager.schema.json</code>) with JSON-pointer diagnostics (error 1244); <code>GET /cluster/{node_id}/configuration</code> serves the canonical schema shape with native types, and <code>cluster.key</code> becomes mandatory. Constructs the old parser tolerated (multiple roots, raw <code>&</code>, legacy comments, unknown options) are now rejected at startup — see the migration guide.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33377</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33570</a></td> <td>Upgraded embedded Python interpreter from 3.10 to 3.12.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#30535</a></td> <td>Adapted Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm, covering first-scan, inventory-change, and feed-update scenarios.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34608</a></td> <td>Removed legacy configuration surfaces, database schemas, build targets, and compatibility layers in the second server cleanup phase.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35881</a></td> <td>Reduced <code>wazuh-manager</code> Debian package dependencies, removed <code>adduser</code>, <code>lsb-release</code>, <code>debconf</code>, and <code>libc6</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#29734</a></td> <td>Upgraded external dependencies: <code>curl</code>, <code>sqlite</code>, <code>xz</code>, and <code>libarchive</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34479</a></td> <td>Implemented cooperative-cancellation graceful termination for <code>wmodules</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35358</a></td> <td>Included source IP in <code>wazuh-manager-remoted</code> log messages.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35478</a></td> <td>Preserved manager configuration files during package upgrades.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35479</a></td> <td>Improved Wazuh server directory layout.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35525</a></td> <td>Updated manager index names to align with the new sync model.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35905</a></td> <td>Added caller module context to indexer-connector logs.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36805</a></td> <td>Randomized the cluster key generated during manager installation instead of using a hardcoded default.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36311</a></td> <td>Changed the default Indexer user used by the Manager from <code>admin</code> to the restricted <code>wazuh-server</code> user, aligning with the Indexer RBAC least-privilege model.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36705</a></td> <td>Enabled shared-password agent enrollment by default, persisting the auto-generated <code>authd.pass</code> and synchronizing it to worker nodes, with fail-closed password validation.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38091</a></td> <td>Raised the minimum TLS protocol version accepted by <code>wazuh-manager-authd</code> (agent enrollment) to TLS 1.3, removed the <code>ssl_auto_negotiate</code> fallback and its <code>-a</code> CLI flag, and changed <code><auth><ciphers></code> to a TLS 1.3 ciphersuite list.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#32698</a></td> <td>Adapted API integration tests.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36453</a></td> <td>Increased the minimum API user password length from 8 to 12 characters to align with PCI DSS.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Renamed the manager's log rotation and agent monitoring internal options from <code>monitord.*</code> to <code>wazuh_modules.manager_task_*</code>. An override left under an old name is silently ignored. Agents keep <code>monitord.*</code> for their own log rotation.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38436</a></td> <td>Standardized the manager's Unix socket names and layout: every socket ends in <code>.sock</code>, carries an <code>-http</code> marker when it speaks HTTP, and lives in <code>queue/sockets/</code>. The sockets that were under <code>queue/db/</code>, <code>queue/tasks/</code> and <code>queue/cluster/</code> moved there, leaving those directories holding only their data. An upgraded installation keeps the old socket files as dead entries until a clean install.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38862</a></td> <td>Disabled <code>allow_run_as</code> on the <code>wazuh</code> API default user. Authorization context login is only used by the dashboard, which authenticates as <code>wazuh-wui</code>; the <code>wazuh</code> account no longer resolves an authorization context into roles, and <code>POST /security/user/authenticate/run_as</code> answers it with the documented 403/6004. <code>wazuh-wui</code> is unchanged. The new value applies to an <code>rbac.db</code> seeded from the defaults — a fresh installation or a <code>rbac_control factory-reset</code>; a database preserved across a package upgrade keeps the flag it already had. A deployment that pointed the dashboard at <code>wazuh</code> with <code>run_as</code> enabled must either use <code>wazuh-wui</code> or re-enable the flag with <code>PUT /security/users/1/run_as</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38862</a></td> <td>Extended <code>bin/rbac_control change-password</code> so it can be driven without a terminal, which the installation password tools need: <code>--user</code> selects a single default user, <code>--password-file</code> reads that user's new password from the first line of a file (or from the standard input with <code>-</code>), and <code>--passwords-file</code> reads a JSON object mapping default usernames to their new passwords and applies all of them in one execution. Passwords are never accepted on the command line. With no option the command keeps prompting for each password, and it now exits non-zero when any requested change was not applied.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39151</a></td> <td>Updated the embedded Python interpreter to 3.12.14 and refreshed its dependencies (<code>aiohttp</code>, <code>cryptography</code>, <code>pip</code> and <code>setuptools</code>). <code>setuptools</code> 84.0.0 no longer ships <code>pkg_resources</code>, removed upstream in 82.0.0, so <code>google-cloud-storage</code> was upgraded from 1.44.0 to 2.19.0 — the version it pinned imported that module and would have broken the gcloud bucket integration at import time.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38992</a></td> <td>Changed the manager to stop generating its own TLS certificates: neither <code>install.sh</code>, the DEB/RPM scriptlets, <code>wazuh-manager-remoted</code> nor <code>wazuh-manager-authd</code> create <code>remoted.pem</code>/<code>remoted-key.pem</code> any more. The listener pair and the CA that signs it (<code>root-ca.pem</code>) are provisioned externally, with the Wazuh installation assistant (<code>wazuh-certs-tool</code>), and the manager fails closed without them: <code>wazuh-manager-control start</code> stops with <code>(1244) … '/remote/https/certificate': file not found</code> and a provisioning hint, and <code>wazuh-manager-remoted</code> refuses to start when the service user cannot read the files.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38994</a></td> <td>Changed the default RBAC policy <code>agents_read</code> to include <code>enrollment_token:read</code>, so the roles that already read agents (<code>readonly</code>, <code>agents_readonly</code>) can list the enrollment tokens they were being refused. The listing never carries a credential; minting and removing still need <code>agents_all</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38993</a></td> <td>Changed the HTTPS agent API's <code>401</code> to name the authentication failure class: every credential failure keeps the generic message but carries <code>WWW-Authenticate: Bearer error="invalid_token", error_description="<class>"</code> and the same class as the body's <code>code</code> (a string on <code>401</code>; other statuses keep the numeric status): <code>unknown_agent</code> (re-enroll), <code>stale_token</code> (fix the clock and retry), <code>invalid_signature</code> (do not re-enroll), <code>invalid_request</code> (no usable credential), <code>token_unknown</code>/<code>token_expired</code>/<code>token_revoked</code> and <code>enrollment_key_unavailable</code> on <code>POST /enroll</code>. The <code>agent</code> table of <code>global.db</code> gains the <code>reenroll_secret</code> column in the schema itself (no <code>user_version</code> bump and no upgrade step: 5.0.0 has not shipped, so a <code>global.db</code> created by an earlier development build lacks the column and must be recreated). The default RBAC policy <code>agents_all</code> gains <code>enrollment_token:create/read/delete</code>; an <code>rbac.db</code> created before this change keeps its previous policies, so administrators of such an installation get <code>403</code> on <code>/agents/enrollment-tokens</code> until the database is recreated or the actions are added.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39053</a></td> <td>Changed the generation of the shared enrollment password (<code>etc/authd.pass</code>) to take 32 bytes straight from the CSPRNG (<code>RAND_bytes</code>) and hex-encode them to 64 lowercase characters, replacing a final MD5 digest that capped the result at 128 nominal bits however much entropy went into it. <code>wazuh-manager-authd</code> now refuses to start rather than write a weaker password if the CSPRNG fails, matching the agent key's fail-closed rule. Only newly generated passwords change: an existing <code>etc/authd.pass</code> is reused untouched, and a password supplied by an administrator is still accepted whatever its shape.</td> </tr> </tbody> </table> <h4>Removed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33124</a></td> <td>Removed Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via <code>indexer-connector</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#30922</a></td> <td>Removed deprecated manager daemons: <code>ossec-authd</code>, <code>wazuh-agentlessd</code>, <code>wazuh-maild</code>, <code>wazuh-dbd</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#30924</a></td> <td>Removed deprecated C CLI tools: <code>manage_agents</code>, <code>agent-auth</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31028</a></td> <td>Removed OpenSCAP server-side module.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31299</a></td> <td>Removed inventory-related API endpoints.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#28425</a></td> <td>Removed legacy API security configuration endpoints.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35908</a></td> <td>Removed SELinux integration from the manager.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38024</a></td> <td>Removed the <code>GET /agents/{agent_id}/stats/{component}</code> API endpoint. Agent statistics are read from the <code>wazuh-agent-stats</code> index.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Removed the <code>wazuh-manager-monitord</code> daemon, along with the <code>monitor</code> component of the active configuration endpoints, which its socket served.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Removed the <code><global><agents_disconnection_alert_time></code> option. A configuration that still includes it fails to start.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38992</a></td> <td>Removed the certificate-generation mode (<code>-C</code>, <code>-B</code>, <code>-K</code>, <code>-X</code>, <code>-S</code>) of <code>wazuh-manager-remoted</code> and <code>wazuh-manager-authd</code>, and the <code>USER_CREATE_SSL_CERT</code> and <code>USER_GENERATE_AUTHD_CERT</code> installation variables.</td> </tr> </tbody> </table> <h4>Fixed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Documented that re-enrollment supports agent ids of up to eight digits: the bearer's <code>kid</code> is validated with the manager's eight-character id rule and the agent applies the same rule to the answer, so an agent whose id has nine or ten digits cannot rotate its credentials. Administrative insertion (<code>POST /agents</code>, <code>manage_agents</code>) still accepts the full id range, deliberately: restricting it would not remove the mismatch, because the automatic id counter follows the highest id in <code>client.keys</code> and would hand out a long id again at the next self-enrollment.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed an agent keeping credentials the database never received. Both an enrollment and a re-enrollment answered with a key and a re-enrollment secret long before the writer stored them, so a wazuh-db outage — or a crash between the answer and the write — left the agent with a key <code>client.keys</code> would eventually carry and a secret nothing durable held: it could talk to the manager and could never re-enroll. <code>wazuh-manager-authd</code> now records every transition in <code>queue/authd/pending-identities</code> (mode 0640) before answering, retries it on its own timer while the database is out of reach, and drops the entry only once the write is committed — through the new <code>global commit</code> query of <code>wazuh-manager-db</code>, since an <code>ok</code> comes from inside a deferred transaction. At start-up each recorded transition is judged against <code>client.keys</code> by key, not by agent id, so a rotation that was superseded is discarded and one that is still owed is applied, coexisting with a row rebuilt from <code>client.keys</code> with no secret. A transition that cannot be recorded — unwritable directory, or 5000 already waiting — is refused with the new <code>9031</code> (Identity transition could not be recorded, remoted's <code>503</code>, the API's <code>1772</code>) instead of handing out a credential nothing wrote down.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed two re-enrollments with the same credential rotating an agent twice. <code>local_reenroll()</code> read the agent's re-enrollment secret from the database and verified the bearer before taking any lock, and the database keeps naming that secret until the writer replaces it, so a second request could verify the very same bearer and rotate again: two valid answers for one agent, the first silently invalidated by the second. A rotation now reserves the agent before the database is asked and the reservation is released by the writer, once the new credentials are stored; a caller that finds it taken gets the new <code>9030</code> (Re-enrollment already in progress), which remoted answers as <code>409</code> and counts as <code>remoted.enroll.reenroll.rejected_in_progress</code> — a retry, as opposed to the <code>401</code> a bearer gets once the rotation has landed. A failed database write deliberately keeps the reservation: the row still holds the old secret, and letting it authorise another rotation is the defect itself.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed a revoked enrollment token coming back after a restart when the store could not be written. <code>wazuh-manager-authd</code> marked the token revoked in memory and, if saving failed, a later retry took the idempotent shortcut and answered success without writing anything, so the file — and every worker replica made from it — kept the token active. A revoke now either lands on disk or is reported as the new error <code>9029</code> (Enrollment token store write failed, the API's <code>1771</code> with HTTP 500), told apart from the <code>9022</code> of an unknown id because the token does exist and the operator has to retry. The pending revocation survives a reload and the next token verb writes it.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed <code>wazuh-manager-authd</code> loading an enrollment token store it could never write back: a file with more than 5000 tokens, or above the serialized byte ceiling, is now refused with a warning naming the limit it crossed, keeping whatever was already loaded. It also documents, in the module reference, that a use counted while the file cannot be written is not durable — a restart may admit another enrollment with that token — while expiry and revocation are.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed the manager publishing private key material through <code>GET /cacerts</code> and <code>--embed-ca</code>. Both surfaces used to hand out the bytes of <code>remote.https.ca_certificate</code> after checking only that they contained a certificate marker, so a PEM that also carried the CA's private key — a misprovisioned but accepted input — was served whole to any unauthenticated caller. The manager now parses that file and publishes a document it re-serialises from the X.509 objects it found, so nothing but certificates can leave through either surface; a file that cannot be parsed to its end is refused whole instead of served up to its first bad block. Minting also stopped reading the file twice: the certificate it validates is the one it embeds.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed <code>GET /cacerts</code> answering with a coherence verdict up to a day old. The PEM was re-read on every request while the decision about whether it signs the served certificate came from the start-up evaluation or the daily tick, so a CA replaced in place could be handed out with a stale <code>200</code> (and <code>remoted.server.tls.ca_matches_leaf</code> still reporting a match), while a repaired one kept answering <code>503</code> until the next tick. The certificates and the verdict now come from the same read, cached under the file's content hash — not its size or timestamp — so a replacement is revalidated in the request that notices it, and the metric never disagrees with what the endpoint just answered.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39078</a></td> <td>Fixed <code>--embed-ca</code> refusing a CA bundle whose signing certificate was not the first one in the file: only the first block was read. Every certificate of the file is now loaded, the signer is looked up among them, and the whole bundle travels in the token.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31746</a></td> <td>Fixed Vulnerability Detector version matcher logic for improved detection accuracy.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33108</a></td> <td>Fixed Cloudtrail log ingestion parsing errors.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34082</a></td> <td>Fixed <code>wazuh-manager-db</code> error assigning groups by avoiding the keyentries counter as index.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35043</a></td> <td>Fixed token validation race condition after revoke.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35638</a></td> <td>Handled the stop signal during vulnerability feed download.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37521</a></td> <td>Fixed <code>GET /cluster/{node_id}/daemons/stats</code> always returning error 1014 for <code>wazuh-manager-analysisd</code> due to a protocol mismatch between <code>WazuhSocketJSON</code> and the engine's HTTP API socket.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35909</a></td> <td>Fixed <code>make deps</code> branch detection in GitHub Actions.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38511</a></td> <td>Fixed world-writable permissions on bundled Python files after DEB installation, caused by the permission restoration script following symlinks.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Fixed the agent disconnection sweep running on cluster workers, and fixed manager log files never rotating daily on a manager that was restarted every day.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38547</a></td> <td>Fixed the API serving its OpenAPI specification and exact version at <code>/openapi.json</code> and <code>/openapi.yaml</code> without authentication.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38565</a></td> <td>Bounded the <code>search</code> query parameter to 1024 characters across every endpoint that accepts it, fixed the API's <code>wazuh-db</code> socket client raising an unhandled error instead of a clean <code>500</code> when <code>wazuh-db</code> closes the connection on an oversized request, and stopped the API from returning <code>wazuh-db</code>'s raw backend error text (including SQL fragments) to the caller.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38592</a></td> <td>Fixed the legacy <code>remote_upgrade</code> task delivery in <code>remoted</code> silently losing an agent's upgrade task when the push failed after the Task Manager had already marked it delivered, and fixed the agent's own reported upgrade failures being logged at <code>INFO</code>, where severity-filtered monitoring never saw them, instead of <code>WARNING</code>. <code>remoted</code> now owns a task's delivery retries end to end once it has read it: a rejection (the agent answered, just not with success) is retried up to 5 times in-memory within the same poll cycle (logging each failed attempt at <code>debug</code> except the last, which logs a <code>warning</code>), while a true no-response is deferred to a small in-memory retry list a later poll cycle picks back up, instead of blocking that cycle's sweep of every other agent. A task that exhausts every retry avenue is simply logged and dropped, never reported back to the Task Manager.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38626</a></td> <td>Fixed <code>POST /agents/insert</code> accepting an <code>id</code> outside the signed 32-bit range the manager stores it in, and <code>authd</code>'s auto-assigned id counter wrapping to a negative id once it reached <code>INT_MAX</code>, both of which produced an agent record that could not be queried or deleted. A caller-supplied <code>id</code> is now rejected when it is out of range or equal to <code>0</code>, and the id counter refuses to wrap, failing the enrollment instead.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38695</a></td> <td>Fixed <code>wazuh-manager-apid</code> and <code>wazuh-manager-clusterd</code> killing their own freshly started process during an unclean-stop recovery, when the kernel reused a PID recorded in a stale <code>.pid</code> file for the new instance. <code>clean_pid_files()</code> now only terminates a process whose creation time predates the stale file, and never the caller's own PID. Also fixed <code>delete_child_pids()</code> matching a child's pidfile by PID substring, which let a child with PID 16 remove the pidfile of PID 161.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38638</a></td> <td>Fixed <code>PUT /groups/{group_id}/configuration</code> accepting content with no XML elements at all (plain text or a comment-only body), which replaced a group's <code>agent.conf</code> without any error. Fixed <code>PUT /cluster/{node_id}/configuration</code> accepting a manager configuration with no <code><cluster></code> or no <code><indexer></code> section at all, which <code>GET /cluster/configuration/validation</code> also reported as valid but left <code>wazuh-manager-clusterd</code> (missing <code>cluster.key</code>, which has no default) or <code>wazuh-manager-analysisd</code> (zero indexer hosts) unable to start on restart. <code>cluster</code> and <code>indexer</code> are now mandatory top-level sections of the schema.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38749</a></td> <td>Fixed <code>install.sh</code> silently repointing the host's <code>wazuh-manager</code>/<code>wazuh-agent</code> service to the directory being installed: an install into an alternative <code>USER_DIR</code> (a sandbox tree, or a package build root) now leaves an existing service definition that names a different directory untouched and warns, unless <code>USER_TAKEOVER_SERVICE="y"</code> is set. <code>USER_REGISTER_SERVICE="n"</code> skips the boot integration altogether.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38810</a></td> <td>Fixed <code>POST /security/user/authenticate/run_as</code> returning a token with the service account's static administrator role when the authorization context was empty. An empty context is now resolved against the authorization rules like any other context instead of falling back to those static roles, so it yields a token with no roles under the default ruleset; a user without <code>allow_run_as</code> posting an empty context now gets the documented 403/6004 instead of a token; the API access log no longer raises on a body that is not an object, which turned the validator's 400 for a <code>null</code>, numeric or boolean body into an unhandled 500 on every endpoint; and the API specification now declares the <code>text/plain</code> response this endpoint returns with <code>raw=true</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38855</a></td> <td>Fixed the API access log writing secrets to <code>api.log</code> and <code>api.json</code> in cleartext. Redaction only ever tested the top-level keys of the request body for <code>password</code>, and for <code>key</code> only on <code>/agents</code> paths, so a secret one level down -- including in a body the API rejected with a 400, which is logged all the same -- was written out verbatim. The log now masks a set of sensitive field names (<code>password</code>, <code>key</code>, <code>token</code>, <code>secret</code>, <code>credentials</code>, <code>authorization</code> and their <code><prefix>_<name></code> forms) case-insensitively at any depth of the body and in the query string, and no longer writes the <code>run_as</code> authorization context at <code>info</code> level, where the <code>hash_auth_context</code> already on the line identifies it. The context is also hashed as received again, so the hash in the log matches the one stamped into the issued token.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38874</a></td> <td>Fixed the API's request-rate limiter being a single global counter shared by every caller: it is now keyed per client address, with a separate, much smaller allowance for unauthenticated/failed-auth requests so they can no longer exhaust an authenticated caller's budget, and rate-limit exhaustion is now logged at WARNING naming the source address. Also fixed a request to a path or method outside the API's specification being billed to the authenticated allowance regardless of whether it carried any credential, since it never reaches the authentication step at all; it is now billed to the smaller, unauthenticated allowance like a genuine authentication failure. Also fixed an authenticated caller already over its per-minute ceiling still paying the full cost of authentication before being rejected; it is now rejected before authentication runs.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38862</a></td> <td>Fixed <code>bin/rbac_control change-password</code> failing to change the password of every user it targets. <code>update_user</code> only lets a reserved user modify another reserved user's password and needs to be told who is asking, which the script never did, so each prompted password was reported as <code>FAILED</code> with error 5011 (<code>Administrator users can only be modified by themselves</code>).</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38633</a></td> <td>Fixed slow delivery of agent-groups assignments on worker nodes when the assignment reaches the worker before the group itself: the worker now retries the rejected assignment instead of waiting for the checksum mismatch limit. The transient rejection is no longer reported as an error while it is being retried, neither by <code>wazuh-manager-db</code> on the worker nor by the master node's synchronization log, and exhausting every retry is reported as a warning naming the affected agents.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38713</a></td> <td>Fixed the vulnerability scanner deleting every finding of an agent's <code>rpm</code> and <code>deb</code> packages when a scan ran without the agent's OS major version or code name. The OS release reaches the scanner only in the OS inventory document a sync session carries alongside its packages, and nothing persisted it between sessions: without it the CNA column family was built from an unsubstituted <code>$(MAJOR_VERSION)</code> template (<code>alas_</code>), every package lookup threw, and the failure was indistinguishable from a clean scan -- so the reconciliation, which pre-loads existing findings as deletions, removed findings it had never evaluated. The Debian families failed the same way silently, through a code name comparison that could not succeed. A package the scanner could not evaluate now keeps its findings and is counted as not evaluated in the scan summary, and a first scan that arrives without a usable OS context no longer clears the agent's existing findings before scanning.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39020</a></td> <td>Fixed the legacy <code>remote_upgrade</code> task delivery in <code>remoted</code> rejecting every task the Task Manager returned as <code>invalid payload</code>, which left every agent older than v5.0.0 without its WPK upgrade. The poller expected the payload as a JSON string while the Task Manager hands it back as the JSON object the producer stored; the poller now reads that object. A task deferred to the poller's retry list after a no-response is now aged from the moment it was deferred, so a task the Task Manager held for a long time still gets its full retry window.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38938</a></td> <td>Fixed API validation errors returning the <code>jsonschema</code> exception text, which embedded the internal schema as a Python dict literal and echoed the submitted value back: a rejected parameter now names itself and the constraint it violated. Bounded <code>offset</code> at 2147483647, so an out-of-range value is rejected by the specification instead of by <code>wazuh-manager-db</code>, and a request for a cluster node the cluster does not have now answers 404 instead of 200 with the node reported as a failed item.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39113</a></td> <td>Fixed <code>get_indexer_client()</code> raising <code>AttributeError: 'str' object has no attribute 'get'</code> when reading <code>indexer.ssl.certificate_authorities</code>, <code>certificate</code>, and <code>key</code> from the manager configuration, which kept the indexer task manager from ever starting <code>disconnected_agent_sync</code>, <code>active_response_task</code>, and <code>metrics_snapshot</code> on a manager with a correctly configured indexer. The reader still expected the shape the old pseudo-XML parser produced; it now matches the shape the schema-validated configuration loader returns. Also fixed the same function requiring <code>certificate</code>, <code>key</code>, and <code>certificate_authorities</code> to be present, when the configuration schema documents all three as optional (client certificate and CA pinning are opt-in; the indexer connection otherwise falls back to basic auth over the system trust store) and the manager's own C++ indexer connector already treats them that way. Also fixed the SSL context only trusting the first entry of <code>certificate_authorities</code>, silently ignoring the rest; the C++ indexer connector already merges every configured CA into the trust store, which the Python client now does too, so a CA rotation with both the old and new CA listed no longer breaks the connection as soon as the indexer presents a certificate signed by the second one. Also fixed a bad certificate/key/CA path escaping as a raw <code>FileNotFoundError</code> instead of an <code>IndexerUnavailableError</code> naming the SSL context as the failure point. Also fixed a blank entry in <code>certificate_authorities</code> being silently dropped instead of rejected, which could mask a misconfigured CA behind an apparently working connection using the remaining entries.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39114</a></td> <td>Fixed <code>wazuh-manager-control</code> failing to reclaim <code>start-script-lock</code> when it was left behind without its pid file, which happens when the owning process dies between creating the lock directory and recording its pid in it. <code>start</code> and <code>status</code> failed indefinitely with <code>Another instance is locking this process</code> until the directory was removed by hand; a lock left with no pid file is now treated as stale and reclaimed, the same as one whose recorded pid no longer exists. Also fixed <code>wazuh-manager-control status</code> reporting <code>wazuh-manager-authd</code> as not running, and exiting non-zero, on a manager with <code>auth.disabled</code> set to <code>true</code>, where <code>start</code> deliberately does not launch it; container healthchecks built on <code>status</code> restart-looped such a manager.</td> </tr> </tbody> </table> <h3>Agent</h3> <h4>Added</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#29533</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31838</a></td> <td>Added local state persistence for agent modules (FIM, System Inventory, SCA), removing the dependency on <code>rsync</code> with the Wazuh Server and reducing network traffic and server-side processing overhead.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37828</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37830</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37832</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37833</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37834</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37835</a> <a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37836</a></td> <td>Added an agent HTTPS client covering the <code>/control</code> lifecycle, the <code>/stateless</code> and <code>/stateful</code> data planes, <code>/download</code> for centralized configuration and WPK packages, task dispatch with durable deduplication, and remote upgrade, with AES-CMAC request signing and fail-closed TLS validation.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37843</a></td> <td>Added periodic <code>/stats</code> and <code>/config</code> push, reporting every module's statistics and configuration in a single aggregated document per endpoint, behind two <code>ossec.conf</code> toggles that are off by default.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>Agents now re-enroll with a per-agent secret stored at <code>etc/reenroll.secret</code>, keeping their agent id.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An agent re-enrolls only when the manager reports that it no longer knows the agent; every other authentication failure is retried with the credential the agent already holds.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An enrollment token the manager refuses is now logged with its token id, so operators know which one to re-mint.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An agent no longer restarts repeatedly when its enrollment token has been revoked or used up.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An agent keeps its enrollment token when the manager reports only that enrollment is disabled.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An agent whose re-enrollment secret the manager refuses falls back to the configured credential, so a rebuilt manager does not require visiting every endpoint.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39407</a></td> <td>Added Enroll and Update CA actions to the Windows agent tray GUI (<code>win32ui</code>), enrolling or refreshing the trust anchor from a pasted token.</td> </tr> </tbody> </table> <h4>Changed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37831</a></td> <td>Changed the agent transport to HTTPS for all server communication, removing the legacy TCP data path and its internal-option fallback.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38465</a></td> <td>Changed agent enrollment to consume the manager's HTTPS <code>POST /enroll</code> endpoint instead of the legacy <code>A:</code>/<code>K:</code> protocol over TCP/1515, reusing the same <code><agent><ssl></code>/<code><agent><server></code> transport as the rest of the agent's HTTPS traffic.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38624</a></td> <td>Changed the <code>WAZUH_MANAGER_ENDPOINT</code> installation variable to carry the whole connection target — <code>host[:port][/prefix]</code>, with only the address mandatory — which the DEB/RPM, source and MSI installers write verbatim into the agent's single <code><endpoint></code> setting. It supersedes <code>WAZUH_MANAGER</code> and <code>WAZUH_MANAGER_PORT</code> when set, and those keep working unchanged when it is not. A trailing slash (<code>host/</code>) opts out of the reverse-proxy prefix. Replaces the variable's previous prefix-only meaning.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33378</a></td> <td>Changed the Wazuh Manager installation path to <code>/var/wazuh-manager</code> (replacing <code>/var/ossec</code>) and removed agent ID <code>000</code>, fully decoupling agent and manager processes on shared hosts.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34849</a></td> <td>Changed Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33199</a></td> <td>Adjusted agent-side Vulnerability Detector inventory emission and synchronization (OS, packages, hotfixes) to align with the updated VD behavior in Wazuh 5.0.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31478</a></td> <td>Simplified rootcheck: removed the server-side database, sync path, and API surface; findings are now indexed through the standard alert pipeline.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38589</a></td> <td>Changed the shared log-rotation helper so a rotation whose target directory cannot be created is reported and skipped instead of terminating the daemon. This also applies to the agent's own log rotation, which previously exited on that error and was restarted by the service manager.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#33382</a></td> <td>Updated logcollector file-tailing initial read strategy for more consistent behavior across log rotation scenarios.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#34462</a></td> <td>Updated Windows Event Channel log collection to emit native XML from <code>EvtRender()</code> without an XML declaration header.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35330</a></td> <td>Increased default limits for agent event throughput and inventory message sizes.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35880</a></td> <td>Reduced <code>wazuh-agent</code> Debian package dependencies, removed <code>adduser</code>, <code>lsb-release</code>, and <code>debconf</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35471</a></td> <td>Standardized agent-start and buffer-status events to a WCS-aligned JSON format.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39274</a></td> <td>Extended the Windows agent's default FIM registry ignore list to exclude the OS telemetry under <code>HKLM\System\CurrentControlSet\Services</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>The 5.0 package upgrade deletes <code>etc/authd.pass</code> from the endpoint. Operators who rotate it should know it disappears at upgrade.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>A fresh 5.0 install no longer creates <code>etc/authd.pass</code>.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td><code>WAZUH_REGISTRATION_PASSWORD</code> is no longer used; the installer logs that it was ignored.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An enrollment password stored outside the default path is left in place.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>The installers no longer add an <code><authorization_pass_path></code> element naming the default password file.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39064</a></td> <td>An agent enrolled before the upgrade keeps working on its existing key, but must be re-pointed with an enrollment token to obtain a re-enrollment secret.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39406</a></td> <td>Changed the Windows agent tray GUI (<code>win32ui</code>) to display the manager address and enrollment key read-only, removing the <code>Save</code> button and its unverified write path.</td> </tr> </tbody> </table> <h4>Removed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#30435</a></td> <td>Removed deprecated agent binaries and legacy modules as part of the Wazuh 5.0 agent cleanup.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#31582</a></td> <td>Removed NSIS-based Windows agent installer; Windows agent now ships exclusively as an MSI package.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38091</a></td> <td>Removed the <code><enrollment><auto_method></code> option; enrollment now always requires TLS 1.3, so there is nothing left for it to negotiate down to. The <code>ssl_cipher</code> option now expects a TLS 1.3 ciphersuite list instead of an OpenSSL cipher-list string.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38465</a></td> <td>Removed the <code><enrollment></code> <code>manager_address</code>, <code>port</code>, <code>interface_index</code>, <code>ssl_cipher</code>, <code>server_certificate_path</code>, <code>agent_certificate_path</code>, and <code>agent_key_path</code> options; enrollment now always targets the same manager and TLS configuration as the rest of the agent's HTTPS traffic. A 4.x <code>ossec.conf</code> carrying them still parses without error after an in-place upgrade.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39674</a></td> <td>Deprecated the 4.x FIM, Syscollector, SCA and agent options that no longer have any effect; an upgraded <code>ossec.conf</code> that still sets them loads with a deprecation warning.</td> </tr> </tbody> </table> <h4>Fixed</h4> <table> <thead> <tr> <th>Issue</th> <th>Comment</th> </tr> </thead> <tbody> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#29668</a></td> <td>Fixed FIM checksum calculation that was incorrectly ignoring some file fields.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#30513</a></td> <td>Fixed syscollector reporting duplicate and bogus packages on macOS arm64.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#32915</a></td> <td>Fixed <code>agent_control</code> not displaying agent status information.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35071</a></td> <td>Fixed SCA handling of invalid operators and missing values in regex patterns.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35156</a></td> <td>Fixed agent modules initializing before agent metadata was fully ready.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35162</a></td> <td>Fixed FIM inventory reporting file modification time as 1970-01-01.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35169</a></td> <td>Fixed agent automatic reload failing after receiving centralized configuration.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35248</a></td> <td>Fixed syscollector false positive package detection on macOS.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35329</a></td> <td>Fixed agent uninstall on Windows after a WPK upgrade.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35474</a></td> <td>Fixed agent 5.x sending a trailing null byte in messages.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35636</a></td> <td>Fixed WUA hotfix collection regression in Windows agent v5.0.0.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35955</a></td> <td>Fixed wodle command argument construction for Windows paths.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35960</a></td> <td>Prevented Windows agent restart abort when the service is already stopping.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35978</a></td> <td>Fixed timeout message displayed after a 4.13-to-5.0 upgrade on Windows.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35979</a></td> <td>Fixed agent disconnection on direct 4.13-to-5.0 custom WPK upgrade.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#35988</a></td> <td>Excluded <code>/bin</code> and <code>/sbin</code> from FIM monitored directories on usrmerge distributions.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36002</a></td> <td>Expanded Windows environment variables in SCA rule inputs.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36061</a></td> <td>Made <code>sync_end_delay</code> interruptible to remove stale <code>modulesd.pid</code> after agent stop.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36092</a></td> <td>Honored the shutdown signal in <code>agent-upgrade</code> <code>StartMQ</code> to avoid timeout warning on agent stop.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36126</a></td> <td>Adjusted DockerListener messages as log entries to fix event categorization.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#36134</a></td> <td>Dropped orphan paths before promoting on agent startup to fix FIM.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38825</a></td> <td>Fixed the agent stopping every timer-driven message for the duration of a backward system-clock jump.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37653</a></td> <td>Lowered the <code>wazuh-agentd</code> connection socket error log to debug level to avoid duplicating the "Lost connection with manager" error on transient disconnections.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37626</a></td> <td>Fixed a race condition when saving the Logcollector file status on shutdown.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37656</a></td> <td>Fixed an unbounded memory leak in <code>wazuh-modulesd</code> caused by a missing RPM macro context cleanup on every package scan cycle.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37543</a></td> <td>Fixed agent-info module caching cluster_name, cluster_node, and agent_groups from a one-time handshake at startup, causing stale values in <code>agent_metadata</code> until the agent process restarted.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37993</a></td> <td>Fixed <code>wazuh-syscheckd</code> failing the <code>file_entry.checksum</code> NOT NULL constraint when the deferred sync-flag update ran for an entry deleted during the scan.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#37993</a></td> <td>Fixed <code>wazuh-syscheckd</code> failure on shutdown, which logged "Invalid handle value", crashed the process and left a stale PID file.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38163</a></td> <td>Fixed <code>wazuh-agentd</code> crashing on start when the agent metadata segment could only be opened read-only, which happens whenever a root process creates it before the daemon drops privileges.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38065</a></td> <td>Fixed SCA and Syscollector sync threads not blocking <code>SIGTERM</code>, which could cause the shutdown handler to run on a module thread instead of the main thread and time out joining it.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38212</a></td> <td>Fixed the Windows agent leaving the FIM synchronization database open when the service stopped, which left the <code>queue\</code> directory behind after an uninstall without purge.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38646</a></td> <td>Fixed SCA HIPAA compliance mappings across policy checks.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38736</a></td> <td>Fixed two CIS Amazon Linux 2023 SCA checks (<code>gpgcheck</code>, <code>vsftpd</code>) reporting false-positives on compliant systems.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38600</a></td> <td>Removed the default <code>netstat</code> and <code>last</code> command monitoring entries, which depend on binaries not present on every supported platform (e.g. minimal container images), causing repeated failed executions every <code>frequency</code> cycle.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39279</a></td> <td>Removed the default <code>df -P</code> command monitoring entry, which reported disk usage/capacity with no security relevance every <code>frequency</code> cycle. Also removed the stale <code>df -P</code>, <code>netstat</code>, and <code>last</code> entries from <code>etc/ossec-agent.conf</code>, the fallback configuration installed by <code>install.sh</code> when template generation fails on a source install.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38829</a></td> <td>Fixed Coverity findings across agent components (<code>syscheckd</code>, <code>sca</code>, <code>agent-info</code>, <code>https_client</code>, <code>agent-upgrade</code>, and <code>shared</code>).</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38766</a></td> <td>Fixed <code>wazuh-agentd</code> crashing with <code>SIGSEGV</code> on every service stop, which also cut the shutdown drain short before the <code>/control</code> shutdown notification was sent.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38850</a></td> <td>Fixed missing <code><manager></code> block on Debian 10 unattended DEB installs.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38975</a></td> <td>Fixed SCA PCI-DSS compliance mappings, updated from v3.2.1 to v4.0 numbering.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38840</a></td> <td>Fixed the agent's reported <code>/config</code> snapshot staying stale for up to an hour after a group's shared configuration (e.g. <code>agent.conf</code>) changed; the manager now sees the update as soon as the agent's reload actually completes, instead of waiting out the periodic report's regular cadence.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38928</a></td> <td>Fixed the CIS Amazon Linux 2023 SCA policy: check 31170 was named for the GID 0 default group control it does not test (its rule actually tests the root password), and check 31172 was a byte-identical duplicate of 31171, both testing <code>/etc/passwd</code> permissions and inflating compliance scores.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#38914</a></td> <td>Fixed the default agent nodiff list not protecting <code>/etc/shadow</code> and real key paths.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39309</a></td> <td>Fixed SCA HIPAA compliance values using parenthesized notation, which the dashboard's Regulatory Compliance catalogue doesn't recognize; converted to the dotted notation the catalogue expects.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39514</a></td> <td>Fixed SCA ISO 27001 compliance mappings, remapped from the superseded 2013 numbering to 2022 Annex A.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39192</a></td> <td>Fixed the <code>block-ip</code> active response not blocking IPs on a default macOS install.</td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/1000045791/4268529/github-release-wazuhwazuh-v500-rc1-05102026/" target="_blank" rel="noopener noreferrer">#39667</a></td> <td>Fixed <code>azure-logs</code> logging a collection whose Python script failed as finished: a non-zero exit code is now reported as a warning, the script output that is not in its log format (e.g. a Python traceback) is logged as an error, also after a timeout, and the request, container and domain are logged as failed instead of finished. A script that cannot be executed, e.g. because python3 is missing, is now reported and no longer stops the module.</td> </tr> </tbody> </table></div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.6 (12.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.612.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.6</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.6</h2> Codewhale v0.9.6 is a subtractive release: fewer runtime guards, one stable prompt, truthful provider endings, and a smaller compaction path that preserves the provider cache. The changes were grounded by matched Terminal-Bench 2.1 runs against Pi 0.8.41 and by dogfooding repeated manual compaction. <h3>Added</h3> <ul> <li><code>web_search</code> defaults to Firecrawl Cloud without an API key; keyless requests are headerless and quota-bounded, while an optional user key raises limits.</li> <li>Green web builds on <code>main</code> now emit an actionable manual-deploy reminder, so site changes cannot quietly appear shipped while Cloudflare still serves an older revision.</li> <li>Mistral AI is a first-class provider route, including Codestral models, first-party reasoning support, authentication, picker entries, and aliases.</li> <li>Headless <code>Bash</code> can transfer explicitly requested persistent Unix services out of an exec run, with ownership and cleanup receipts.</li> <li><code>/remote-env</code> opens hosted Work from the current GitHub or CNB branch tip and states exactly which unpushed, dirty, ignored, secret, and session state stays local.</li> <li>Linux ARM64 release and nightly assets are static musl builds with native launch checks.</li> <li>Maintainers can report observed daily active installs from the same anonymous, aggregate telemetry dataset; no additional client data is collected.</li> <li>Fleet-dispatched members under a read-only evidence (no-network) ceiling now keep the <code>Web</code> tool's read-only <code>search</code> and <code>fetch</code> actions — parity with an ordinary scout — while every reaching surface (<code>web.run</code>, <code>fetch_url</code>, <code>github</code>, MCP) stays denied and the sentinel-backed capability envelope remains the fail-closed backstop.</li> <li><code>/fleet setup</code> can show an optional, deterministic, unratified role-to-model advisory built only from configured ready routes. Accept, edit, and reject all remain inside the existing human-reviewed profile save boundary; the advisory never launches a Fleet or writes a second configuration.</li> <li><code>/update</code> checks for a newer Codewhale release and installs it from inside the TUI, while <code>tui_help</code> gives agents the same command and key map users see.</li> <li>Markdown file paths render as OSC 8 links where the terminal supports them, and every agent row can open that agent's transcript directly.</li> <li>ACP editor sessions can execute multi-round file, search, Git, patch, and explicitly enabled shell tool calls through the shared Runtime registry. Shell access requires both the client's terminal capability and Codewhale's headless shell opt-in, and cancellation stops an in-flight tool before the turn returns (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5225</a> by <a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@rafaelcavalheri</a>).</li> <li>Lowercase <code>read</code> returns bounded typed PNG, JPEG, GIF, and WebP results to image-capable Chat, Responses, Anthropic, and ACP routes. Text-only routes receive an explicit omission receipt; image bytes never spill into ordinary transcript, export, compaction, or relay text.</li> </ul> <h3>Changed</h3> <ul> <li>Anonymous usage counting is on by default for fresh installs and disclosed in a native first-run Codewhale modal with an immediate opt-out. Prior declines remain off. Codewhale does not collect conversations, code, prompts, files, repo or branch names, credentials, model content, or per-turn activity timelines.</li> <li>Wide terminals use a responsive, full-screen ocean canvas with modest gutters: prose keeps a readable measure while tools, diffs, work surfaces, the composer, and status chrome can use the available width. Turn and major activity seams breathe without padding every call inside a tool group.</li> <li>Root CLI help describes product actions directly instead of exposing internal TUI/runtime layers.</li> <li><code>Bash action="wait"</code> now blocks by default when a wait is requested; callers can still ask for a nonblocking snapshot, and persistent service ownership remains explicit.</li> <li>Compaction is one cache-stable summary request followed by one committed replacement summary and a bounded recent-message tail. Older saved sessions still restore.</li> <li>Ask, Work, Auto-Review, and Full Access share one stable base prompt. Modes continue to differ through permissions and the live tool catalog; the former Act label is now Work throughout the product and shipped locales.</li> <li>Full Access now auto-approves non-bypassable tools consistently, and the default choice shown on ordinary approval cards is configurable.</li> <li>Model, context-window, dispatch-name, and nested-agent spawn receipts report the route and limits actually used rather than silently substituting a guessed identity.</li> <li>Child-agent launches mint one immutable route receipt before admission and preserve it through status, interruption, completion, resume, Work Graph, and ledger projections, so provider/model attribution cannot drift (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5305</a>).</li> <li>Goal runs no longer stop because of internal continuation, repeated-gap, or unanswered-question guards. Explicit user limits and terminal goal states remain authoritative.</li> <li>Account-owned <code>/rc</code> remote control now keeps exclusive ownership and a crash-recoverable delivery journal until the server acknowledges terminal, approval, failure, and snapshot state.</li> <li><code>todo_write</code> is an optional progress surface rather than required model ceremony.</li> <li>New turns use one small, stable toolbox: <code>read</code>, <code>write</code>, <code>edit</code>, <code>bash</code>, <code>agent</code>, <code>todo_write</code>, and <code>tool_search</code>. The optional progress tool stays visible as familiar working memory; specialized native, Web, MCP, plugin, memory, task, and verification tools are policy-filtered and searchable; activated schemas stay in a bounded per-conversation cache. Every sub-agent keeps its own search and cache, including policy-allowed Web research, while forked context and parent activations remain warm starts rather than allowlists.</li> <li>The direct file and shell schemas follow Pi's deliberately small contract: bounded complete-line reads, hash-free writes, unambiguous multi-edit with BOM/CRLF preservation and conservative fuzzy matching, and one foreground <code>bash</code> command with a bounded chronological output tail. Modes change execution authority, not those primitive names.</li> <li>Codewhale no longer re-states the To-do list to the model. The model learns what is on the list from the tool result its own <code>todo_write</code> call returned, which is ordinary conversation history — the same way Pi's To-do works. The transient <code><codewhale:work_state></code> block that used to ride the tail of every parent turn-loop and sub-agent step request is gone, along with the stable system prefix being disturbed by list changes. A snapshot is still shown once, where a person asked for it: the <code><codewhale:fork_state></code> block a newly forked sub-agent is handed, <code>/relay</code> handoff instructions, and the agent card. The complete To-do stays visible in the UI. A structural test asserts real outbound provider request bodies do not carry the list.</li> <li>Scout and Reviewer name the read-only investigator roles. Both expose exactly one shell entry point — canonical lowercase <code>bash</code>, bounded by the strict read-only classifier — and the legacy <code>Bash</code> alias stays denied in the catalog and at dispatch. Previously a case-insensitive name match let a call spelled <code>Bash</code> execute through that carve-out, returning raw shell to a read-only role.</li> </ul> <h3>Fixed</h3> <ul> <li> Sending more context while a lowercase <code>bash</code> command is running now moves the command to <code>/jobs</code> and returns a successful running receipt instead of falsely reporting <code>Command exited with code -1</code>; the process keeps running and its completion still arrives through the normal runtime event. </li> <li> First-run usage disclosure now opens as a native Codewhale modal instead of a shell questionnaire before application startup. Telemetry remains unarmed until the native choice is made, and an in-memory Disable choice governs the current session even when its preference cannot be saved. </li> <li> <code>/compact</code> completion, failure, queued, duplicate, and mailbox outcomes are durable transcript receipts instead of short-lived toasts. A stray terminal event can no longer leave every later compaction stuck as already running. </li> <li> Compaction now follows Codex's simple transcript shape: recent user context followed by one ordinary history checkpoint. It never appends the summary, the To-do list, or volatile shell/worker state to the standing system prompt; reloads migrate the persisted carrier back into exactly one history item. </li> <li> Automatic compaction uses a percentage of the real context window, clamped to the route's spendable ceiling. Pressure comes from the current parent-route prompt, not cumulative billing or child-model usage. </li> <li> Compaction, review, verify, routing, setup, Fleet, MCP, RLM, vision, translation, and sub-agent calls inherit the resolved route's normal output, sampling, and reasoning policy. Small internal-task token caps no longer truncate thinking routes or special-case individual providers. </li> <li> Incomplete provider responses fail truthfully across ordinary turns and every internal model consumer. Partial text stays interrupted, pending tool calls do not execute, and billed usage is retained. </li> <li> Transport-only <code>(reasoning omitted)</code> placeholders no longer enter new transcripts and are filtered from restored sessions. Reasoning expand/collapse actions stay attached to the exact rendered cell, including after replacement, restore, filtering, and resize (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5291</a>). </li> <li> Step-budget exhaustion is a typed failure and cannot release a pending persistent service. Cancellation after terminal usage still charges the turn. </li> <li> Deferred tools now preserve a completed result when a provider reuses its tool-call ID on the retry turn, preventing successful plugin calls from entering a repeated execution loop. </li> <li> Website setup, provider, diagnostics, Fleet, and single-runtime claims now match the source candidate. </li> <li> Opening the sub-agent register no longer hides the to-do list: the Agents panel shows the full register and the durable checklist together, and the register header is a two-way door that returns to Tasks on a second click. </li> <li> The ⌥V / Alt+V details chord opens the selected work-surface row's own inspector instead of the transcript's nearest tool cell, so a selected to-do row shows its own content rather than the latest reasoning. </li> <li> The first-run usage disclosure now asks a clear question — "Help improve Codewhale?" — with unambiguous "Yes, keep anonymous counts" / "No, turn off tracking" choices in every shipped locale, and states the persistent opt-out command. Consent semantics are unchanged: telemetry stays unarmed until a choice is made. </li> <li> macOS screencapture screenshots referenced in a message are copied to a stable attachments directory the moment the message is received, and the reference is rewritten to the stable path, so the image still exists when the agent reads it. Only files under a screencapture "Temporary Items" directory are touched; copies are idempotent and a failed copy keeps the original reference. </li> <li> Manual <code>/compact</code> during an active turn now queues even when the engine's bounded op mailbox is saturated. The request defers client-side, retries as mailbox slots free, and cannot latch as already running after it settles. </li> <li> Interactive <code>/load</code>, startup <code>--resume</code>, and <code>/resume</code> picker paths preserve the persisted provider, endpoint, and model identity; picker resume also leaves a durable transcript receipt. </li> <li> Relative <code>mcp_config_path</code> values no longer depend on the launch directory or silently load an empty server pool: Codewhale warns and falls back to the user-global MCP configuration. Explicit absolute paths remain authoritative. </li> <li> Alibaba Model Studio <code>qwen3.8-max</code> and <code>qwen3.8-max-preview</code> still stream their current reasoning, but no longer replay historical <code>reasoning_content</code> that those routes do not accept. Historical reasoning replay is now gated by the exact provider/API/model contract, so unknown <code>*-thinking</code> lookalikes fail closed while documented Qwen, Kimi, DeepSeek, Mistral, Anthropic, and Responses continuity rules remain intact. </li> <li> Compatibility File/patch calls retain optional content-hash guards when a caller supplies them. The new direct <code>write</code> and <code>edit</code> schemas do not expose hash or prior-read ceremony. </li> <li> Shell previews hold back incomplete UTF-8 sequences instead of emitting replacement characters, and compaction receipts report token deltas. </li> <li> Nested agents may narrow but can never widen their inherited depth budget (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5317</a> by <a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@ousamabenyounes</a>). </li> <li> Container publication now assembles AMD64 and ARM64 images in parallel on native runners from the already-verified static release binaries, then publishes and checks one multi-architecture manifest. It no longer rebuilds both targets through the single long-running QEMU job that lost its runner. </li> </ul> <h3>Removed</h3> <ul> <li>The no-progress guard, repeated-read guard, and injected tool-error strategy coaching. Productive polling, repeated inspection, and model-owned recovery are no longer interrupted by runtime heuristics.</li> <li>Never-wired decision-card, keybinding, hover, shell-execution, engine-op, and release-script paths were deleted so the supported runtime has one route for each behavior.</li> </ul> <h2>Contributors</h2> <ul> <li>Xavier Pestel (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@xavierpestel-ai</a>) — Mistral AI provider route (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5295</a>).</li> <li>Ben Younes (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@ousamabenyounes</a>) — inherited nested-agent depth cap (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5317</a>).</li> <li>Rafael Cavalheri (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@rafaelcavalheri</a>) — ACP agentic tool turns (<a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5225</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044349/4267086/github-release-codewhale-hqcodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.7 (13.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.713.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.7</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.7</h2> Codewhale v0.9.7 keeps the catalog ordinary. Grok 4.6 lands as a normal catalog row instead of a provider-shaped pile of special cases, OrcaRouter joins as a named provider, and a panic-safety advisory in <code>lru</code> is cleared by lifting the pin that caused it rather than living around it. <h3>Added</h3> <ul> <li>Grok 4.6 is the direct xAI default, with the <code>grok</code> alias moving onto it and <code>grok-4.5</code> still explicitly selectable. Its 500K context, text/image input, tool and structured-output support, <code>low</code>/<code>medium</code>/<code>high</code>/<code>xhigh</code> reasoning efforts (default <code>high</code>), and server-side web search all come from the Models.dev-shaped catalog rather than model-specific code. <code>reasoning_effort</code> reaches the wire only on the exact first-party <code>https://api.x.ai/v1</code> route, and the usage-aware 200K-token pricing boundary is scoped to direct xAI so aggregator routes reusing the model slug cannot inherit xAI billing.</li> <li>OrcaRouter is a first-class named provider: <code>ORCAROUTER_API_KEY</code>, default base URL <code>https://api.orcarouter.ai/v1</code>, <code>deepseek/deepseek-v4-pro</code> default, <code>orcarouter/auto</code> routing, CLI <code>--provider</code> selector, and TUI picker entries (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5321</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Reasoning-effort normalization and the model picker read a model's published <code>reasoning_options</code> list from the catalog instead of collapsing every route to the historic Low/Medium ladder. Any catalog row that publishes an effort list keeps its own vocabulary.</li> <li>Docs record DeepSeek's live <code>DeepSeek-V4-Pro-0813</code> backend label while the callable API ID stays <code>deepseek-v4-pro</code>. No aliases are remapped and no <code>deepseek-v4-pro[1m]</code> selector is sent.</li> </ul> <h3>Fixed</h3> <ul> <li>Copying a user or assistant message takes its canonical content instead of reserialized transcript lines, keeping role glyphs, continuation rails, and visual wrapping out of the clipboard while preserving authored Unicode, Markdown, and hard line breaks. Tool and Thinking cells stay on the existing full-transcript path (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5319</a>).</li> <li><code>load_session</code> no longer runs crash recovery on every read. Snapshot reads go through a side-effect-free <code>load_session_snapshot</code> and recovery is explicit via <code>recover_session_for_resume</code>, so an embedding host inspecting a durable session while a tool is still running no longer gets a spurious crash repair (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5320</a>).</li> </ul> <h3>Security</h3> <ul> <li><code>lru</code> moves to 0.18 to clear RUSTSEC-2026-0253, where <code>LruCache::pop()</code> was not panic-safe and could leave dangling list pointers. The <code>ratatui-core</code> <code>=0.1.0</code> pin that transitively forced <code>lru</code> ^0.16 is lifted, so <code>ColorCompatBackend</code> now answers <code>get_cursor_position()</code> from tracked cursor state — the upstream-recommended workaround for the startup CPR race (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">ratatui/ratatui#2483</a>, <a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">ratatui/ratatui#2640</a>) that the pin originally worked around. <code>ratatui</code> itself stays pinned at <code>=0.30.0</code>, so the API surface is unchanged.</li> </ul> <h3>Known issues</h3> <ul> <li>The integration test <code>exec_persistent_service::failed_exec_kills_pending_service_and_exits_nonzero</code> is a confirmed flake under parallel load ("service pid file never appeared"). It passes in isolation and is unrelated to any v0.9.7 change.</li> </ul> <h2>Contributors</h2> <ul> <li>XhesicaFrost (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@XhesicaFrost</a>) — canonical message copy (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5319</a>).</li> <li>h3c-hexin (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>) — session snapshot and crash-recovery split (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5320</a>).</li> <li>XiaoHuo888-hue (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@XiaoHuo888-hue</a>) — OrcaRouter provider registration (<a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5321</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044348/4267085/github-release-codewhale-hqcodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.9 (18.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.918.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.9</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.9</h2> Codewhale v0.9.9 is a truth-and-resilience release: the shell tool can no longer wedge a session when the host runs out of disk or descriptors, unverified context windows and output ceilings are labeled honestly at every surface, DeepSeek V4 is priced on the published peak/off-peak tiers, SSE UTF-8 fails closed in every dialect, Fleet shadowing is visible, bwrap gets container essentials and extra roots, the <code>dsh</code> skin rides the bundle profile, the <code>agent</code> tool schema is down to 12 fields, and README/website locales grow to 18 and 8. <h3>Fixed</h3> <ul> <li>The lowercase <code>bash</code> tool no longer wedges when its complete-output spill file cannot be created: a full temp volume or exhausted descriptor table used to fail every call — <code>echo ok</code> included — with the harness-internal "Failed to create streaming shell output" and never recover until the host was cleaned up. The spill is now best-effort (the bounded tail is still returned and the truncation notice says why the full-output path is missing), and any remaining spawn/stream failure names the exhausted resource — disk, file descriptors, memory — and says the next call is safe to retry (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5465</a>; the wedge that took out the owner's own 0.9.9 session).</li> <li>A concrete route/offering output limit now outranks the conservative 8,192-token compatibility guess for an uncatalogued model. Routes that publish no output limit remain fail-closed, documented model ceilings stay authoritative, and a route limit can never raise the requested cap (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5460</a>).</li> <li>Context-window honesty at every surface (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5239</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5441</a>): the <code>model-name hint</code> and <code>fallback</code> rungs of the context-window ladder are guesses, and every surface that renders one now says so — the status line, <code>/status</code>, <code>/config</code>, the context-pressure message, the model picker chips, and the auto-router inventory. Unverified windows still drive real budgets (compaction trigger, context meter, output reservation); they just stop reading as capabilities anyone checked. A window parsed from an <code>_Nk</code> model-name suffix (<code>qwen3-32b-256k</code> → 256K) is now its own <code>model-name hint</code> rung below <code>catalog</code>, because it is optimistic rather than conservative — a catalog or provider-reported value beats it. The <code>[providers.<name>] context_window</code> override remains the hard fix and renders as <code>configured</code> with no marker.</li> <li>Output-ceiling honesty (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5440</a>): an Anthropic-family model the catalog does not describe keeps the 64K Messages floor as its clamp and the ChatGPT/ Codex OAuth route keeps its 4K policy, but <code>OutputCeilingSource</code> gained an <code>unverified</code> rung for both, so exec-stream receipts and the model picker label them <code>unverified</code>/"assumed floor" instead of <code>documented</code>. Clamp values are unchanged.</li> <li>Telemetry default-on is visible (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5441</a>): <code>codewhale doctor</code>'s runtime-posture section gained a <code>telemetry=on (default)</code>-style row with the source that decided it (cli | env | config | default), and <code>codewhale config get telemetry</code> reports the resolved consent with its source instead of <code>key not found</code> on a machine whose batches ship. Truth change only; resolution and behavior are untouched.</li> <li>Fleet: a scout's read-only shell carve-out (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5428</a>) is now honored by both the posture gate and the execution envelope, so <code>git log</code>, <code>find | head</code>, <code>npm view</code> and the other bounded read-only commands run in-place instead of being refused as "Executes" (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>). Delegation still never widens authority: the role-isolation test and docs/SUBAGENTS.md pin that a child cannot exceed its parent's posture (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5435</a>).</li> <li><code>/rename</code> and <code>/title</code> now apply mid-first-turn: the session file does not exist until the first autosave, so the rename fell through with NotFound; the shared path now prefers the per-session checkpoint and rebuilds from App state, with a PTY regression test through the live event loop (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5430</a>).</li> <li><code>integrations dsh plan</code> no longer refuses DeepSeek's default Responses-dialect route (<code>deepseek-v4-flash</code>); Responses and Anthropic-Messages routes are carried through pi-ai <code>openai-responses</code> / <code>anthropic-messages</code> instead of being approximated or refused; only credentialed base URLs are still refused, with an error that names provider and model (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5434</a>).</li> <li>Session cost no longer sits at <code>unverified_live_pricing</code> when live pricing cannot be verified (control-plane 503, Models.dev capabilities-only overlays): provider-docs bundled fallback rates for the DeepSeek V4 family on Fireworks / OpenCode Zen restore a usable figure, live per-provider rows still win, and <code>kimi-k3</code> stays unpriced until a published rate exists (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a>; harvested from <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5402</a>).</li> <li>Release assets: <code>release.yml</code> asset-freshness checks compare against the release job's own <code>started_at</code>, so job-level reruns of the npm step are no longer poisoned by earlier uploads (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5429</a>).</li> <li>macOS CI: the <code>agent_focus_pty</code> auto-review receipt test waited on a worker that had already completed and raced the rail's focus; it now holds the child's wrap-up and waits for a settled live row (refs <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5403</a>).</li> <li>DeepSeek V4 pricing follows the published peak/off-peak tiers (peak 01:00–04:00 and 06:00–10:00 UTC; off-peak is half of peak) for <code>deepseek-v4-flash</code> and <code>deepseek-v4-pro</code> in USD and CNY, resolved from each turn's recorded time; the stale single-tier rows understated cost up to ~4×. Because every direct DeepSeek first-party rate is now time-windowed, the scorecard fails closed (<code>missing_recorded_time</code>) on an undated DeepSeek turn instead of guessing a tier (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5470</a>; <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a> follow-up, verified against api-docs.deepseek.com on 2026-08-17).</li> <li>SSE UTF-8 split across HTTP/2 DATA frames now fails closed in every streaming dialect: a shared strict decoder, tail flush, and <code>decode_failed</code> propagation (<code>InvalidSseUtf8</code>) replace the per-dialect approximations, with byte-chunk decoder tests (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5374</a>; supersedes draft <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5404</a>).</li> <li>CI: <code>release_four_read_only_fleet_roles_launch_with_canonical_prompts</code> answered Fleet children with SSE while they call the blocking JSON path; the parse failure was retried and double-counted the worker on slow macOS runners (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5471</a>; refs <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> <li>Context: every web tool surface (<code>Web</code>, <code>web_search</code>, <code>web.run</code>, <code>fetch_url</code>) now uses the noisy-result soft limit, so large fetches are compacted like shell output instead of consuming the ordinary hard limit (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5474</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>).</li> <li>Routing: a lowercase saved selector such as <code>glm-5.2</code> resolves against the owning Z.ai / DeepSeek catalog row (case-fold fallback, only when exactly one provider-owned wire id matches) instead of being classified as another provider's bare model (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>; diagnosis by <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@asto18089</a> in <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">Pinvou#14</a>).</li> <li>Model catalog brought current as of 2026-08-17 against the official pricing pages: gpt-5.6-terra / gpt-5.6-luna rates, <code>claude-sonnet-5</code> keeps $2/$10 (the announced September increase was withdrawn), <code>claude-opus-5</code> added, <code>kimi-k3</code> and <code>kimi-k2.7-code-highspeed</code>, <code>MiniMax-M2.7-highspeed</code>, Mistral first-party rows, xAI <code>grok-4.5</code> / <code>grok-4.3</code> with long-context tiers, Gemini and Qwen limits, and RedNote's <code>dots3-note</code> preview as an OpenRouter row (no first-party API exists yet) — every number carries its source and a pinned test (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5485</a>).</li> <li>Website: copy on codewhale.net rewritten in plain declarative sentences — one idea per sentence, numbers from the generated facts, no self-narration — with a voice sheet at docs/design/WEB_VOICE.md (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5483</a>).</li> <li>CI: the release workflows no longer restore npm/cargo caches after checking out a caller-supplied SHA — the CodeQL cache-poisoning Highs <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#88</a>–<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#107</a> are closed with a contract test over the workflow files (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5463</a>).</li> <li>Compact TUI rows below 60 columns no longer reserve a hidden session-metrics strip, so narrow terminals reclaim the row instead of clipping the transcript (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5486</a>).</li> <li>Ghostty's truecolor underwater field now uses a dedicated synchronized 60 FPS lane instead of the legacy 30 FPS compatibility cap, with continuous caustic fades replacing visibly stepped color changes.</li> <li>Live reasoning's advertised <code>Space:expand</code> action now runs before the composer's first-character paste-burst hold, while spaces in an active paste remain payload. The newest reasoning preview also spends only genuinely free viewport rows before truncating instead of stopping at the fixed 10/12-row fallback on roomy terminals.</li> <li>Strict <code>cargo doc</code> builds no longer fail on bare URLs in rustdoc comments; the remaining links are explicit Markdown targets (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5489</a>).</li> </ul> <h3>Changed</h3> <ul> <li>The model-facing <code>agent</code> tool advertises exactly 12 fields — <code>action</code>, <code>prompt</code>, <code>type</code>, <code>profile</code>, <code>name</code>, <code>agent_id</code>, <code>message</code>, <code>until</code>, <code>detached</code>, <code>worktree</code>, <code>write_roots</code>, <code>resume_from</code> — down from 33 (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5324</a>, refs <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5123</a>). Budgets (<code>max_steps</code>, <code>wall_time_secs</code>, <code>max_depth</code>), routing overrides (<code>model</code>, <code>model_strength</code>, <code>thinking</code>), worktree-path knobs, the deliberate/spawn-contract fields and the wait/status/interrupt extras moved off the advertised schema. Every removed field stays parse-accepted and honored unchanged (same contract as <code>token_budget</code>), so saved transcripts, ACP/MCP clients and Fleet configs replay as-is; the <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>/<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5435</a> containment clamps are untouched. Child budgets now resolve from role defaults (60/120 turns, 1800 s wall time, unchanged clamps) and new <code>[subagents]</code> keys <code>default_max_steps</code> / <code>default_wall_time_secs</code>. Because the tool catalog is part of the session-pinned prompt prefix (docs/CACHE.md), upgrading re-fills the KV prefix once per session.</li> <li>TUI prose — user messages, assistant answers, and reasoning/thinking — now wraps at the full content width on wide terminals, matching tool/status cells, instead of stopping at a 105-column rail that left a dead right margin on ultrawide displays (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5436</a>).</li> <li>Configured skill prompts are stable across session roots and operating systems: only custom configured roots hide their physical path, ordinary workspace/global skills keep a discoverable privacy-safe path, warning replacements are boundary-aware (including non-UTF-8 Unix paths), and Windows separators render as <code>/</code>. The skills prompt is also 50 bytes leaner without raising a runtime-contract ceiling (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5492</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5473</a>).</li> <li>Auto-router classifier requests accept <code>[auto.router] timeout_secs</code>, while preserving the existing default when the key is absent (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5494</a>).</li> <li>Every <code>ci.yml</code> job now has an explicit 10–90 minute timeout appropriate to its workload, bounding stale assigned runners instead of inheriting GitHub's six-hour default (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5495</a>).</li> <li>The docs shell and shared web components now route localized copy through the typed dictionary spine; these are two incremental phases of <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5337</a>, not completion of the full epic (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5488</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5490</a>).</li> <li>Dependency: rusqlite 0.40.2 (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5391</a>).</li> <li>Documentation: stale A/B/C-tier references, provider defaults, module descriptions, and line anchors now match the current code (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5481</a>).</li> </ul> <h3>Added</h3> <ul> <li><code>[transcript] prose_measure</code> (positive integer, optional): caps prose wrap at N columns for owners who want a bounded reading measure on ultrawide terminals. <code>0</code> or absent keeps the full width; negative or non-integer values are rejected with a clear config error. Tool, diff, and status cells never inherit the cap (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5436</a>).</li> <li>Localization: README translations for Français, Deutsch, 繁體中文, हिन्दी, Türkçe, Italiano, Polski, العربية and Català join the existing nine (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5451</a>); codewhale.net routes fr, de, ca, hi, tr, it, pl and ar (with <code>dir="rtl"</code> plumbing) as partial locales (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5453</a>).</li> <li>Docs: README Integrations section (incl. the DeepSeek Harness <code>dsh</code> plugin path, docs/INTEGRATIONS_DSH.md) localized across all READMEs; RFC keeping the deterministic-first auto-review hybrid (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5427</a>); Claude Code parity reference for agents/workflows/plugins/skills (docs/design/CLAUDE_CODE_PARITY.md); config.example.toml / SUBAGENTS.md / TOOL_LIFECYCLE.md brought back in line with the code (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5447</a>).</li> <li><code>dsh</code> integration: the Codewhale palette is applied through the bundle profile via dsh's documented <code>overrideTokens</code> (on by default; <code>codewhale integrations dsh update --skin false</code> turns it off), replacing the 0.9.8 exported-CSS skin that dsh's inline body variables overrode (docs/design/DSH_BUNDLE_SKIN.md, docs/INTEGRATIONS_DSH.md) (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5469</a>).</li> <li><code>dsh</code> integration: an ambient ocean scene behind the DSH web UI — slow whale silhouettes, a school of <code>><></code> glyph fish, bubbles — drawn on a canvas under a translucent veil of the Codewhale palette, plus an explicit responsive <code>WHALE BROTHERS / CODEWHALE × DEEPSEEK HARNESS</code> lockup; light and dark, ~30 fps capped, paused when hidden, a static frame under <code>prefers-reduced-motion</code>; on by default with the skin, <code>codewhale integrations dsh update --ocean false</code> turns it off (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5484</a>).</li> <li>Fleet: agent shadowing is visible — a roster-row badge, a Layers block in agent detail, and a <code>doctor</code> "Fleet roster layers" section (JSON <code>operate_fleet.roster.multi_layer</code>), in all 15 TUI locales. Layer collapse and <code>[fleet.profiles]</code> migration stay for 0.9.10 (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5098</a>).</li> <li>Sandbox: bwrap containers get the <code>--dev/--proc/--tmpfs</code> essentials plus configurable extra roots (<code>bwrap_ro_roots</code> / <code>bwrap_dev_roots</code>) so toolchains that live outside the workspace stay reachable read-only (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5410</a>).</li> <li>Tests: <code>crates/tui/tests/README.md</code> states the keyless assembled-journey rule and maps the Auto-Review guardian acceptance items to the engine journeys that exercise them (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5361</a>).</li> <li>OrcaRouter's default endpoint is classified as an aggregator billing surface, so pricing and session-cost reporting use the correct billing posture instead of treating it as a first-party provider (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5493</a>).</li> <li>Dependencies: ratatui 0.30.2, thiserror 2.0.20.</li> </ul> <h3>Removed</h3> <ul> <li><code>dsh</code> integration: the exported-CSS skin file and its "skin export" status line (superseded by the bundle-applied <code>overrideTokens</code> skin, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5469</a>).</li> </ul> <h2>Contributors</h2> <ul> <li>hexin (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>) — a concrete route/offering output limit outranks the 8,192-token compatibility guess for an uncatalogued model (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5461</a>, closes <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5460</a>); web tool results use the noisy soft limit (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5474</a>); owned direct model casing resolves safely (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>); and configured-skill prompts stay stable across ephemeral roots and operating systems (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5492</a>, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5473</a>).</li> <li>Gabriel-Degret (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a>) — configurable auto-router classifier timeout (<a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5494</a>; first contribution).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@asto18089</a> — diagnosed the Z.ai <code>glm-5.2</code> casing collision and wrote the first provider-scoped fix in <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">Pinvou#14</a> (carried upstream in <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>).</li> <li>Reports and reproductions that shaped this release: <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@hardy922</a> (context- window honesty, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5239</a>), <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@redstar</a> (bwrap extra roots, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5410</a>), <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@all-lopezg</a> (SSE UTF-8 garbling on DeepSeek Flash, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5374</a>), <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@alitvak69</a> (unverified live pricing, <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a>), and <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a> (the macOS filtered-suite hang investigation on <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044347/4267084/github-release-codewhale-hqcodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.8 (20.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.820.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.8</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.8</h2> Codewhale v0.9.8 ships the remaining assigned finish. Remaining web settings polish moves to v0.9.9. Prefab third-party templates that have a published OpenAI-compatible host ship here (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5350</a>). <h3>Fixed</h3> <ul> <li> <code>sudo</code> (and <code>su</code>/setuid helpers) work again for wheel-group administrators who want Codewhale to be able to escalate: the Linux startup hardening's irreversible <code>PR_SET_NO_NEW_PRIVS</code> flag — inherited by every child process — is now skippable with <code>CODEWHALE_NO_NEW_PRIVS=0</code> (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5413</a>). The flag stays on by default; the no-ptrace and no-core-dump measures are never skipped. </li> <li> Abort-class process deaths no longer poison the terminal (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5424</a>). A stack overflow, allocation failure, or double panic skips the panic hook and every cleanup guard, which is how a v0.9.7 user's mid-turn exit left mouse capture leaking SGR sequences into their shell. An async-signal-safe handler now restores the terminal modes and appends a one-line cause marker to <code>~/.codewhale/crashes/last-fatal-signal.log</code> before re-raising, keeping the honest 128+signal wait status. A SIGKILL (OOM killer) remains uninterceptable by design. </li> </ul> <h3>Changed</h3> <ul> <li> Prompt-cache prefix is pinned for the session. The tool loop no longer recomposes the system prompt from disk on every model step, so an agent writing a file no longer busts the provider KV prefix cache mid-turn. The system prompt and tool catalog are re-composed only on a declared header change (<code>/model</code>, mode, goal, session resume), which re-pins under a logged reason; an undeclared change is reported as drift and the original pin is kept instead of silently becoming the new baseline. Workspace, AGENTS.md, skills, memory, and goal drift now reaches the model as one bounded <code><context_update></code> user message at the next user turn — a history append, not a header rewrite. <code>/cache stats</code> shows the pin reason, the last-miss reason, the undeclared-drift count, and the context-update count. See <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">docs/CACHE.md</a>. </li> <li> Plugin compatibility is now per-component. A reviewed, trusted, enabled bundle that mixes Skills or MCP with unsupported commands, agents, hooks, LSP, native, filesystem-roots, or lifecycle-mutation declarations keeps the supported adapters active and reports the rest as inactive (<code>full</code> / <code>partial</code> / <code>unsupported</code>). All-unsupported bundles still cannot be enabled. The capability hash is now v2 and binds this build's activation policy, so older v1 receipts and any later adapter-enablement change fail closed as needs-review. Skills and each MCP transport re-request their own capability at the consumption boundary. </li> </ul> <h3>Added</h3> <ul> <li> Composer multiline mode is available in <code>/settings</code>. When enabled, Enter inserts a new line and Shift+Enter sends the message (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5345</a>, reported and tracked by <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@AiurArtanis</a>). </li> <li> <code>/plugin marketplace add|list|show|remove|install</code> completes the federated marketplace journey (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5311</a>). <code>add</code> reads one LOCAL catalog document in the real published schemas (Kimi, Claude, Codex, or Codewhale native) — no network, regular files only — and persists it beside the plugin state with the same hardened, fail-closed store. <code>list</code>/<code>show</code> render every candidate with per-entry diagnostics, display-only tiers, and honest install plans that say when Codewhale cannot fetch a source; <code>install</code> routes through the existing reviewed installer, so installed bundles still enter disabled and untrusted. Foreign auto-install policy (Codex <code>INSTALLED_BY_DEFAULT</code>) is visibly ignored; nothing is auto-installed, auto-trusted, or granted vendor trust. </li> <li> <code>/rc</code> attach now includes an observed <code>owner/name</code> git remote when the folder has a GitHub, CNB, or Gitee origin, so CWC can label the paired session. Paths stay off the wire. Reconnect after both this client and CWC <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#202</a> land to backfill existing empty rows. </li> <li> The local Runtime web client keeps the thread rail clipped so New thread cannot paint over the session fact chips. Chips wrap instead of sliding under the rail. </li> <li> Z.ai <code>GLM-5.3</code> is live on the Coding Plan and is now the default direct Z.ai model: <code>DEFAULT_ZAI_MODEL</code> resolves to <code>GLM-5.3</code> in both <code>codewhale-tui</code> and <code>codewhale-config</code>, and it is the first <code>/model</code> row after <code>/provider zai</code>. Explicit <code>GLM-5.2</code> selections (<code>model = "GLM-5.2"</code> and its <code>glm-5.2</code> aliases) keep their own id — only the default moved. Limits and reasoning options still inherit from <code>GLM-5.2</code> until Z.ai publishes distinct 5.3 numbers. No USD price is claimed. A live call can still 429 with entitlement code 1311 on accounts that are not provisioned for 5.3. </li> <li> The TUI transcript renders Markdown blockquotes (<code>></code> lines) with a quote rail — nested quotes, inline bold/code/links, wrapped continuation rows, and selection copy that keeps the quote text and skips the rail chrome. </li> <li> Sub-agent details show the resolved model, fleet role, and type. Labels use the session/role name instead of a generic Agent N (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5371</a>, <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5287</a>). </li> <li> Documented catalogue output ceilings (DeepSeek V4 384K) are honored on the request. A clean output-limit stop continues the turn instead of killing it (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5373</a>). </li> <li> Ollama Cloud is a first-class hosted provider (<code>/provider ollama-cloud</code>) on the official OpenAI-compatible <code>https://ollama.com/v1</code> route. Local Ollama stays keyless. The exact released <code>ollama</code> + Cloud URL tuple keeps a bounded compatibility path across saved sessions, Fleet, and nested subagents; neighboring remotes stay custom and fail closed against inherited official credentials. </li> <li> Homebrew ships a <code>codewhale</code> formula. <code>brew tap Hmbown/deepseek-tui && brew install codewhale</code> is the install path; <code>brew upgrade codewhale</code> updates it. The legacy <code>deepseek-tui</code> formula remains a deprecated alias for one overlap release. </li> <li> Terminal tab/window titles now carry the existing saved session name before the live state (<code>Codewhale</code>, <code>reasoning…</code>, <code>using tool…</code>, <code>done</code>), so parallel sessions are identifiable at a glance without a second title setting. <code>/title <name></code> is a discoverable alias for <code>/rename</code>; both update the one session name shown in the picker, composer, and terminal tab. Control, bidi, and zero-width format characters are stripped from the saved name itself, so <code>/title</code>, <code>/rename</code>, the picker, the Runtime API, <code>codewhale sessions</code>, and the OSC 0 tab title all carry the same escape-free text (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5419</a>, Sh1Zuku). </li> <li> Eden AI is a named OpenAI-compatible Chat Completions provider (<code>edenai</code>, aliases <code>eden-ai</code> / <code>eden_ai</code>) with <code>EDENAI_API_KEY</code>, global and EU base-URL overrides, a live provider-scoped model catalog, and <code>deepseek/deepseek-v4-pro</code> as the verified default. Generic reasoning fields stay omitted because Eden AI routes multiple upstream model families (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5422</a>, Kai Nacke). </li> <li> Children (sub-agents and Fleet workers) inherit the session's permission posture faithfully: Auto-Review's deterministic floor and model guardian decide a worker's held calls (fail closed when unavailable, never a prompt); under Ask a held call is raised in the parent's approval UI and the worker waits visibly; Full Access still fails closed on the safety floor. Each prompt-less decision is a one-line note in that worker's transcript (focus mode) and an audit-log record. </li> <li> Worker role defaults keep what the role does not intend to withhold: every built-in role keeps network reads; <code>planner</code> may run read-only shell probes; <code>custom</code> inherits the parent's write/network/shell posture and is narrowed only by its explicit tool list or the spawning call. Read-only roles (<code>scout</code>, <code>reviewer</code>, <code>planner</code>, <code>verifier</code>, <code>consultant</code>) still never write the workspace. The focused worker's header states its effective posture from the runtime snapshot. </li> <li> <code>/workflow status</code>, <code>/workflow cancel [run_id]</code>, <code>/workflow settings</code>, and <code>/workflow help</code> are answered by Codewhale itself from the run journal and live run state — no model turn — and <code>/workflow run <path></code> launches a checked-in workflow as-is. <code>/config workflow</code> and <code>/config goal</code> explain the effective tables. The workflow tool now honors the session <code>[workflow]</code> table (<code>automatic</code>, <code>auto_start_read_only</code>, <code>require_approval_for_writes</code>, limits) instead of product defaults. </li> <li> Goal mode enters as readily as DeepSeek Harness: the agent may create the session goal when a direct request describes a verifiable multi-turn end state, and Codewhale shows a one-line <code>Goal set</code> receipt with how to pause or clear it. Bare <code>/goal</code> shows plain progress (and how to continue when no turn is running), prints usage on an empty session instead of asking the model, and <code>/goal help|status</code> are reserved words. </li> <li> Whale Teams in the terminal: the six Signal Cut whale identities (Scout, Patch, Harbor, Echo, Keel, Lantern) appear as species badges on <code>/fleet</code> roster rows and worker rows, with an identity portrait in the roster detail pane and a six-state word (Resting, Thinking, Working, Waiting for you, Blocked, Offline) derived only from the child's real runtime status. Colors come from the theme tokens, every glyph has an ASCII fallback, and the working wake animates only under full motion. See <code>docs/design/WHALE_TEAMS_TUI.md</code>. </li> <li> A session metrics strip on the phase row (<code>4 turns · 108 steps │ LLM 11m46s · Tool call 1m52s │ TTFT avg 1.5s · 120 tok/s │ Cache hit 99% │ Input 9.3M</code>), on by default as the <code>session_metrics</code> footer item (<code>/statusline</code>, <code>[tui].status_items</code>). Every value comes from engine receipts — turn starts, per-model-call usage with stream time, time-to-first-token and whole-call time, tool start/complete edges, and provider-reported cache and input tokens. Cells without evidence are omitted, never estimated. <code>/status</code> prints the untrimmed line; the phase row sheds its lowest-value groups to fit the columns it actually has. </li> <li> Auto-Review decisions nobody was prompted for are now visible in the transcript as one-line notes: model-guardian allow/deny verdicts with their risk tier and stated reason, guardian failures (denied, fail closed), deterministic policy blocks, and holds Auto-Review denied without pausing. The audit log keeps the full record. <code>/permissions</code> ends with the active posture, what it decides on its own versus never, and the audit-log path. The footer's <code>Esc to interrupt</code> hint is localized. See <code>docs/design/AUTO_MODE_PARITY.md</code> for the Claude Code / Kimi Code parity ledger and follow-ups. </li> <li> <code>codewhale integrations dsh status|plan|connect|update|launch|disable|enable|remove</code> connects an existing official DeepSeek Harness (<code>dsh</code> 0.1.0-rc.6, verified) through Codewhale using only its documented seams: a <code>--patch</code> overlay that pins the exact Codewhale provider/model/endpoint identity (native <code>deepseek-official</code> route, or a hand-declared <code>openai-completions</code> route named <code>codewhale-<provider></code> for OpenAI-compatible providers), the Codewhale permission posture exported as <code>DSH_PERMISSION_MODE</code>, and an append-only receipt. Codewhale writes only under <code>$CODEWHALE_HOME/integrations/dsh/</code>, never copies API keys or edits DSH files, never broadens permissions (<code>--allow-full-access</code> only mirrors an existing Codewhale full-access posture), and reports not-installed / offline / incompatible / detected / connected / stale-config / stale-version / disabled honestly. Anthropic Messages and OpenAI Responses routes are refused as not carriable. The documented DSH plugin path is an explicit opt-in: <code>install-bundle</code> materializes a Codewhale bundle package (<code>codewhale-dsh-bundle</code>, MIT notice retained) and installs it with <code>dsh plugin --profile codewhale add <path></code> into a dedicated <code>codewhale</code> profile (pnpm required, reported truthfully when missing; <code>web</code>/<code>headless</code> untouched), so <code>dsh --profile codewhale</code> alone carries the identity; <code>update</code> regenerates the bundle patch and <code>remove-bundle</code> reverses it, leaving the DSH-owned profile directory in place. <code>/setup tools</code> and <code>codewhale doctor</code> show the read-only detection state; <code>doctor</code> also lists the DSH read-only credential consent alongside Codex and Grok. The optional <code>--skin</code> export writes a Codewhale token stylesheet generated from the TUI palette (Blue Stage dark/light, ombre water column, mode/permission/state colors, reduced-motion fallbacks); DSH exposes no custom-theme API, so the sheet is labeled an unsupported overlay and is never injected. See <code>docs/INTEGRATIONS_DSH.md</code>. </li> </ul> <h3>Fixed</h3> <ul> <li> Selecting the <code>google</code> provider kind resolved to the <code>antigravity</code> TUI identity (and vice versa): the agy provider entry was inserted at different positions in the config-level enum and the TUI's discriminant-indexed lookup table. The table now matches the enum, so provider pickers, sorted display, and kind round-trips are correct. </li> <li> The provider picker's key-entry stage accepted typed input and pastes for OAuth-only providers after <code>antigravity</code> declared OAuth acquisition; those gates now key off the OAuth acquisition class instead of a hard-coded provider identity. </li> <li> The webhook hook sink no longer panics when its HTTP client fails to build; it falls back to a default client (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5381</a>, EvanProgramming). </li> <li> Session-index JSONL writes are serialized behind a process-wide mutex so concurrent state stores cannot drop an append during compaction (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5382</a>, EvanProgramming; complements the cross-process file lock). </li> <li> A billed <code>max_tokens</code> stop followed by a transport error fails the turn instead of continuing into a second request. A clean output-limit stop still continues. Mid-size context windows keep the ordinary 65K internal reservation so compaction does not collapse to the 1K headroom floor when the catalogue documents a matching output ceiling. </li> <li> Thinking cycle, <code>/effort</code>, and Settings now walk each model's real ladder instead of the DeepSeek off/high/max shortcut. Grok 4.6 is auto/low/medium/high/xhigh (cannot disable); Grok 4.5 is auto/low/medium/high; first-party DeepSeek keeps a documented <code>low</code> tier. <code>/effort</code> persists and receipts through the same path as Ctrl+T. </li> <li> Google Gemini is its own backend (<code>/provider google</code>) on the official OpenAI-compatible route with thought-signature capture/replay and fail-closed replay for thinking models. Antigravity (<code>agy</code> 1.1.13) is a separate provider: consent-gated read-only import of the official CLI's login, then a text-only cloud-code stream (<code>/v1internal:streamGenerateContent</code>). Tools, images, and unknown SSE shapes fail closed. Gemini 3.7 Flash is not advertised until a live turn succeeds on this wire. The website 44-count still excludes Antigravity. </li> <li> DeepSeek Flash SSE on macOS no longer turns mid-character HTTP/2 flushes into U+FFFD replacement characters (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5374</a>). Invalid UTF-8 fails the line instead of using lossy decode. </li> <li> <code>[workshop] read_result_max_bytes</code> and <code>tool_result_max_bytes</code> raise the model-visible read/tool-result floor; they never lower the compile-time defaults and cap at 2MiB (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5367</a>). </li> <li> Fireworks and OpenCode Zen DeepSeek V4 Flash/Pro keep a bundled family rate when the live control plane is down, so session cost is not stuck on <code>unverified_live_pricing</code> (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5241</a>). <code>kimi-k3</code> stays unpriced until a published rate exists. </li> <li> Provider setup ships a SenseNova OpenAI-compatible preset (<code>S</code>) on the published <code>https://token.sensenova.cn/v1</code> host (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5350</a>). OpenCode Zen/Go stay first-class rows. Agnes has no published URL, so it has no preset. </li> <li> Privileged release workflows no longer restore rust-cache, sccache, or npm caches after checking out a caller-supplied SHA (CodeQL cache-poisoning <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#88</a>–<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#106</a>). Catalog drift no longer prints raw bundled/upstream blobs (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#107</a>). </li> <li> Cancelling a turn now cancels its foreground child agents with it. </li> <li> Empty compaction no longer wipes conversation history. </li> <li> Wide terminals and tmux panes fill the full available width again for the transcript and composer (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5322</a>). The brief v0.9 session-shell side gutter is gone so expanding a pane rematerializes layout the same way shrinking does. </li> <li> The agent tool schema rejects empty calls. </li> <li> The local web client keeps recovered stream gaps closed, user questions answerable, manual bootstrap access intact, and streamed prose quiet for assistive tech. </li> <li> Website zh-Hans copy now says 宪章, matching the TUI pack (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5397</a>, Lstarsky0). </li> <li> Public website provider facts include Google Gemini and Ollama Cloud (44 runnable routes). Antigravity stays credential-plane-only. Harvested from <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5398</a> (Lstarsky0) with that correction. </li> <li> The website models page carries a truthful read-only settings preview built from repository facts; it never implies the site can change local configuration (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5370</a>, <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5411</a>, mvanhorn). </li> <li> The canonical <code>ultra</code> reasoning effort now maps to each provider's maximum tier alongside the legacy <code>ultracode</code> alias, instead of being silently dropped (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5303</a>, <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5409</a>, buiducnhat). </li> <li> Session titles truncate by character count, not byte offset, so multi-byte titles (CJK, emoji) cut at the intended width and word boundary instead of past the limit (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5415</a>). </li> <li> Wide terminals and tmux panes fill the full available width again for the transcript and composer (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5322</a>). The brief v0.9 session-shell side gutter is gone so expanding a pane rematerializes layout the same way shrinking does. </li> <li> The background verifier test drives the current libtest executable instead of the rustup <code>rustc</code> shim, so the TUI suite no longer depends on <code>$HOME</code> or holds the process-wide test environment lock across an async wait (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5056</a>, <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5423</a>, Isabel Wu). </li> </ul> <h3>Removed</h3> <ul> <li>The source-structure budget ratchet (CI step, checker, baseline JSON). It measured line counts, not quality: every legitimate feature required a hand-edited ceiling and the accompanying "review" was self-review, so it bought ceremony, not protection. Behavior-measuring gates (dead-code, runtime-contract, persistence-backlog) stay enforced.</li> <li>DeepSeek can reuse a key already stored by official DeepSeek Harness (<code>dsh</code>) after <code>codewhale auth external-consent --provider deepseek --mode read-only</code>. Codewhale reads only <code>DEEPSEEK_API_KEY</code> from the exact granted <code>$DSH_HOME/.credentials.yaml</code> and never writes or refreshes that file.</li> <li>The TUI markdown parser now honors CommonMark fence-length rules: a ```` opener is not closed by a shorter ``` line, so <code>></code> content inside a longer fence stays literal code instead of escaping into a quote.</li> <li>Sub-agents finalize when the parent session id changes, so a closed session cannot block new children as a live owner (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5372</a>).</li> <li>Child spawn-route receipts stay live and usage is deduped by response (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5366</a>).</li> <li>Doctor keeps persisted setup readiness across first-run / update checkpoints (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5340</a>).</li> <li>Approval default selection is applied and explained; agents are told when approvals are disabled (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5293</a>).</li> <li>A <code>/models</code> 2xx probe is a connection check, not model readiness.</li> <li>Site layout uses one container, the ticker no longer implies false provider readiness, and install links stay in the active locale.</li> </ul> <h2>Contributors</h2> <ul> <li>EvanProgramming (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@EvanProgramming</a>) — webhook client panic fallback (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5381</a>); session-index JSONL mutex (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5382</a>).</li> <li>Lstarsky0 (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — session peek hides internal runtime events (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5376</a>); thinking-ladder test re-pin (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5378</a>); provider-count follow-ups (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5383</a>/<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5384</a>); macOS agy fixture canonicalization (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5392</a>); zh-Hans 宪章 terminology (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5397</a>); regenerated website facts harvested and corrected from <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5398</a>.</li> <li>Matt Van Horn (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@mvanhorn</a>) — read-only models settings preview on the website (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5411</a>, fixes <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5370</a>).</li> <li>Nhat Bui (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@buiducnhat</a>) — canonical <code>ultra</code> reasoning effort mapped across provider effort tables (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5409</a>); session titles truncated by character count, not byte offset (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5415</a>).</li> <li>Sh1Zuku (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>) — <code>/title</code> and the session name in the terminal tab/window title, plus the mid-turn title deadlock fix (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5419</a>).</li> <li>Kai Nacke (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@redstar</a>) — Eden AI provider registration, aliases, <code>EDENAI_API_KEY</code>, and the global/EU endpoints (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5422</a>).</li> <li>Isabel Wu (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) — background verifier test isolated from rustup and <code>$HOME</code> (<a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5423</a>, slice of <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044346/4267083/github-release-codewhale-hqcodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.10 (20.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.1020.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.10</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.10</h2> <ul> <li>Show the full slash-command or <code>/model</code> completion row in a bounded, wrapping hover popover whenever narrow terminals truncate it, closing the remaining scoped gap from <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#998</a>. Thanks <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@AiurArtanis</a> and <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@formp3</a> for identifying the affected surfaces.</li> <li><code>registry_sync</code> no longer ships the full MCP Registry catalog into the conversation. It takes a required query, scores the local snapshot host-side, and returns at most eight matches; the complete catalog stays on disk, and the compaction and spillover exemptions that let a multi-hundred- kilobyte dump reach the model unchanged are gone.</li> <li>Providers that mirror the outgoing <code>(reasoning omitted)</code> replay placeholder back as a reasoning delta no longer have that echo ingested as real thinking: the exact transport placeholder is dropped on arrival, so live sessions stop showing a stream of placeholder reasoning blocks and saved transcripts stay free of them.</li> <li>Mid-stream connection drops during an interactive turn no longer persist a synthetic <code>[runtime]</code> user message. Retry state is a typed engine-internal descriptor; a thinking-only drop re-issues the request without claiming a partial reply was preserved, the retry budget is enforced in mechanism, and recovery produces exactly one authoritative final answer.</li> </ul> Codewhale v0.9.10 is a retention, identity, and product-clarity release: the shell and transcript can no longer retain unbounded tool output in memory or on disk, mid-turn history inserts no longer strand in-flight tool rows, every agent that ran this session is visible from <code>/agents list</code>, the PTY acceptance lane has a stall watchdog and bounded CI steps, approval outcomes are durable and fail closed (cyq1017, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5360</a>), and three $HOME disk leaks are reclaimed. Extension surfaces now name their real state and act only through the reviewed install and trust flows, and sub-agent, shell, task, and workflow state is owned by the session that created it (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5518</a>). Test threads get an 8 MiB stack so the lib suite can no longer abort under load. <h3>Fixed</h3> <ul> <li>First run starts on the welcome screen again. A missing key no longer skips Welcome and auto-opens the local-provider list: Enter walks to the calm provider explanation, then Enter opens the picker so a first API key can be set. Returning missing-key recovery still opens the picker on launch.</li> <li>A foreground <code>bash</code> command that named no timeout is bounded again. The model-facing <code>bash</code> tool left an omitted <code>timeout_ms</code> at the internal ceiling (~24.8 days) instead of the 120 s default its own schema advertises, so a CLI that blocked on an interactive prompt or a hung network call held the turn open indefinitely — one report sat on a single unauthenticated CLI call for over two hours with the tool row simply counting seconds. The advertised default now applies, which arms the existing recovery: the process is killed and the model is told to rerun with <code>background=true</code> and poll with <code>action="wait"</code>. An explicit <code>timeout_ms</code> is still honored for genuinely long foreground work, and background and interactive runs keep their own lifetimes.</li> <li>The Extensions (<code>/plugin</code>) Marketplace is no longer a read-only list. Every recommendation and stored candidate names its truthful state and primary action — Add, Enable, Configured, or Unavailable — and Enter or a mouse click runs that action through the existing reviewed <code>/mcp add recommended</code>, <code>/mcp enable</code>, and <code>/plugin</code> install/trust controllers, so no second trust path exists. Browser Use and Sandbox Runtime stay honestly Unavailable with their real setup routing instead of implying an install Codewhale cannot perform.</li> <li>The Extensions MCP tab now renders one honest inventory: the header count and the visible rows derive from the same configured-server set, so <code>MCP (6)</code> can no longer sit above two rendered rows. Disabled servers stay visible and labeled disabled instead of silently disappearing, and configured servers absent from the live snapshot list as not-yet-inspected with their own explicit reload affordance through the MCP command controller.</li> <li>Installed plugin rows now act on their real state: Enter opens an active bundle (<code>/plugin show</code>), offers Enable for a trusted-but-disabled bundle, or routes an untrusted bundle to the existing trust review — through the same confirmation and persistence controllers as the slash commands.</li> <li>Sub-agent handoffs and rosters, background shell jobs, durable tasks, delayed continuations, and workflow controls are now scoped to the session that owns them. Records carry immutable root-session ownership, stale completion-channel payloads are rejected before deduplication, background work drains and reports only to its owning session, and legacy ownerless jobs fail closed (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5518</a> failure class reported by <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@hxfhd</a>; the report's exact JavaScript provenance was not claimed as reproduced).</li> <li>The resolved route envelope now reaches every outbound model call: all wire dialects and auxiliary calls clamp at the shared transport seam under one wire/reservation budget, provider input limits are honored, and switching models on the same protocol no longer inherits the previous model's limits (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5516</a>, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5518</a>).</li> <li>First-run continuity: the chosen onboarding provider persists across restarts, a missing first-run config no longer interrupts the flow, and the automatic working-agreement checkpoint renders as a standalone setup handoff instead of regressing the onboarding rail to the full wizard's 4/10 progress.</li> <li>Explicitly worded natural-language <code>/goal</code> declarations now create a durable goal in the provider-neutral engine before model dispatch, while ordinary tasks and quoted transcripts stay out of goal mode and prose acknowledgement alone can no longer stand in for goal creation.</li> <li><code>/model</code> now keeps the current Z.ai default (<code>GLM-5.3</code>) visible when an older installation has an explicit <code>GLM-5.2</code> route saved. The saved 5.2 route remains exact; choosing 5.3 sends and remembers the distinct 5.3 ID.</li> <li>The constitution checkpoint now leads with the bundled balanced agreement; the default path writes no custom constitution. The startup launch surface distinguishes read-only Chat from folder-bound, approval-gated Work.</li> <li>Tabby and other IME bridges no longer observe a stale visible caret while a frame diff is being painted; Codewhale hides the cursor during the diff, restores the canonical composer cell, and only then reveals it again (BrathonBai, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5023</a>).</li> <li>Pre-header HTTP/2/SSE transport failures get one bounded HTTP/1.1 retry; authentication, provider-semantic, response-body, and already-pinned HTTP/1 failures remain fail-closed (demian-welt, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#4683</a>).</li> <li>MCP <code>tools/call</code> images now travel as bounded typed content instead of leaking base64 through model-visible JSON. Direct and parallel calls share the same MIME, size, validation, and one-image boundary (PR <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5515</a> by <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@cacdcaecawae</a>).</li> <li>Linux npm installs and updates race GitHub Releases against the CNB mirror at the checksum-manifest layer, then download from the first verified source without making users wait through a doomed slow-source timeout.</li> <li><code>CODEWHALE_PREFER_BWRAP</code> now applies the documented Linux sandbox override, and Codewhale-era names own build metadata, hook session/tool-call IDs, and sandbox child markers. The corresponding <code>DEEPSEEK_*</code> names remain as 0.9.x compatibility aliases (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5443</a>).</li> <li>Windows default launch prefers Windows Terminal: zip archives ship <code>codewhale.bat</code> (CRLF, <code>wt.exe</code> then the exe), <code>install.bat</code> copies that launcher, and the NSIS Start Menu shortcut opens it instead of the raw binary (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#1854</a>).</li> <li><code>fix(tui): make the header status mark honour its setting</code> — <code>status_indicator</code> did nothing for three of its four documented values. The header hardcoded a leading <code>cw</code> span and asked for a second mark beside the effort chip, then filtered the second one against the literal <code>"cw"</code>; because <code>cw</code>, the legacy <code>whale</code> opt-in, and every unknown value all normalize onto that same mark, the filter discarded them and left <code>off</code> with nothing to turn off. <code>cw</code>, <code>whale</code>, <code>off</code>, and a typo all rendered byte-identical headers. There is one mark now and the setting owns it: <code>cw</code>/<code>whale</code> draw the typographic mark, <code>dots</code> draws the activity frames, <code>off</code> removes it (thejayjetson, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5512</a>).</li> <li><code>fix(tui): rebase active-cell tool bindings on every mid-turn history insert</code> — <code>/rename</code> mid-turn left the running tool row spinning forever (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5478</a>).</li> <li><code>fix(tui): bound what the shell and transcript retain from tool output</code> — a 1.1 MB Bash call kept over a megabyte resident for up to an hour; raw streams now cap at 16 MiB in flight and release delivered output, and retained tool outputs cap at 64 KiB per record / 8 MiB per transcript (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5472</a>).</li> <li><code>fix(tui): reclaim the three $HOME disk leaks</code> — orphaned session dirs, the unbounded audit.log, and stranded writer temp files.</li> <li><code>fix(tui): persist approval outcomes before execution</code> (cyq1017) — approval receipts are committed to a session-owned log before execution proceeds; unpersistable evidence blocks the tool; resume reconstructs closed and interrupted approvals (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5360</a>).</li> <li><code>test(tui): break the LazyLock/env-barrier deadlock in the test harness</code>.</li> <li><code>ci: give test threads the 8 MiB stack they need</code> — the lib suite aborted with SIGABRT under load on the default 2 MiB stack.</li> <li>YOLO entry points honor a locked approval policy: <code>--yolo</code>, <code>/mode yolo</code>, <code>/zidong</code>, and Alt+Y can no longer set Full Access + trust + shell when config or managed requirements own the posture.</li> <li>Terminal PTY tools fail closed without a sandbox backend under a narrowed filesystem posture, and otherwise start <code>$SHELL -i</code> through <code>SandboxManager::prepare</code> like <code>bash</code>.</li> <li>Skill update refuses to replace a directory that has no <code>.installed-from</code> marker — same ownership gate plugins already used.</li> <li><code>cp</code>/<code>mv</code> are workspace-safe only when every path operand stays inside the workspace — Auto-Review no longer auto-allows <code>cp /etc/passwd .</code>.</li> <li>Main CI no longer shares one concurrency group per branch: each SHA gets a verdict instead of a cancelled pending run. A hermetic Safety gate job runs authorization tests in under 15 minutes (test bankruptcy restructuring — no tests deleted).</li> <li>Config-fixture tests no longer honor <code>lock_test_env</code> as a license to read a populated <code>~/.codewhale/config.toml</code>; they need an <code>EnvVarGuard</code> like settings already did. Safety-gate and CNB workspace tests pin a hermetic <code>CODEWHALE_HOME</code>. <code>exec_persistent_service</code> is serialized in nextest and inside the cargo-test binary instead of dropped (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5355</a>).</li> <li>Short CLI no longer waits up to three seconds for a telemetry POST on exit; <code>session_end</code> is recorded and the buffer ships on the next interactive session.</li> <li>Bare <code>/</code> now opens a deliberately small starter set: <code>/help</code>, <code>/setup</code>, <code>/model</code>, <code>/settings</code>, <code>/resume</code>, and <code>/rc</code>. The full command inventory remains searchable through <code>/help</code>, the command palette, and direct prefix typing, without front-loading the entire control surface (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5442</a>, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5439</a>).</li> <li>First run now asks only for decisions needed to become usable, keeps the offline route explicit, and leaves optional provider, tools, policy, and appearance work in the progressive <code>/setup</code> repair guide. The idle aquarium asks one task-oriented question instead of advertising a tutorial or command billboard, and the localized telemetry choice appears after the workspace is ready without blocking the composer.</li> <li>Provider, active model, and reasoning effort moved out of the crowded header into a quiet, width-aware footer identity. Compact layouts keep model and effort before provider detail and shed whole low-priority groups instead of clipping the composer or control hints.</li> <li>The model picker no longer re-parses <code>~/.codewhale/config.toml</code> once per provider when deciding who has a saved key.</li> </ul> <h3>Added</h3> <ul> <li><code>/workflows</code> opens a live run dashboard over this workspace's durable workflow journal: every retained run with status, phases, child roster, progress, and host-side cancel — observation only, it never launches a run.</li> <li>Repository instructions now assemble from the actual containing checkout: applicable <code>AGENTS.md</code> files resolve repository-root to current-directory in order under one aggregate budget, a linked worktree is its own root, and scope is never inferred from path mentions or whichever branch is named <code>main</code>.</li> <li><code>/goal</code> is a codex-style control plane: setting an objective dispatches it to the engine, which owns the goal and starts the first goal turn itself — the objective is never echoed back as the user's own message, pause/resume are real control ops, and the hunt-era vocabulary and trophy cards are gone.</li> <li><code>/extensions</code> and <code>/plugins</code> open one localized inventory for Hooks, Plugins, local Marketplace catalogs, Skills, and MCP. Reviewed suggestions include Playwright, Chrome DevTools, Cua Computer Use, Browser Use, and the sandbox runtime without granting trust or installing anything on open.</li> <li>Turn Inspector now opens the newest turn and pages across complete recorded user, reasoning, tool/subagent, and assistant output with page-scoped search, copy, and export (sky-sun-moon, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#1682</a>).</li> <li>Background tasks have bounded incremental persistence, durable terminal reasons, truthful timeout/cancellation receipts, restart recovery, and interruptible continuous-goal delays (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5497</a>, <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5508</a>).</li> <li><code>/title</code> once again controls the terminal window title independently from <code>/rename</code>, survives session save/load, and sanitizes control, bidi, and zero-width characters (PR <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5509</a> by <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>).</li> <li>MCP snapshots preserve whether capabilities were advertised by the server, discovered through the bounded legacy fallback, or not observed (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#4170</a>).</li> <li><code>codewhale auth status --diagnostic</code> reports canonical paths, isolation source, backend class, and value-free provider-source presence without opening credential stores or creating/migrating state (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#2369</a>).</li> <li><code>codewhale doctor --probe-search</code> performs an explicit credential-free, policy-checked transport probe for the selected search provider; ordinary doctor and JSON output remain offline (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5442</a>).</li> <li>The safe deferred <code>read_media</code> tool is available to supported read-only roles, and history receipts distinguish localized tool execution outcomes without exposing raw payloads (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5102</a>).</li> <li>npm Linux x64 first-party source selection. The wrapper concurrently fetches the GitHub Releases and CNB checksum manifests for the exact package version, locks the first source whose HTTP response and manifest validate, and downloads binaries only from that source. Explicit <code>CODEWHALE_RELEASE_BASE_URL</code> / <code>CODEWHALE_USE_CNB_MIRROR=1</code> still skip the race; other targets stay on GitHub.</li> <li><code>/workflow <objective></code> and <code>/workflow run <path></code> now produce a bounded, tool-less proposal for review. Only <code>/workflow confirm</code> can launch that reviewed draft; status, cancel, settings, and the <code>/workflows</code> dashboard stay host-owned and do not spend a model turn (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5439</a>).</li> <li><code>feat(tui): add cancellable cadence to continuous goals</code> (M-Maciej) — <code>[goal] continuation_delay_seconds</code> gives coordinator goals a visible quiet period between successful turns while reusing the existing coalesced goal continuation token; Esc, Ctrl+C, pause/done/blocked/clear cancel before the next provider request, and failures never continue (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5508</a>).</li> <li><code>feat(tui): add command context adapters and migration gate (FEAT-015)</code> (aboimpinto) — TUI-owned capability facets, a dual-path dispatch seam, and source-aware CI enforcement so a command slice cannot claim to be migrated while it still accepts concrete <code>App</code>. Zero production commands migrate in this slice (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5316</a>).</li> <li><code>feat(web): move docs/hooks and docs/troubleshooting onto the dictionary spine</code> (Lstarsky0) — both pages now read copy from the locale dictionaries instead of inline bilingual literals (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5337</a>).</li> <li><code>feat(web): move docs/constitution and docs/runtime-api onto the dictionary spine</code> (Lstarsky0) — both pages now read copy from the locale dictionaries instead of inline bilingual literals; another incremental phase of <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5337</a>, not completion of the full epic (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5517</a>).</li> <li><code>docs(i18n): complete Tier 1 of Chinese docs localization</code> (SparkofSpike) — Chinese and Indonesian docs move to <code>docs/zh_hans/</code> and <code>docs/id/</code>, with redirect stubs at the old paths for one release cycle (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5482</a>).</li> <li><code>feat(tui): show repository context in git chrome</code> (wuisabel-gif) — the TUI header now identifies the active repository or linked worktree before the branch and dirty marker, so operators can see where the agent is working without opening the worktree manager (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5437</a>).</li> <li><code>feat(tui): formalize the status-bar color grammar</code> — seven semantic families live in <code>docs/design/STATUS_BAR_COLOR_GRAMMAR.md</code> and <code>palette::grammar</code>; header and phase-strip ink resolve through named <code>ChromeInk</code> slots so chrome cannot invent an eighth meaning or spend Failure red on a dirty worktree or selected mode. The footer's session metrics strip resolves through the same inks, and the red reservation is checked against every selectable theme, not just the whale default; typed footer toasts resolve through the grammar too. Repo/worktree chrome stays metadata and still renders when Git names a location but not a ref (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5437</a>).</li> <li><code>feat(tui): first slice of the agents roster</code> — every agent that ran this session, receipts-only, via <code>/agents list</code> and the sidebar fan-out rows (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5479</a> spec items 1 and 5).</li> <li><code>ci: bound PTY acceptance and add a stall watchdog to the harness</code> — QA_PTY_STALL_TIMEOUT_SECS aborts a wedged PTY run with a diagnostic; the isolated PTY step is capped at 15 minutes; Windows NSIS provisioning gets a bounded retry (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5496</a>).</li> <li><code>chore(scripts): dev-cache warns before it fills a disk</code> (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5465</a> class).</li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">Sh1Zuku</a> (<code>@SparkofSpike</code>) — restored <code>/title</code> as an independent, persistent terminal-window title in PR <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5509</a>, in addition to the Tier 1 Chinese and Indonesian documentation work below.</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">Sun Zhenyuan</a> (<code>@bistack</code>) — extracted the turn-loop stream processor in PR <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5514</a> while preserving retry, cancellation, usage, TTFT, steering, and partial-response behavior.</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">OctoBored</a> (<code>@OctoBored</code>) — supplied the working no-token Star History mirror used across the localized README set after the canonical chart endpoint began returning a restricted placeholder (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5510</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">cacdcaecawae</a> (<code>@cacdcaecawae</code>) — added provider-neutral typed MCP image forwarding in PR <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5515</a>; the harvested version also makes malformed image fields produce a visible omission receipt.</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">DingYong4223</a> (<code>@DingYong4223</code>) — reported the narrow-terminal completion truncation closed by the bounded hover reveal (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#998</a>). Thanks also to <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@AiurArtanis</a> and <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@formp3</a> for identifying the affected completion surfaces.</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">sky-sun-moon</a> (<code>@sky-sun-moon</code>) — reported the missing full per-turn input, reasoning, tool, and assistant pages that shaped Turn Inspector navigation (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#1682</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">cy2311</a> (<code>@cy2311</code>) — reported the Windows launch path that now ships and installs a Windows Terminal-aware batch launcher (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#1854</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">demian-welt</a> (<code>@demian-welt</code>) — provided the reproducible pre-header SSE transport failure behind the bounded HTTP/1.1 retry (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#4683</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">BrathonBai</a> (<code>@BrathonBai</code>) — reported the Tabby/CJK IME candidate-window jump that led to the hide-diff-position-show cursor transaction (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5023</a>).</li> <li>M-Maciej (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@M-Maciej</a>) — the real-world organization-coordinator use case and 5–30 minute cadence requirement behind cancellable cross-turn goal delays (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5508</a>).</li> <li>cyq1017 (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@cyq1017</a>) — approval outcomes are persisted before execution can proceed: receipts commit to a session-owned log first, unpersistable evidence blocks the tool, stale decisions are rejected, and resume reconstructs closed and interrupted approvals (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5491</a>, closes <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5360</a>).</li> <li>aboimpinto (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a>) — the TUI-owned dependency-injection and migration infrastructure that makes slash-command extraction safe: seven capability facets, a dual-path dispatch seam, and source-aware CI enforcement so a command slice cannot claim migration while it still accepts concrete <code>App</code> (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5506</a>, EPIC-005/FEAT-015 under <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5316</a>, which they also filed).</li> <li>wuisabel-gif (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) — the TUI header now names the active repository or linked worktree before the branch and dirty marker, derived from Git's common directory and capped by shell density tier (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5511</a>, the repo/worktree slice of <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5437</a>).</li> <li>SparkofSpike (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>) — Tier 1 of the Chinese docs localization: Chinese and Indonesian documentation moves to <code>docs/zh_hans/</code> and <code>docs/id/</code> with redirect stubs held at the old paths for one release cycle (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5507</a>, epic <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5482</a>, which they also filed).</li> <li>Lstarsky0 (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — <code>docs/hooks</code> and <code>docs/troubleshooting</code> move onto the dictionary spine, retiring their inline bilingual literals in favor of locale dictionaries with token-aware code spans (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5504</a>, closes <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5337</a>, which they also filed).</li> <li>Lstarsky0 (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — <code>docs/constitution</code> and <code>docs/runtime-api</code> follow the same dictionary spine: 28 inline <code>isZh</code> branches become typed English and Chinese dictionaries held to key and token parity, while the other sixteen locales keep the English fallback (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5517</a>, a further phase of <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5337</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@thejayjetson</a> — the header status-indicator report that pinned the regression to a specific setting, with every value, theme, and <code>fancy_animations</code> combination already ruled out (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5512</a>).</li> <li>hxfhd (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@hxfhd</a>) — reported the deterministic cross-session contamination class behind this release's session-ownership boundary, plus route budgeting evidence (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5518</a>).</li> <li>sfdzhmr (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">@sfdzhmr</a>) — reported the route budgeting root causes that exact route-limit propagation now closes (<a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">#5516</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044345/4267082/github-release-codewhale-hqcodewhale-v0910-20082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.11 (23.08.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.1123.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.11</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.11</h2> Codewhale v0.9.11 tightens the long-running agent loop, makes workflow failures visible instead of successful-looking, adds an experimental vision-capable DeepSeek route, and prepares reproducible Codewhale-versus-Pi evaluation without publishing a result before a real run. The complete item-level change record is retained below the categorized release highlights. <h3>Added</h3> <ul> <li>Added first-party <code>deepseek-v4-flash-vision-exp</code> discovery and selection for DeepSeek, including the <code>flash-vision</code> alias, bundled offline metadata, registry and picker entries, and image-input capability on the chat route. Context and output limits inherit from V4 Flash until DeepSeek publishes distinct values; pricing remains unknown rather than guessed.</li> <li>Added a provider-controlled Codewhale-versus-Pi parity harness with three hermetic coding tasks, route and reasoning-effort receipts, doctor/dry-run modes, and bounded result artifacts. The repository ships the harness, not a benchmark verdict; comparable real runs remain an acceptance gate.</li> <li>Added portable, secret-free config export/import with a reviewable plan, explicit headless consent, backup and rollback, and idempotent re-import.</li> <li>Added bounded multi-file diagnostics through the existing model-facing <code>lsp</code> tool without increasing the tool-catalog count. Thanks to Isabel Wu (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) for PR <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5524</a>.</li> <li>Added portable presentation, media-attachment, and operation-digest facets to the command contract, then moved all seven utility handlers onto the contract-backed dispatch path. Thanks to Paulo Aboim Pinto (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a>) for PR <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5525</a>.</li> </ul> <h3>Changed</h3> <ul> <li>Sub-agent, Fleet-worker, workflow-task, and thread-runtime model turns no longer inherit a hidden role-based step ceiling. An omitted or zero <code>max_steps</code> is unbounded; a positive user/config value remains an explicit cap and is still clamped to the runtime safety ceiling. Wall-clock, provider, heartbeat, cancellation, and admission safeguards are unchanged.</li> <li><code>/rc</code> now mirrors one shared session rather than transferring terminal ownership: local and web prompts remain available while idle, approvals use first-decision-wins semantics, and transport/integrity failures remain fail-closed.</li> <li>The terminal status rows around the composer are now two stable bands: <code>provider · model · thinking level</code> is the persistent identity row below the composer in every phase, and a separate activity row above the composer carries the live phase, notices, and cost/metrics. Sending a prompt no longer relocates the route identity above the composer, and neither row ever duplicates it.</li> <li>The embedded local Web client now uses the current CWC Ocean hierarchy and readable control sizing, follows the shared Enter/Shift+Enter composer grammar, and chooses a provider plus model per new thread without mutating Runtime defaults. Exact image-input capability is labelled honestly; a vision-capable route does not imply that browser attachments exist.</li> <li>The runtime now has one authoritative model-turn loop. The placeholder <code>crates/core</code> engine tree is gone, while the active TUI loop and its extracted tool-call stages retain existing policy, hook, cancellation, and budget behavior. Thanks to Sun Zhenyuan (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@bistack</a>) for PR <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5523</a>.</li> </ul> <h3>Fixed</h3> <ul> <li>Chat Completions streams now require terminal proof from <code>[DONE]</code> or a non-empty <code>finish_reason</code>. Protocol-only frames no longer count as answer content or time-to-first-token, and a provider continuation that ends after tool results with no answer or tool call fails durably instead of producing a false <code>Completed</code> receipt.</li> <li>A selected v2 Fleet now drives one bounded, deterministic Agent roster across terminal and runtime surfaces. Fleet operator/member/explicit-route precedence, resolved member identity, and exact <code>vision</code> requirement admission now fail visibly instead of silently falling back, first-matching, or rerouting.</li> <li>A workflow whose <code>task()</code> dispatch was rejected no longer loses that failure inside a <code>parallel()</code> null slot or presents a successful-looking run. Rejected dispatches now fail the run, persist as typed bounded receipts with an exact count, and appear in transcript, activity detail, and workflow-panel views.</li> <li>Provider readiness, credential-source explanations, focused-agent scrolling, compact <code>/status</code> and <code>/help</code> rendering, shell/web output bounds, MCP lifecycle reporting, and narrow-terminal onboarding received the detailed fixes recorded below.</li> <li>Portable config import/export now preserves typed tables, arrays, numbers, booleans, and datetimes without stringifying them, while refusing machine-bound trust overlays, credential readers, automatically executable hooks/LSP definitions, local-path authority, machine-local network proxy routes, cookies, redaction placeholders, and nested or camel/dotted credential keys. Project and global bundle operations now load and validate the document for their actual scope in both directions, including a workspace whose document still lives under the legacy app directory.</li> <li><code>codewhale login</code> now means Codewhale account sign-in (the same browser device flow as <code>codewhale account login</code>, with <code>--no-open</code> and <code>--timeout-seconds</code>); provider API keys are configured exclusively through <code>codewhale auth set --provider <provider></code>, and the hidden legacy <code>--api-key</code>/<code>--provider</code> flags redirect loudly instead of silently writing a key.</li> <li>Account sessions prefer the OS credential manager and now fall back automatically to the private <code>0600</code> Codewhale secrets file on headless hosts, SSH boxes, and containers; the <code>CODEWHALE_CLOUD_ALLOW_FILE_SESSION_STORE</code> opt-in is deprecated and ignored.</li> <li><code>/update</code> gained a <code>Ctrl+Shift+U</code> install chord (catalogued in <code>docs/KEYBINDINGS.md</code>, localized in all 15 packs) and a startup hint that names the previous and current version on the first launch of a newer build, pointing at <code>/change</code>.</li> <li>Fleet product-model copy pass: the TUI, docs, and locale packs now use Fleet / Member / Role / Model / Access / Saved consistently so a user can say "scout", "DeepSeek V4 Flash", or the member name and mean the same thing.</li> <li>A reasoning model that returns only hidden reasoning and a clean stop (no answer, no tool call) is now re-requested automatically up to twice before the turn fails, instead of dead-ending with "the provider response was incomplete." The retry reuses the cached prefix so it is cheap; an output-length stop (<code>length</code>/<code>max_tokens</code>) is never retried, and a persistently answerless model still fails honestly after the bound.</li> <li>Model-bound tool results now use a credential-shaped redaction policy: only values that look like secrets (known prefixes, JWTs, bearer tokens, PEM private-key blocks, long opaque strings) are masked before a <code>read</code> or shell result reaches the model, so code such as <code>password: credentials?.password</code> or <code>"password-validator": "^5.3.0"</code> stays byte-exact for edits and read-back. Exact configured credential values are still always replaced, and logs/previews/exports keep the broad key-based scrubber. (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5546</a>, reported by <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@ronohara</a>)</li> <li>Terminal input shutdown no longer waits forever on a wedged TTY read, Windows launch receipts can atomically replace an existing record, and the complete <code>/status</code> report now follows the active locale without rewriting exact custom-provider identities that contain brace-like text.</li> <li>Localized READMEs again match the English install and third-party-notice surface, including shell-completion guidance in all 18 translations.</li> </ul> <h3>Security</h3> <ul> <li>Unified OAuth device-code polling now validates verification URLs before opening them, redacts token-bearing types, honors server slowdown intervals, and keeps credential save/logout mutations serialized.</li> <li>Project instructions, rules-directory traversal, secret-shaped config data, URL fingerprints, and shell network authority now retain the explicit bounds and fail-closed behavior described in the detailed record.</li> </ul> <h3>Detailed change record</h3> The notes below are preserved in full so the categorized highlights do not erase behavior, migration, security, compatibility, or verification details. <ul> <li> Provider completion is now evidence-based. A Chat Completions stream reaches <code>MessageStop</code> only after <code>[DONE]</code> or a non-empty <code>finish_reason</code>; raw EOF without either is a typed failure. Message-start, ping, usage/terminal deltas, block-stop, and message-stop frames do not count as productive content or mint time-to-first-token. After tool results, a terminal provider step with no answer or tool call now emits a durable failed turn and never fabricates an empty assistant message. </li> <li> A selected v2 Fleet is the single effective Agent roster across terminal, Runtime threads, direct Workflow, Fleet execution, doctor, and setup/readiness; legacy profile layers are consulted only when no Fleet is selected, and invalid selections fail visibly with bounded, redacted errors. Member references resolve exact id first and otherwise require a unique display name, role, pinned model, offline model name, or provider/model route; <code>agent action=roster</code> exposes that same bounded roster. The Fleet operator supplies fresh-root and inherited-member routing unless an explicit launch route or member pin wins, the resolved member is shown separately from the requested alias, and <code>requires = ["vision"]</code> is admitted only on an exact route with verified offline <code>image_input</code> support—never by silent rerouting or custom-proxy inference. Fleet selection remains an explicit user/folder contract independent of legacy project-profile loading. </li> <li> Breaking (app-server): <code>/prompt</code>, <code>prompt/request</code> and <code>prompt/run</code> now execute a real model turn instead of reporting success for work they never did. <code>Runtime::handle_prompt</code> called no model: it resolved config, ran a local <code>ModelRegistry</code> lookup, emitted three canned hook events (<code>ResponseDelta</code> was literally the string <code>model-selected</code>), and returned HTTP 200 with <code>output</code> set to a stringified JSON echo of the caller's own routing metadata — the prompt included. Worse, when a <code>thread_id</code> was supplied it appended a real user row, flipped the thread to <code>Running</code>, and then wrote that echo into durable history as an assistant message plus a <code>prompt_response</code> checkpoint. Nothing marked the row synthetic and nothing ever moved the thread out of <code>Running</code>. All three endpoints now route through the same <code>RuntimeBridge</code> that stdio <code>thread/message</code> has always used, so <code>output</code> is the model's streamed text, <code>model</code> is what the runtime reports for the thread that ran the turn, and <code>events</code> are the real streaming frames. <code>Runtime::handle_prompt</code> and its synthetic history write are gone. </li> <li> Breaking (app-server): a failed prompt is now a typed failure rather than a success-shaped body. <code>POST /prompt</code> returns <code>{"error":{"code":...,"message":...}}</code> with <code>400</code> (invalid request), <code>404</code> (thread not found), <code>503</code> (<code>runtime_unavailable</code>) or <code>500</code>, instead of HTTP 500 carrying a <code>PromptResponse</code> with the error text stuffed into <code>output</code> where model text belongs. The stdio surface gained JSON-RPC <code>-32005</code> <code>runtime_unavailable</code> for "the turn engine could not be reached, so nothing ran" — distinct from <code>-32603</code>, and retryable. There is no configuration in which a prompt silently echoes instead of running. </li> <li> Breaking (app-server): <code>POST /thread</code> with a <code>Message</code> body runs the turn. It previously replied <code>status: "accepted"</code> with a <code>ResponseDelta("queued")</code> frame while starting no worker and calling no bridge — the stdio path for the same request has always done real work, so the two transports disagreed about what <code>accepted</code> meant. HTTP now replies <code>status: "completed"</code> once the turn reaches a terminal state, with the streamed frames in <code>events</code> and the turn id in <code>data</code>. <code>Runtime::handle_thread</code> no longer accepts <code>ThreadRequest::Message</code> at all: it owns thread bookkeeping, not the turn engine, and returns an error naming <code>POST /v1/threads/{id}/turns</code> rather than a canned acceptance. </li> <li> Breaking (app-server): <code>AppRequest::SubmitUserInput</code> now refuses explicitly (<code>ok: false</code>, <code>error: "user_input_reply_unsupported"</code>) instead of returning <code>resolved: true</code> and filing the answers in a map that had no reader anywhere in the crate — every answer submitted was silently discarded. It cannot be made to work on this transport: while a turn streams, the stdio loop executes only <code>thread/interrupt</code> and queues everything else, so an answer sent there would wait on the very turn waiting for it. The refusal names the surface that does accept it, <code>POST /v1/user-input/{thread_id}/{request_id}</code> on the runtime API. The client-visible refusal is whitespace-clean, and the <code>/tool</code> path that mints the <code>UserInputRequest</code> is unchanged and still genuine. </li> <li> Split the coordination ledger out of <code>tools/subagent/coord.rs</code> into <code>tools/subagent/coord/ledger.rs</code>. The file held two unrelated things: the model-facing <code>agents/*</code> tool wrappers, and the durable decision/claim/ contention records those wrappers happen to write — records whose consumers are mostly not in the tool layer (<code>tui::coordination_detail</code>, <code>tui::work_surface</code>, <code>tui::ui::tests</code>, <code>core::engine::tests</code> all name these types). At 3.8k lines, reading either one started by scrolling past the other. A pure move with a glob re-export from <code>coord</code>, so every <code>crate::tools::subagent::coord::{…}</code> path still resolves and no consumer file was edited; the only content change the move required is one constant going from private to <code>pub(super)</code> because its caller stayed behind. <code>coord.rs</code> is now 2.3k lines and <code>ledger.rs</code> 1.6k. </li> <li> <code>agent</code> is now the only sub-agent tool the model can see. <code>AGENTS.md</code> has said "the model-facing sub-agent surface is <code>agent</code> only" since the lifecycle tools were removed, but six more were reachable: <code>agents/list</code>, <code>agents/message</code>, <code>agents/followup</code>, <code>agents/interrupt</code>, <code>agents/coordinate</code>, and <code>agents/wait</code> all defaulted to model-visible, so they shipped in the catalog and <code>tool_search</code> could load any of them — and the <code>agent</code> description told the model they existed. They now declare <code>model_visible() -> false</code>, the same shape <code>rlm</code> and <code>exec_shell</code> use: still registered, still executable by name so a persisted transcript replays against the same implementation, never advertised and never returned by either <code>tool_search</code> matcher. Five of the six were already duplicates of an <code>agent</code> action. The sixth was not: <code>agents/coordinate action=claim</code> was the only way to widen a write claim, and write enforcement fails closed, so hiding it would have left a refusal ("expand it first with…") pointing at a tool the model could no longer call. <code>agent</code> gains one action, <code>claim</code>, taking the write scope vocabulary <code>action=start</code> already uses (<code>write_roots</code>, plus parse-accepted <code>exact_files</code> and <code>coordination_contracts</code>). It keeps <code>agents/coordinate</code>'s <code>Auto</code> approval — gating it deadlocks autonomous fan-in — and it can only widen the caller's own scope; peer contention still fails. A scopeless claim is refused rather than reported as granted, because <code>expand_write_claim</code> returns the unchanged claim with <code>Ok</code> when every list is empty. Collapsing six tools into one action set also collapses the gating: <code>agent</code> is deliberately exempt from both name-keyed gates (<code>posture_permits_tool</code> short-circuits it so delegation depth governs spawning, and <code>execution_envelope</code> classifies it <code>Bounded</code> so a read-only member can fan out read-only work), so a capability folded into it inherits no gate. <code>claim</code> is therefore gated per action, reproducing the envelope check that kept <code>agents/coordinate</code> off a read-only role's catalog — in the catalog and again at dispatch, since catalog shaping is not an authority boundary. The other actions keep exactly the visibility they had. </li> <li> One placement table now decides which wire channel a message role belongs in, and unrepresentable role/dialect pairs are refused at the outbound seam (<code>DeepSeekClient::prepare_outbound_request</code>) instead of at the provider. Chat Completions and OpenAI Responses used to drop an unfamiliar role silently, Anthropic Messages forwarded <code>message.role</code> verbatim and took an opaque provider 400 for it, and Google cloud-code was alone in failing closed. Positioned <code>system</code> and <code>developer</code> history — including compaction and branch summaries — is carried natively by Chat Completions and Responses and projected, in place, onto Anthropic's user channel. It is neither hoisted nor dropped. Genuinely unknown roles keep the previous dialect-specific fail-closed/omit behavior, now decided in one table. The dead <code>"tool"</code> arm in the Responses adapter is gone — nothing constructs that role. </li> <li> Message roles are a closed <code>Role</code> enum (<code>crates/core/src/role.rs</code>) instead of a free-form <code>String</code> on <code>Message</code>. Four wire adapters each decided independently what an unfamiliar role meant, and a typo in a role string was a silent transcript edit rather than a compile error. <code>Role</code> keeps an <code>Unrecognized(String)</code> variant and serializes via <code>as_str()</code>, so a saved session's bytes are unchanged, a transcript written by a newer build still loads here, and <code>assistant_interrupted</code> stays a distinct session item — no session schema bump and no migration ladder. </li> <li> Portable config bundles: <code>codewhale config export --portable</code> writes a deterministic, secret-free bundle (credential and machine-specific keys dropped), and <code>codewhale config import <FILE|URL|-></code> applies one with a strict versioned envelope, a printed added/changed/skipped/conflicting/ rejected plan, consent gating (<code>--yes</code> required headless), a timestamped backup with rollback, and idempotent re-import. Credential-shaped entries are rejected by key name and value shape — rejections name the field, never the value. Remote imports revalidate the HTTPS-or-loopback-HTTP policy on every same-scheme redirect hop, and duplicate keys across applicable section labels fail before any backup or write instead of silently resolving by section order. Structured TOML values round-trip with their original types and exact named-provider identity; recursive sanitization covers arrays/tables and camel-case, dotted, cookie, and access-key spellings while retaining ordinary token-count metrics. Machine-bound project trust, credential-source consent, automatic hook/LSP execution, and local-path authority are non-portable and fail before mutation. A missing target is created transactionally and removed again on rollback, and project/global scope validation rejects the wrong document before import or export. Imported tables deep-merge portable fields into the target, so omitted machine-local provider credentials, endpoints, and executable definitions remain intact instead of being erased by a sanitized bundle. </li> <li> <code>/rc</code> is now a shared-session mirror instead of a terminal takeover. Attaching the web app no longer locks the local composer or hides approvals: both surfaces can prompt while idle (one turn runs at a time), approval cards stay visible in the terminal and are shared with the web with first-decision-wins semantics (the losing side is told, a web decision dismisses the local card), and structured questions are answered locally instead of cancelled. Fail-closed behavior survives — the post-failure reconnect lockout, integrity-gated <code>/rc stop</code>, and the fail-closed shared-approval channel on transport loss are unchanged. The takeover vocabulary ("web owns prompts and approvals") is gone from every surface. </li> <li> Auto-mode provider readiness no longer reports "key saved · not checked" forever. Readiness checks are recorded against the concrete model the router ran, but auto-mode reads resolved against the literal <code>auto</code> identity, which never matched any recorded check — so the setup receipt, model picker, and fleet setup view showed an eternal unchecked badge even after hundreds of successful turns. The read now falls back to the most recent check on the same route (provider + endpoint + auth class); concrete-model reads keep exact per-model scoping. </li> <li> The focused sub-agent transcript now scrolls like the main transcript. The frame renderer sampled the ocean column through a <code>ChatWidget</code> whose constructor consumed <code>pending_scroll_delta</code> — every PageUp/PageDown and wheel event was swallowed by an invisible widget before the focused pane could read it. The delta is now parked across the sample; the pane pins on user scroll-up, follows new child activity at tail, and jump-to-bottom releases the pin. </li> <li> Every Codex OAuth Responses request carried <code>max_output_tokens</code>, a parameter that endpoint rejects outright ("Unsupported parameter: max_output_tokens"), so every gpt-5.6-sol turn — including every sub-agent on that route — failed at the first request. Codex Responses bodies now ship without a client-side output cap; the backend applies its own. Every other Responses route keeps the central cap on the wire, exactly as before. </li> <li> The model-facing <code>lsp</code> tool now supports a bounded <code>read_lints</code> operation for multi-file, workspace-relative LSP diagnostics without adding another tool catalog entry (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#4070</a>). </li> <li> HTTP 400 classification no longer calls an unsupported-parameter error a context-window overflow. Responses shape errors such as "Unsupported parameter: max_output_tokens" name a token-shaped field, which the generic keyword rules read as prompt-size exhaustion and pointed users at compaction that could never help. Such responses now classify as invalid requests. </li> <li> xAI device login validated nothing about the URL it opened. The <code>verification_uri</code> from the device-code response went straight to <code>webbrowser::open</code> with no parse, no scheme check and no credential check, so a spoofed or compromised issuer could hand the platform's "open this" call a <code>file:</code> path, a custom application scheme (<code>vscode://</code>, <code>slack://</code>), or a credential-bearing URL. The shared primitive now refuses anything that is not a web page before the URI is printed or opened. Behaviour change: a non-loopback plain-<code>http:</code> verification URI now aborts login where it previously opened; <code>http:</code> on a loopback host is still allowed, because local runtimes legitimately use it. </li> <li> The xAI OAuth types no longer print bearer material through <code>Debug</code>. Five types holding tokens (<code>GrokAuthEntry</code>, <code>TokenResponse</code>, <code>DeviceCodeResponse</code>, <code>DeviceCodeGrant</code> and the poll outcome) either redact or no longer derive <code>Debug</code> at all, so a token has no printable path through a <code>{:?}</code> on any surrounding struct. The shared <code>DevicePollOutcome</code> derives nothing, which the compiler enforces. </li> <li> Behaviour change: an <code>interval</code> of <code>0</code> from the authorization server now falls back to RFC 8628's five-second default rather than a one-second floor, in both the xAI and account device flows. </li> <li> OAuth device-code login is now one implementation. xAI/Grok device login and Codewhale account login each carried their own hand-rolled RFC 8628 polling loop with nothing shared between them; both now call a single primitive (<code>codewhale-config</code>'s <code>device_code</code>), ported from pi. Three fixes come with it. <code>slow_down</code> now honours a server-supplied <code>interval</code> instead of always adding five seconds, which is what stops polling from running early forever under WSL and VM clock drift. Timing out after a <code>slow_down</code> now says so and names clock drift, rather than reading as a plain timeout. And the xAI verification URI is validated before it is handed to the browser opener — Codewhale previously opened whatever the device-code response said, so a spoofed or compromised issuer could point the platform "open this" call at a <code>file:</code> path or a custom application scheme. It must now be <code>https:</code>, or <code>http:</code> on a loopback host for self-hosted issuers. Stored credential files are unchanged and existing logins keep working. MCP OAuth is untouched: it delegates to <code>rmcp</code>/<code>oauth2</code> and was never hand-rolled. </li> <li> Shell output truncation now stays inside its own budget. A truncated shell result keeps a 6 KB head, a 24 KB tail, and any high-signal lines rescued from the omitted middle — but that rescued block was bounded only by a line count. One rustc <code>error:</code> line carrying a long inferred type or a minified bundler frame is routinely hundreds of kilobytes, so a "30 KB" result could arrive at 430 KB with the omitted line pasted back in whole. Each rescued line is now clipped and the block has a 4 KiB ceiling; the signal survives, the payload does not. </li> <li> Fetched web pages in non-Latin scripts no longer arrive half-read. Page text was reflowed against a column budget measured in bytes, so Cyrillic and Greek wrapped at roughly half the intended width and CJK at two thirds — and since the page view is delivered by line count, the surplus lines pushed real content off the end of the window. A Russian or Japanese URL returned a fraction of the text an English one did, for the same call. Wrapping now measures display width. </li> <li> The <code>bash</code> tool no longer tells the model it has no default timeout when it does. An omitted timeout has always been bounded at 120 seconds and the command killed there, but the tool description and its <code>timeout</code> field both claimed otherwise — steering the model away from the one parameter that would have saved a longer build. Both now name the real bound. </li> <li> MCP servers no longer restart because an unrelated setting was saved. The lazy config reload re-reads every watched source whenever one of their mtimes moves and keeps the live connections only when the content hash matches — but the hash was taken over <code>serde_json</code> bytes produced straight from the config's <code>HashMap</code>s, and two <code>HashMap</code>s with identical contents do not iterate in the same order. Any touch of any watched file therefore hashed differently, tore down every connection, and SIGTERMed and respawned every stdio child. Keys are now sorted before hashing. </li> <li> An MCP server marked <code>required</code> now still tells you why it failed to start. <code>connect_all</code> appended a generic "required MCP server failed to initialize" entry after the real per-server error, and the snapshot folds those pairs into a map keyed by server name — so the contentless entry replaced the diagnosis and /mcp showed the marker instead of "No such file or directory". The marker is now only synthesized when nothing else reported a cause. </li> <li> A crashed stdio MCP server is now rebuilt instead of being handed back dead. A failed transport read disconnected the connection; a failed write did not, so after the child exited the connection stayed <code>Ready</code>, the pool reused it on every later tool call, and /mcp kept listing the server as connected. </li> <li> An MCP response carrying neither <code>result</code> nor <code>error</code> is now an error rather than an empty success. It previously reached the model as a successful tool call with a <code>null</code> payload, indistinguishable from a tool that did nothing. An explicit <code>"result": null</code> is still a valid empty success. </li> <li> Stdio MCP server requests are answered while the client is idle instead of blocking behind the zero-capacity response rendezvous until an unrelated client call. <code>ping</code> receives its prompt empty result, unsupported methods receive JSON-RPC <code>-32601</code>, and the reader keeps only a weak stdin handle so dropping the client still delivers graceful EOF. </li> <li> <code>base_url_fingerprint</code> is a persisted-key change for two input shapes. The digest is serde-serialized into <code>ProviderCatalogCache</code> and <code>LiveOffering</code>, pricing defect receipts, and <code>TurnRecord.routed_usage_source_ids</code> — it is not an in-memory-only cache label. Empty or whitespace-only values (and scheme-less query-only strings that strip to an empty authority) now hash the invalid-or-secret-bearing sentinel instead of SHA-256 of the empty string. Scheme-less URLs that contain <code>@</code> now strip <code>userinfo</code> before hashing, matching the scheme-bearing branch, so a typed <code>user:pass@host/v1</code> no longer embeds the password in a stored digest. <code>routed_usage_source_fingerprint</code> feeds arbitrary scheme-less source ids into the same function, so a turn rehydrated from an older build can fail to dedupe one routed-usage row. Recovery is a cache miss and a re-fetch, not corruption. Empty input was not restored to the old digest: an empty authority is not a usable endpoint, and mapping it to the same sentinel the scheme branch already uses for an empty host keeps invalid inputs from minting a unique cache scope. </li> <li> Diagnostic lines that mention token counts are no longer swallowed by secret redaction. A stream error such as <code>max tokens = 8192 but budget = 4096</code> was matching the <code>token</code> hint as a substring of the English word <code>tokens</code>, and the spaced-assignment pass then dropped the rest of the line, leaving <code>max tokens = [redacted]</code>. Token counts are not credentials; the hint now matches a credential identifier (<code>token</code>, <code>api_token</code>) rather than an English word, so the numbers survive while <code>token = Bearer …</code> is still redacted. </li> <li> Dashboard thread search no longer loads every thread's transcript to decide whether the row matches. <code>GET /v1/threads/summary?search=</code> walked the full thread list and called <code>get_thread_detail</code> on each row before matching, and that detail read is itself a whole-store walk of every turn JSON and every item JSON. A non-matching keystroke was therefore O(threads × (all_turns + all_items)) file reads — on the order of 10^8 JSON parses at a few thousand threads. Search now matches <code>id</code>, title, and model from the thread record (and, when the title is unset, the single latest-turn file that supplies the displayed title) and loads detail only for matches, so preview stays a display field rather than a search key. Session summary already refused to search last-message text for the same reason. </li> <li> Silent <code>#[allow(dead_code)]</code> suppressions on the modules AGENTS.md warns auditors not to delete — prompt zones, context budget, the route seam — and on the next-largest holders (palette tokens, hotbar actions, core events) are now <code>#[expect(dead_code)]</code>, or gone where the lint was already stale. A suppression that stops matching the lint fails the <code>-Dwarnings</code> gate instead of sitting quiet. The same gate is recorded in <code>[workspace.lints]</code> so member crates inherit it from the manifest rather than only from CI <code>RUSTFLAGS</code>. </li> <li> "missing key" now says where it looked. The provider picker reported credential readiness as the bare strings <code>missing key</code> / <code>key:not-set</code>, which named no source at all — so a home whose secret store held a working DeepSeek key could show <code>DeepSeek missing key</code> in the picker while a real turn from that same home completed, and nothing on screen said which layer disagreed. Every row now resolves through one sourced resolver and states the place its credential came from ("OPENROUTER_API_KEY", <code>secret store "deepseek"</code>, <code>[providers.x] api_key</code>, "xAI OAuth", a consented external CLI file); a row without a credential lists the places that were probed, in precedence order, and the command that fixes the first of them. Where a durable slot is deliberately not read — an inactive provider whose config table carries no api-key marker — the row says so rather than implying an empty slot. </li> <li> Provider credential precedence is now stated once, in a doc comment beside the single resolver that enforces it, instead of being implied by a 150-line cascade of provider special cases. No precedence decision changed: <code>has_api_key_for</code> is now a wrapper over that resolver, and a test asserts the two agree for every provider. </li> <li> Credential saves and logouts no longer interleave. Both took a snapshot of the durable slot, wrote it, mutated the config document, and rolled back on failure, with no lock held across the sequence — so a save racing a logout on the same slot could leave the secret store and the config file disagreeing. Both now hold that provider's credential write lock for the whole read-modify-write. Design ported from pi-mono (MIT, Copyright (c) 2025 Mario Zechner); see <code>docs/THIRD_PARTY_NOTICES.md</code>. </li> <li> Enumerating stored credentials no longer fails closed on one bad slot. Listing used to propagate a backend read error, so a single unreadable secret-store entry made <code>/provider</code> and logout treat every other stored credential as missing. Enumeration now skips the unreadable slot and continues, matching the probe loop it replaced. </li> <li> The first screen of first run no longer cuts its own headline. The welcome and ready titles, and the provider-step heading, were emitted as single unwrapped lines while the sentence beneath them wrapped, so at 40 columns German read "Codewhale arbeitet mit dir in diesem O", Russian lost its final stop, and Japanese lost "します。". Headings are prose and now wrap like it, in every shipped locale. </li> <li> The workspace-trust screen no longer cuts its own question in half on a small terminal. The question, the prompt-injection risk hint, and the trust-effect hint were each pushed as one unwrapped line, so at 40 columns the screen read "Should Codewhale work with the instruc" — severed mid-word with nothing marking the cut, while the workspace path directly beneath it wrapped correctly. Asking someone to grant filesystem trust while the question itself is truncated is the worst place in the product for that to happen. All three now wrap through the same helper the rest of onboarding uses, which also means they wrap correctly in Japanese and Chinese. Verified across all fifteen shipped locales at 40, 60, 80 and 120 columns. </li> <li> <code>codewhale completions <shell></code> generated a script for the wrong program. The subcommand forwarded to the in-tree <code>codewhale-tui</code> binary, which rendered completions from its own clap tree under its own name, so the output ended in <code>complete -F _codewhale__tui ... codewhale-tui</code> (bash), <code>#compdef codewhale-tui</code> (zsh), and <code>Register-ArgumentCompleter -Native -CommandName 'codewhale-tui'</code> (PowerShell). Sourcing it registered nothing for <code>codewhale</code> or <code>codew</code> — the two commands current installers expose — so tab completion appeared to do nothing. The forwarded tree was also stale against the real CLI: it offered <code>pr</code>, <code>scorecard</code>, and <code>session-diagnostics</code>, which <code>codewhale</code> does not have, and omitted <code>run</code>, <code>rc</code>, <code>config</code>, <code>model</code>, <code>thread</code>, <code>lane</code>, <code>workflow</code>, <code>web</code>, <code>account</code>, <code>app-server</code>, <code>mcp-server</code>, <code>metrics</code>, <code>update</code>, <code>cloud</code>, <code>completion</code>, and <code>lane-log-proxy</code>, which it does. Completions are now rendered in-process from the CLI's own command tree, and <code>completions</code> is an alias of the existing <code>completion</code> subcommand rather than a second, divergent path. Regenerate any script you installed from an earlier release. Reported by RepentStar (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5526</a>); part of the <code>deepseek-tui</code>-era identifier retirement in <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5443</a>. </li> <li> Completion scripts now fire for the <code>codew</code> shorthand as well as <code>codewhale</code>. Releases publish <code>codew</code> as a byte-identical copy of the <code>codewhale</code> binary, so a script bound to only one of the two names was half installed for anyone who types the short one. Each shell gets its own idiomatic hook rather than a second copy of the script: bash re-binds the generated function, zsh widens the <code>#compdef</code> tag line to <code>#compdef codewhale codew</code>, fish adds <code>complete -c codew -w codewhale</code>, PowerShell registers <code>-CommandName 'codewhale','codew'</code>, and Elvish aliases the completer with <code>set edit:completion:arg-completer[codew] = $edit:completion:arg-completer[codewhale]</code>. </li> <li> Documented shell completions. <code>docs/INSTALL.md</code> § 8 now gives the generate and install commands for bash, zsh, fish, PowerShell, and Elvish, with a note to regenerate after upgrading and to delete scripts produced by v0.9.10 or earlier. There was previously no completion documentation anywhere in the repository, which is how <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5526</a> was reported as three problems instead of one. </li> <li> <code>/status</code> was 31 rows. On an 80x24 terminal the transcript viewport is 18, so typing <code>/status</code> landed you on the tail of the report: the version, route, directory, mode and sandbox rows had already scrolled past, and what stayed on screen was five <code>not reported</code> rows and a <code>$0.0000</code>. The report is 18 rows on a fresh session — <code>Window override:</code> is present unless the value is already configured. That is the viewport's height, so once <code>/status</code> itself occupies a history cell the title row still scrolls off; it does not fit that terminal whole. Provider, model and reasoning effort are one <code>Route:</code> lockup, the way the header rail already writes them. Mode and its permissions are one statement of posture. <code>Rate limits:</code> is gone — it was a <code>push_row</code> of a string literal and could never say anything but "not available from provider telemetry". The per-turn token ledger is gone too, because <code>/tokens</code> is that ledger's whole subject and <code>/status</code> was printing six rows of it at the same weight as the sandbox policy; the two facts that lived nowhere else, the cumulative in/out split and the cumulative cache totals, survive on one <code>Session tokens:</code> row. <code>Footer items:</code> no longer prints ten internal config keys across the full width — <code>/statusline</code> owns them, and the report now points there in the same row that points at <code>/tokens</code>. Two blank gutters do the grouping; the <code>===================</code> rule under the title is gone. </li> <li> The <code>/status</code> window-override key has its own labelled row. It used to be parenthesised onto the end of the provenance row, which pushed <code>context_window in config.toml</code> past the right edge at 80 columns and wrapped the sentence. <code>Window source:</code> states the provenance and <code>Window override:</code> names the exact key — and the override row is omitted entirely when the value is already configured, rather than advising you to set what you have set. </li> <li> <code>/help</code> no longer truncates anything. Every label and description used to run through a <code>truncate_to_width</code> that appended <code>…</code>, which in a two-hundred-row list promises text no keystroke can reveal and lands mid-token: <code>(aliases: /qin…</code> left the parenthesis hanging open. Descriptions now shed whole fields — the alias parenthetical first, then trailing clauses at their own joints, and only where there is no joint at all, the sentence's short form on a whole word with no mark, keeping the head noun of a simple verb + modifier + noun phrase rather than the adjectives that qualified it. The focused row's description is restated under the filter at the panel's full width, only when the row itself could not hold it, so a wide terminal does not say the same sentence twice. At 60 columns that restatement is itself shed — the <code>/advisor</code> detail stops before <code>session</code> — so the detail is longer than the row, not a copy of the original sentence. </li> <li> The <code>/help</code> label column is measured instead of assumed. It was a flat 28 columns at every terminal size, so at 60 columns twenty blank cells sat between <code>/advisor</code> and a description cut down to 21. Each group now sizes its column to the labels it actually holds, which nearly doubles the description column on a narrow terminal, and the label — the string you have to type — reads one step brighter than the description that qualifies it. </li> <li> <code>/help</code> stopped spending rows on itself. The match count moved onto the filter row it describes, the blank spacer under it is gone, and the footer no longer repeats <code>type to filter</code> while the filter box says <code>Type to filter</code> two lines above — at 60 columns that duplicate was what pushed the footer onto a second row. A group header also stopped printing <code>▸ ▾</code>: the selection cursor and the collapsed chevron are the same glyph, and a focused collapsed group was showing it twice for two different facts. Help now opens focused on the first entry rather than the header above it. </li> <li> The bottom status rail is no longer one run-on sentence. At 120 columns it read <code>▌· idle · Ollama · deepseek-v4-flash · max · Anonymous usage counts are on. … ⌥V:output · /context:context · fn+F1:keys</code> — live state, route identity, a telemetry consent notice, and keyboard hints all strung together by the same middle dot in the same ink, so nothing was grouped and the eye had nothing to skim by. At 80 columns it simply stopped mid-notice, and at 60 the row overflowed and was clipped by the terminal mid-word. The rail now divides its groups with a blank gutter instead of another dot (the dot is kept for peers inside a group), the model name reads one step brighter than the qualifiers that narrow it, and <code>Esc to interrupt</code> reads in the same hint weight as the right-hand chords rather than in the separator weight. </li> <li> Nothing on the status rail is ever truncated now. A notice sheds whole sentences to fit, and if one sentence is still too long it sheds at the inner joints — a colon, a semicolon — with the trailing mark cut so the phrase that survives does not itself advertise that more was coming. Route identity sheds the provider, then the reasoning effort, rather than rendering <code>deepseek-v4-flash-prev…</code>; a clipped model name is worse than no model name because routes share prefixes. Clauses rejoin without a Latin space after a full-width stop, so the Japanese receipt reads as Japanese. </li> <li> A notice now stands the standing facts down instead of queueing behind them. Route identity and the ledger chips are still there in ten seconds; the notice is not, so it takes the row and the key hints yield last. This is what makes the telemetry receipt readable at 80 columns, where it used to be simultaneously always present and never legible. </li> <li> The status rail no longer advertises <code>/context:context</code>. It was spending eighteen columns of a 24-row screen to name a slash command that announces itself the moment you type <code>/</code>; the rail advertises chords you cannot discover any other way. The rail now reads the same at 80 columns as at 200. </li> <li> The idle screen no longer has an absolute path stretched across it. The workspace caption between the wordmark and "What do you want to accomplish?" was composed at full length and then truncated to the lane width, which made the centering inset <code>(width - caption.width()) / 2</code> evaluate to zero — so a line that was written to be centered rendered flush-left and full-bleed, cutting the centered whale/wordmark/prompt composition in half. The clipping also destroyed the information it was supposed to carry: at 80 columns the line read <code>/private/tmp/claude-501/-Volumes-.../34267917-11f4-4d15-911a-…</code>, which tells the reader nothing about where they are. The caption now sheds detail instead of being cut — MCP count first, then branch, then leading path components — so it always fits with room to center, and the folder you are standing in is the last thing to go. Elisions land on a path separator rather than mid-directory. </li> <li> Removed the placeholder engine tree in <code>crates/core/src/engine/</code>. Its <code>Engine::run</code> accepted <code>Op::SendMessage</code>, appended to a journal, and emitted <code>TurnComplete { status: "completed" }</code> without ever contacting a model, and <code>TurnExecutor</code> was a struct with a field-copy constructor and a <code>step < max_steps</code> comparison. Nothing in the workspace referenced any of it — the only mention of <code>codewhale_core::engine</code> anywhere was a doc comment inside the tree itself — but its comments ("the real turn loop is wired here in the next slice") were what <code>docs/ARCHITECTURE.md</code> leaned on to claim that <code>crates/core</code> owns the agent loop. There is now exactly one turn loop in the workspace, <code>Engine::run_turn</code>, and a guard test fails if a second one appears. <code>docs/ARCHITECTURE.md</code> and <code>AGENTS.md</code> now say where it actually lives. </li> <li> First-run onboarding no longer silently truncates its explanation in languages that do not put spaces between words. <code>wrap_words</code> split on whitespace, so a Japanese sentence arrived as a single token, the line-break check (which only fires once a line is non-empty) never triggered, and the over-wide line was clipped by the terminal. At 80 columns the provider screen read "Hosted providers need a key, but loca" and stopped — losing exactly the half that tells the reader local runtimes need no key, on the screen where they choose a provider. Space-less scripts now break by display width on grapheme clusters, and a line may not begin with closing punctuation (<code>。</code>, <code>、</code>, <code>」</code>, <code>）</code> and friends). Wrapping for languages that do use spaces is unchanged. </li> <li> Project instructions are bounded by one budget and no longer treat other agents' files as law by default. Previously <code>.claude/instructions.md</code> and <code>CLAUDE.md</code> sat at ranks 2 and 3 of the canonical instruction list — above Codewhale's own <code>.codewhale/instructions.md</code> — <code>.claude/rules/</code> was an auto-discovered rules directory, and <code>.cursorrules</code>, <code>.cursor/rules</code>, <code>.clinerules</code>, <code>.windsurf/rules</code>, <code>.gemini</code>, <code>.github/copilot-instructions.md</code> and <code>.github/muse-instructions.md</code> were all imported into the system prompt with no opt-in. Dropping a <code>CLAUDE.md</code> written for a different tool into a repository silently made it standing authority here, which is an injection surface rather than a convenience. Codewhale now reads <code>AGENTS.md</code>, the cross-agent <code>.agents/AGENTS.md</code>, and its own instruction files by default; every other agent's format is opt-in by name through <code>project_instruction_imports</code> (env <code>CODEWHALE_PROJECT_INSTRUCTION_IMPORTS</code>), imported files rank below Codewhale's own, and a workspace that contains an un-imported format says so in a warning naming the exact setting. </li> <li> Separately, a symlinked candidate rules directory — <code>.cursor/rules</code>, <code>.windsurf/rules</code>, or <code>.gemini</code> pointing outside the workspace — was traversed and its contents imported as instruction authority, because the directory check followed the link while only the files inside it were checked. The two instruction loaders now apply the same no-follow rule that <code>.codewhale/rules/</code> already had. </li> <li> The three separate ceilings on standing instructions (200 KiB for the root->workspace chain, 500 KiB for the rules block, 40 KiB for imported fragments, and a global layer that was merged in after the chain budget had already closed and so counted against nothing) are replaced by a single 48 KiB aggregate budget covering all of them together. Instructions claim it before rules, and are trimmed from the broadest scope inward so the nearest-scope file is the last thing dropped rather than the first thing stranded. Truncation still leaves an explicit marker. </li> <li> Editing the workspace no longer grants the shell outbound network access. <code>workspace-write</code> sandboxes are created network-restricted; <code>curl</code>, package installs, and <code>git fetch</code> inside a sandboxed shell are denied by the OS sandbox unless network is granted explicitly. This closes a real gap rather than tightening a working boundary: the elevation added in <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#273</a> was justified by the application-level <code>NetworkPolicy</code> remaining "the only outbound boundary", but that policy governs <code>fetch_url</code>, <code>web_search</code>, and MCP HTTP and never constrained shell subprocesses, so workspace-write turns had unrestricted egress with nothing enforcing anything. Network now comes from one of three explicit places: the new <code>sandbox_network_access</code> config key (also <code>CODEWHALE_SANDBOX_NETWORK_ACCESS</code>), a <code>danger-full-access</code> posture, or the existing post-denial elevation prompt that grants network for a single call. Yolo and <code>--yolo</code>/Bypass are unchanged — they resolve to <code>danger-full-access</code>, which applies no sandbox at all. <code>external-sandbox</code> reports the network it was actually granted instead of hardcoding <code>true</code>, and <code>/status</code> reads the flag instead of printing "network on" for every workspace-write policy. Platforms with no sandbox backend (default Linux without bubblewrap, and Windows) still enforce nothing, and both <code>/status</code> and <code>doctor</code> continue to say so. </li> <li> The nightly Windows ARM64 artifact build works again. Every nightly from 2026-08-16 failed while compiling <code>codewhale-tui</code>, deterministically on the same codegen unit across all three build attempts, with <code>thread 'optimize module codewhale_tui...-cgu.13' has overflowed its stack</code>. The trigger is stack depth in the LLVM worker threads that run per-codegen-unit optimization, not the workflow's <code>lto=off</code> override: holding the crate and every flag fixed and varying only <code>RUST_MIN_STACK</code> on aarch64 shows 1 MiB crashes rustc while 2 MiB and 4 MiB succeed. Unix std defaults to 2 MiB and passed; the Windows ARM64 runner sat under the requirement. Nightly now sets <code>RUST_MIN_STACK</code> explicitly for every target, because the requirement follows from the size of <code>crates/tui</code> rather than from the platform. The redundant <code>codegen-units</code> override is gone -- <code>[profile.release]</code> already sets 16, so restating it never changed anything. Shipped binaries were never affected; <code>release-artifacts.yml</code> builds <code>--profile dist</code> with fat LTO and <code>codegen-units = 1</code>. </li> <li> Test debt: the transcript history-cell suite has been rebuilt. It was 123 tests across 3,964 lines, and about a third of it pinned the current skin rather than any behavior -- <code>assert_eq!(spans[1], "⣤")</code> for the reduced-motion marker, <code>title_span.style.fg == theme.tool_title_color</code>, <code>visible[1] == "▏ done: scan repo"</code>, four separate tests each asserting one shape of fenced code never takes the transcript rail, and one test whose only assertion was <code>!text.is_empty()</code> under a name promising it checked the rendered tool id. Assertions like those break on every legitimate visual change and catch nothing a reader of the transcript would notice, which is the liability <code>d64b9429b</code> named. The replacement is 40 tests, each named for the property it protects and asserting the property instead of the token: reduced motion is checked by rendering the same running card at two different elapsed times and requiring the frames to match -- which also catches an animation leak the glyph constant missed -- and a frozen marker must stay visible rather than landing on the spinner's invisible blank (U+2800). Severity colors are checked by requiring warning not to read as error rather than by naming a palette entry. A streaming assistant glyph must actually pulse when motion is allowed, checked against <code>pulse_brightness</code> rather than by sleeping on the 2s sine. Each of the invariants claimed was verified to fail the new suite when deliberately broken in the renderer. </li> </ul> <h2>Contributors</h2> <ul> <li>Sun Zhenyuan (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@bistack</a>) — tool-call stage extraction with the existing execution and policy contracts preserved (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5523</a>).</li> <li>Isabel Wu (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) — bounded multi-file <code>read_lints</code> support (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5524</a>), plus independently reviewed completion-routing overlap in <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5530</a>.</li> <li>Lstarsky0 (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — maintainer review hardening for truthful per-file states and truncation metadata in <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5524</a>.</li> <li>Paulo Aboim Pinto (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a>) — portable presentation/media/digest facets and the seven utility-handler migrations (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5525</a>).</li> <li>RepentStar (<a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">@RepentStar</a>) — reported and reproduced the stale completion-generator path and missing <code>codew</code> registration fixed for <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">#5526</a>.</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044344/4267081/github-release-codewhale-hqcodewhale-v0911-23082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.12 (05.09.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.1205.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — official GitHub release</h3> New macOS/Linux install (checksummed binaries from this release): <pre>curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.9.12" sh "$HOME/.local/bin/codewhale" --version</pre> For Windows, use the matching installer or archive below. For an existing direct install, run <code>codewhale update</code>; it prints the executable path and keeps newer builds. If the install directory is occupied by a different build, use the fresh-directory migration in <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">the installation guide</a>. <h3>Secondary packaging — npm and Cargo</h3> <pre>npm install -g codewhale # or build from source cargo install codewhale-cli --locked</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.12</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.12</h2> Codewhale v0.9.12 puts computer use in the binary, opens two new routes — Alibaba Model Studio through the data-driven provider table and Concentrate as an opt-in BYOK Responses gateway — and adds cloud dispatch plus a config-gated per-session control socket. The shell is the other half of the release: a new launch card, the work surface docked under the composer, one focus owner for Tab, tool cells that carry their own state, and <code>fleet</code> as the public word for the live collective. The complete item-level change record is retained below the categorized release highlights. <h3>Added</h3> <ul> <li>Computer use ships with the binary. The <code>computer-use</code> plugin — 38 tools across macOS, Windows, Linux and HarmonyOS, accessibility-first observation with pixel fallback, screenshots, zoom, screen recording, and registered remote computers over ssh and hdc — is embedded in Codewhale and written to <code>$CODEWHALE_HOME/builtin-plugins</code> on first run, so every install channel carries it. It lists as <code>builtin · not-reviewed</code> and stays disabled until you review and enable it: shipping it is not consenting to it. The stdlib-Python computer-use server it replaces is gone.</li> <li>Alibaba Model Studio joins the data-driven provider table as an <code>openai-compatible</code> descriptor: international compatible-mode endpoint, <code>DASHSCOPE_API_KEY</code> credential, live <code>/v1/models</code> discovery. Qwen 3.8 Flash and Qwen 3.8 Max arrive through the catalog authority — never a hard-coded id.</li> <li>Concentrate: first-class opt-in BYOK Responses gateway with live models discovery and typed SSE streaming (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5725</a>).</li> <li>Cloud dispatch: remote runner offloads coding agent tasks to isolated cloud sandboxes with machine token auth and structured job tracking (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5701</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5712</a>).</li> <li>Per-session control socket: config-gated <code>[control_socket]</code> table binds <code><sessions-dir>/<session-id>/control.sock</code> per running session, exposing message, interrupt, relaunch, and status JSON-RPC verbs (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5533</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5831</a>).</li> </ul> <h3>Changed</h3> <ul> <li> Anonymous usage counting is on by default. The 0.9.11 release asked first; 0.9.12 counts the same aggregate version/platform, session, feature and error totals unless you turn it off, and says so once at first launch (policy notice version 5, schema 3, <code>notice_version</code> replacing <code>consent_version</code>). Every recorded opt-out stays off: a durable <code>telemetry = false</code>, a decline recorded under the old opt-in notice, unreadable privacy state, and the <code>CODEWHALE_TELEMETRY=0</code> / <code>--telemetry false</code> kill switches. Showing the disclosure records only that it was shown, never an acceptance. <code>codewhale config set telemetry false</code> turns it off and wipes queued counts; <code>codewhale config set telemetry true</code> deliberately re-enables it. Nothing new is collected: no conversations, code, prompts, files, names, model content, credentials, or IP. </li> <li> The launch screen is our own card take: a thin top line <code>⑂ branch path</code>; a centred bordered card with the whale mark, <code>Codewhale</code> + version, one announcement line only when it is true (the no-model warning, or MCP news), and the menu New worktree / Resume session / Changelog / Quit with their real chords right-aligned. Enter runs the highlighted entry, Up/Down move it, and typing goes straight to the composer. The card dissolves on the first keystroke or command (≤240 ms, instant under reduced motion) (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5826</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5801</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5815</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5286</a>). </li> <li> The work surface sits under the composer by default, keeping history readable and leaving the stage unencumbered (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5809</a>). </li> <li> Skills command shapes: FEAT-022 command shapes and retained-host validation (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5825</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5829</a>). </li> <li> After the card dissolves, the working screen shows <code>⑂ branch path</code> with <code>⋮ MCP n/m</code> on the right, the transcript starts with the <code>◆ session_start</code> receipt (naming the configured session-start hooks), and the composer's bottom rule carries <code>model (effort) · permission</code> — the route's one launch reading. The posture bar and metrics line appear only once a session exists. </li> <li> Vocabulary: <code>fleet</code> is the public term and <code>Pod</code> is retired from copy — roster, setup, detail, worker-runtime and managed-API messages now say Fleet (<code>/fleet</code> canonical, <code>/pod</code> alias). The workflow wire accepts the canonical role spellings (general/explore/planner/reviewer/implement/ test/advisor) with the pre-rename ones kept as load-time aliases, and serializes canonical names. </li> <li> The Operate mode-picker hint is shortened to fit 80 columns. </li> <li> The footer always shows the permission posture; when only one chip fits, the permission chip outranks the mode word (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5796</a>). </li> <li> Local Ollama: the header names a model only when the local catalog can serve it, and says <code>unknown</code> until it knows. The startup mark, web and app icon carry the new side-view prompt-eye whale (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5795</a>). </li> <li> One focus owner: Tab and Shift+Tab work regardless of what is in the composer; Alt shortcuts survive mid-draft; Ctrl+Tab no longer cycles the mode by accident (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5798</a>). </li> <li> Tool cells carry their own state: a running, failed or warned tool reads as such in the transcript itself, with per-entry rail dots and family-coloured glyphs (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5799</a>). </li> <li> Web: docs hub with task search, shared empty/loading/error states, an offline-to-back-online banner, <code>/changelog</code> in every locale, and real 404s with correct metadata (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5743</a>). </li> <li> Web: the app's colours come from one file generated from the TUI whale palette; re-typing a colour by hand fails web CI (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5797</a>). </li> <li> Web: a one-way ceiling on <code>isZh</code> branching outside the i18n spine — the count may only go down (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5805</a>). </li> <li> An internal agent handoff doc was removed from the public tree and <code>.playwright-mcp/</code> is now ignored (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5800</a>). </li> <li> First run paints the composer immediately: the Welcome/language/provider/ trust gates no longer precede the first keystroke. Missing-key and workspace-trust recovery stay for returning users; language and provider remain in <code>/setup</code>. </li> <li> The canonical whale-tile mark propagates beyond web to the exact-raster surfaces that can carry it (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5738</a>). </li> <li> Dead-code sweep: delete proven-unreferenced helpers (unused builders, wrappers, and leftover identifiers) and drop stale <code>#[allow(dead_code)]</code> where the item is production-called or test-exercised. No runtime behavior change (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5791</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5587</a>). </li> <li> Remote-control recovery gives every fresh pre-dispatch attempt a new lease generation while preserving that generation across its typed start (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5605</a>). </li> <li> Public roster language is Pod. <code>/pod</code> is the customer surface; fleet remains the internal wire, storage, and migration name (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5776</a>). </li> <li> Compaction replacement history keeps a bounded last user round (assistant + tool results) instead of dropping them behind a summary. <code>/context</code> names the compaction path and <code>/anchor</code> survival. Failed compact still does not replace live history (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#4394</a>). </li> <li> Provider catalogs: compatible hosts (Baseten, Groq, Cerebras, SenseNova, Command Code) no longer compile a frozen model roster. Descriptors name the wire, URL, and env; live <code>GET /v1/models</code> and a Codewhale-owned catalog layer are the offering list. Command Code is a catalog/descriptor row, not a <code>ProviderKind</code>. Catalog presence is not an availability, entitlement, or provider-acceptance claim (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5783</a>). </li> <li> Provider selection no longer probes or adopts an external CLI credential on ordinary picker use. Reuse requires an explicit "Use external CLI credentials" choice, exact-path confirmation, and Codewhale-owned revoke (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5772</a>). </li> <li> TUI: startup no longer presents an approximate ASCII or block-glyph whale as the product mark. It keeps the direct Tideline prompt while exact-raster surfaces remain responsible for the canonical asset. </li> <li> TUI: the active-session composer paints the same three-cell <code>[↑]</code> send target as Startup and clicks it through the existing Enter submit dispatcher (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5771</a>). Compact/quiet composers still omit the control. </li> <li> TUI/CLI: Pod is the public roster surface. User-facing Fleet wording moves to Pod; durable receipt keys stay compatible (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5776</a>). </li> </ul> <h3>Added</h3> <ul> <li> Native ChatGPT sign-in for the <code>openai-codex</code> route: <code>codewhale auth chatgpt</code> opens a browser PKCE flow and stores refreshable tokens in Codewhale-owned credentials — no Codex CLI install required. <code>/auth chatgpt-revoke</code> clears them off the event loop (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5784</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5778</a>). </li> <li> MCP servers and plugins can be connected self-serve from the session: a unified auth flow with rotation-safe token handling, a spoken authorization URL, and catalog refresh when stored credentials stop working (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5747</a>). </li> <li> <code>/operate</code> reads match the landed CWC <code>OperateRecord</code> contract: fetching an absent record returns a truthful not-found view instead of a fabricated operation, and an empty evidence path is rejected rather than resolving to the workspace directory (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5703</a>). </li> <li> TUI: scheduled automations project into the top strip (<code>⏱ N scheduled · M running</code>, compact <code>⏱ N·M</code>) with typed <code>HistoryCell::Automation</code> receipts when a run this session watched settle. <code>/automation</code> acknowledges failures. The merged footer does not carry the work fact (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5748</a>). </li> <li> The app-server can listen on a unix domain socket and advertise a <code>daemon/attach</code> handshake, so a local client can attach to an already-running engine instead of spawning its own. The socket is created with owner-only permissions and stale sockets are reclaimed on start. Non-unix hosts return a typed unsupported-platform refusal; the Windows named-pipe endpoint is named but not yet implemented (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5749</a>). </li> <li> The engine's internal <code>Op</code>/<code>Event</code> types and the wire protocol's <code>Op</code>/ <code>EventMsg</code> now carry a compile-enforced twin for every variant: adding an engine variant without a protocol counterpart fails the build instead of drifting silently. Internal durability work — no user-visible surface change yet (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5751</a>). </li> <li> Machine tokens: with <code>CODEWHALE_API_KEY</code> set, the CLI authenticates as the Codewhale account with no local session file and no browser — the CI authentication path, with a typed token shape and redaction (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5721</a>). </li> <li> Compaction publishes a structured survival contract for session-tree journal entry types (<code>crates/tui/src/compaction/SURVIVAL_CONTRACT.md</code>) and fails closed when the last user round, tool results, <code>/anchor</code> text, or checkpoint receipt would vanish (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#4394</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5782</a>). </li> <li> Internal: <code>codewhale-config</code> gains <code>RouteAuthoritySnapshot</code>, one immutable authority that owns a compiled provider catalog together with the route resolver projected from it, so a picker, a readiness view, and an execution path can no longer resolve against different catalog snapshots without a type-level signal. Resolution still goes through the sole resolver; the returned receipt distinguishes an exact catalog row, a custom-endpoint route whose provider facts are deliberately not reused, and an allowed pass-through route with no catalog row. All state is secret-free. No call site changed and no user-visible behaviour changed yet (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5766</a>). </li> <li> Computer session records now count only time a provider actually accepted the session as active, at per-second granularity. Idle, queued, stopped, and teardown time are excluded, and a session whose allocation does not match a standard profile is refused rather than recorded approximately. Covered by hermetic fixtures; no live provider call and no deploy (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5781</a>). </li> <li> Website: the public site moves to the Tideline deep-ocean design language (dark by default with an opt-in light documentation sheet, palette grounded in the TUI's WHALE_* tokens) and the new whale brand mark across the favicon, app icons, web manifest, nav wordmark, and social card (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5573</a>). </li> <li> Add <code>codewhale dispatch</code> / <code>/dispatch</code> so a local session can propose a Codewhale cloud agent against an explicit <code>github</code>, <code>cnb</code>, or <code>gitee</code> remote. Confirmation is required; missing credentials fail closed; cloud jobs share the existing <code>/jobs</code> surface as <code>kind=cloud</code>. See <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">DAYTONA_CLOUD_DISPATCH.md</a>. </li> <li> <code>/login</code> reports the Codewhale account session and provider-key next steps. The internal cloud-agent credential is not user surface: there is no <code>auth set-slot</code>/<code>auth clear-slot</code> command, no hint, and no completion entry for it — signing in with <code>codewhale login</code> is the only door. </li> <li> Add the Tideline component family from the ratatui translation spec (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5698</a>'s screens, riding the <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5699</a> work-strip layout): hero startup surface with quick actions and option strip, notifications inbox, merged footer band, pod ledger, receipt stream, theme list with motion toggles, live preview, settings rail, and the left rail — each a standalone render module pinned by 28 new byte-exact golden buffers. Frame wiring follows the Tideline acceptance gate; <code>NO_COLOR</code> is now honored by palette depth detection. </li> <li> Route Contract Phase 1: <code>RouteResolver</code> is the runtime path for <code>resolve_runtime_options</code>; <code>codewhale providers export --json</code> ships the owned descriptor catalog; CLI <code>--provider</code> accepts any catalog route id (the closed <code>ProviderArg</code> enum is deleted). Catalog layers are bundled → models.dev → provider <code>/v1/models</code> → config.toml → user, with policy DENY last and never overridden. </li> <li> Add provider-native web search for documented Xiaomi MiMo 2.5 Pro and 2.5 chat routes while keeping neighboring models and custom gateways fail-closed. </li> <li> Add structured provider-native web search for exact Z.AI global and Zhipu China general API routes, using each site's documented search engine value. Existing <code>open.bigmodel.cn</code> configurations now share Z.AI's official model namespace and credential scope; unknown model IDs still pass through. </li> <li> Add provider-native web search for documented Qwen models on ModelStudio Token Plan's Responses Harness, without enabling Coding Plan or Anthropic routes. </li> <li> Added <code>/copy</code> to place the latest completed assistant response on the clipboard without copying tools, system messages, hidden reasoning, or active partial output (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5668</a>). </li> <li> Add provider-native web search for documented DeepSeek V4 routes through the Responses API, with fail-closed capability gating for compatible custom endpoints. </li> <li> Add provider-native search for exact Moonshot K3 Formula, legacy K2.6 built-in search, and Kimi Code membership <code>/search</code> routes. Treat the exact Moonshot China endpoint as a first-party direct route. </li> <li> Z.ai <code>GLM-5.3-Flash</code> and OpenRouter <code>z-ai/glm-5.3-flash</code> are first-class picker rows (<code>/model GLM-5.3-Flash</code>). Flash is the faster/explore sibling of <code>GLM-5.3</code>; the Z.ai default stays <code>GLM-5.3</code>. List price is $0.15/$0.50 per 1M (durable; the 50% promo through 2026-09-09 is not the catalog row). </li> <li> Baseten, Groq, and Cerebras are bundled OpenAI-compatible setup templates (<code>[providers.<id>] kind = "openai-compatible"</code>), not new <code>ProviderKind</code> variants. <code>/provider</code> fills URL, model, and env from one catalog row. </li> <li> MCP manager copy now names the server, the failure, and one recovery command (<code>The X MCP server requires OAuth reauthentication. Run /mcp login X</code>). </li> <li> Settings Advanced exposes clickable MCP Connect, Reconnect, and Diagnose actions, while Extensions and Problems route recovery through the existing <code>/mcp login</code>, <code>/mcp reload</code>, <code>/mcp validate</code>, and <code>/plugin validate</code> commands (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5643</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5655</a>). </li> <li> Plugin prompt matching (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5579</a>): sending a task can toast the next review step when the prompt strongly matches an installed-but-idle plugin or a marketplace catalog you added (for example a Supabase prompt suggesting <code>/plugin trust supabase</code>). A live composer CTA offers the same review command while you type, matching turns append a bounded <code><recommended_plugins></code> user block, and <code>request_plugin_install</code> surfaces review without installing. <code>/plugin suggest</code> now ranks manifest keywords and catalog candidates, never auto-installs, and on-disk plugin changes also nudge <code>/plugin reload</code> between turns. </li> <li> Added <code>/import-claude</code> (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5557</a>): reads <code>~/.claude.json</code> and <code>~/.claude/settings.json</code> read-only and renders an explicit, reviewable migration plan plus a written report. MCP servers route through the existing <code>/mcp import <name> --approve</code> consent flow, allowlisted env keys become an unapplied portable bundle for <code>codewhale config import</code>, and permissions/hooks map to manual follow-ups; secret-shaped values are named but never echoed or imported. </li> <li> Added the managed Chat relay: account-owned Chat commands now execute on the native runtime thread engine through a new <code>runtime_chat_relay</code> module instead of a second execution path. Each Chat thread is a dedicated, isolated runtime thread with an empty model-visible tool allowlist, a chat-only system prompt, and no workspace, memory, skill, credential, or local-path context; the active interactive TUI thread is never reused. The relay keeps one durable state file per scope behind a session-wide owner lock, binds a saved session permanently to its first remote target, replays exact duplicate commands from retained results instead of starting a second inference turn, terminalizes orphaned reservations on restart, and rejects (never queues into) a busy local Work turn with an immediate retryable result. Stop commands require the exact run and turn identity, and a worker aborts on any account or target mismatch during token refresh. </li> <li> Added a verified Omarchy/AUR packaging path: <code>packaging/aur</code> now carries a <code>PKGBUILD</code> template, <code>.SRCINFO</code> renderer and tests, release-candidate render step, and docs; the live AUR compatibility alias <code>codewhale-tui -> codewhale</code> is preserved, AUR dependencies match the live package, and the self-updater refuses to fight an Omarchy/package-manager installation. </li> <li> Added a Fleet run-wide cost/token usage ceiling (R6, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5567</a>): an accumulator plus admission gate and alert bound a whole run's spend across workers. </li> <li> Added the real provider cache hit rate to <code>/context</code> (C3, DSH <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#3</a>): the token-weighted provider-reported rate from the same telemetry <code>/cache</code> aggregates, plus an honest "no cache telemetry yet" state when nothing is recorded. </li> <li> Added per-step cost movement: <code>TurnUsage</code> receipts are priced as they land so the live cost surface moves during long agentic turns instead of only at <code>TurnComplete</code> (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5578</a>), and the footer now honestly shows <code>cost: unknown</code> when nothing can be priced instead of hiding the line. </li> <li> Added the underwater session surface: the ambient water reads session state from across the room, its animation shape follows live agent activity, and attention tints are steady (no breathing) with a distinct reading treatment and no mid-water seam on tall windows. </li> <li> Added <code>@path:START-END</code> ranged line mentions (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5550</a>, picker half to follow), a predictable last-copy backup file for clipboard exports with the path named when the clipboard fails (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5555</a>), <code>wait</code> on multiple background shell tasks with <code>until=any|all</code> (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5549</a>, named-kill half to follow), and composer double-click word / triple-click line selection. </li> <li> Added workflow parallel-<code>schema</code> slot partial success (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5583</a>): a slot that produces a schema-valid partial result no longer fails the whole parallel branch. </li> <li> Added plugin load-failure startup hints (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5579</a>) and OpenRouter app attribution headers on outbound requests. </li> <li> Added <code>codewhale doctor --fix</code> (with <code>--yes</code> for non-interactive consent): the doctor now computes a concrete repair plan — delete stale <code>.tmp*</code> leftovers from interrupted atomic writes, tighten secret-store file permissions to <code>0600</code>, disable structurally broken (Error-status) MCP entries through the atomic MCP save path, and scaffold missing user-global <code>skills</code>/<code>tools</code>/<code>plugins</code> directories — shows it, and applies it only after explicit consent. Every action is narrowly scoped and idempotent; JSON and context-JSON modes stay read-only and conflict with <code>--fix</code> (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5552</a>, v1). </li> <li> Added <code>/context</code> reporting of the real provider prompt-cache hit rate (C3) alongside token pressure. </li> </ul> <h3>Changed</h3> <ul> <li> Provider-native web search now applies domain constraints before accepting an attempt, discards generated answers when returned citations violate those constraints, and preserves the caller's configured/local timeout as an independent fallback budget (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5681</a>). </li> <li> Idle session metrics omit zero facts (<code>0 turns</code>, <code>LLM 0s</code>) until the runtime has evidence. Working chrome says <code>in the current</code> instead of a generic <code>working</code>. </li> <li> Deleted nine uncompiled <code>runtime_contract/</code> staging files. Live contracts remain <code>model.rs</code> and <code>termination.rs</code>. </li> <li> The first <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5587</a> dead-code sweep converts audited test-only helpers to <code>#[cfg(test)]</code>, keeping production builds free of test-only APIs without changing runtime behavior. </li> <li> <code>/plugin reload</code> is now discoverable when on-disk plugin bundles change: the next send and <code>/plugin list</code> nudge once with <code>Run /plugin reload to apply</code> instead of silently keeping the stale catalog (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5579</a>). Trust is unchanged; this does not auto-reload. </li> <li> Context-pressure warnings and critical alerts now remain visible in sticky UI status until compaction or explicit dismissal, instead of disappearing into scrolling turn metadata (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5620</a>). </li> <li> The Runtime thread store defaults to a per-session root (<code>$CODEWHALE_HOME/sessions/<id>/runtime</code>) so multiple Codewhale processes on one machine no longer share one owner lock (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5630</a>). The exclusive lock is unchanged; <code>CODEWHALE_RUNTIME_DIR</code> still selects a shared root when that is intended. </li> <li> Session token totals now include display-only per-model-call deltas while a turn is running, including input/output and cache-class counters; the authoritative <code>TurnComplete</code> totals still reconcile exactly once (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5581</a>). </li> <li> Transcript focus now exposes per-block actions: <code>y</code> copies content, <code>Y</code> copies the rendered metadata view, Enter opens a fullscreen block pager, and <code>r</code> opens raw detail; the existing Tasks rail shortcuts remain unchanged (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5551</a>). </li> <li> Provider neutrality (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5588</a>): model resolution of omitted/aliased models is now provider-relative, OpenAI-native defaults no longer route through another provider's table, CLI credentials stay provider-scoped, and NVIDIA credentials no longer leak into the DeepSeek keychain. Neutrality test matrices exercise several providers instead of standing in with one. </li> <li> The workflow engine module was decomposed out of its 3k-line mega-file into <code>journal</code>, <code>usage</code>, and <code>report</code> modules plus a module directory (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5586</a> slices 1a/B/C/D), a semantic-free move verified by normalized-content hash. </li> <li> Compaction refusals are now always named (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5577</a>): silent holds under context pressure are gone, the context meter honors the same provider-billed prompt the trigger uses (T1), and prune outcomes are projected without cloning the transcript. </li> <li> Step budgets now end honestly: an ~80% soft landing nudges the model to write its final report, and exhaustion grants exactly one bounded report-on-exhaustion turn instead of dying silently (A1/A2). </li> <li> Contributor credit: recognized agent contributors (e.g. <code>Codewhale Agent</code>) may now carry <code>Co-authored-by</code> trailers; unknown bot/tool trailers are still rejected by the credit gate. </li> </ul> <h3>Fixed</h3> <ul> <li> Fast typing no longer corrupts the composer. The paste-burst heuristic ran on every session until a real bracketed paste arrived, holding, buffering, retro-grabbing, and absorbing Enter on timing guesses; it is now fallback-only (gated off when the terminal provides bracketed paste), the retro-grab is deleted, and Enter on held command text flushes and submits. </li> <li> Ctrl+C works on the pre-session launch menu and speaks everywhere: the first press arms the two-second exit window with a visible localized "Press Ctrl+C again to quit" hint (previously silent), the second exits. The worktree name input keeps Ctrl+C as cancel-input. </li> <li> Fresh interactive sessions no longer leave a phantom one-message duplicate behind. The TUI claimed one session id (Runtime store lock, turn-start crash checkpoint) while the engine minted a second one; the first <code>SessionUpdated</code> re-keyed the App, the completion commit cleared only the engine id's checkpoint, and <code>codewhale --continue</code> later "recovered" the orphaned checkpoint as a duplicate session instead of the real one. The engine now adopts the host-owned id at spawn (<code>EngineConfig::session_id</code>) and <code>/clear</code> mints the next id in the App like <code>/new</code>. A non-TTY <code>--continue</code> no longer promotes and consumes the crash checkpoint before failing the terminal check, and the root <code>codewhale --resume <id></code> / <code>--session-id <id></code> flags documented in the operations runbook now parse instead of being swallowed as a prompt. </li> <li> Website: <code>/signin</code>, <code>/signup</code>, and <code>/auth/callback</code> are locale-aware public routes instead of localized 404s. Sign-in and create-account send the person to the CWC app; OAuth callbacks hop to <code>app.codewhale.net</code> with the query intact; <code>/login</code> and <code>/register</code> are aliases. Local CLI use is not presented as requiring an account (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5767</a>). </li> <li> The sandbox read deny-list matches a rule's resolved path as well as its literal spelling. On macOS <code>/etc</code> and <code>/var</code> are symlinks into <code>/private</code>, so a read of <code>/private/etc/sudoers</code> walked around the <code>/etc/sudoers</code> rule, and a rule written against a symlinked directory never fired for the real path that <code>canonicalize</code> and the process cwd hand back. </li> <li> Background shells are first-class work-strip rows (<code>▾ Shells N</code>) you can open, watch, and cancel by the <code>shell_*</code> id on the row. <code>/jobs cancel all</code> cancels running shells; it no longer looks up a task named <code>all</code>. The composer hourglass crumb no longer stands in for a shell surface. </li> <li> <code>codewhale logout</code> and <code>/logout</code> now clear the Codewhale account session and the Daytona secret slot, not only provider API keys. The TUI crate's leftover <code>login --api-key</code> path no longer claims to save a key. </li> <li> Account sessions no longer read the macOS Keychain. Unsigned or rebuilt <code>codewhale</code> binaries were a new Keychain ACL principal every time, so <code>codewhale web</code> and the TUI popped a password dialog on start. Sessions now use <code>~/.codewhale/secrets/secrets.json</code> (mode 0600), the same store as provider keys. Extracted from the Keychain-retirement half of <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5632</a>. </li> <li> Hardened the dispatcher-side config parse the same way: <code>ConfigStore</code> loads and project-config parsing now deserialize <code>ConfigToml</code> on a dedicated 16 MiB-stack thread (the guided-setup save path could overflow a 2 MiB worker stack the same way the TUI's <code>ConfigFile</code> parse did), and the <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5585</a> setup-confirm toast test runs its runtime on an equally sized thread instead of overflowing the default libtest stack. </li> <li> Fixed detached interactive agents reporting worker usage after the parent turn ends with the usage missing from the session/live <code>/cost</code> total (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5597</a>): interactive turns acquire an owner-scoped runtime usage lease, late usage enters the session cost pool without reopening the sealed mailbox, and worker/session/reload accounting share one hashed response identity so retried deliveries stay exactly-once. </li> <li> Fixed the sub-agent fiasco class: in-workspace absolute <code>git -C</code> no longer trips the read-only child shell gate with a coherent bounded gate (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5595</a>), turn end parks turn-owned children resumably instead of silently cancelling them (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5596</a>), stale write-claims are released by liveness with coordinate release (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5562</a>), and the verifier role description matches its real surface (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5562</a>). </li> <li> Fixed workflow responseSchema failure handling (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5583</a>): bounded repair with typed receipts (kind + attempt), raw-output receipts persisted as artifacts that survive reload, and failures surfaced instead of null success (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5528</a>). Degraded owner snapshots no longer project as ordinary Completed runs (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5582</a>), typed task error kinds enable fail-fast parallel/pipeline (R9), and <code>/workflow confirm</code> finds the draft despite interleaved messages. </li> <li> Fixed the DeepSeek session that never auto-compacted at 842k/1M (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5577</a>): the exact <code>billed_842k_on_a_1m_window_compacts_despite_a_small_estimate</code> regression pins the trigger. </li> <li> Fixed sandbox escapes and authority gaps: workspace-write tools resolve hard-linked files before writing (S2, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5569</a>), an opt-in read deny-list bounds full-disk reads in any posture (S1, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5568</a>), and session grants match the command family instead of widening the whole tool (R2). </li> <li> Fixed provider-transport robustness: non-streaming HTTP requests are bounded by a read timeout (R4), and Chat-Completions mid-stream error frames surface instead of hanging (R3). MCP OAuth expiry now reacts to 401/403 with a named recovery path and login hint instead of looking like a broken server (T4, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5572</a>). </li> <li> Fixed Fleet lifecycle gaps: detached workers are reaped when their manager dies (R7) and the per-task wall-clock timeout is enforced (R5); the local Fleet host compiles on non-Unix targets; detached schema repair stays within the runtime budget. </li> <li> Fixed prompt-cache correctness: the tool catalog is fingerprinted in provider wire order (C1), prefix changes between requests are always declared (C5) — including the newly named mid-turn <code>change:tool_surface</code> reasons for deferred-tool admission, tool-search activation, and runtime MCP tool arrival — and a reasoning-only response stopped at the output limit now fails the turn honestly instead of re-issuing a request that can only reproduce the stop. </li> <li> Fixed docs/public-surface drift: REBRAND.md no longer presents <code>api.deepseeki.com</code> as a China fallback (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5564</a>), and the web facts/tool counts match the repository. </li> <li> Heavy pull requests now run the real Linux workspace nextest, doctest, and lockfile lanes directly on GitHub Actions instead of reporting a green placeholder while waiting for a branch-specific CNB mirror (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5547</a>). </li> <li> Fleet roster members in a selected Fleet now expose a visible edit affordance and a direct <code>m</code> model-picker shortcut, while the coordinator row remains read-only (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5604</a>, covers <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5589</a>). </li> <li> The context inspector now attributes bounded tool-schema cost to the built-in catalog and each discovered MCP server without changing prompt assembly or cache behavior (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5553</a>). </li> <li> The goal-continuation quiet period (<code>[goal] continuation_delay_seconds</code>, added in <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5508</a>) now applies on every dispatch path. Previously the within-turn dispatch hook fired the next continuation prompt immediately whenever a model step ended with the goal still active, so CLI-resumed and host-managed sessions never observed the configured delay (measured end-to-start gaps of ~9 s with a 300 s delay configured). The wait now runs unconditionally inside <code>goal_continuation_message_if_needed</code>, remains cancellable, and pause/clear/terminal <code>update_goal</code> calls still cancel a pending pass (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5534</a>). </li> <li> Two unit tests no longer depend on process-global environment state that sibling tests mutate concurrently. <code>route_budget::tests::v4_trigger_uses_window_percent_when_it_fits_spendable_input</code> asserted no-override output-budget values while reading <code>CODEWHALE_MAX_OUTPUT_TOKENS</code> / <code>DEEPSEEK_MAX_OUTPUT_TOKENS</code> without holding <code>lock_test_env()</code>, so a concurrent writer could flip the value mid-assertion (the order-dependent full-suite flake). <code>prompts::tests::system_prompt_prefix_never_leaks_private_content</code> read the real home via <code>HOME</code>/<code>USERPROFILE</code>, so a machine with <code>~/.codewhale/instructions.md</code> leaked its absolute path into the prompt and failed the no-private-paths assertion unless a sibling's temporary <code>HOME</code> guard happened to be live. Both tests now hold the env barrier and pin the variables (the route-budget test removes the overrides; the prompts test points <code>HOME</code>/<code>USERPROFILE</code> at a scratch dir). Assertions unchanged. </li> <li> TUI sessions now apply a subtle OSC 12 cursor accent only on explicitly supported terminals and restore the terminal default through normal, panic, and signal cleanup paths (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5554</a>). </li> </ul> <h2>Contributors</h2> <ul> <li>hexin (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>) — provider-native web search across four routes (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5682</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5683</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5685</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5687</a>), authoritative edit-last-turn boundaries (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5621</a>), Kimi Code k3-256k (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5622</a>), post-compaction input-token reporting (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5623</a>), and preserving the scheduled model selection in automations (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5650</a>).</li> <li>秋月凉梦 (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@qiuYliangM</a>) — co-authored the edit-last-turn boundary fix (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5621</a>), Kimi Code k3-256k support (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5622</a>), and post-compaction input-token reporting (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5623</a>).</li> <li>Isabel Wu (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) — live session token totals (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5624</a>), persisted context-pressure warnings (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5629</a>), discoverable Fleet roster editing (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5604</a>), the capability-gated cursor accent (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5599</a>), and <code>/copy</code> for the latest completed response (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5692</a>).</li> <li>Paulo Aboim Pinto (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a>) — Windows verbatim-path operands preserved through POSIX word splitting (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5610</a>), the plugins group moved onto the command shapes (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5657</a>), FEAT-022 skills command shapes with retained-host validation (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5825</a>), and FEAT-020 plugin command shapes re-landed on main (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5865</a>).</li> <li>Alex Musichen (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@musichen</a>) — a stable DeepSeek heading in the configured-view model picker, keeping every official catalog model for the active provider visible (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5689</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@gaord</a> — the <code>GET /v1/fleet/profiles</code> runtime API endpoint, reusing the FleetManager validation path (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5688</a>).</li> <li>Sh1Zuku (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>) — corrected English documentation inaccuracies and the first zh_hans translations for the Tier-2 docs (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5613</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@M-Maciej</a> — goal continuation cadence (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5591</a>) and the per-session control socket (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5533</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5831</a>).</li> <li>Serephus (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@serephus</a>) — nixpkgs update (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5669</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@whp233</a> — <code>wire = responses|anthropic</code> for openai-compatible custom routes and opencode-zen muse-spark (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5716</a>, landed as <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5719</a>).</li> <li>Gabriel Degret (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a>) — found the reasoning-only retry gap and built the first fix; landed as the <code>[reasoning_only]</code> retry ceiling with a request-scoped nudge (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5867</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@huangxianzhan</a> — the <code>x-opencode-session</code> header for OpenCode Go and Zen gateways (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5868</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@zhuowp</a> — task origin preserved in job snapshots (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5869</a>).</li> <li>AdityaG (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@AdityaVG13</a>) — a ten-commit performance pass: a zero-copy LaTeX fast path for streaming render, single-pass token accounting on the per-turn pressure paths, memoized provider resolution in the catalog cutline, parsing the bundled and on-disk models.dev catalogs once per process (interactive boot -70%), adaptive poll cadence for foreground shell completion, and worker caps across the read-only diagnostic family.</li> <li>Nightt (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>) — isolated remote recovery lease generations (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5790</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@yiheng-kkk</a> — replaced stale todo transcript snapshots so a rewritten todo list renders its current tasks (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5871</a>, <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5873</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@Lfanxing</a> — Moonshot routes now degrade incompatible tool definitions per request instead of failing the turn.</li> <li>WissssleyL (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — moved <code>docs/subagents</code> and <code>docs/mcp</code> onto the dictionary spine (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5337</a>), with the metaTitle probe that keeps them there.</li> </ul> Reports and reproductions that shaped this release: <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@slowly247</a> — reported the Ollama input budget collapsing to 1,024 tokens on 32K local models (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5820</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@ronohara</a> — reported the engine stopping after recoverable network errors, with the reproduction that pinned the discarded approval (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5769</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@Lujc0523</a> — asked for ACP session configuration of mode and model (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5863</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">@senka9h</a> — reported that <code>serve --acp</code> lacked <code>session/list</code> and <code>session/load</code> (<a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">#5864</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044343/4267080/github-release-codewhale-hqcodewhale-v0912-05092026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.9.13 (14.09.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.9.1314.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — official GitHub release</h3> New macOS/Linux install (checksummed binaries from this release): <pre>curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.9.13" sh "$HOME/.local/bin/codewhale" --version</pre> For Windows, use the matching installer or archive below. For an existing direct install, run <code>codewhale update</code>; it prints the executable path and keeps newer builds. If the install directory is occupied by a different build, use the fresh-directory migration in <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">the installation guide</a>. <h3>Secondary packaging — npm and Cargo</h3> <pre>npm install -g codewhale # or build from source cargo install codewhale-cli --locked</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.13</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.13</h2> Codewhale v0.9.13 addresses integrity issues in 0.9.12: multiline paste is one paste again, truncated tool arguments can no longer execute, strict ACP clients connect again, concurrent instances stop destroying each other's queued text, and the Computer Use bundle includes plugin 0.3.1 with an accessibility-first pointer that no longer steals focus. DeepSeek V4.1 Flash (<code>deepseek-flash</code>) is the default DeepSeek model, reasoning-capable routes keep reasoning out of the answer even when a model id carries no version number, and <code>/mcp reload</code> no longer freezes the interface while servers reconnect. The Codewhale pet arrives with <code>/pet</code>: a full-screen habitat that shows what the Engine is doing and reveals the answer when it is done. <h3>Added</h3> <ul> <li><code>/pet</code> turns the terminal over to the Codewhale pet. <code>/pet on</code> (or bare <code>/pet</code>) gives the habitat the whole content viewport now and on every accepted turn, reveals the actual answer or error when the turn completes, and Escape returns to the composer without cancelling anything. <code>/pet off</code> closes the view and stops automatic entry while the durable companion keeps the pet alive; <code>/pet appearance|window|source|sound|export|status</code> address the shared companion. The pet no longer lives in the workbar: the Watch panel and <code>/workbar watch …</code> are gone (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6109</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6110</a>).</li> <li>Codewhale Computer Use 0.3.1 ships as its own notarized Mac app. Download the disk image from <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">codewhale.net/computer-use</a> or the <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">v0.3.1 release</a> (<code>Codewhale-Computer-Use-0.3.1-macos-universal.dmg</code>, drag into Applications; the ZIP stays for the in-app updater). The bundled plugin and the first-party marketplace pin the same 0.3.1 sources, so the app, the <code>computer-use</code> plugin and <code>/mcp</code> see one implementation.</li> </ul> <h3>Fixed</h3> <ul> <li> The website's Computer Use download page resolves its state without the GitHub API (using <code>GITHUB_TOKEN</code> only when bound), and every page regenerates on the Worker again: the Open Graph image route read brand SVGs at import time, which the Workers runtime cannot do, so codewhale.net had been serving its build-time snapshot. </li> <li> Operate can run structured workflows directly, with named phases, model assignments from Fleet, prerequisite results and shared budgets. Independent steps run together; dependent work waits for its required results and gates. Detached runs return their outcome to the owning conversation, and headless sessions stay alive between phases until the final handback is consumed. </li> <li> Computer Use 0.3.1: mouse actions no longer steal focus or reclaim the foreground when the user switches apps mid-action; background typing, scrolling and selection use semantic input, and screenshots stay scoped to the targeted app. The bundled plugin and the first-party marketplace pin carry the same 0.3.1 sources. A registered macOS helper stays in charge of input through its Pause and Stop controls; an unavailable registered helper produces an error instead of silently bypassing those controls. </li> <li> The Fleet editor uses the standard model picker to manage sub-agent model and thinking assignments. Enter edits the selected row without changing the running session's model. Unconfigured providers are refused, failed saves retain the previous assignment, and a changed or removed team file must be reopened before a pick can overwrite it. </li> <li> The provider catalog includes Baseten and the other compatible-provider templates as selectable rows, opening their existing prefilled setup forms. DeepSeek routes with clock-based pricing show the current peak or off-peak tier beside session cost, with translated labels. </li> <li> Extensions, teams, workflows and automations support mouse-wheel scrolling. Plugin and MCP rows have keyboard enable/disable controls and two-step removal; MCP OAuth can retry with narrower scopes after a scope rejection. </li> <li> Healthy sub-agents continue after an ordinary parent reply. Headless runs keep the existing Engine alive for child results within the run deadline. Explicit cancellation remains authoritative when result queues are full or a completion starts a followup turn. </li> <li> Sub-agent followup supports multiple targets and all parked children, keeps old IDs connected to their current continuation, and saves continuation identity before starting work. Repeated followup does not fork duplicates. </li> <li> Sub-agents validate declared output files and distinguish real edit claims from file citations and unrelated workspace changes. Disjoint file claims can run together; overlapping writers receive the actual conflict and remedies. Explicit read-only shell analysis requires an enforcing native sandbox and refuses execution when that protection is unavailable. </li> <li> Delegation depth stays absolute through saved profiles, nested workers and continuations. Per-call token, step and time limits narrow inherited limits; continuation retains ancestor usage and deadlines. Workers reserve room for one tools-disabled partial report inside those limits, then run the declared- output checks. Missing usage or unavailable reporting room produces an explicit fallback; partial work is never marked complete. </li> <li> Agent rosters and detail pages have bounded output, visible continuation and descendant relationships, and usable handles for full diagnostic evidence. Completion receipts include measured worker and descendant token usage, count each continuation once, and distinguish unreported usage from zero. </li> <li> Localization and native helper builds resolve the active checkout when the build script runs, so a shared Cargo target keeps working after a worktree moves or is removed. </li> <li> Selecting a saved agent profile that is malformed, unreadable or duplicated now fails before any child request, including when its name matches a built-in role; the parent's default route is never substituted silently. <code>agent(action: "roster")</code> lists affected profile identities and paths, Fleet run creation performs the same check, and <code>docs/SUBAGENTS.md</code> documents the valid personal profile format with <code>[permissions]</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6117</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a>). </li> <li> Interactive startup no longer mistakes worker scheduling delays for an unresponsive terminal. Terminal ownership checks and shutdown cleanup remain enforced (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5929</a>). </li> <li> Interrupted conversations whose saved runtime store is missing recover into a fresh scope without restoring old tasks or approvals. Stale session saves cannot resurrect the broken binding (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6102</a>). </li> <li> Permission checks distinguish literal heredoc data from executable commands, including substitutions and shell stdin (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6098</a>). </li> <li> Automatic compaction runs quietly from live context pressure, preserving the current task and recent tool exchanges while keeping the system/tool prefix stable. Original history and the handoff are saved before context replacement; failed or canceled compaction retains the conversation (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5620</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6047</a>). </li> <li> Custom and gateway providers can override context limits for each exact model, so switching models also switches the meter and compaction budget (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6108</a>). </li> <li> Plugin suggestions explain their matching term and remember explicit dismissals across restarts. Generic words and repository-host domains no longer trigger unrelated installation prompts (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6031</a>). </li> <li> Plugin trust and automation deletion have keyboard and mouse confirmation controls bound to the exact reviewed content; users can still copy the command and changed content requires a fresh review (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6039</a>). </li> <li> The model-facing MCP start tool can reconnect an existing configured name after login without changing its credential key or restarting healthy siblings (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6030</a>). A decreasing token-expiry countdown no longer makes a revoked credential look like a new login from another session. </li> <li> Gemini setup uses the official endpoint's supported reasoning-effort field, avoiding the rejected top-level Google thinking object. Gemini 2.5 and 3 keep their supported effort ranges; signed tool history still survives reasoning changes and restart (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6018</a>, thanks @vmakarov-uk). </li> <li> Missed automation occurrences coalesce without overlapping a running job; restart reconciles durable receipts without replaying accepted work. Damaged neighboring records are isolated while preserving their original bytes. </li> <li> The bundled first-party marketplace lists the actual plugin bundles and uses the existing install, review, trust and update paths. A read-only connection check verifies catalog and skill mirrors on changes and weekly. Already present bundles lead to their local review and management controls; catalog installs refuse name collisions before downloading, without overwriting or granting trust. </li> <li> Windows deny checks preserve native path separators while retaining the conservative POSIX scan for shell wrappers and substitutions. </li> <li> The config example agrees with the telemetry disclosure: usage analytics are optional and enabled by default; local diagnostics do not require telemetry (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6011</a>). </li> <li> Sub-agents enforce the session's typed shell and file deny rules, including Full Access, delegated edits, and policy updates after a child starts (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6097</a>). </li> <li> Live permission edits reach running engine clones atomically. Deny rules support token wildcards and Windows command spellings while keeping POSIX arguments literal (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6054</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> Tool-result images use the existing typed inline path and are fully decoded under size and allocation limits before admission or provider projection. Invalid images keep a visible omission receipt alongside the text result (adapted from <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6053</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> A lone <code>y</code>, <code>Y</code>, or <code>r</code> remains composer input after selecting transcript text. Clicking the composer releases transcript and dock focus. </li> <li> The Agents register updates from live worker events while the parent is busy, including when the register opened before the workers spawned. </li> <li> Ghostty no longer shows a second graphical whale over the launch mark. The selected model stays visible before the first message; unused session metrics stay quiet. Scheduled counts open <code>/automation</code> directly. </li> <li> Marketplace installation accepts compatible Claude plugin bundles and roots their relative sources outside <code>.claude-plugin</code>; unsupported components fail explicitly. Native trust and enablement review still applies. </li> <li> Config table and nested reads work consistently and redact credentials. Unsupported dotted writes fail without changing the file, and <code>config doctor</code> no longer labels runtime settings as never applied (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6083</a>). </li> <li> Esc during a worker fanout keeps the parent stopped when cancelled workers finish. Their receipts remain available for the next explicit user turn. </li> <li> Undo preserves messages even when older state lacks a timestamp. Session journal entries retain their append-time stamps when saved again. </li> <li> Extension actions refresh in place, and inspection output uses the text pager. The empty launch shell hides unused metrics and keeps recovery hints readable when several MCP servers need attention. </li> <li> The large-output router defaults to bounded spillover; adaptive routing remains opt-in through <code>CODEWHALE_ADAPTIVE_OUTPUT_ROUTING=1</code>. </li> <li> Direct composer paste (<code>Ctrl-V</code>) preserves rich clipboard headings, lists, links, tables and code as Markdown, with plain-text fallback. Whole-answer copy preserves authored Markdown without terminal wrapping; settings fields still paste literal text. </li> <li> The embedded Computer Use bundle includes the marketplace's JPEG capture and bounded-payload fixes, so new built-in installations receive them too. </li> <li> A provider's missing-<code>thought_signature</code> HTTP 400 now explains how to recover: use the built-in Google provider and start a new session, or verify the gateway's signature handling. Working gateways are not blocked by a broader preflight check (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6048</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6081</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>). </li> <li> Chinese documentation links resolve to the contributor guide and Windows screenshots from their translated paths (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6080</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@c020627</a>). </li> <li> GLM-5.3 reasoning controls follow the forced-thinking contract on Z.ai and BigModel routes, including low effort when a prior configuration requested thinking off (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6051</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> Finance calls respect the session network policy, and model-facing shell, verifier, notification and Fleet guidance matches executable contracts (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6052</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> The sandbox-elevation prompt shows every option, <code>Abort</code> included. The card was a fixed 22 rows centred on the frame; inside its border and padding that left at most 18 usable rows against 20 to 23 rows of content, with no scroll rail and no truncation hint. The safe exit — the one choice that grants nothing — was painted past the bottom edge at every terminal size. The card is measured from its content now and reserves the option rows before the denial detail, which is what shortens; below roughly 60x24 the per-option descriptions shed and every choice keeps its row. Option hitboxes were also counted in unwrapped source lines, so a description that wrapped put every hitbox below it out of step and a click committed a different choice than the one under the pointer. </li> <li> <code>d</code> in the Hotbar setup modal asks before it clears every slot. It persisted <code>hotbar = []</code> on the first keystroke, in a view that takes bare letters as its filter — the destructive key and the search key were the same press. It arms a confirmation that owns every key until answered, and the prompt takes the intro's place in the header so it cannot be the line that falls off a five-row budget. </li> <li> Failure red means failure again. The metrics line painted the context reading in the error colour from 80 %, while the posture bar one row above called the identical threshold Attention; the workflow panel painted a <code>Waiting</code> row like a crashed one, though its own <code>is_running</code> counts Waiting as healthy; and the work surface spent <code>error_fg</code> on to-dos that were merely waiting, blocked or stale, and on the routine approach to auto-compaction. <code>WorkTone</code> has a real <code>Failure</code> variant now, and a guard test holds the reservation across every selectable theme rather than the default alone. </li> <li> The command palette runs the row you highlighted. <code>refilter</code> clamped the selection index but never re-anchored it, and every keystroke re-sorts the list, so refining a query could move the highlight to an unrelated entry that Enter then ran. Long labels also overran their column and pushed the description off the card, because the padding never truncated and the capacity was measured against the popup rather than the content area. </li> <li> The work surface's first <code>Down</code> reaches the first row. Nothing is selected when the dock opens, and that resolved to "row 0 is selected", so the first press moved to row 1 and row 0 could not be reached by pressing Down at all. </li> <li> Auto-compact could not fire mid-turn. The gate read <code>max(last billed prompt, /4 estimate of the whole list)</code>, so as soon as the estimator undercounted the full list below the last bill, every tool result appended after that prompt was invisible to it, and a long turn could exhaust the context window with nothing compacted. It now reads live tokens — the billed prompt plus the growth since it, watermarked when the parent usage is recorded — and is still evaluated at the pre-request boundary after tools complete, never mid-tool-call. </li> <li> Esc or Ctrl+C during a compaction that is serving an in-flight turn now stops the turn. It previously cancelled only the compaction pass, so the turn resumed against the context that had just failed to shrink. A manual <code>/compact</code> with no request in flight still cancels only the pass. </li> <li> The <code>request_user_input</code> dialog is a bottom-anchored sheet instead of a centered 22-row overlay. It leaves the transcript visible above it, grows with its content, and scrolls internally so the highlighted option and the custom response being typed stay on screen at 141x38 and 80x24. Left arrow or <code>h</code> goes back to the previous question; Esc still cancels the whole request. PageUp/PageDown, Home/End and modified arrows now review the transcript while the sheet stays open; the mouse wheel scrolls the surface under the pointer. Wheel browsing preserves the answer, and option navigation or typing restores the focused content to view. The transcript viewport ends above question and approval prompts, so End keeps the newest rows visible. Documented in GUIDE.md and KEYBINDINGS.md (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6045</a>). </li> <li> <code>/mcp reload</code> no longer freezes the interface. The reload was awaiting the whole reconnect batch on the TUI event loop; it now joins the same supervised background pass the session boot uses, the status chip counts the batch down live, and the finished receipt arrives as an event. With 23 configured servers (11 live, 10 awaiting auth, 2 failing) the first echoed keystroke after a reload lands in ~5 s instead of ~42 s (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5974</a>). </li> <li> The posture bar no longer states the same duration twice on a first turn (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6041</a>). </li> <li> Reasoning-capable models whose id carries no version substring (<code>deepseek-flash</code>) keep <code>reasoning_content</code> in the thinking block instead of the answer text. The gate only ever matched the literal <code>deepseek-v4</code> version string, so it now consults the model catalog as well; the older literal arms remain for the V4 aliases they were written for (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6044</a>). </li> <li> <code>codewhale model resolve</code> accepts a provider's declared default even when its registry row is missing — <code>deepseek-flash</code> failed resolution against the provider that declares it as default — and a test now resolves every provider's <code>DEFAULT_*_MODEL</code> for its own provider (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6043</a>). </li> <li> A configured <code>default_text_model</code> is honored when a new thread's route is resolved. That path consulted only the provider's catalog default, so a config naming one model silently created threads on another, and the unset default disagreed with the shipped one; the active provider's configured default now wins, matching <code>provider_default_model</code>, and both unset defaults name <code>deepseek-flash</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6043</a>). </li> <li> Markdown <code>_italic_</code> requires both delimiters to be flanking per CommonMark, so math subscripts no longer italicize the prose between them (<code>[t_, b_p]. Actually — hold on, do we even tile all the way from t_?</code> rendered 60 characters italic) (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6042</a>). </li> <li> An MCP server configured for OAuth that answers 401 before its first login now points at <code>/mcp login <name></code> in the failure hint instead of a bearer token that does not exist (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6030</a>). </li> <li> Cancelling a foreground shell wait stops its owned process group even when the tool future is dropped. Explicitly backgrounded jobs retain their ownership. Interrupted tool receipts distinguish work that started from calls skipped before execution, and returned tool failures remain errors in the next model request. </li> <li> Saved Fleet model identifiers retain exact spelling through selection, role pins, and roster changes, so changing one saved model does not modify another identifier that differs only in letter case. </li> <li> Chat wrapping reserves its scrollbar gutter consistently, keeping long identifiers readable when the viewport changes. </li> <li> The Engine keeps large send-message futures off the event loop's stack, preventing stack exhaustion when a restored session starts a provider turn. </li> <li> New, imported, and live session titles skip runtime handoffs and use the first real user prompt. Explicitly renamed titles retain priority (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6012</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>). </li> <li> UI dispatch acceptance now precedes Engine execution, so a delayed acceptance callback cannot overwrite a turn that has already started or completed. Cancelling before acceptance preserves the prompt and leaves the next dispatch usable. </li> <li> Bottom-chrome effort is omitted when the route cannot prove an effective tier; <code>/status</code> retains the full explanation. Cost remains visible when known, and <code>cost: unknown</code> remains on metered routes lacking a reading (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5950</a>). </li> <li> Pasting multiline text is one paste again. 0.9.12 gated the paste-burst heuristic off whenever bracketed paste was requested, but a terminal can accept <code>EnableBracketedPaste</code> and still deliver a paste as individual keystrokes — on those terminals (observed on Windows 11) every pasted line was submitted as its own message. The heuristic is again armed whenever <code>tui.paste_burst_detection</code> is on, and the existing <code>bracketed_paste_seen</code> guard still disarms it for the rest of the session once a real <code>Event::Paste</code> arrives, so fast typing on terminals with working bracketed paste is unaffected (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5981</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@nsfoxer</a>). </li> <li> <code>serve --acp</code> no longer breaks strict JetBrains clients: the <code>initialize</code> response advertised <code>sessionCapabilities.list</code> as a boolean and carried an undefined nested <code>load</code> capability; it now sends <code>{"list": {}}</code> with no <code>load</code> key, per the ACP schema (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5969</a>, reported by <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Lujc0523</a>). </li> <li> Concurrent Codewhale instances no longer destroy each other's queued, unsent text. The offline input queue was one global file that boot cleared on session-id mismatch, so a second instance deleted the first's parked messages. Queues are now keyed per session (mirroring per-session checkpoints), an existing global file is adopted by its owning session rather than discarded, and the adoption race between two instances of the same session tolerates the loser's cleanup. </li> <li> A tool call truncated at the provider's output limit can no longer be repaired into valid JSON and executed: repairs that had to synthesize structure (append or discard closers) are routed to the existing malformed-arguments path so the model is asked to re-issue — including when the stream is cut before the closing content-block event (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5986</a>). </li> <li> <code>codewhale metrics</code> reads Codewhale's own receipts again: the deepseek-home fallback resolved <code>$HOME/.deepseek</code> unconditionally, so the rollup reported all zeros from a directory nothing has written since 2024. The Codewhale audit log is primary, with a checked legacy fallback. </li> <li> The goal-continuation loop's promised stall bound actually bounds stalls now, and undeclared fleet role names fail closed to read-only <code>explore</code> in both fleet drivers instead of resolving to write-capable customs in one and not the other. </li> <li> <code>allow_insecure_http = true</code> under a <code>[providers.<name>]</code> table works again. 0.9.12 tightened plain-HTTP base URL handling in a way that silently dropped the per-provider key, leaving the process-wide env var as the only opt-in — LAN llama.cpp and internal-gateway users had to export <code>CODEWHALE_ALLOW_INSECURE_HTTP=1</code> to connect at all. The key is honored again (parsed, settable and unsettable through <code>codewhale config set providers.<name>.allow_insecure_http</code>, and listed in the custom-provider field hint), it stays distinct from <code>insecure_skip_tls_verify</code>, and the refusal message now leads with the config key. Loopback hosts remain auto-allowed and telemetry endpoint validation deliberately still consults neither switch (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5991</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a>). </li> <li> A Fleet task that selects a roster member with <code>worker.agent_profile</code> now runs with that member's posture. The launch-time resolver only consulted the resolved member when the legacy <code>worker.role</code> label was absent, so a task labelled <code>manager</code> that selected <code>member:reviewer</code> ran as a write-capable manager instead of a reviewer and was never leased. The member's canonical slot now wins whenever one resolved; the label remains the posture only when no member resolved at all. To keep the fix from widening authority in the mirror case (a read-only label on a write-capable member), a spec whose <code>worker.role</code> names a different posture than the selected member's role is rejected at run creation with a message naming both postures; casing and legacy aliases of the member's own role are still accepted (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5945</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@gaord</a>). </li> <li> A queued message keeps one transcript entry from queue through steer to dispatch. It no longer reads as delivered while it is still pending, and the second Enter the strip prompts for no longer paints a duplicate bubble. </li> <li> The Tasks rail panel no longer swallows the first keystroke of typed input: bare <code>y</code>/<code>Y</code> yank only when the work surface holds keyboard focus, so a message that starts with "yes" stays intact (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#2000</a>). </li> <li> <code>wait</code> results reach the parent intact. The parent-context summarizer projected every <code>agent</code> tool result through the sub-agent snapshot renderer, which replaced a wait envelope's <code>settled</code>, <code>still_running</code>, <code>timed_out</code>, <code>waited_ms</code>, and <code>note</code> with <code>unknown (agent) status=unknown</code>. Only snapshot-shaped results are summarized now. </li> <li> A sub-agent's final summary uses the same adaptive tool-result budget as every other tool result (<code>tool_result_max_bytes</code>, 12k floor, 2 MiB ceiling) instead of a hardcoded 12k/4k/4k copy that cut a 12,001-character report to 8,000. </li> <li> The metrics line no longer carries a permanent <code>/help</code> hint. The route still appears until its binding has been used and then retires with the other footer hints, so the row stays quiet once help is learned. </li> <li> <code>request_user_input</code>'s description names when asking is the right move (ambiguous scope, an irreversible or expensive choice, a missing preference) and when it is not, so the model stops guessing at discoverable facts. </li> <li> <code>config.example.toml</code> states the real search default (keyless Firecrawl, not DuckDuckGo) and the preferred <code>CODEWHALE_SEARCH_*</code> environment names. </li> <li> Startup type-ahead is preserved whole, and a slash command interrupted by startup keystrokes is no longer re-read as prose and sent to the model (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5925</a>). </li> <li> The model picker renders a large catalog without lag and supports per-column sort and mouse selection (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5975</a>). </li> <li> Session metrics report effective request throughput from provider receipts instead of a live estimate divided by the whole turn, and cost stays honest when a route has no price reading (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5976</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5977</a>). </li> <li> An offline-queue submit delivered as late raw keystrokes no longer wedges the composer behind stacked session notices (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5999</a>). </li> <li> Fleet setup with a model filter that matches nothing renders a hint instead of panicking (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5953</a>), and shortlist enrollment plus authoritative role pins are honored on dispatch (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5915</a>). </li> <li> A mid-turn MCP catalog refresh keeps the tool pool deferred and the active set narrow (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5939</a>). </li> <li> Computer Use on macOS verifies application activation before sending keystrokes and guards input by the frontmost app (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5927</a>). </li> <li> Onboarding tests isolate <code>CODEWHALE_HOME</code>, so a fixture provider can no longer leak into the real setup state (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5932</a>). </li> <li> Snapshot availability is retained with one warning per session, and a diverged engine session id is a visible notice rather than a log line (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5930</a>). </li> </ul> <h3>Changed</h3> <ul> <li> How long Codewhale waits for a human is configurable. <code>[tools] user_input_timeout_seconds</code> governs the wait for an approval decision or a <code>request_user_input</code> answer; it was a hardcoded 300 seconds, which silently cancelled the work of anyone who stepped away mid-task. An explicit <code>0</code> waits indefinitely, the value is clamped to 24 hours, and omitting the key keeps the previous 300-second default. Documented in <code>docs/CONFIGURATION.md</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6003</a>). </li> <li> <code>docs/PROVIDERS.md</code> lists every beginner setup template, not the four it happened to mention when the page was written. Baseten, Groq, Cerebras and Command Code have shipped as supported OpenAI-compatible hosts for a while and appeared nowhere in the provider documentation, which reads from outside exactly like not supporting them. The page now carries the full table — host, default model and key env for each — and states the rule it follows: a plain Chat Completions backend is a template row, while <code>ProviderKind</code> is reserved for distinct wires. A test now fails if a shipped template is missing from that page. </li> <li> Reasoning capability for the Kimi coding routes and the qwen3.x Model Studio deep-thinking ids is catalog data now rather than hardcoded match arms, and <code>model_reasoning_capability</code> reports a model nothing knows about as unknown instead of silently not reasoning-capable. <code>model_supports_reasoning</code> keeps its <code>bool</code> shape for existing callers, where unknown still reads as false. The ids that have no cited source yet keep their literal arms (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6032</a>). </li> <li> The website uses Shannon Sans with versioned local font assets and retained serif, monospace, and language fallbacks. Terminal fonts are unchanged. </li> <li> <code>codewhale metrics</code> reports recorded model requests and stream recovery separately from provider-reported token usage, with coverage for missing and duplicate receipts. Status messages and cumulative snapshots do not add requests or count tokens again. </li> <li> Runtime turn receipts retain the Engine's terminal model-request, stream-retry, and resume counters separately from displayed status and provider-reported usage. These counters do not count HTTP retries inside a provider client or establish provider billing. </li> <li> Initial tool definitions no longer repeat shell interpreter guidance and agent lifecycle/scope instructions in multiple description fields. Parameter schemas, approval rules and dispatch behavior are preserved. This reduces prompt schema size; it does not establish a provider billing regression. </li> <li> The built-in Computer Use plugin bundle is refreshed to the standalone plugin's 0.2.1 runtime (vendored from <code>Hmbown/codewhale-cu-plugin</code> at <code>724ad258</code>): the native macOS accessibility backend with an a11y-first pointer strategy (covered points are refused, previews are drawn), the permission-owning desktop-app socket transport, remote computers over ssh and HarmonyOS HDC with contained temp handling, truthful win32 PowerShell failure reporting, and the shared allow-listed request handler for the app socket and ssh agent. The bundle retains the hardening port from <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">standalone plugin PR #12</a>. Single left clicks on macOS element targets now revalidate and press the observed element directly, without substituting a point hit-test or raw-pointer fallback. Explicit event clicks retain the app-ownership guard; a sent press still requires visual verification. Background mode permits application-bound keys and accessibility actions while refusing shared-pointer gestures; it does not provide an isolated desktop. The embed list gained the five new runtime files, and a consistency test now pins the embed list to the vendored tree so the bundle cannot rot silently again. Because the bundle's content hash changes, Computer Use deactivates and asks for a fresh review after upgrading — that is the designed fail-closed path for a desktop-driving plugin. The current macOS source candidate also embeds the compiled native helper, so its bundled server can run directly without a separate Computer Use app or a compiler on the user's machine. Accessibility and Screen Recording permissions belong to the hosting app or terminal and remain user-controlled. The CLI's Computer Use server requires Node.js 20 or newer. These are source candidate changes; they do not establish published-package or platform qualification. See the <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">included plugin guide</a> for platform requirements and limitations. </li> <li> <code>/statusline</code> drives the bottom chrome again. Since the 0.9.12 shell redesign the posture bar and the metrics line were built independently of <code>tui.status_items</code>, so every toggle in the picker except the balance fetch was decoration. Each remaining item now shows or hides exactly one thing: <code>model</code>, <code>context_percent</code>, <code>cost</code>, <code>balance</code>, <code>cache</code>, <code>tokens</code> and <code>session_metrics</code> are metrics-line segments, and <code>mode</code> is the posture bar's plan/act/operate chip. The <code>status</code>, <code>agents</code>, <code>reasoning_replay</code>, <code>prefix_stability</code>, <code>git_branch</code>, <code>last_tool_elapsed</code> and <code>rate_limit</code> items drove nothing and are retired; an existing <code>config.toml</code> still loads and those keys are ignored (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5950</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5962</a>). </li> <li> The context reading is back on screen at every fullness. 0.9.12 painted <code>ctx NN%</code> only from 50% up, which left most of a session with no context signal at all; it now paints from 0% and keeps its warning colour from 80% up (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5950</a>). </li> <li> A child agent parked because its parent's turn ended is shown as <code>parked</code> in the Agents panel, the sidebar and Agent Details, with <code>resume_from</code> / <code>cancel</code> as the recovery, instead of wearing the same "waiting for input" label as a child that asked a question. Parked work sorts below live and answerable work and no longer inflates the <code>blocked</code> chip; the receipts roster and the wire <code>state</code> gain <code>parked</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5906</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5921</a>). </li> <li> <code>codewhale account keys set|remove|list</code> no longer carry a hardcoded eight-provider list. Provider ids come from the control plane's public catalog (<code>GET /api/model-providers</code>), are validated locally against <code>^[a-z0-9][a-z0-9-]{0,63}$</code> before they reach a URL path, and <code>list</code> shows every catalog provider with its label and stored-key state. <code>--from-local</code> maps a catalog row onto the local runtime provider through the catalog's own <code>runtimeProvider</code> field, so a newly supported provider needs no CLI release. </li> <li> <code>/mcp</code> lists the servers that need a login first, as their own <code>Needs login</code> group above <code>Needs attention</code>, and opens with the cursor already on the first such row so the Enter the screen advertises runs <code>/mcp login <server></code> straight away; translated in all 15 packs. A snapshot test pins the footer shape the chip landed with (<code>MCP · N connected · N ◆ auth required · N failed</code>) so an expired login never regresses into the failed count (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5926</a>). </li> </ul> <h3>Fixed</h3> <ul> <li> Five of the load-flaky tests tracked in <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5929</a> no longer depend on shared state or live local daemons. Background-hook capture tests wait for the capture file to hold bytes instead of merely existing (the shell's <code>></code> redirection creates the file empty before <code>cat</code> writes, which read as <code>valid JSON: EOF</code> under load); the session-picker acceptance test drives the real picker over a private store instead of a process-global <code>CODEWHALE_HOME</code> redirect that concurrent tests could observe mid-flight; the DeepSeek-Anthropic translate test holds the test env barrier so its request-time and assertion-time <code>max_tokens</code> reads cannot straddle another test's <code>CODEWHALE_MAX_OUTPUT_TOKENS</code> override; the unit-test binary no longer probes a real local Ollama daemon (<code>127.0.0.1:11434</code>) from the fire-and-forget provider catalog refresh, whose merged tags could flip another test's live-snapshot assertions; and the tmux clipboard test's attach/OSC 52 wait bounds tolerate a fully loaded machine (3s -> 30s) without changing what they verify (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5929</a>). </li> <li> The posture bar states how long the session has been working and how long the current turn has run, distinguishing actively working from waiting on a tool, a sub-agent or the operator; the 0.9.12 shell had dropped the overall working-time indicator from the place a glancing user checks (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5914</a>). </li> <li> A background runtime turn whose own store record could not be read, parsed or written (<code>Failed to read turn …</code>, <code>Failed to read item …</code>) was only a log line. The runtime now publishes a <code>runtime.store_failure</code> event naming the file, the root cause and the next action (move the file aside, or check free space and permissions); the TUI shows it as a warning toast and a transcript line, the task timeline records it, and the runtime API streams it. A turn whose own record is unreadable or unwritable is reported as terminal, so its task fails at once instead of idling out (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5931</a>). </li> <li> An MCP token refresh that fails to parse the provider's answer keeps the endpoint's receipt — status line, content type, and a 200-byte excerpt with every credential-shaped value (<code>access_token</code>, <code>refresh_token</code>, <code>client_secret</code>, <code>id_token</code>, bearer schemes) masked before the cut — instead of rmcp's bare <code>Failed to parse server response</code>, so a provider outage answering an HTML 502 reads differently from a parser defect, and the login remedy stays named (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5926</a>; remedy wording landed in <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5959</a>). </li> </ul> <h3>Added</h3> <ul> <li> <code>POST /v1/threads/{id}/file-revert</code> restores exactly one file from the exact <code>tool:</code>/<code>pre-turn:</code> snapshot the client selected, checking the reviewed file hash before and after the mandatory safety snapshot. Literal file names, regular files only, thread trust and active-turn admission are enforced, and <code>patch-undo</code> no longer forks a conversation whose file rollback failed (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6111</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@gaord</a>; engine half of <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">HengQuWorld/CodeWhale-VSCode#3</a>). </li> <li> Authenticated Runtime API workspace file suggestions reuse TUI <code>@file</code> matching and discovery, with bounded queries/results and workspace-contained relative paths only (<code>GET /v1/workspace/files/search</code>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6095</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6120</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>; reported by <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@LmeSzinc</a>). Shared discovery now honors disabled symlink following for AI-tool directory scan roots too. </li> <li> Serply is available as an opt-in <code>[search]</code> provider for the Web tool (<code>provider = "serply"</code>, key from <code>[search] api_key</code> or <code>SERPLY_API_KEY</code>). Preflight fails closed without a key; Firecrawl remains the default and existing configurations are unchanged (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6100</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@googio</a>). </li> <li> Linux terminals: finishing a transcript or composer mouse selection copies the text to the PRIMARY selection without touching the regular clipboard, and middle-click inside the composer pastes PRIMARY at the pointer without submitting. Native X11 and Wayland data control are used through one bounded background worker; SSH sessions without a forwarded display keep their terminal's own selection behavior (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6116</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@dmt4</a>). </li> <li> <code>codewhale sessions export <id-or-unique-prefix></code> saves a <code>.tar.xz</code> archive with the durable record, portable session container, manifest and artifacts. Prefix exports preserve unfinished tool calls; confined reads reject linked artifact roots, and existing outputs require <code>--force</code>. Archives retain unredacted content; <code>/load</code> opens the extracted record without installing extracted artifacts (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6056</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> <code>deepseek-flash</code> (DeepSeek V4.1 Flash: 1M-token context, reasoning and tool calls) joins the catalog as DeepSeek's declared default, and the offline catalog seed matches it; the DeepSeek Pro listing no longer overstates the published price (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6025</a>). </li> <li> DeepSeek's September 11 reversal is reflected in provider notices and cost estimates: V4 Pro remains available after September 14 at Pro rates. Explicit Pro selections remain unchanged; Flash remains the default (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6025</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@ronohara</a>). </li> <li> Native plugin authoring guides now cover English and Chinese. The explicit offline converter supports selected portable Skills and static Streamable HTTP MCP declarations from OpenCode and DSH. Unsupported executable hooks, automatic OAuth and policy-bearing configurations are refused; generated bundles still require native installation, review and trust. Legacy SSE fallback is not reproduced (#5827, requested by <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@giancarlocp</a>). </li> <li> Signed cloud model facts can refresh provider capabilities and prices while preserving verified cached data when a refresh fails. A dispatched request keeps its selected price snapshot so later catalog updates cannot change its recorded cost (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5752</a>). </li> <li> Saved sessions preserve exact provider routes. Auxiliary model calls settle their usage once against the route and price snapshot that executed them, including recovery, rather than resolving a new price at completion (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5726</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5848</a>). </li> <li> <code>[tui].posture_bar</code> and <code>[tui].metrics_line</code> accept <code>full</code>, <code>compact</code>, or <code>hidden</code>, also available through <code>/config</code>. Compact preserves the existing rows' essential fields; hidden returns their space to the transcript (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5973</a>). </li> <li> Optional model-bound tool-output redaction opt-out, with two explicit startup confirmations and a receipt bound to the readable config contents and modification time. Unconfirmed requests keep masking enabled; routing and stored goal summaries remain redacted (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5982</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>). </li> <li> The <code>rusty-alloc</code> cargo feature on <code>codewhale-tui</code> and <code>codewhale-cli</code> opts the binaries into the <code>rusty_alloc</code> global allocator (the mimalloc v2.4.5 architecture remade in pure Rust — no C compiler or build script on that path) instead of the default mimalloc. It is off by default and the default build is unchanged; build with <code>cargo build -p codewhale-tui --features rusty-alloc</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5872</a>). </li> <li> The <code>/theme</code> picker now discovers valid user-authored <code>custom:<name></code> overlays, previews their colors, highlights the active overlay, and preserves it when the picker is opened and committed without navigation (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5901</a>). </li> <li> Compaction has two standing knobs next to <code>[context]</code> in config.toml: <code>[compaction] summary_instructions</code> (appended to the summarizer prompt on every manual and automatic pass; <code>/compact <focus></code> still composes after it) and <code>[compaction] retained_user_message_tokens</code> (default 20 000, clamped 2 000..=200 000) for the verbatim user-message budget. Both are absent by default and absent means the pre-existing behavior. The <code>/compact</code> receipt names the effective budget and whether operator instructions applied (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5956</a>). </li> <li> <code>[tools] user_input_max_questions</code> (default 6, 1..=10) and <code>[tools] user_input_max_options</code> (default 4, 2..=10) replace the hard-coded <code>request_user_input</code> limits; the validator, the tool schema and its description read one value, spawned children inherit the parent's ceilings, and a rejected payload names the ceiling it hit and the key to raise (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5949</a>). </li> <li> The slash menu shows a command's usage line and its subcommands as soon as a space is typed after the verb, filtered by what follows, so Tab completes <code>/workspace wor</code> to <code>/workspace worktrees</code>; <code>/help</code> states the focused command's usage in its detail slot (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5952</a>). </li> <li> The three <code>/fleet</code> views (roster, live workers, saved teams) are one back-navigable stack: <code>Esc</code> in workers or saved teams returns to the roster with its cursor intact and still closes the window at the root or on direct entry; the <code>Esc</code> footer hint says <code>back</code> or <code>close</code> accordingly (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5954</a>). </li> <li> <code>/fleet</code> presents its prioritized core (<code>members</code>, <code>setup</code>, <code>teams</code>, <code>workers</code>, <code>help</code>); every other verb stays dispatchable and is documented under explicit groups in <code>/fleet help</code>. The roster no longer shows the untouched built-in <code>general</code> alias next to <code>worker</code> (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5888</a>). </li> <li> <code>codewhale</code> provider: account-backed model access over the provider keys a customer connected to their Codewhale account. One base URL (<code>https://api.codewhale.net/v1</code>, overridable with <code>CODEWHALE_API_BASE</code>; HTTPS required except on loopback), one <code>cwc_key_…</code> account API key with the <code>models:infer</code> scope (<code>CODEWHALE_API_KEY</code>), and a per-model wire chosen from the account's authenticated <code>GET /v1/models</code>: ids are <code>provider/model</code> and each row states <code>chat-completions</code> (<code>/v1/chat/completions</code>) or <code>anthropic-messages</code> (<code>/v1/messages</code>). Both protocols authenticate with <code>Authorization: Bearer</code>, never <code>x-api-key</code>. The key is read from <code>CODEWHALE_API_KEY</code>, the <code>codewhale</code> secret-store slot, or <code>[providers.codewhale] api_key</code> / <code>api_key_env</code>, and a missing key fails before any request instead of dispatching unauthenticated. If the catalog cannot be fetched the route falls back to three bootstrap ids and says so. </li> <li> <code>codewhale account api-keys create --scope</code> now accepts <code>models:infer</code> alongside <code>account:read</code> and <code>agent:run</code>, and an omitted <code>--scope</code> sends all three explicitly. <code>--use</code> saves the new secret as this machine's local <code>codewhale</code> provider credential in the same secret store <code>codewhale auth</code> uses; nothing is uploaded. </li> <li> <code>Git</code> grows a <code>commit_plan</code> action: a propose-only planner that splits the working tree into ordered atomic commits (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#3999</a>). It groups whole files — lock files ride with their manifest, tests ride with the source they name — orders the groups so a commit that defines a symbol lands before the commit that uses it, and refuses the whole plan when that dependency graph has a cycle. It reads <code>git diff HEAD</code> plus the untracked-file list and writes nothing: no <code>git add -N</code>, no <code>git apply --cached</code>, no <code>git commit</code>, so staging and committing stay with the ordinary <code>git add</code> / <code>git commit</code> shell path where the approval gate already applies. Thanks <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@goransh-walia</a> for the original implementation (PR <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5870</a>, fixes <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#3999</a>). </li> </ul> <h3>Notes</h3> <ul> <li>DeepSeek V4 Pro continues after September 14. The vendor reversed its earlier retirement notice. Codewhale preserves Pro selections and Pro pricing; <code>deepseek-flash</code> remains the default for new direct DeepSeek configurations.</li> <li>Upgrading from 0.9.12 with Computer Use trusted and enabled: the bundle's content hash changes with the 0.2.1 refresh, so the plugin deactivates and asks for a fresh review — that is the designed fail-closed path for a desktop-driving plugin. Re-trust it from the Plugins page.</li> <li>The multiline-paste fix restores v9.11 behavior on terminals that accept <code>EnableBracketedPaste</code> but deliver pastes as keystrokes (reported on Windows 11 / PowerShell). Verified at the input-contract level and in CI; a manual paste check on a real Windows terminal is still welcome — please comment on <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5981</a> with your terminal if anything still misbehaves.</li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@LmeSzinc</a> — requested Runtime API access to the TUI's fuzzy file search (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6095</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@googio</a> — added the Serply web-search provider (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6100</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@dmt4</a> — requested Linux copy-on-select and middle-click paste (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6116</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a> — reported that saved agent profiles were silently ignored when spawning sub-agents (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6117</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@nightt5879</a> — Gemini signature recovery guidance and transport regressions (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6081</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@c020627</a> — Chinese documentation link repairs (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6080</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@asto18089</a> — GLM-5.3 reasoning controls and tool-gating/documentation fixes (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6051</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6052</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Hmbown</a> — dependency updates (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6057</a>) and the Gemini signature recovery report (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6048</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@gaord</a> — contributed the file-scoped restore endpoint and the trust-gated whole-tree rollback (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6111</a>), Fleet schema inspection, role precedence and worker deliverable receipts, and linked the community VS Code frontend (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5944</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5945</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5946</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5992</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@goransh-walia</a> — contributed the propose-only commit-planning rework (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5870</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> — documented turn budgets and goal configuration, and reported gaps in command discovery, Fleet navigation, human waits, state hooks, history and provider routing (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5996</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5952</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5954</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6003</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6004</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6006</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6007</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a> — contributed two-stage consent for opting out of model-bound credential redaction (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5982</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a> — moved session lifecycle and session-control commands onto shared command contracts (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5902</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5951</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@EvanProgramming</a> — reported Windows input and CRLF-write defects, and contributed CRLF preservation and an injectable Windows input runner (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5908</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5909</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5910</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5911</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5912</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a> — exposed workspace file suggestions through the Runtime API (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6120</a>) and added custom-theme discovery, preview and selection in the theme picker (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5907</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@zhuowp</a> — matched model-visible shell guidance to the interpreter selected for execution (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5900</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@nsfoxer</a> — reported the multiline-paste regression and incomplete provider model lists (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5981</a>, <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6009</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Nefelibata1024</a> — confirmed the multiline-paste regression's impact (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5981</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a> — reported the loss of the allow_insecure_http provider setting (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5991</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@Lujc0523</a> — reported the ACP initialize schema violation affecting strict IDE clients (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5969</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@mo-vic</a> — proposed storing evicted context on disk so it can be retrieved later (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6008</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@giancarlocp</a> — requested a plugin authoring guide and OpenCode plugin conversion (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#5827</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">@hxfhd</a> — supplied a Windows reproduction of a turn stopping before its stated next tool action (<a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">#6010</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044342/4267079/github-release-codewhale-hqcodewhale-v0913-14092026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.10.0 (22.09.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.10.022.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — official GitHub release</h3> New macOS/Linux install (checksummed binaries from this release): <pre>curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.10.0" sh "$HOME/.local/bin/codewhale" --version</pre> For Windows, use the matching installer or archive below. For an existing direct install, run <code>codewhale update</code>; it prints the executable path and keeps newer builds. If the install directory is occupied by a different build, use the fresh-directory migration in <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">the installation guide</a>. <h3>Secondary packaging — npm and Cargo</h3> <pre>npm install -g codewhale # or build from source cargo install codewhale-cli --locked</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.10.0</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.10.0</h2> Codewhale v0.10.0 brings a redesigned terminal workbench, clearer settings, and more reliable session and runtime behavior. It supersedes the unpublished v0.9.14 candidate. <h3>Security</h3> <ul> <li> Children never inherit desktop or computer-control tools. Desktop control is the most machine-wide capability in the catalog, and a verifier child inherited it by default: on 2026-09-17 one opened the host Terminal and typed a blocked shell command into the user's live session. A family classifier now removes those tools when a child's registry is built, so they are neither eager nor searchable, and <code>execute_full</code> refuses the family at dispatch for every child role — visibility is a grant, and hiding is not the only defense (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6296</a>). </li> <li> Runtimes can be held to an organization's plugin allowlist. A managed policy document (<code>managed-policy.json</code> beside <code>state.json</code>, or <code>CODEWHALE_MANAGED_POLICY_PATH</code>) lists the plugin ids a Runtime may run, with an <code>allow_unlisted</code> flag and a schema version checked exactly like <code>PluginStateFile</code>. Enforcement sits inside <code>apply_state</code>, so a plugin enabled before the policy arrived — or hand-edited to <code>enabled: true</code> — never comes back enabled, and <code>enable()</code> re-reads the document so a policy landing after discovery refuses with a reason that names it. A malformed document fails closed rather than degrading to unenforced. With no policy present, behaviour is bit-for-bit what it was. This is the enforcement primitive only; the authority that decides the allowlist is still local, so it binds a cooperating Runtime, not a hostile one. </li> <li> Approving an <code>apply_patch</code> "for the session" is now scoped to the file you approved. The grouping key that scopes a session grant was built by a second, weaker patch parser that read only <code>+++ b/</code> headers and the <code>replace</code> array: it saw no target at all for the documented <code>apply_patch{path, patch}</code> override, for <code>--no-prefix</code> diffs, or for delete-only diffs, and collapsed every one of them to a single shared key. One approval therefore pre-approved every later patch of that shape, to any file, with no card and no notice. The key now comes from the same resolver the executor and the permission path already use, and an input that cannot be resolved gets its own key rather than a shared one (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6247</a>). </li> </ul> <h3>Added</h3> <ul> <li> The statusline's performance readings survive compact mode and are separately configurable. Measured TTFT and average output rate are kept when space allows, shedding help text and secondary counts first; the existing metrics and statusline settings gain individual toggles with a migration that preserves a legacy single setting, and the picker takes mouse selection and scrolling. </li> <li> Tasks can be given their own run name. <code>NewTaskRequest</code>, <code>TaskRecord</code> and <code>TaskSummary</code> carry an optional <code>name</code>, stored as given and omitted when absent, so queues still fall back to prompt-derived titles; a run started by an automation inherits the automation's name. The <code>tasks</code> tool's schema extends backward-compatibly and legacy records decode through serde defaults (APPS-153). </li> <li> The offline catalog seeds Xiaomi's MiMo 2.6 family — <code>xiaomi/mimo-v2.6-pro</code> and <code>xiaomi/mimo-v2.6-flash</code> — so a first boot without network no longer shows the 2.5 generation. <code>DEFAULT_XIAOMI_MIMO_MODEL</code> stays on <code>mimo-v2.5-pro</code>, and the rows carry no price because the published rates cover only <code>sk-</code> keys. </li> <li> Native memory is a reviewed store, not a model-writable file. <code>codewhale-memory</code> backs the TUI with SQLite as the authority instead of Markdown, and the <code>remember</code> tool now only proposes candidates — a model can no longer write an active memory. <code>/memory</code> and the Runtime API commit through <code>remember_reviewed</code>, and a Context Lens surface (<code>/v1/memory/lens</code>, <code>/lens/actions</code>, <code>/events</code>) shows what was kept and why. </li> <li> Code mode (Experimental, default off): <code>execute_tools</code> runs a JavaScript program against a QuickJS host surface so a model can express several tool calls as one program. Nested calls must be read-only and auto-approved; the tool is hidden in Plan and refused under worker authority. Enable with <code>[features] code_mode</code>. </li> <li> Two new built-in providers: ZenMux (<code>ZENMUX_API_KEY</code>) and CSDN 星图 (<code>CSDN_API_KEY</code>, Coding Plan quota billing), each with its own key slot, bootstrap model and catalog rows. </li> <li> The Runtime API gained the surface a native client actually needs: jobs with stdin, kill and cursor reads; context, secrets, git, diagnostics, targets, LSP and voice routes; <code>GET /v1/commands</code> for the slash-command catalog; <code>GET /v1/workspace/instructions</code>; account-wide <code>GET /v1/approvals</code>; plan and to-do inventory; <code>/v1/settings/schema</code>, with <code>POST /v1/config</code> now persisting every declared <code>settings.toml</code> key rather than a curated allowlist; PTY byte replay, resize and exit; and tool images as session artifacts. </li> <li> Codewhale holds the host's idle-sleep assertion while a turn is in flight (<code>caffeinate -i</code> on macOS, <code>systemd-inhibit</code> on Linux), so an unattended machine no longer sleeps mid-run. You will see one child process per turn. </li> <li> Skills are reachable in one call. The pinned <code>## Skills</code> index told the model to call <code>load_skill</code>, but the tool was deferred behind <code>tool_search</code>, so it was never in the tool array that instruction was printed beside: using a skill cost a discovery hop, a <code>name="list"</code> round trip, and a <code>change:tool_surface</code> re-pin of the whole cached prefix. <code>load_skill</code> is now eager for the parent and for children — +244B of pinned catalog, measured, against a re-prefill avoided every time a skill is used — and it takes a <code>query</code> that searches names and descriptions, so a truncated index no longer forces pulling the whole catalogue to find one skill. The usage line now says to load the matching skill by name before starting the work. </li> <li> A fast lane the router cannot serve now says so. <code>provider_router_candidates</code> answers <code>cheap: None</code> for any pair its tables do not know, and a <code>Faster</code>/<code>Auto</code> child on such a pair used to run at the parent's model and price with no receipt and no way to tell "single tier by design" from misconfiguration. The fallback stays — the router must not invent a model — but the spawn receipt now carries a <code>fallback_note</code> naming the unserved lane, the same field the pinned-provider fallback already uses. <code>Inherit</code> and served lanes stay quiet: this reports a fallback, it does not nag. </li> <li> The runtime API tells a replayed submission apart from a new admission: <code>POST /v1/threads/{id}/turns</code> answers <code>200</code> with <code>idempotent_replay: true</code> when the operation key was already used, and <code>201</code> for a fresh admission, so a client that retries after a dropped response can no longer create a second turn. The flag is absent on a fresh admission, so responses existing clients already parse are unchanged (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#76</a>). </li> <li> Event streams resume where they left off: journal frames carry their durable <code>seq</code> as the SSE event <code>id:</code>, <code>Last-Event-ID</code> is honoured as the cursor when no explicit <code>since_seq</code> is asked for, and <code>RuntimeCapabilities</code> advertises <code>event_stream_resume</code> so a client can gate its reconnect controls on the capability instead of discovering it from a missing id (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#76</a>). </li> <li> TTFT and average output rate stay visible in the compact working footer when space allows. <code>/statusline</code> now controls them separately; existing <code>session_metrics</code> settings still work. </li> <li> StepFun’s current coding catalog includes Step 5 Preview, Step 3.7 Flash, Step 3.5 Flash and its 2603 version, with published reasoning controls and PAYG rates. Existing Step Plan routing remains subscription-based. </li> <li> <code>read</code> responses now always report the file's byte size, line count, and whether output was truncated, and truncation footers name the total size alongside the continuation offset — so paging through a large file is deliberate instead of a surprise (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6283</a>). </li> <li> File edits are parse-gated before the write lands: Rust goes through <code>syn::parse_file</code> for a grammar-exact <code>line:column</code>, and <code>.toml</code> / <code>.json</code> through the parsers already vendored. An edit is refused only when the file parsed before and would not parse after — repairing an already-broken file is the commonest reason to edit source at all, so pre-existing breakage and new files fail open. The check precedes the write, so a rejection leaves the file untouched and <code>apply_patch</code> cannot half-apply (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6204</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6206</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6151</a>). </li> <li> Rust files that were already <code>rustfmt</code>-clean are re-normalized after an edit, so the next patch's anchors still match. Hand-formatted files are never rewritten, and every failure path skips and lets the edit land (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6205</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6151</a>). </li> <li> Native clients can finish provider setup without dropping to the CLI: <code>DELETE /v1/providers/{id}/key</code> clears a Codewhale-owned credential through the same shared owner as <code>codewhale auth clear</code>, and <code>GET /v1/providers</code> now carries <code>credentialSource</code> / <code>credentialWritable</code> (plus a reason) so a client disables its control with a truthful explanation instead of letting a write fail late. A credential Codewhale does not own — a literal key in a config file, or an active external consent — refuses both verbs with <code>409</code> rather than appearing to succeed against a source that still wins at request time (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6179</a>). </li> <li> The interactive approval card can be bounded: <code>[approval] timeout_seconds</code> resolves an unanswered card to deny when the window elapses — the same fail-closed decision the external approval path takes — and the transcript says the bound denied the call, not the operator. Omitted or <code>0</code> keeps today's unbounded wait, so nothing changes unless you opt in (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6101</a>). </li> <li> Transcript drag selection copies Markdown source by default: every cell the selection touches serializes through the same canonical path <code>Ctrl-Y</code> and <code>/copy</code> use, joined with blank lines, and the toast names the copied cell count. A selection that does not cover every touched cell end to end copies the exact rendered fragment instead: rounding a pinpoint selection out to whole cells meant copying an entire model message (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6228</a>). <code>tui.selection_copy_markdown = false</code> keeps the rendered-text payload (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6156</a>). </li> <li> The Runtime API serves the workspace files a native client browses and edits: <code>GET /v1/workspace/files</code> lists one directory, <code>GET /v1/workspace/files/read</code> returns a bounded byte window with a whole-file SHA-256 revision, and <code>PUT /v1/workspace/files</code> writes atomically through the confined opener with revision-checked overwrites (409 on drift). <code>.git</code> is never served and symlinks are never followed. A saved session's oversized tool outputs are served as artifacts at <code>GET /v1/sessions/{id}/artifacts</code> and <code>GET /v1/sessions/{id}/artifacts/{artifact_id}</code>. (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6163</a>) </li> <li> A session that ended mid-turn is no longer invisible to the model. The newest workspace-scoped session still holding a crash-recovery checkpoint is surfaced as a one-line <code>## Prior Session</code> notice in the session-pinned prompt prefix — metadata reads only, excluding the live session and any session this process instance created. Clean sessions get no block, so their prefix bytes are unchanged. Two bounded read-only tools, <code>session_search</code> and <code>session_get</code>, give the model workspace-scoped recall over the same store (one-line summaries and an 8-message tail, labeled untrusted user data, read on the blocking pool). Resuming stays the user's decision: the hint tells the model to offer a continuation, never to silently take one (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5715</a>). </li> <li> <code>codewhale exec --hooks</code> opts a headless run into the same <code>HookExecutor</code> the TUI builds — global config, reviewed plugin snapshots, and trusted project <code>hooks.toml</code>. Headless runs previously fired no hooks at all. <code>tool_call_before</code> can still deny and <code>shell_env</code> still applies; a hook <code>ask</code> resolves fail-closed without a terminal. Fleet worker subprocesses never opt in, and <code>permissions.toml</code> typed rules are unchanged (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6099</a>). </li> <li> <code>codewhale doctor</code> flags fleet and profile model pins that the provider's own roster no longer offers. A pin is reported only when a fresh cached live roster for that exact route exists and omits it — stale, failed, or absent rosters prove nothing and are counted as <code>unverifiable</code> rather than raising a false warning. Each row names the route and every owner of the pin; the pin is surfaced, never rewritten (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6035</a>). </li> <li> Background-capable clients can enumerate owned work and watch TUI-visible conditions: <code>GET /v1/threads/running</code> lists threads with queued or in-progress turns in one call (one turns scan grouped by thread), and <code>GET /v1/threads/{id}/notices</code> serves active <code>subagent-terminal</code>, <code>elevation-needed</code>, and <code>model-notify</code> notices with thread/turn identity, cleared by ack or — for elevation — when the tool call completes (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6180</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#3757</a>). </li> <li> Sub-agent launches adapt to provider throttling: a <code>DynamicGate</code> replaces the fixed semaphore so launch capacity adjusts at runtime, and a <code>RateLimitGovernor</code> halves capacity on 429 pressure, pauses admissions past the threshold, and recovers additively; 429 retries honor <code>Retry-After</code> with jittered backoff, and quota exhaustion keeps the failure path (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6055</a>). </li> <li> Turns record the mode they ran in, so mixed-mode sessions stay legible after the fact (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6321</a>). </li> <li> Shell spawning refuses NUL bytes in command and cwd before spawn, and sub-agent runs fall back loudly past credentialless profile provider pins instead of misrouting silently (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5529</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6318</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6320</a>). </li> <li> Children land past a per-step context bound instead of burning quadratically, and status rows surface live declared-vs-observed writes (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6189</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6194</a>). </li> <li> Queued Agent Mail can be cancelled before delivery, and the TUI suspend/resume handshake restores on stop and rebuilds on continue (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6176</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6169</a>). </li> <li> MCP connections are supervised: dead servers are probed and reconnected with transitions reported, and a failed reconnect keeps the last-good catalog instead of dropping tools (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6187</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6142</a>). </li> <li> Web search autodetects Tavily from <code>TAVILY_API_KEY</code> (Firecrawl stays the default), fleet refusals name the alternative, and verification runs on a bounded Git fetch plus a <code>merge_tree</code> verify surface (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6298</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6296</a>). </li> <li> Fleet authority projects through one <code>ChildGrant</code>, and ModelScope joins the built-in providers (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5633</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6299</a>). </li> <li> Child tool results are capped at capture time, and run tests/verifiers accept a bounded cwd (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6282</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6294</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6296</a>). </li> </ul> <h3>Changed</h3> <ul> <li> SearXNG results rank by the score the instance returns rather than by arrival order. Integers, floats and numeric strings are accepted; anything else, including NaN and infinity, becomes 0.0, and rows are stable-sorted descending before the result cap, so equal scores keep instance order. The docs now spell out the self-hosting requirement: the separate process must expose <code>search.formats: [json]</code> — an HTML-only instance answers 403 — and bind to loopback or a policy-allowed host, with no default instance discovered. </li> <li> The bundled skills move to a new generation. social-media and health leave the shipped pack (phone-export workflows rather than everyday skills), feedback moves to <code>docs/skills/</code> beside contributor onboarding, and the exact earlier body is retained so only unmodified shipped skills upgrade — a skill you have edited is left in place. Google OAuth scopes and client setup, Photos exports, forgetting limits, Spotify playback and plugin reload guidance were corrected in the same pass. </li> <li> <code>auto</code> is a declared default, not a guess about your wording. Reasoning effort no longer maps request vocabulary to tiers (debug/error to Max, search to Low) and Auto routing no longer infers cheap-versus-big from phrasing: both resolve the configured default, with <code>[auto] cost_saving</code> as the explicit opt-in. The same prompt now costs the same thing twice. </li> <li> A workflow's shared token budget is opt-in. <code>[workflow] default_token_budget</code> applied a silent 120,000-token cap across a run and all of its children, and a fan-out died at the limit with no hand-back; the default is now 0, meaning no shared cap. </li> <li> The shipped <code>deepseek-flash</code> route speaks the Responses endpoint, and <code>xhigh</code> effort maps to <code>high</code> per the vendor's own table. </li> <li> Streamed text is paced at a steady rate rather than inheriting the provider's SSE chunking, so output reveals at a readable beat instead of in bursts. </li> <li> Broadening shell access for a conversation now requires an idle conversation and rejects a stale-workspace check before it commits. Engines advertise a <code>thread_shell_consent</code> capability, so an older Engine reads as unsupported to a native consent client instead of silently accepting. </li> <li> One base prompt now serves every host. <code>HEADLESS_BASE_PROMPT</code> was a second hand-maintained rendering of the same constitution — the drift pattern this repo forbids by convention — so headless runs compose the same <code>BASE_PROMPT</code> plus language and output layers that interactive runs do, skipping only host chrome (execution profile, authority recap). Headless and interactive can no longer disagree about what the agent is. </li> <li> <code>BASE_PROMPT</code> gains a Bearing article, which changes how the agent talks to you: the user is a peer who gets honesty rather than deference, a blocking gate is named plainly instead of dressed up as refusal, bad code is called bad, a crude request is carried out without a lecture, and an apology appears only when there is something to apologize for — not as punctuation. It also states that the request is the whole mandate, so the scope law opens with what is yours to do before it reaches the edge. Every pinned kernel invariant survives verbatim. </li> <li> The ocean reads as animals rather than a mechanism. The school used to translate as one rigid body — bob phase and tail pose were staggered per fish, but horizontal position was locked to an exact wedge offset — so each fish now eases a dot fore and aft of its slot on its own slow period, and the formation breathes while it travels. Bubble emission and the per-animal periods are hash-jittered instead of sharing one clock. Amplitude stays an order of magnitude under the crossing speed, so no fish travels against the school and <code>facing == velocity</code> still holds by construction. The species list is unchanged. </li> <li> Extensions keeps the exact-content plugin review on the panel: confirming a bundle's digest re-reads the inventory, so the row you just reviewed reports its new trust state and offers Enable instead of leaving you in the transcript with a stale "not reviewed" row. </li> <li> Underwater motion ticks at the cadence the frame limiter actually draws (the atmosphere interval while only the water moves, the authored 80 ms ocean cadence inside the interactive cap while a turn streams), and the event loop wakes exactly for the next tick instead of on the next idle poll. Idle water no longer requests frames it cannot draw or quantizes its cadence to the poll interval; reduced motion, Ghostty, tmux and the six-second idle settle are unchanged. </li> <li> The launcher keeps the Codewhale mark while balancing its layout above the composer. A single cursor identifies the selected action; MCP faults retain their warning color even in compact terminals. Recent-session counts now read correctly for a single message. </li> <li> Model and provider settings use quieter selection surfaces, one focused cursor, clearer missing-key warnings, compact output limits, and less repetitive credential detail. Plugin actions use plain labels. </li> <li> The terminal opens on Shoreline, the same palette the GPUI client already uses: warm charcoal field <code>#211F23</code>, a raised plate for panels and the composer, one blue for action and selection <code>#90B9FF</code>, and the whale's ivory <code>#F2ECE5</code> for body text, with 4.5:1 floors on every muted step. The old saturated navy gradient is not gone — it is a named <code>underwater</code> theme, and after review it is once again what a fresh 0.10.0 install opens on (<code>DEFAULT_TUI_THEME</code>); Shoreline is one <code>/theme</code> away. Existing installs keep whatever theme they have saved (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6222</a>). </li> <li> Menu navigation is starting to mean the same thing everywhere. <code>menu_style</code> already single-sourced how a selected row looks; what a key does was still reinvented per surface — <code>h</code>/<code>l</code> in the provider picker against <code>Left</code>/<code>Right</code> in the model picker one screen later, <code>Home</code>/<code>End</code> in one of seven pickers, and no paging at all in Fleet's detail view. <code>list_nav</code>, which already owned the wrap arithmetic, now owns the vocabulary too: one vertical axis, one horizontal axis, and two entry points so a picker with a live filter never has a letter stolen out of its query. Fleet's detail view adopts it first and gains PageUp/PageDown and Home/End in both its lists (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6290</a>). </li> <li> Reviewed plugin bundles are no longer re-hashed four times per MCP dispatch. <code>verify_plugin_authority</code> walks and hashes both the reviewed source and the runtime snapshot, and four separate authority checks ran per <code>tools/call</code> — eight tree walks. Three of them sat one statement after a <code>validate_before_use</code> on the same source, so <code>is_ready</code> re-verified what had just been verified; readiness and authority are now separate, and only the callers with no preceding check still pay for both. The tool catalog is built once per turn instead of twice, which also removes a case where the two assemblies could disagree if authority drifted between them. The digest is deliberately not cached on <code>(path, mtime, len)</code>: the reviewed tree is user-writable and <code>utimensat(2)</code> lets a same-uid process restore an mtime after an equal-length rewrite, so a stat-keyed cache would serve a pre-tamper digest (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6209</a>). </li> <li> A sub-agent's completion is read from the manager once instead of polled. The workflow pump re-read it up to fifty times, sleeping 20ms between attempts, waiting for a terminal status that was already committed — every publisher commits the status inside the same <code>&mut self</code> call that wakes the pump, so the write guard spans both and the first read always sees it. A child the manager had no record of cost a full second of head-of-line blocking before failing; it now fails immediately, and says what actually happened instead of claiming the child "did not report a terminal status within 1s" (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6211</a>). </li> <li> MCP protocol negotiation: every surface advertised the original 2024-11-05 revision and the stdio client required an exact match, so newer servers could not connect. The server and both clients now advertise 2025-06-18 and negotiate over the supported set (2025-06-18, 2025-03-26, 2024-11-05) — the server echoes the client's revision when it is supported and answers with the latest otherwise, the stdio client accepts any supported revision, and streamable HTTP sends the required <code>MCP-Protocol-Version</code> header on every post-initialize request (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6280</a>, first half). </li> <li> Configured MCP servers now connect lazily instead of all at session boot. The pool owns a <code>connecting</code> set marked at spawn and cleared on resolution or abort, so "connecting" is no longer inferred as enabled-minus-connected. The boot pass scopes to the eager set — <code>required</code> servers plus those covered by <code>tools.always_load</code> / <code>allowed_tools</code> — and a turn naming an unstarted server spawns its connects alongside, under the existing five-second deadline. A configured-but-unstarted server now reads as configured on every surface (session-boot rows, Extensions tab, launch card), never as connecting. <code>docs/MCP.md</code> documents the lifecycle (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6033</a>). </li> <li> The launch card's MCP problems row runs its own remedy. It already printed <code>/mcp login <name></code> or <code>/mcp</code>; it now joins the shared paint/click/keyboard ordering, so Up/Down lands on it and Enter or a click types the printed command into the composer for you to send. Typing beats copying: no clipboard dependency over SSH, and you see the command before a second Enter runs it (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6085</a>). </li> <li> Computer Use is the only computer-use product in Extensions and <code>/mcp recommendations</code>. Cua is no longer suggested as a parallel desktop-control MCP; enable the first-party <code>computer-use</code> plugin instead. The bundled plugin is 0.11.2 — macOS beta, with the Windows and Linux backends experimental and source-only. It carries the per-app consent ledger, background-by-default control, and a focus lease that refuses rather than stealing the foreground, alongside <code>get_app_state</code>, <code>focus</code>/<code>get_value</code> and <code>stop_computer_control</code>. Shared-desktop pointer gestures stay gated, and arbitrary background dragging remains unavailable. </li> <li> The bundled first-party catalog pins marketplace revision <code>d8640b17f27542e7122c76368724196f92a0af61</code>, so installing Computer Use from the Extensions listing fetches the same 0.11.2 source the binary already carries. </li> <li> Materializing is not enabling: the built-in bundle is written under <code>$CODEWHALE_HOME/builtin-plugins</code> on first run but stays <code>NeverReviewed</code>, so Computer Use is never switched on without an explicit capability review. </li> </ul> <h3>Removed</h3> <ul> <li>The host no longer parses prose into goals. Ten phrasings and a clause allow-list ("make it your /goal to …") were turned into durable goals before the provider call; prose now reaches the model, which calls <code>create_goal</code> when a goal is useful. The deterministic path — a leading <code>/goals <objective></code> — is unchanged.</li> </ul> <h3>Fixed</h3> <ul> <li> A thinking fold is an absolute choice again. The stored bit was relative to the display preference (<code>folded ^ !(verbose || thinking_default_expanded)</code>), so every recorded choice flipped meaning the moment a preference changed: turning <code>thinking_default_expanded</code> on closed a block the reader had explicitly expanded (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5847</a>). An explicit tri-state intent now records Expanded or Collapsed outright, and the absence of an entry means untouched, so the preference baseline decides that cell's default. Space still toggles, and an untouched cell still follows <code>verbose || thinking_default_expanded</code>. </li> <li> A terminal byte-stream cursor past the head is clamped instead of echoed back. <code>read_since</code> returned a future cursor as <code>next_cursor</code>, so a client that continued from it skipped every byte the stream produced before reaching that position — permanently. The start position now clamps to <code>total</code>: a future cursor reads nothing, is not a gap, and hands back the head. </li> <li> Language-server startup is bounded and a failed transport now terminates. The client waits for successful initialization before sending notifications, drains stderr without buffering it, bounds request queueing and replies, caps protocol frames, and fails pending requests when the child transport dies. </li> <li> Input no longer freezes for the rest of a turn when the engine's 32-slot op mailbox is full. The remaining input-path sends no longer await: droppable ops whose rejection is reported and retryable use <code>try_send</code> (CancelSubAgent, PreviewOutboundRequest, bang shell input, PurgeContext, and the single-op settings updates), ops that must land once the UI changed reserve first, and <code>ChangeMode</code> publishes its live authority even on a full channel. Must-deliver ordered transitions still await, and say why at <code>EngineHandle::send</code> (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6150</a>). </li> <li> The pet's whale is one body again. The same authored point set is checked in three copies plus four fixtures, and the Rust and TypeScript cores disagreed on particle positions from frame 0 while agreeing on every channel and constant — so the v1 fixtures had never matched what Rust produced and the conformance job had never passed. The bodies and the fixtures are reconciled and that check now runs green. </li> <li> The context meter and the auto-compact gate share one honest estimator. The status bar inflated <code>ctx %</code> by about half and disagreed with the gate, so "ctx 82%" could sit beside a <code>/compact</code> that refused to run; displayed percentages now read materially lower because they are correct (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6297</a>). </li> <li> A steer the engine never accepted is queued for the next turn instead of being shown as held and then silently dropped with no turn and no answer (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6297</a>). </li> <li> Every <code>reqwest</code> client routes through <code>codewhale_release::tls</code>. A bare <code>Client::builder()</code> panics under rustls with no installed provider; 17 call sites were swept. </li> <li> The bundled OpenAI-compatible hosts have their <code>/provider</code> rows back. Retiring the <code>ProviderSetupTemplate</code> layer moved SenseNova, Baseten, Groq, Cerebras, DashScope and Command Code into <code>provider_descriptors.json</code> and then wired that file to nothing, so six vendors silently lost their picker rows; AICraft never had one. Each descriptor is a row again, built through the same named-custom-provider builder a configured host uses, so endpoint, bootstrap model and "missing <code><ENV></code>" reporting all come from one place. A descriptor whose id or alias already names a <code>[providers.*]</code> entry is dropped, so a configured row stays the only one. These rows are an invitation, not a route: they are not <code>is_configured</code>, and only the form's submit writes anything (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6289</a>). </li> <li> A StepFun Step Plan subscription reaches its own catalog. A subscriber's <code>base_url</code> is <code>https://api.stepfun.ai/step_plan/v1</code>, but only the pay-as-you-go <code>/v1</code> host was recognised as official, so the Step Plan host read as a custom endpoint, the catalog was withheld, and the picker showed <code>0 bundled</code> and a guessed context window for a route whose console advertises <code>step-5-preview</code> at 1M context. The model was in the seed the whole time. All four StepFun hosts — global (.ai) and China (.com), each with a <code>/v1</code> and a <code>/step_plan/v1</code> surface — are now recognised; a host StepFun does not own stays custom and keyless, since this predicate also scopes credentials. </li> <li> The send cue stopped strobing while you type. <code>[↵]</code> flickered between dim <code>[·]</code> and bold blue once per character at an ordinary typing pace. The cue was not lying — Enter really does insert a newline during the ~120 ms paste-safety window, which every keystroke re-armed — but that window only exists for terminals that deliver a paste as a burst of ordinary keystrokes. Ghostty, iTerm2, WezTerm, Windows Terminal and Terminal.app now skip the heuristic from the first keystroke instead of waiting for proof by paste. </li> <li> Shift+Tab sets the permission posture in Plan. Tab cycles the mode and Shift+Tab cycles Ask/Auto-Review/Full Access, but Plan refused the second one outright, so the key silently did nothing there and the two axes read as welded together. Plan's read-only guarantee comes from the mode, not the posture — <code>authority</code> maps <code>(Plan, _, Bypass)</code> to <code>SandboxPolicy::ReadOnly</code> and <code>tool_catalog</code> gates every write tool on <code>mode != Plan</code> — so the cycle now moves the durable Act/Operate baseline while Plan's live policy stays <code>Suggest</code>, and a toast says the posture lands when the mode leaves Plan. </li> <li> A steer delivered mid-turn now clears its pending card. The transcript showed the message and the model answered it, while the "sending into this turn" card still listed it as pending: <code>turn_loop</code> commits a steer trimmed, but the UI handed the engine the untrimmed text and kept that same copy for matching, so a composer newline made the two differ by whitespace alone and the steer was never promoted to a transcript cell. The text is trimmed once at the source that feeds both, so they are the same string by construction; the match stays an exact <code>==</code>. </li> <li> A Xiaomi MiMo key no longer fails verification with another vendor's 401. The legacy top-level <code>base_url</code> is a DeepSeek field, and a route without an endpoint of its own inherited it — so a config carrying <code>base_url = "https://api.deepseek.com"</code> made that host the MiMo route's endpoint. The custom-endpoint guard correctly withheld the MiMo credential from a host the route does not own, and the setup wizard's probe, which bypassed the guard, sent the key as <code>api-key:</code> — a header DeepSeek ignores. The result was <code>HTTP 401 Unauthorized: Authentication Fails (governor)</code>, DeepSeek's unauthenticated 401, shown to someone who believed they were testing their own key. Every layer that reads the root now inherits it only when the URL belongs to that provider's own official endpoint family; DeepSeek, which owns the field, is unchanged, and any other host is still expressible on <code>[providers.xiaomi_mimo] base_url</code>. Key verification failures now also name the endpoint that was probed, so a wrong endpoint reads as a wrong endpoint instead of a bad key. </li> <li> The Extensions panel can act on the rows it shows. Every plugin now carries its on/off switch — Space, or <code>e</code> — including one that has never been reviewed: <code>/plugin enable</code> already routes an unreviewed bundle into the exact-capability review and only flips the switch once you confirm the digest, so withholding the control bought no safety and left the shipped <code>computer-use</code> bundle reading <code>disabled</code> with nothing that could enable it. </li> <li> The panel stopped saying "untrusted". A bundle that is waiting on its capability review now reads <code>needs review</code> — <code>off · needs review</code> when the switch is off too — and its detail line says what Codewhale is withholding and which key ends the wait, instead of restating an internal pair of booleans. Enter's verb on that row is <code>review</code>, not <code>inspect</code>. </li> <li> MCP servers say where they live, and mutations write there. Each row is labelled <code>global</code>, <code>project</code>, or <code>plugin: <name></code>. Enabling, disabling or removing a workspace-scoped server previously edited the user's global file and failed with "MCP server '' not found" on a row the panel had just offered; the write now lands in the file that declares the server, and a plugin-contributed server says it is switched off by disabling its plugin. </li> <li> The permanent "Plugins · Problems: N" footer chip is gone. It could not be acted on from the footer, and its count and the Plugins tab disagreed by construction — the chip counted bundles waiting on a review while the tab's Problems group lists only registry-level diagnostics, so the rows behind the number were never the rows you found. A bundle waiting on a review is a row with an action, and <code>/plugins</code> states it per bundle next to the key that resolves it. </li> <li> The Extensions marketplace no longer advertises what it cannot install. Browser Use and the sandbox runtime were pinned rows whose only possible action was <code>unavailable</code>; they are removed, along with the browser-driver and sandbox-runtime component vocabulary that existed solely to describe them. </li> <li> Configuration parsing keeps the parsed base config boxed, so loading a profile no longer carries the full <code>Config</code> by value through the deserializer and overflows a default 2 MiB test-thread stack; the runtime-store binding test that also overflowed is split into phases and pinned to that budget so CI's larger stack cannot mask a regression (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6362</a>). </li> <li> Stopping a turn revokes its pending approvals. A late approval cannot resume the cancelled action or save an automatic approval for later turns. </li> <li> Expanding and collapsing selected reasoning now matches its rendered state when verbose mode and the default-expansion preference are both enabled. </li> <li> Branch navigation preserves sibling histories, stable entry IDs and timestamps through autosave, resume and forks, and synchronizes the selected branch into the live engine. Thanks to <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> for the report (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6367</a>). </li> <li> Compaction now writes local diagnostic records for completed passes and automatic refusals. <code>codewhale metrics</code> reports them with summarizer token usage; text-mode exec retains its session after attempting compaction. Historical artifacts are not backfilled. Thanks to <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> for identifying the missing producer (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6368</a>). </li> <li> The opening workbench retains the canonical Codewhale mark in a responsive header while keeping recent-session titles full-width and actions clickable. </li> <li> <code>serve --acp</code> no longer ignores the approval posture. The ACP adapter hardcoded <code>ApprovalMode::Suggest</code>, so <code>--yolo</code> (and any configured <code>approval_policy</code>) never reached admission: every mutating tool parked behind a permission request no unattended client answers, and sessions executed zero tools. Posture now derives from server config — <code>--yolo</code> pre-approves prompts and flows into the sandbox policy — while hard blocks (safety floor, repo law, reviewer consult) and the Plan read-only guardrail stay intact (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6337</a>). </li> <li> Plain agent spawns could not resolve. <code>built_in_members()</code> seeded both <code>general</code> and <code>worker</code>, and the role parse boundary migrates <code>worker</code> to <code>general</code>, so both canonicalized to the same role — and <code>role:general</code>, the selector the roster advertises for the default posture, matched two members and raised <code>Ambiguous</code> every time, permanently. The duplicate built-in is gone. The legacy name still resolves: <code>general</code>, <code>member:general</code>, <code>role:general</code> and <code>default</code> all land on the <code>worker</code> posture through the identity selector rather than through a second member, which is what allowed the duplicate to be removed (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6244</a>). </li> <li> Clicking a <code>path:line</code> in tool output no longer spawns <code>$EDITOR</code> detached while the TUI still owns the terminal, and no longer spawns one editor per matching line. The launch goes through the single terminal-handoff path, and a click is one request to open one file (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6235</a>). </li> <li> A write-scope contention refusal now names a remedy that works. The <code>agent</code> tool's description claimed <code>release</code> was "the remediation a write-scope contention refusal names"; the refusal did not name it, and pointing back at it would have been worse, because <code>release</code> only clears claims whose owner is no longer running while a contention refusal names a live one. The refusal itself now says to wait for that owner to settle or cancel it (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6272</a>). </li> <li> The session picker no longer refuses a saved session whose Runtime store exists but holds nothing. A force-quit leaves the store on disk, ownerless and empty, and the switch path refused it because recovery only covered a missing store. A switch now also adopts a store that is provably empty (every work directory, plus the event sequence that remembers pruned appends) and provably unheld (the process-owner lock, which a live manager holds from open to close), with no automation pinned to its execution scope — and the save gate treats that shape as abandonable too, so the repaired binding persists. The first fix was reverted on a race (emptiness without liveness); this reland checks the lock first (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6207</a>). </li> <li> Double-tap Enter now sends every queued follow-up into the running turn, oldest first. The second Enter used to steer only the most recent message and leave older ones queued; a failed steer restores the failed message plus everything unattempted in original order, so nothing is lost or reordered. </li> <li> Only the most recently sent prompt carries the elevated-surface background now; every older prompt renders on the bare ground. The fill used to sit behind every user row (striping), then behind none; newest-only keeps the eye on the turn in play. Sending a new prompt moves the highlight and un-highlights its predecessor. </li> <li> Diff rows tint whole: added/deleted line numbers now share the row's green / red background instead of sitting bare next to a painted body. Context rows stay on the bare ground. </li> <li> MCP connections are supervised now: a background task notices a dead server within one sweep, reconnects on the existing backoff ladder, and reports each transition, so Extensions rows flip with liveness instead of parking on stale-ready or a silent [reconnect]. Five consecutive failures park the server with a notice naming <code>/mcp retry</code>; an explicit retry or a fresh connection resumes watching. Tool calls also retry once across a dead pipe/socket (not just stale sessions), and a reconnect that fails reports both errors instead of swallowing the original (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6187</a>; <code>list_changed</code> catalog refresh stays open). </li> <li> A steer the engine never delivered is no longer reported as sent. The runtime API persisted the steer item as already-<code>Completed</code> and emitted <code>turn.steered</code> + <code>item.completed</code> the moment the text entered the engine's mailbox — before the engine decided anything. The engine discards a steer whose turn has moved on, and an interrupted or failed turn drops whatever it had queued, so a GUI could show "Guidance sent", clear the composer, and lose the user's words. The engine now returns a verdict for every steer on every exit path, the item settles <code>completed</code> or <code>canceled</code> to match, a dropped steer emits <code>turn.steer_dropped</code> and answers <code>409</code> so a client can resend, and <code>steer_count</code> counts steers the model actually received (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6276</a>). </li> <li> <code><recommended_plugins></code> suggestions stop nagging: a plugin id is now injected at most once per engine lifetime, and a plugin whose name a loaded skill already covers is never suggested — the local skill owns the domain, so the nudge was noise. Dismissals still apply, and the fragment stays append-only on the user turn (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6274</a>). </li> <li> A canceled automation run now settles with a transcript receipt that names the cancellation (by request, cancel timeout, or shutdown) instead of vanishing from the live band silently. The receipt wears attention ink and never lights the failure demand; the run record keeps the cancellation reason as its error detail. (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6162</a>) </li> <li> A failed workflow run no longer settles silently: its terminal failure raises a sticky error toast naming the cause (dispatch, schema, or script errors), alongside the existing panel state (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5528</a>). </li> <li> MCP OAuth re-login now forces the provider's consent screen: logout only clears the local token, so without a prompt the provider silently re-granted the same account/workspace and a re-login could never change it. <code>/mcp logout</code> and <code>codewhale mcp logout</code> also say plainly that they clear local credentials only (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6040</a>). </li> <li> Session retention no longer deletes transcripts once the store reaches the cap: the oldest active session is archived — still openable from the picker's archived view — instead of being unlinked, and archived records sit outside the cap until they are pruned (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6136</a>). </li> <li> Empty auto-created "New Session" stubs are capped separately (the ten newest are kept) and can no longer occupy a real transcript's slot in the session cap (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6137</a>). </li> <li> A failed resume or session load is now a durable transcript error instead of a status line the next footer update replaces, so a resume that cannot restore its target no longer looks like a silent new session (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6138</a>). </li> <li> Compaction no longer retains a tool result whose tool call was summarized away: an older turn that mixes text with a tool result keeps its text and drops the orphaned result blocks, which providers reject outright (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6119</a>). </li> <li> Automation runs that need a tool approval no longer die as silent idle-timeout cancels: a pending approval suspends the idle watchdog for its decision window, and an unanswered window settles the run Failed with the recorded reason instead of a silent Canceled (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6118</a>). </li> <li> <code>/mcp</code> no longer freezes the console while a turn is running: the panel opens immediately from the last known MCP snapshot with a receipt naming the wait, and live-pool mutations say their refresh is deferred instead of parking the UI event loop behind the running turn (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6159</a>). </li> <li> MCP OAuth login no longer fails with "Authorization server response missing required issuer" against servers that implement RFC 9207, such as Cloudflare's <code>mcp.cloudflare.com</code>. The local callback listener now keeps the <code>iss</code> parameter from the redirect and hands it to the token exchange so the callback binds to the discovered issuer; servers that do not send <code>iss</code> keep working unchanged. (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6157</a>) </li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@AdityaVG13</a> — fixed composer wrapping, tab/caret placement, pasted and editor-returned draft history, painted-column transcript copying, explicit terminal foregrounds, headless user-input tool availability, and engine synchronization after importing foreign sessions (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6369</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6363</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6365</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a> — moved the TUI session-export slice onto shared command contracts (FEAT-025): a session-export contract facet with one shared sanitizer, <code>/export</code> routed through the facet, pinned with baseline-captured goldens and gates (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6096</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@BX166</a> — contributed the AICraft provider template and its documentation (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6171</a>). It was closed unmerged, but it is what surfaced the decision to stop special-casing named OpenAI-compatible hosts (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6289</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> — reported the session-retention defects behind archive-past-the-cap and empty-session cap occupancy (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6136</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6137</a>), the resume-failure design behind durable transcript errors (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6138</a>), and the gaps behind the opt-in approval timeout (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6101</a>), <code>codewhale exec --hooks</code> (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6099</a>), Markdown drag-copy (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6156</a>), and the browsable, current-aware session picker (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6014</a>); the goal token-budget hard stop (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6013</a>) and the fleet no-progress guard shared with child workers (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6015</a>) landed as first slices of two larger proposals, and the runtime-store session refusal (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6207</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a> — reported TUI tests reading machine state instead of hermetic fixtures; the <code>lock_test_env</code> remedy from that report shaped two more hermetic fixes, for the shared UI fixtures and the compaction budget test (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#5359</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@Lujc0523</a> — reported <code>/hooks edit</code> splitting keystrokes between the editor and the composer, fixed by pausing the TUI input pump inside the editor handoff (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6165</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@Statter</a> — reported the Gemini <code>/models</code> failure that now surfaces the provider's reason instead of an empty error (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6173</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@sequico</a> — reported the ACP <code>session/new</code> ids that <code>session/load</code> could not resolve, fixed by minting resolvable session ids (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6174</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@bevis-wong</a> — reported the mid-run engine freeze behind the bounded turn-end foreground-child join, and the resume path that re-ran identical tool-call repair on every load instead of persisting it (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6184</a>, <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6185</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@gaord</a> — recorded the mode each turn ran in (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6321</a>, harvested), stated the approval posture a task thread starts on (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6386</a>), and rebuilt the runtime-API thread summary in one store pass (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6376</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@zhuowp</a> — preserved chat roles across compaction, protected user turns on recompaction, and kept the operate contract intact (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6286</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> — rate-limit-adaptive subagent launch scheduling: the <code>DynamicGate</code> that replaces fixed spawn pacing under provider throttling (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6055</a>, harvested).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@asto18089</a> — co-authored the rate-limit-adaptive launch scheduling work (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6055</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@yrk111222</a> — ModelScope provider support, landed through the shared <code>ChildGrant</code> fleet authority (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6299</a>, harvested).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@xiechimon</a> — capped child tool results at capture time rather than at render (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6294</a>, harvested).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@VincentCorleone</a> — defined and implemented the weixin-bridge Quick Start so a first run works from the README alone (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6170</a>, harvested).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@Serendo</a> — fixed the <code>/config</code> theme editor exiting the panel on an arrow key (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6336</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@yetuge</a> — dropped the retired <code>token_budget</code> field from the subagent documentation (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6335</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">@Water-Run</a> — ingested namespaced model-only catalog entries so models present only in the canonical <code>models</code> map reach the offering list (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6400</a>); translated the local browser client guide into Simplified Chinese (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6401</a>); and retired the blanket dead-code allowance with its unused feature stages, tightening the budget to match (<a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">#6402</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044341/4267078/github-release-codewhale-hqcodewhale-v0100-22092026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: codewhale-hq/Codewhale v0.10.1 (08.10.2026)</h1> Mon, 12 Oct 2026 20:39:00 +0200 <div class="github-feed-entry"><div class="github-feed-badges">🛡️ Security Fix <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">codewhale-hq/Codewhale</a>v0.10.108.10.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — official GitHub release</h3> New macOS/Linux install (checksummed binaries from this release): <pre>curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.10.1" sh "$HOME/.local/bin/codewhale" --version</pre> For Windows, use the matching installer or archive below. For an existing direct install, run <code>codewhale update</code>; it prints the executable path and keeps newer builds. If the install directory is occupied by a different build, use the fresh-directory migration in <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">the installation guide</a>. <h3>Secondary packaging — npm and Cargo</h3> <pre>npm install -g codewhale # or build from source cargo install codewhale-cli --locked</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/codewhale-hq/codewhale:v0.10.1</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale.bat</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code>, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (<code>wt.exe</code>) when it is installed.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Double-click <code>codewhale.bat</code> (not the raw <code>.exe</code>) to launch</li> <li>Run <code>install.bat</code> to copy the binaries and launcher to <code>%USERPROFILE%\bin</code></li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run <code>codewhale.bat</code> from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.10.1</h2> <h3>Contributor integration and reliability</h3> <ul> <li>OAuth retry diagnostics omit provider-controlled error fields; account replacement stops before retired Weixin receipts exceed their storage limit, preserving uncertain work for local review.</li> <li>Resuming a session through a symlink to the same workspace no longer shows a false workspace-change warning.</li> <li>Runtime clients can read one tool call's actual workspace changes and reviewed skill details (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@gaord</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6817</a> and <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6869</a>). In-flight snapshot pairs remain pending; missing objects and corrupt repository metadata are distinguished.</li> <li>Search accepts valid preferred locales, and image dimensions describe the same bytes sent to the model (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@asto18089</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6860</a> and <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6858</a>). Automation deletion keeps its definition until cleanup succeeds, and compaction preserves its original summary anchor (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6864</a> and <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6857</a>).</li> <li>Config/status/permission commands share portable contracts while the host retains mutation authority; queue workers acknowledge a scheduled retry for temporary first-claim contention and fail honestly on corruption (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6832</a>).</li> <li>Indefinite questions, approvals and elevation waits survive the TUI watchdog. Answers get time to resume the current turn; settled requests disappear by identity. Thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> for <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6872</a>.</li> <li>Configured approval expiry belongs to the held Engine request; hiding or covering its card cannot restart the deadline, and a late queued answer cannot approve an expired call.</li> <li>Tool discovery keeps the highest-ranked matches when a result batch exceeds the existing cache bounds, preserving search order and the 16 KiB limit (adapted from <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@AdityaVG13</a>'s <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6393</a>).</li> <li>Model-switch receipts now translate their session-only saving note in every complete locale pack; the three save commands remain directly usable (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6875</a>).</li> <li>Route-save receipts and <code>/workspace</code> replies are translated in every complete locale pack, the Operate descriptions in fourteen packs match the current English, pt-BR, es-419 and ca regain accents six strings had lost, and long CJK text can be shortened between Han and kana characters (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6884</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6885</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6886</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6888</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6887</a> and <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6882</a>).</li> <li>Long sessions keep less in memory: superseded journal entries beyond a retained window move out of the live session into a per-session archive under <code>sessions/.journal-archive/</code> (kept until the session is deleted; <code>/branch</code> can still restore an archived entry), ended shell operations in the work graph are capped, and session metadata larger than the first read no longer forces a full-file read. Not yet addressed: usage fingerprints in session metadata still grow without a bound, snapshots are still cloned on the UI task, and resume still reads the session file twice (thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a>, refs <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6842</a>).</li> <li>Weixin bridge threads belong to the account and chat that created them: resuming or listing another chat's thread is refused. An explicit <code>/new</code> after an account replacement keeps the old account's private receipt and never replays its prompts automatically. Replies never reuse another bot account's Weixin context token, and <code>/threads</code> lists this chat's own older threads even when other chats have newer ones.</li> <li>Windows messaging bridges retry a briefly locked record replacement (EPERM/EACCES/EBUSY) with bounded delays and never delete the previous record first.</li> <li>The website and README installation guides are generated from one shared source, and the critical Simplified Chinese guides were re-reviewed against current English.</li> <li>A Codewhale sign-in that expired, or an account service that is unreachable, no longer blocks turns on your own provider key. The turn uses your local settings and Codewhale says once how to restore account preferences.</li> <li><code>codewhale login</code> keeps a DeepSeek route you chose, or one with a local key, instead of switching it to the managed Codewhale provider.</li> <li>The bundled <code>computer-use</code> plugin is 0.12.1, reconciled with canonical source <code>724f9c422db1a51880dc81154dae70816c475ed8</code> while retaining Core's embedding manifest and version contract. Its image renderer lock now carries Sharp 0.35.5.</li> <li>The bundled first-party catalog pins marketplace revision <code>6512f1dfaa91ee287e9f81ebabaf4909e8a371a3</code> and lists all 19 reviewed plugins, up from 6. Every catalog plugin still installs disabled and untrusted until you review it.</li> <li>Every committed npm lockfile is audited in CI, including build tooling. The VS Code extension packages with <code>@vscode/vsce</code> 4 on Node 22 while it still compiles and tests on its Node 20 runtime. The website keeps one reviewed, hash-verified depth guard for an unpatched <code>braces</code> advisory (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">GHSA-vfj7-8cjw-p6xm</a>); its raw audit findings are retained, not hidden.</li> <li>Pasting through Windows Terminal (Ctrl+Shift+V) no longer drops emoji and other characters outside the Basic Multilingual Plane. Release binaries and source builds carry a small patch to crossterm 0.29.0 in <code>patches/</code> (the change proposed upstream as <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">crossterm-rs/crossterm#1073</a>); a real Windows Terminal paste of 24 Unicode lines is now a release gate.</li> <li>Experimental extension host: reviewed Native plugins can register avatar packs with <code>ctx.avatars.registerPack</code> (<code>/pet avatar [key]</code>, <code>/pet action|view <name></code>). <code>/plugin import dsh <package-dir></code> reviews a DeepSeek Harness bundle and now lists the Native host code it contains; <code>approve <dir> <content-hash></code> installs it disabled and untrusted. Trusted host plugins stay trusted across a restart, enabling a second host plugin activates it without <code>/plugin reload</code>, and the review no longer crashes the TUI.</li> </ul> Codewhale v0.10.1 focuses on reliability and first-run behavior. Turns that stall now say so, approvals keep what you approved, plugin suggestions are quieter, and Fleet runs can be checked before they spend anything. Scripts that parse <code>--json</code> output should read the Breaking for scripts note below before upgrading. <h3>Added</h3> <ul> <li> <code>/plugin doctor</code> reports stale built-in records and snapshots, and <code>/plugin doctor --fix</code> retires them. A user plugin, a snapshot a running process names, and a snapshot inside the grace window are kept. The previous <code>state.json</code> is kept as <code>state.json.pre-gc</code>. </li> <li> Reviewed plugins can declare named OpenAI-compatible OAuth routes. The host owns PKCE, refresh and credential storage, and checks the review at each request (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">docs/PLUGIN_PROVIDERS.md</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6805</a>). The provider capability advances plugin review policy to v5 (v6 with the extension host): older receipts require explicit review again. </li> <li> OrcaRouter account sign-in uses PKCE and saves the same durable API key as manual setup; its live catalog keeps chat-capable rows and stated pricing and modality facts (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6867</a>). </li> <li> Experimental TypeScript extension host. New in this release and off by default: turn it on with <code>[features] extension_host = true</code>. A plugin that declares a <code>native</code> TypeScript or JavaScript entry (the Cordis / DeepSeek Harness plugin model) can contribute tools, slash commands, pre-execution policy hooks, additive prompt sections, reviewed skill roots and plugin-local JSON state. Its code runs in a separate Node process, never inside Codewhale (Bun is an opt-in through <code>[extension_host] runtime</code>), and every call goes through Codewhale's own gate: an extension tool is never treated as read-only, so it always meets the approval gate (Full Access, Bypass or a session grant for that reviewed plugin can satisfy it), a command runs only when you type it, and a plugin must be reviewed and enabled first. The host is sandboxed on macOS (Seatbelt) and on Linux with bubblewrap, with no direct network and no reads of the protected credential locations (Codewhale's secret stores and the Codewhale, Codex and DSH homes). A Native extension starts only after that sandbox is verified at launch: if bubblewrap is missing or its namespace probe fails, activation is refused with the concrete error. Codewhale's own pinned built-in host modules keep a diagnosed exception, and every effect still needs a Rust operation ticket. On Windows a Native extension starts only in a freshly created Less Privileged AppContainer whose only capability is <code>registryRead</code> (Winsock cannot start without it), after Codewhale checks its token and a real file and network probe; otherwise activation is refused. Other files you can read, such as project <code>.env</code> files, stay readable, and plugins sharing the host can interfere with each other, so enable only plugins you have reviewed (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">docs/EXTENSIONS.md</a>). </li> <li> Extension slash commands: a plugin registers one with <code>ctx.commands.register</code>. It runs only when you type it, and it can show text, or submit a prompt as your next message that then goes through the ordinary turn and its approvals; it cannot call the model or a tool itself. A command cannot take a built-in command's name or another plugin's, and a markdown command with the same name wins. A command has 30 seconds, and commands are TUI only: the Runtime API does not list or run them. </li> <li> Native extension authoring now includes policy listeners through <code>ctx.on('tools/pre-execute', ...)</code>, prompt sections through <code>ctx.prompt.registerSection</code>, and persistent plugin-local state through <code>ctx.storage</code>. Listeners may deny, ask, revise input or annotate; Rust rechecks revised calls and owns every approval. Prompt sections cannot replace the system prompt, and state exposes no session history or secret API. These services share the experimental, off-by-default host's reviewed owner lifecycle and are withdrawn when their owner unloads or is revoked; saved state remains available when the plugin reloads. </li> <li> Extension tool input is checked against the JSON Schema the tool registered, before an approval card appears and again before the call reaches the host. An invalid call comes back to the model as an error naming what to correct, and the host never sees it. A schema that cannot be compiled, or that refers outside itself with <code>$ref</code>, is refused when the tool registers. </li> <li> An extension tool can call eligible core tools with <code>core/call</code> while the ordinary turn is running that extension tool. Rust supplies a temporary invocation ticket and still owns planning, hooks, permissions, approval and execution. The ticket is bound to the plugin owner, host process and live invocation, and expires when that invocation ends or is revoked. Commands, timers and plugin startup cannot use this path. Approval grants are scoped to the reviewed extension build; a grant to the model does not cover it. Shell and network calls require a person's prompt even with a remembered grant; a permission mode that cannot present that prompt refuses the call. MCP tools, Computer Use, other extensions, agent/workflow launches and permission-changing tools remain unavailable through this path. A cancelled invocation withdraws its pending approvals instead of deciding them for you. </li> <li> Extension host identity is checked at startup: its reported trust tier and built-in module digests must match the process Rust launched. Built-in host code and third-party plugins have separate process and owner namespaces; the table pins the MCP protocol module and the execution harness. The optional Host MCP backend uses the official TypeScript SDK for framing, with Rust retaining credentials, network/process access, approval and exact operation tickets. All 30 existing recorded comparisons pass locally. The Rust backend stays the default until platform and rollout gates pass; its protocol adapters remain through the compatibility window. </li> <li> A plugin can declare several <code>native</code> entries (<code>native.paths</code>, up to 64). They activate in order under one owner, so one disable, review change or crash takes all of them down. If one entry fails to activate, only that entry is withdrawn: entries that already activated stay registered, and the plugin fails only when no entry activates. </li> <li> Plugin settings and context: <code>[plugins."<name>".config]</code> in your own <code>config.toml</code> is passed to the plugin's <code>apply(ctx, config)</code> and checked against its exported <code>Config</code> schema; a project's <code>.codewhale/config.toml</code> cannot set it, a change applies at <code>/plugin reload</code>, and <code>/plugin show</code> lists the keys, never the values. Tools and commands also receive the workspace of the session that called them and a private data directory for the plugin under <code>~/.codewhale/extension-host/data/plugins/</code>; no home, credential or other workspace path is passed. </li> <li> <code>codewhale --enable <feature></code> and <code>--disable <feature></code> work from the <code>codewhale</code> command; before, they were rejected. Put the flag before any subcommand. </li> <li> The extension host bundle carries MIT-licensed code (Cordis, Schemastery and others). Its third-party licence notices are generated from what the bundle actually contains and written beside the bundle when it is unpacked, and <code>THIRD_PARTY_NOTICES.md</code> lists the packages. </li> <li> Extension host runtime: Bun 1.4.0 or newer is an opt-in; Node stays the default. <code>[extension_host] runtime = "node" | "bun" | "auto"</code> chooses: unset means <code>node</code> (or <code>bun</code> when the table sets only a <code>bun</code> path), <code>bun</code> runs only Bun, and <code>auto</code> prefers a supported Bun and uses Node when none is found or the Bun host fails to start. An explicit choice never falls back, and restarts keep the runtime the session first started on; a runtime binary replaced mid-session is refused. A configured <code>node</code> or <code>bun</code> path is used as given and fails loudly rather than falling through to <code>PATH</code>, and a runtime found on <code>PATH</code> inside a <code>node_modules</code> directory or the working directory is skipped, not run. <code>codewhale doctor</code> and <code>/plugin</code> show which runtime runs the host, why, and how its memory is capped. Under Bun the host never auto-installs packages and ignores <code>.env</code> and <code>bunfig.toml</code> in its data directory. Extensions cannot run native code inside the host on either runtime: <code>bun:ffi</code>, <code>Bun.FFI</code>, <code>node:ffi</code>, the SQLite builtins, <code>process.dlopen</code>, <code>process.execve</code>, Worker threads and <code>ShadowRealm</code> are refused, and the host will not start if one of these restrictions does not hold. Known limit: that lockdown covers the native-code entry points found so far (Bun 1.4, Node 22 and 26); one a newer runtime adds is not covered until it is added. The 1 GiB memory cap uses <code>RLIMIT_DATA</code> on Linux, the Job Object on Windows and, for a Bun host, a kernel jetsam limit on macOS; a Node host on macOS is checked at each heartbeat. Bun is qualified on macOS only: the Rust host tests, the memory cap included, have not run a Bun host on Linux or Windows (CI runs them with Node, and the JS host suites under Bun 1.4.0 on Linux). <code>host/hello</code> reports the runtime and version that actually run. </li> <li> <code>docs/features.toml</code> lists every user feature with its status, first release, docs page and owning code. A test fails when a <code>[features]</code> flag and its row disagree, or when a listed docs page or code path is missing. The configuration reference now lists the <code>verify_tool</code>, <code>vision_model</code> and <code>extension_host</code> flags, and <code>config.example.toml</code> lists <code>code_mode</code>. </li> <li> A reusable GitHub Action runs PR reviews with a configurable model endpoint and a checksum-pinned Codewhale binary. It checks the PR's eligibility and exact revisions before inference; fork events receive no model key (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6780</a>). </li> <li> An optional, off-by-default shadow Decision Gate classifies the first request of a turn — tool need, answerability from context, intent — through the existing System One client and only logs a typed recommendation; it never changes routing or delays the model call. Configure it with <code>SUPERFAST_ENABLED</code> and <code>SUPERFAST_PROVIDER</code> (docs/CONFIGURATION.md) (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6603</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6604</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Andrea-Bruno</a>). </li> <li> <code>tool_call_after</code> hooks for shell tools receive <code>DEEPSEEK_TOOL_EXECUTION_RECEIPT</code>: the command that actually ran after admission, its working directory, how it ended, and bounded stdout/stderr previews, so a hook can record exactly what executed (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6689</a>, requested by <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>). Supported settled local shell calls also send a versioned JSON document on stdin to foreground or background observers, with session/tool-call IDs, nullable exit status and output truncation flags. Existing environment fields stay available; unsupported execution paths send no document, and observer output cannot change the completed call (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6582</a>). </li> <li> Runtime API: turns now record what they produced. Each item and turn carries typed artifact references (path, kind, size, revision, and a restore point when file-revert would accept one) for files a tool wrote, spilled tool output, and media. <ul> <li>Once the post-turn snapshot settles, the turn also lists what changed in the workspace while it ran, including shell and sub-agent writes. It then publishes <code>turn.artifacts</code>.</li> <li><code>GET /v1/threads/{id}/turns/{turn_id}/artifacts</code> lists a turn's references, and <code>.../artifacts/{artifact_id}</code> reads one from the workspace, the post-turn snapshot or the session artifact directory.</li> <li>Spills from unbound runtime threads were unreadable before; they are now readable.</li> <li>The legacy <code>artifact_refs</code> field is now filled with the workspace files a tool call wrote, so Preview in current desktop builds shows them (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6653</a>).</li> </ul> </li> <li> Runtime API: git stage, unstage, discard and commit accept optional <code>expect</code> preconditions (full HEAD id, an index token, per-file <code>rev</code>, or a whole-tree <code>revision</code>, all read from <code>GET /v1/git</code>). When the repository changed since the client read it, the write does nothing and answers 409 <code>git_state_changed</code> with the current state, so a Review sheet can no longer stage bytes, discard edits or commit an index the user never saw. Requests without <code>expect</code> behave as before. Path writes now use literal pathspecs, as the docs already said, and <code>files[].path</code> is workspace-relative in a subdirectory workspace. Guards cover executable mode, submodule HEAD and changes outside that workspace; oversized or budget-limited stat-only revisions cannot authorize a guarded write. Status stays best-effort: unreadable paths, symlinked ancestors, special files and broken nested repositories withhold only affected row tokens and the whole-tree revision. Normal Git filters and untracked settings apply, with directory inventories scoped to the rows or paths that need them. Untracked workspace files and renames leaving the workspace remain visible, and broken HEADs cannot satisfy an unborn-HEAD guard (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6647</a>). </li> <li> Runtime API: <code>POST /v1/threads/{id}/fork-at-turn</code> forks a thread at a named user turn, keeping that turn and every turn before it. The receipt matches <code>/undo</code> and returns the first dropped prompt so a client can put it back in the composer. Naming the turn replaces a client-computed depth, which could fork the wrong prefix. The fork leaves the workspace and any running turn untouched (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6580</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@gaord</a>). </li> <li> Official model routing: <code>/router</code> (also <code>/model router</code>) sets up the Auto router with presets: Jev (TypeSafe's decision model, via OpenRouter or a TypeSafe key), your provider's fast tier, Off, or Custom. Jev and Fast each make one test call before you save, the Turn Inspector (Ctrl+Alt+O or <code>/turn inspect</code>) shows the router's choice, cost and latency, and a failing router is shown as failing (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6525</a>). </li> <li> ChatGPT sign-in uses Codewhale-owned protected credentials and a model roster fetched for the signed-in account. Account, workspace and issuer changes cannot reuse another roster; a missing or stale roster offers no models. Authentication failures and subscription limits do not silently fall back to a paid API route. </li> <li> Code mode composes MCP and plugin tools and is on by default: <code>execute_tools</code> programs can call MCP tools, and each nested call passes the same approval gate as a direct call, pausing the program for approval when needed. Every nested call keeps its receipt, including calls that finish before a deadline, and <code>[features] code_mode = false</code> stops offering <code>execute_tools</code> up front (it stays reachable through tool search). <code>codewhale mcp list</code> and <code>codewhale doctor</code> warn when a user MCP server duplicates the built-in Computer Use bundle (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6562</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6509</a>). </li> <li> Tsubasa is a bundled OpenAI-compatible provider row: base <code>https://api.tsubasa.sh/v1</code>, key <code>TSUBASA_API_KEY</code>, model <code>tsubasa-pro</code> (also <code>tsubasa-fast</code>). Its window is 32,768 tokens; set <code>providers.tsubasa.context_window</code> to match (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6695</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@cenab</a>). </li> </ul> <h3>Changed</h3> <ul> <li>The pinned prompt header follows the turn at the top of the viewport, handing over to the previous prompt as you scroll, and clicking it jumps back to the message it names (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6830</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>).</li> <li>On Windows, every PowerShell command the shell tool starts now passes <code>-ExecutionPolicy Bypass</code> for that process only, so a local <code>Restricted</code> or <code>AllSigned</code> policy no longer blocks multi-line commands. (<code>.ps1</code> script tools still start as <code>powershell -File</code> without the flag and remain subject to the local policy.) A policy set by Group Policy still wins and the command is refused with PowerShell's own message. Scripts that a command invokes run under the same process-scoped setting. To let the machine or user policy apply instead, start Codewhale with <code>CODEWHALE_POWERSHELL_EXECUTION_POLICY=inherit</code>: it then omits <code>-ExecutionPolicy</code>, so a <code>Restricted</code> or <code>AllSigned</code> policy refuses the multi-line commands that need a temporary script; any other value keeps the default. Not verified on a native Windows machine (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6745</a>).</li> <li>The website's not-found page now uses the Codwhale poster and typo joke, with English/Chinese recovery links to home and docs (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6419</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6420</a>).</li> <li>Script tools can no longer approve themselves or replace built-in tools (founder decision D4). A <code># approval: auto</code> line in a script under <code>~/.codewhale/tools</code> (or <code>[tools].plugin_dir</code>) is ignored: the tool follows the session's approval setting like a script with no <code>approval:</code> line, and the runtime log and <code>/plugin tools</code> name each script that still declares it. A <code>[tools.overrides]</code> entry of <code>type = "script"</code> or <code>type = "command"</code> keyed by a built-in tool name is refused, and the built-in stays active; a status line names the key once per session, and the runtime log records it. <code>type = "disabled"</code> still turns a built-in off, and script or command overrides under a new name still work. To keep a wrapper such as an audited shell, disable the built-in and give the wrapper its own name (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">configuration</a>).</li> <li>Complete the session slash-command group’s shared command boundary, including <code>/structcopy</code>, so all seventeen commands can compile independently of the TUI. Host operations remain behind capability interfaces; command behavior and upstream tool-execution identity safeguards are preserved (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6792</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6145</a>).</li> <li>The declared minimum Rust version is now 1.89. It said 1.88, which could not build Codewhale: a locked dependency (<code>serde-saphyr</code>) needs 1.89, the version CI's minimum-version job builds. The install guides and the npm wrapper's build-from-source hints now say 1.89 too.</li> <li>A deferred tool's first call now runs when its arguments already carry every required field and no field the schema does not declare, instead of costing a retry turn. Malformed calls still get the schema, and approvals, deny lists and Plan mode apply first. Argument types are still checked by the tool itself. Sub-agents preload tools named in <code>allowed_tools</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6494</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6437</a>).</li> <li>Automatic Git status and review reads need Git 2.31 or newer, because they pin Git's runtime configuration overrides. With an older Git they refuse with "upgrade Git (2.31 or newer)". This covers the read-only Git tools (<code>git_status</code>, <code>git_diff</code>, <code>git_log</code>, <code>git_show</code>, <code>git_blame</code>, <code>verify</code>); Git writes you ask for keep their existing behavior (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">docs/dependency-maintenance.md</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>A failure Codewhale can name is no longer labelled an internal fault. An HTTP 400/405/409/413/422 rejection, an out-of-credits 402, the context-budget stop and a turn's own step or wall-clock ceiling now carry an input or budget label, and a bare <code>ERROR</code> from a provider is reported as an unreadable error instead of a warning. Refs <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6843</a>.</li> <li>A transient upstream failure reported as an error frame inside a successful response is retried within the stream retry budget. When the budget is spent the turn fails once with an error card instead of an amber warning that promised a retry. Refs <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6795</a>.</li> <li>Diff lines and tool output wrap at grapheme boundaries, so emoji families, skin tones and variation selectors no longer split across lines (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6829</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>).</li> <li>Twelve translated packs now translate the context inspector's making-room and anchors rows, the Ctrl+O hint and the <code>/turn inspect</code> and <code>/advisor</code> descriptions instead of showing English (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6831</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>).</li> <li>Optional MCP servers can be found before they connect. <code>tool_search</code> matches the query against configured, enabled server names (or an <code>mcp_<server>_</code> prefix), connects up to eight matches within the existing boot wait, and returns their real tool schemas. Before, a lazily started server exposed no tools, so the model could never trigger its connection (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6828</a>). Known limit: a query that names neither the server nor <code>mcp</code> does not wake it. <code>codewhale mcp connect</code>, <code>validate</code> and <code>tools</code> run their own connection and do not attach to a running session.</li> <li><code>/undo</code> and <code>/restore <N></code> refuse while a turn is running in the workspace, instead of rewriting files under it.</li> <li><code>--resume <id></code> after a crash recovers that session's interrupted turn from its crash checkpoint, as <code>--continue</code> does.</li> <li><code>/resume <file></code> keeps an imported session on the current provider route instead of a default one.</li> <li>When the stall watchdog recovers a turn, the Engine's turn is ended too, so the next message is accepted (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6800</a>).</li> <li>A turn you cancel, or one the stall watchdog recovers, releases input at once. A message still waiting to reach the engine is abandoned and its unsent text returns to the composer, instead of holding input for up to 60 seconds (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6800</a>).</li> <li>A transient upstream failure that a gateway reports as an error frame inside a successful response ("Provider returned an empty response") is retried under the stream retry budget when nothing had streamed; authentication and invalid-model frames still fail at once (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6795</a>).</li> <li>Long sessions no longer start every turn late. Once a workspace held more than 50 undo snapshots (around the sixteenth turn), each new snapshot rebuilt the whole snapshot history before the provider request, about 2.8 s per turn in a small workspace. Old snapshots are now dropped half a window at a time.</li> <li>Resuming a crashed session from inside the TUI recovers its interrupted turn too.</li> <li>Release builds compile on Rust 1.99.</li> <li>TUI undo and retry rewind the Engine conversation and saved session before replacement inference. If the conversation or its settings change while undo is being prepared, it refuses without overwriting that newer state or changing the draft. Retained compaction summaries survive the rewind and cannot be selected as editable user prompts (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6788</a>).</li> <li><code>/edit</code> replaces the exchange it revises through the same rollback: the old prompt and its answer leave the transcript, the model's context and the saved session before the edited prompt is sent.</li> <li>When the rollback that <code>/edit</code> needs is refused, your revised text goes back to the composer with edit mode still on, instead of being dropped. Opening <code>/edit</code> while you are editing a queued follow-up returns that follow-up to the queue first.</li> <li>A session can still be resumed by its id when a stray copy of its file sits in the sessions directory; before, the id was reported as ambiguous.</li> <li>Agents follow the Permissions you choose while they run: switching to Full Access reaches an agent that is already working, instead of leaving it with the Auto-Review guardian that denied it. Tightening reaches it too. An agent's answer to an approval prompt is delivered while the main session is busy, and a forced delete inside the workspace is no longer treated as a catastrophic system delete. On Linux, Full Access switched on at runtime cannot lift the kernel no-new-privileges flag set at startup, so <code>sudo</code> and setuid helpers still fail; start with <code>sandbox_mode = "danger-full-access"</code> or <code>CODEWHALE_NO_NEW_PRIVS=0</code> if agents need them (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6787</a>).</li> <li>Stream limits and transport settings share a typed <code>[stream]</code> configuration table, including retry budgets, TCP keepalive and HTTP/2 keepalive. Explicit values take precedence over legacy <code>[tui]</code> aliases; omitted values preserve existing defaults and environment behavior. A configured HTTP/1 pin stays pinned during recovery. <code>/config stream_chunk_timeout_secs ... --save</code> updates the canonical setting so it survives reopening a configuration that already had a timeout. Transport changes apply when a client is built (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6700</a>).</li> <li>Switching providers keeps a model set only in the root <code>default_text_model</code> with the provider it belongs to. Switching away and back (<code>/provider</code> in the TUI, or the desktop app's model chip) used to land on the provider's catalog default such as <code>gpt-5.6</code>, and a pass-through provider switched to in between inherited the other provider's model, or a stale legacy root <code>model</code> that the root default had been shadowing (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6693</a>).</li> <li>A turn no longer stops after an hour of work. The cumulative per-turn wall clock is unlimited by default, like model steps; set <code>[tui].turn_wall_clock_secs</code> to cap it.</li> <li>OpenRouter turns are priced again instead of always showing "rate unavailable". The model-list refresh no longer fails as a whole on one bad row: <code>~</code> "latest" aliases are dropped, routers that publish a <code>-1</code> variable price are listed without a rate, and other malformed rows are skipped and counted. Main interactive turns now honor a <code>[[custom_models]]</code> rate the same way background work does, a declaration without rates no longer hides the catalog price, and an explicit declared rate prices a vendor-pinned OpenRouter route (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6690</a>).</li> <li><code>codewhale exec</code> can take prompts past the OS argument limit (~128 KiB on Linux, where larger prompts failed with <code>Argument list too long</code> before Codewhale started): <code>--prompt-file <PATH></code> reads the prompt from a file, and <code>--prompt-file -</code> reads it from stdin; a positional <code>-</code> stays literal text (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6688</a>).</li> <li>Keep reasoning effort labels, including <code>xhigh</code> and <code>ultra</code>, visible beside short model names in the 80-column terminal footer.</li> <li>First-run TUI startup keeps explicitly configured providers, models and endpoints (including environment overrides and a legacy top-level <code>base_url</code>), even with a missing key, instead of adopting a detected local Ollama model. The <code>default_text_model</code> line written into the generated first-launch config is not treated as a choice, so starting Ollama after the first launch is still detected. Usable configured routes skip the provider picker and record the provider step as configured, without claiming a successful check; missing-key recovery focuses the configured provider even on a fresh home. Switching from that recovery picker (or after Esc) to a provider that has its key clears the launch "needs a key" state, so the footer names the route instead of "model not connected" and a detected local Ollama can no longer take over the provider just chosen. Empty sessions no longer show a full context window from the startup prompt; a submitted first turn or reported usage still shows real pressure.</li> <li><code>/trust on|off</code> changes file-tool trust for this session. Add <code>--save</code> to persist workspace trust for project skills, commands, hooks, MCP servers, and project context. Skipped-skill notices stay out of conversation titles and user bubbles, and trust changes append a correction to the model's history.</li> <li>Stored-secret cleanup skips busy Runtime stores and reports unreadable paths while continuing through other files. Configured storage roots may be symlinks; discovered symlinks are not followed. Cleanup also masks current configured credentials, and doctor's bounded scan reserves capacity for saved transcripts and checkpoints separately from Runtime receipts.</li> <li>Hooks: <code>tool_call_after</code> and <code>on_error</code> now get a shell command's exit code in <code>DEEPSEEK_TOOL_EXIT_CODE</code> on Runtime API threads as well as in the TUI, and for a failing command as well as a passing one, so <code>exit_code</code> conditions match. The Runtime API path passed no exit code at all, and a command that exited nonzero, timed out, or was killed reached hooks with no exit code on either surface. The new <code>DEEPSEEK_TOOL_STATUS</code> says how the command ended (<code>completed</code>, <code>failed</code>, <code>timed_out</code>, <code>killed</code>) (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6582</a>).</li> <li>Scrolling a long transcript repaints the reasoning reveal hint in place instead of rebuilding the transcript tail. Wheel and scrollbar input use interactive frame pacing, collapsed tool groups reuse cached summaries, and height-only resizes keep wrapped history. Width changes still rewrap content, and other per-frame work still grows with session length (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6652</a>).</li> <li>A settled transcript frame reuses its existing render plan instead of rebuilding or moving unchanged history on every poll. New output, selection, resize and other real changes still invalidate the affected work (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6652</a>).</li> <li>Workflow progress rows and working, verification and translation indicators use the pinned Codewhale terminal component kit. Quiet and reduced-motion working/verification indicators hold its semantic current-work mark. Working and verification keep their existing delay and cadence, while translation uses the same earned marker and five-frame-per-second cadence. The Engine still supplies workflow state, clocks, localized text, custom themes and terminal adaptation. The composer, transcript viewports, dock tabs, posture/metrics rows, pending-input cards, approval band, Ocean background and the whale's Braille raster now also render through the pinned kit.</li> <li>Calm transcript previews keep the latest three rows of live thought and a single duration header when it settles. Successful tool headers are quieter; failed generic and MCP calls keep a bounded head-and-tail excerpt, with full output available in details. Existing collapsed groups show their hidden count and reveal cue, and explicit thought expansion stays available.</li> <li>Composer history preserves multiline entries and literal quoted text while retaining the old history file during migration. An oversized message stays in the composer if its paste file cannot be saved, with a localized notice; mouse placement and quoted file mentions handle multibyte text and spaces (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6776</a>).</li> <li>The notice for an oversized message that cannot be saved as a paste file is now a short line that fits the footer ("Not sent: over N characters; paste file not saved."), in every supported language. The full reason, including the write error, goes to the transcript once.</li> <li>Model-facing guidance names callable tools and explains discovery before a deferred read. The stopship workflow's scout activates the deferred <code>grep_files</code> with one required <code>tool_search</code> call, then gathers bounded <code>grep_files</code> evidence from the current workflow source paths (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6747</a>).</li> <li>Simplified and Traditional Chinese permission, provider and session wording now follows the current behavior. Chinese guides correct hook receipts, trusted skills, MCP startup and Windows limitations, preserving the contributor translations and a shared glossary.</li> <li>Unknown website locale segments, including dotted missing paths, return a real 404 with noindex metadata and no home-page canonical URL. The existing layout guards now have regression coverage across all registered locales (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6786</a>).</li> <li>The terminal caret no longer blinks at the hidden composer while a picker, settings screen or other view covers it; it returns when the view closes (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6545</a>).</li> <li>On Linux and macOS, a <code>background: true</code> shell's process group is now stopped when the TUI dies without cleaning up (SIGKILL, a crash, or the signal exit path). The shell and the processes it started used to keep running as orphans. Processes that move to their own process group or session, staged services you choose to keep, and <code>tty: true</code> background shells are not covered. Under the bwrap sandbox, the sandboxed command now also exits when bwrap does (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6654</a>).</li> <li>Idle task workers stop periodically reloading a settled, unchanged empty queue, and task listings reuse an unchanged store snapshot. New queue writes and local notifications still wake workers; recent or unreadable metadata and failed claims keep bounded retries. This reduces repeated disk work when several TUIs share a data directory without changing task ownership or cancellation (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6573</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6728</a>).</li> <li>Idle task workers check the queue file's metadata about once a second instead of five times a second, and no longer reloads the store when nothing changed. An in-process notification still wakes a worker at once; a write by another Codewhale process that shares the data directory is noticed within about a second instead of about 200 ms. A worker with pending work, a retry deadline or a failed claim keeps the short interval (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6728</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6573</a>).</li> <li>After five seconds without session activity, the UI loop polls every 250 ms instead of 48 ms and the automation-panel scan backs off to 15 seconds. After thirty quiet seconds, the Git probe runs one <code>git status</code> every 15 seconds instead of the full probe every two seconds, unless the Git panel is showing. User input and engine events restore the active cadence. This reduces idle work; it does not remove every cost that grows with session history (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6728</a>).</li> <li>When the task store is busy, the message now names the process that holds its lock and how long it has held it ("lock held by pid 1234 for 12s"), when that can be read. A repeated "Task claim unavailable" error is logged once per episode, then at debug level (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6573</a>).</li> <li>On Windows, Fleet can read a running worker's log while its writer holds the file open, and task-store contention can still read the lock-holder record. These paths previously failed because of whole-file sharing and locking.</li> <li>File writes, including legacy <code>File</code> and <code>write_file</code> calls, stop if the original contents cannot be read; legacy writers also reject non-UTF-8 originals, keeping undo and diffs from recording an empty original file.</li> <li>Resuming a session preserves user messages that quote a compaction marker.</li> <li>Requirements allow-lists now check unset approval and sandbox defaults, accept equivalent approval aliases, and lock permission posture when sandbox modes are constrained so saved Full Access and YOLO cannot bypass them.</li> <li>Logout completes xAI OAuth revocation and attempts every credential deletion before reporting remaining credentials with a non-zero exit status.</li> <li>ChatGPT and xAI sign-in now show the account the selected route actually uses, and sign-in names the account it replaces. <code>/auth chatgpt</code> and <code>/auth xai-device</code> switch the running session; signing in from a separate shell requires restarting an already-open session. Subscription-limit errors name the account that made the request and explain how to switch, without printing credentials (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6715</a>).</li> <li><code>doctor --fix</code> keeps temporary files modified within the last hour.</li> <li>Provider streams stop with a clear error if an SSE line exceeds 8 MiB.</li> <li>Recursive <code>rlm_query</code> turns inherit the parent's remaining deadline, bounded by the existing child budget, including asynchronous lock waits, startup, model requests and Python evaluation. Expired work is refused before dispatch; a timeout returns the last response with an incomplete-result error. Nested code and status receipts accompany the enclosing tool result on success or failure and survive its session save/reopen. In-flight receipts still need that result to be handed back before they become durable (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6511</a>).</li> <li>The TUI keeps redrawing while its terminal is unfocused. v0.10.0 held every frame on focus loss, so on Windows Terminal, macOS and other terminals a window sitting behind another one looked frozen until you clicked back into it. Frames are now held only on GTK/VTE terminals, which replay the damage themselves when they return. That hold was added for the MATE flicker in <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6311</a> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6651</a>).</li> <li>TUI <code>/undo</code> now restores only the files the undone tool call or turn changed, and refuses, changing nothing, when one of them changed since. Before, it checked out the whole snapshot tree, which also reverted later edits to other files. It also finds restore points older than the newest 100 snapshots, and a forked session can undo the turns it inherited. It waits for a post-turn snapshot that is still being written, leaves a changed symlink or other non-regular path in place (and says so) instead of refusing the whole undo, and writes nothing to the snapshot store when it refuses outside trusted mode (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6644</a>).</li> <li>On a fixed model, each Ctrl+T press now moves to a different thinking tier. Ctrl+T and the <code>/model</code> picker could list tiers the route treats as the same one — DeepSeek's <code>medium</code> is <code>high</code>, and Z.ai GLM-5.2's <code>low</code> is <code>high</code> — so some presses changed nothing. They now share one list per route with one entry per effective tier. Under Auto model routing, Ctrl+T walks the picker's Auto list instead of a longer private one; the tier is still settled when the turn is routed, so two neighbouring choices can land on the same tier. DeepSeek now reports <code>minimal</code>, <code>xhigh</code> and <code>ultra</code> as the <code>low</code>, <code>high</code> and <code>max</code> it sends, in <code>/status</code>, receipts and <code>/effort</code>, and Kimi Code K3 no longer offers <code>off</code>, which it always ran as <code>low</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6650</a>).</li> <li>A top-level <code>base_url</code> or <code>api_key</code> in <code>config.toml</code> now means one thing everywhere. Every reader used its own rule for which routes inherited it, which is how a DeepSeek endpoint became the Xiaomi MiMo route's and failed with DeepSeek's 401. Old files keep working: the keys are read as <code>[providers.deepseek]</code> (or the vendor whose official host they name), the next save moves them there with a one-time backup and a one-line note, and a value that disagrees with its table is left for <code>codewhale config migrate --prefer</code> to settle. <code>codewhale config doctor</code> shows what is in use (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6394</a>).</li> <li>Setting up a bundled OpenAI-compatible host from <code>/provider</code> now shows that host's key console, docs link and guidance on the setup form, the same way the built-in providers' key entry does; before, the descriptor file carried them and nothing read them. AICraft gains all three (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6616</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@BX166</a>).</li> <li>Runtime API undo now restores the files of the turns it undoes, for every kind of thread. Before, a new thread's turns were not linked to their workspace snapshots, so <code>patch-undo</code> returned <code>201</code> and rewound the conversation but left the files changed, and <code>file-revert</code> refused. Each turn record now lists its snapshots in <code>workspace_snapshots</code>, the engine runs under the thread's own id across restarts, and a fork owns the turns it inherited. <code>patch-undo</code> restores only the files the undone turns changed, including every write in a turn, and leaves later edits by the user or another thread alone. Every tool call that may write is bounded by its own snapshots, so a file another thread or an editor changed while the turn ran is never reverted as the turn's, and a turn's restore points survive the snapshot count cap. When it cannot restore files (including a write to a gitignored path) it now refuses with <code>409</code> and an <code>error.code</code> instead of returning <code>201</code>. A nameless <code>PUT /v1/sessions</code> updates the document the thread is bound to (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6621</a>).</li> <li>A Runtime thread that is not bound to a saved session keeps one engine session id, its own thread id, across its first turn, eviction and restarts. Before, each engine spawn generated a new id, so the thread's tool-output spills, snapshot tags and shell jobs were scattered across a different <code>sessions/<id>/</code> per spawn (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6659</a>).</li> <li>Saved sessions no longer go orphaned, and existing orphans are repaired at launch. Deleting a session now sets aside the Runtime store it was actually bound to, and switching a conversation to another host's store sets aside the store it left, unless another session still uses that store or it holds work. Exporting a thread (<code>POST /v1/sessions</code>) updates the thread's own document instead of creating a new one each time. A thread whose document was appended to elsewhere keeps loading. A thread whose document was deleted or rewritten loads from its own turns instead of failing, and threads write their files under the session they belong to. Each launch and <code>codewhale serve</code> repairs the store in the background: a store holding threads with no session gets a "Recovered:" session for each thread, and unreadable documents, unused empty stores and old files no session names move to <code>sessions/.set-aside/</code> with a manifest. Nothing is deleted. <code>codewhale doctor</code> reports the last repair, and <code>codewhale doctor --repair-sessions [--dry-run]</code> runs one now. <code>PUT</code> and <code>DELETE /v1/sessions</code> refuse a session that another Codewhale process has open (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6144</a>).</li> <li>Runtime API: the thread event stream now ends with a typed <code>stream.end</code> frame (reason and resume cursor) whenever the server closes it, including on shutdown, so clients can tell a Runtime error from a dropped connection and resume from the right event. A replay worker crash no longer ends history early and skips events without a detectable gap, and the mobile page resumes from its last event instead of replaying from zero, with stream statuses in the configured UI language. Cross-origin clients can read the stream-end and replay-progress capability headers, and the SDK exports <code>isThreadStreamEnd</code> for TypeScript narrowing.</li> <li><code>codewhale exec --auto</code> no longer exits 141 with no output when a child it writes to, such as a stdio MCP server, closes its pipe early. Headless exec now ignores SIGPIPE while it runs, as the interactive TUI already did, and <code>exec ... | head</code> still ends quietly. One-shot <code>codewhale exec</code> no longer prints DeepSeek's raw <code><｜｜DSML｜｜ calls></code> tool-call markup as its answer: the markup is removed, and an answer that was only a tool call fails at once with the reason and a pointer to <code>--auto</code>, instead of asking the model again and blaming an incomplete provider response.</li> <li>Resuming a session keeps its "Resumed:" confirmation on screen instead of replacing it with "Make room automatically: on" when nothing was switched.</li> <li>Tool output is no longer cut off where you can't get it back. Search answers, test runs, git, verifier and web results reach the model whole up to one budget sized to the model's context window, and anything beyond it can be read back with <code>retrieve_tool_result</code>, including read-only tools executed alone or in parallel. Restored raw results use the active route's same inline budget; existing recovery receipts stay intact. Tiny budgets use a compact retrieval reference instead of a long artifact path and instructions; a complete reference is kept even when it alone exceeds the allowance. Native search now asks for answers up to 8,192 tokens (was 2,048–4,096) and waits long enough for them to arrive, and an answer the provider still cuts short is marked as cut (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6508</a>).</li> <li>The installation page is generated from <code>docs/INSTALL.md</code>, so the website and the guide can no longer disagree; broken anchors and unsafe links fail the build (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6450</a>).</li> <li><code>codewhale config set</code> refuses a value of the wrong type for a known setting (a word for an on/off switch, text for a number, a choice outside the list) instead of saving it (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6568</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@dajiaohuang</a>).</li> <li>Receipts: <code>/receipts</code>, <code>codewhale receipts [ID|--last] [--format md|json]</code>, and <code>GET /v1/threads/{id}/receipt</code> (plus a per-turn form) list what a session did, one line per action: files changed with line counts, commands with exit codes, web and MCP calls, agents, approvals and who gave them, and failures. They also count what ran without asking and name the posture each turn ran under, read from the turn's own record. A call Codewhale blocked before it started (Auto-Review or guardian, a tool policy, a refused sandbox escalation, invalid input, a missing tool) is listed as blocked, with the reason, and is not counted as run or as ran without asking. Only Codewhale's own refusal text counts: an MCP server, a fetched page, or a program cannot make a call that ran read as blocked. A terminal session's receipt also lists the files a command changed in each turn, from the workspace snapshots taken before and after it (not ignored files or anything outside the workspace), with control characters in paths escaped so a file name cannot forge a receipt line. All three read the records Codewhale already keeps and say what those records do not hold (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">docs/RECEIPTS.md</a>). <code>audit.log</code> is not that record: it logs security events, and it logs an approval only when one is requested, which under Full Access is almost never.</li> <li>Approvals now record who decided: you, a session rule, or the posture. An automatic approval used to be saved exactly like one you gave, and an app approval that expired was saved as your denial. <code>GET /v1/approvals</code> now returns <code>decided_by</code>.</li> <li>Network audit lines now go to the same <code>audit.log</code> as every other audit event (<code>$CODEWHALE_HOME</code> included), and test runs no longer append to your real one.</li> <li>In the terminal UI, Auto-Review verdicts now reach <code>audit.log</code>, as <code>/permissions</code> said they did; before, they were written only when <code>CODEWHALE_TOOL_AUDIT_LOG</code> was set. Headless <code>exec</code> and Runtime API sessions do not write them yet.</li> <li>A turn that stops producing output now reports itself: the turn loop records its phase and last progress, and an overdue phase surfaces instead of hanging silently until the stream idle timeout. A delegated agent's final result is never dropped when the host is busy, so a finished child no longer leaves a ghost Running row behind (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6184</a>).</li> <li>Git commands run by tools never stop to ask for a password, passphrase or host-key confirmation inside the terminal, and <code>git_fetch</code> has a timeout (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6184</a>).</li> <li>A provider response that ends cleanly with no text and no tool call is retried before the turn fails, and the failure names how many retries ran (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6310</a>).</li> <li>The context meter, the point where Codewhale makes room, preflight, <code>/context</code> and turn receipts show one pressure number instead of disagreeing (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6407</a>).</li> <li>When Codewhale makes room, the note it leaves for the next turn is written in its own words, under fixed headings: the objective, the user's corrections, permissions and limits, changed files, what is still running and the checks left. A message that quotes the note's opening words now stays in the conversation instead of being dropped. If the summary request itself is too large, older history is dropped but the previous note is kept, and making room stops rather than write a new note without it.</li> <li>Continuing a conversation that is already open no longer adds a second thread, and a fork keeps its own session file, so autosave on one side no longer leaves the other unloadable (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6406</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@gaord</a>).</li> <li>Upgrading Codewhale no longer turns off the built-in Computer Use. Each build writes the built-in bundle to its own directory, so an upgrade used to present it as never reviewed and disabled. Now the review and enablement carry to the new build when its capabilities are unchanged. Changed capabilities show <code>capabilities-changed</code> and wait for review, and a revoked trust never carries (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6303</a>).</li> <li>"Allow for this conversation" records a grant for that tool and argument class instead of switching the whole thread to Full Access, so the call you just approved is no longer failed by a Permissions change. An approval also survives a Permissions change that only widens what is allowed, grants end when a thread is archived or deleted, and <code>web.run</code> open grants are scoped by host. Full Access covers MCP tools that declare themselves destructive in every host, including <code>codewhale exec</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#3866</a>).</li> <li><code>web.run</code> retries a refused page once with a browser user agent, and one site's failure no longer fails the whole call or drops its search results.</li> <li>Web search no longer stops when DuckDuckGo cannot be reached. After a connection error, timeout or non-2xx answer, the search tries Bing before giving up, and the result says it used Bing. A DuckDuckGo that hangs no longer uses up the whole time budget: when Bing may follow, DuckDuckGo gets 60% of it and Bing the rest. This also covers the DuckDuckGo step after a configured API provider. A custom <code>search_base_url</code> still has no public fallback and keeps the full budget. Bing sees the query only after DuckDuckGo has failed or returned nothing it could read (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6746</a>).</li> <li>Hooks treat <code>bash</code>, <code>Bash</code> and <code>exec_shell</code> as one tool in <code>tool_name</code> conditions, so the documented example fires.</li> <li>macOS no longer reports Codewhale's ordinary heap as GPU (IOAccelerator) memory.</li> <li>Code highlighting uses less memory, and long transcripts, the pager and the session picker do less work on the event loop; session previews load in the background (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6014</a>).</li> <li>The composer's send cue follows the draft, not a paste in progress (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6397</a>).</li> <li>Voice status is localized, ASCII-mode markers are distinct, and the cursor honours <code>NO_COLOR</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#5846</a>).</li> <li><code>/cache</code>, <code>/stash</code>, <code>/config</code>, session prune, <code>metrics --since</code> and the <code>lane start</code>/<code>lane stop --json</code> flags handle their edge cases.</li> <li>Plain <code>codewhale exec</code> (no <code>--auto</code>) runs one Engine turn with the same system prompt as every other run, so <code>--json</code> no longer changes the model's instructions. It offers no tools unless a flag grants them (<code>--auto</code>, <code>--yolo</code>, <code>--allowed-tools</code>, or resuming a session): <code>--max-turns</code>, <code>--disallowed-tools</code>, <code>--append-system-prompt</code>, <code>--sandbox</code> and <code>--output-format stream-json</code> no longer turn a chat call into a tool-using agent, and tool-only flags passed without a grant print a warning. A reply cut off at the provider's output limit is continued instead of failing the run, for at most 8 model steps unless <code>--max-turns</code> sets another limit. Breaking for scripts: the <code>--json</code> one-shot receipt no longer has <code>stop_reason</code>, adds the agent receipt's fields (<code>prompt</code>, <code>tools</code>, <code>outcomes</code>, <code>status</code>, <code>termination_reason</code>, <code>error_category</code>), and leaves out <code>usage</code> when the turn never settled (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6510</a>).</li> <li><code>codewhale review</code> of a plain diff uses the same review prompt as <code>review --pr</code> and prints the structured review as Markdown, or the model's prose when it ignores the JSON format (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6510</a>).</li> <li>A recursive <code>rlm_query</code> that runs out of rounds returns its last answer marked <code>[rlm_query incomplete: …]</code> instead of an empty string, its model calls appear in the parent turn's record, and its history is no longer trimmed (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6511</a>).</li> <li>Starting without a network connection no longer drops images you attach to a model that accepts them. The offline model list lagged behind providers and listed Claude and others as text-only; it can now only say a model takes images, never that it refuses them, and a provider that does refuse gets one resend without the image and a message saying so (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6396</a>).</li> <li>Model prices that a flat rate would get wrong now show as unknown after the model list refreshes online, as they already did offline: DeepSeek (priced by time of day, or from Codewhale's reviewed table on hosted providers), Grok and MiniMax M3 (rates rise on long prompts), Xiaomi MiMo (pay-as-you-go and Token Plan keys look the same), GLM-5.3 and the Alibaba Model Studio plans (quota or credits, not per-token) and StepFun. DeepSeek's output limit stays at its published 384K instead of the refreshed 393,216, and the reasoning controls Codewhale records for Grok, MiniMax, Qwen 3.8 Max, Muse Spark and Step 3.5 (defaults, always-on thinking, extra effort tiers) survive the refresh. Committed corrections now fail at load if their provider or model is missing from the bundled seed; partial live refreshes may still omit those rows (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6396</a>).</li> <li>The offline model list is now generated from Models.dev instead of edited by hand, so a fresh install without network sees the same limits, image support and reasoning controls as an online one. Claude, GPT-5.5, Kimi and several OpenRouter models now show image input offline, and a model whose catalog row offers an on/off switch next to its effort tiers keeps Off in <code>/effort</code> and Ctrl+T instead of rounding it up (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6396</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6612</a>).</li> <li>Cost estimates for GPT-5.6 and GPT-5.6 Sol use OpenAI's current rates of $4 input, $0.40 cached input and $20 output per million tokens. They were still at the older $5, $0.50 and $30 (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6396</a>).</li> <li><code>codewhale integrations dsh</code> now reads current DeepSeek Harness prerelease versions such as <code>0.1.7-alpha.2</code> as semver. They were reported as <code>offline</code> and refused; they now show as <code>stale-version</code> (launchable once connected, clearly unverified). Only <code>0.1.0-rc.6</code> is still the verified version, and text that is not a version is still <code>offline</code>.</li> <li>Rule and chain-segment source labels in the project instructions the model receives (<code><project_rule source=...></code> and the scoped-instructions comments) are repo-relative instead of absolute. Moving or recasing a checkout no longer changes the pinned system prompt prefix or adds a spurious context update (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6739</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@asto18089</a>).</li> </ul> <h3>Security</h3> <ul> <li>On Windows, a broad Node kill (<code>Stop-Process -Name node</code>, <code>Get-Process node | Stop-Process</code>, <code>taskkill /IM node.exe</code>, and wrapped, aliased or nested-shell forms) is held by a built-in safety floor: it is refused in Full Access, Auto-Review and Never, and asks in other modes. With the npm launcher such a command ended this and every other npm-launched Codewhale session without cleanup. Stopping a server by PID or port still works, and the Windows installer and archives have no Node launcher (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6827</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@jayanthvee</a>).</li> <li><code>code_execution</code> and <code>js_execution</code> now start their Python and Node interpreters through the same permission-aware launcher as other commands, so the session's execution policy applies to them. Before, an approved call ran the interpreter directly, and its working directory was the only boundary (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6820</a>, thanks <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Guan0923</a>).</li> <li>A saved task without an <code>auto_approve</code> field is no longer treated as auto-approved. Updates accept HTTPS URLs only from the release-host allow-list, and the npm release-asset check bounds every request.</li> <li>Workspace profile and skill discovery, pasted-image and screenshot writes, configuration redaction receipts and legacy configuration migration reject linked paths where they could redirect access outside their intended roots. Additional <code>.codewhale</code> writers use the existing confined filesystem helpers. The VS Code file opener checks the file's real path, and PowerShell temporary scripts receive unpredictable names and owner-only permissions.</li> <li>Update development tooling to Undici 7.29.1 or newer for <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">GHSA-w293-vg96-wgc3</a>, brace-expansion 1.1.21/5.0.12 for <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">GHSA-q2hr-2g5m-vwhr</a>, and the VS Code extension's markdown-it to 14.3.2 for <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">GHSA-253c-mchw-3w2r</a>.</li> <li>Harden local runtime browser sessions, fleet SSH trust, agent continuation ownership, task gate approval, plugin tool registration, bridge action tokens, and release metadata credential forwarding. Browser sessions recover across reloads and new tabs, and stream tickets retry after transient failures. Fleet SSH known-host checks support OpenSSH 7.x and later. SSH host configs using <code>host_key_fingerprint</code> must migrate to <code>known_hosts</code> with verified host keys; the unsupported fingerprint field is now refused when an SSH worker starts, before any connection is made, instead of being silently ignored.</li> <li>Harden workspace instruction, note, and anchor file access with shared no-follow reads and writes. Compaction loads pinned anchors only from trusted workspaces. Validate registry skill names before selecting cache paths.</li> <li>Tighten approval, execution and endpoint boundaries. Computer control consent and script calls need an exact decision a person gave on that call's own approval card. Automatic Git status and review reads go through the sanitized review command and stay pinned to the checked Git executable. Config backups, config dumps, MCP listings and notification payloads share one sensitive-key vocabulary; structured exports now also redact keys ending in <code>key</code>. Python a child model writes during a recursive <code>rlm</code> call is admitted round by round like an inline <code>repl</code> block, and Python kernels are discarded when permissions narrow. Gate commands and the cargo test runner start inside the session's shell sandbox. Mutable session artifacts are written and read through pinned session-relative paths. The stdio bridge's Runtime child chooses and reports its own loopback port.</li> <li>Chat bridges (Feishu, Telegram, WeCom, Weixin) accept an approval decision only from the person who started that turn, for the Runtime's current pending approval. After upgrading, approvals for turns that were already running are decided from the TUI, and WeCom <code>/allow</code> no longer takes <code>remember</code>.</li> <li>More file and network paths are confined. A task or automation created by a session without full shell access no longer inherits the host's shell default. The commit planner, oversized-paste backup and project harness notes do not read or write through links that leave the workspace. On Unix, audit and approval logs are created owner-only and are not opened through a link; Windows is unchanged. Lane ids must be plain names. A session file is refused when it records a different session id than its name. The updater does not follow a redirect from HTTPS to plain HTTP and stops reading a response larger than 512 MB.</li> <li>Nothing is written through a <code>.codewhale</code> that is a link. The workflow run journal no longer creates <code>.codewhale/</code> or its ledger when it is opened, only when the first record is written, and reads and appends through the same confined helpers as other state. The sub-agent coordination lock refuses a linked <code>.codewhale</code> or <code>state</code> directory before it creates anything.</li> <li>On Unix, the runtime log is created owner-only and is not opened through a link; an existing log from an earlier version is tightened. The <code>.reconcile.lock</code> and <code>current.json.lock</code> lock files are created owner-only too.</li> <li>Inline <code>```repl</code> blocks in a reply now follow the same rules as the <code>code_execution</code> tool. They never run in Plan mode or when <code>code_execution</code> is not on the turn's tool surface, and they are admitted like a <code>code_execution</code> call with the same code: before-tool hooks, disallowed-tool rules, Auto-Review (including its reviewer) and repository law all apply, then the same approval under the session's permission posture (a blocked, denied or unanswerable call skips them with a visible note). Only a fence that opens its own line counts, here and in the <code>rlm</code> tool's child rounds, so a reply that mentions a fence in prose runs nothing. An <code>rlm(...)</code> call from a fence gets a one-shot child answer rather than a child that runs its own code. The docs no longer describe the REPL kernel as sandboxed.</li> <li><code>codewhale serve --mcp</code> now exposes only read-only tools by default (<code>file_read</code>, <code>search</code>). Tools that write files or run commands are neither listed nor run unless the operator sets <code>require_approval = false</code> in the MCP server config; a client's own <code>approved</code> flag no longer counts as approval. At startup the server names on stderr each configured tool it withholds and the setting that allows it.</li> <li>A <code>Bash</code> entry in the disallowed tools now also blocks <code>start_mcp_server</code> and <code>start_registry_mcp_server</code>, which launch local processes.</li> <li>An MCP tool call whose connection closes before it answers is no longer sent again on a new connection, since the server may already have run it. The same holds for a server error reply that mentions an expired or invalid session. The call reports an unknown outcome and the next call reconnects. Only a call the HTTP transport turned away for a stale session, before the server handled it, is still retried once.</li> <li>Durable tasks and scheduled automations created by the agent no longer carry more authority than the session that created them: requested <code>auto_approve</code>, <code>trust_mode</code> and <code>allow_shell</code> are capped at what that session holds, a task's workspace and an automation's directories must be reachable from the session, and a task's turn runs under the posture pinned when it was created instead of re-deriving one from the legacy bit or a legacy mode alias.</li> <li>The approval card for creating a task or creating/updating an automation now lists the requested trust mode, shell, auto-approve, mode and workspace as labeled lines.</li> <li>"Approve for session" on a shell command now covers only a simple, known command family (<code>git status</code> still covers <code>git status -s</code>). Compound, wrapper, interpreter, unrecognised and option-configured commands are granted as the exact command, and interact/wait calls on a running shell as the exact call.</li> <li>Workflow plan approval flags shell, network and file-write capability for the <code>Bash</code>, <code>Web</code> and <code>File</code> tool families regardless of letter case.</li> <li>An agent session can no longer update, resume or run an automation whose stored <code>auto_approve</code>, <code>trust_mode</code> or <code>allow_shell</code> is more than the session holds, unless the same update lowers those fields.</li> <li>The approval summary every Runtime client receives for task and automation create/update now names the requested trust mode, shell, auto-approve, mode and workspace, from the same fields the TUI card shows.</li> <li>A shell session grant keeps its command family only when every option is a known value-free option such as <code>--release</code> or <code>--porcelain</code>; other options, in any spelling, grant the exact command. Families whose arguments are what runs or is installed (<code>go run</code>, <code>deno run</code>, <code>cargo run</code>, <code>make</code>, <code>git bisect</code>, <code>git submodule</code>, package installs) grant the exact command.</li> <li>Workflow plan approval recognises tool names in any quote style and with a pattern suffix (<code>'Web'</code>, <code>`File`</code>, <code>Web(*)</code>), and flags <code>rlm</code>, Git and GitHub, computer and browser control, and task/automation tools with the capabilities they carry.</li> <li>Model-run code no longer inherits provider credentials or other secrets from Codewhale's environment. Python <code>code_execution</code> (and every other Python runner), <code>gate_run</code> task gates, custom and completion verifier gates, persistent <code>terminal</code> sessions, and <code>run_tests</code> now start from the same scrubbed child environment as <code>exec_shell</code>; variables a gate declares are still passed through. <code>gate_run</code> also runs <code>/bin/sh -c</code> instead of a login shell, so profile files cannot re-export what was removed.</li> <li>A <code>workflow</code> start with <code>verify: true</code> now needs approval even for a read-only plan, because the completion gates run workspace build and test scripts.</li> <li>Git commands no longer hand provider credentials to programs that a workspace's git config can start (<code>core.fsmonitor</code>, hooks, filters) when they run through Codewhale's shared git helper: those start from the scrubbed environment plus the ssh agent, global config location and author identity. Sub-agent worktree provisioning and delivery do not use it yet. The read-only <code>git_status</code>, <code>git_diff</code>, history and <code>verify</code> tools also disable the workspace's fsmonitor, hooks and clean/process filters.</li> <li>Language servers started for post-edit diagnostics, and every Python and Node command constructor, start from the scrubbed child environment.</li> <li>Proxy URLs passed to model-run children (<code>HTTP_PROXY</code>, <code>HTTPS_PROXY</code>, <code>ALL_PROXY</code>, <code>FTP_PROXY</code>, <code>CARGO_HTTP_PROXY</code>) keep their host and port but lose any <code>user:password@</code> part.</li> <li>Behaviour change: the scrubbed child environment now keeps non-secret build configuration — <code>CARGO_*</code> (except registry and token-like keys), <code>RUSTFLAGS</code>, <code>RUST_LOG</code>, <code>RUST_BACKTRACE</code>, <code>VIRTUAL_ENV</code>, <code>JAVA_HOME</code>, Go paths, <code>NVM_*</code>/<code>NODE_OPTIONS</code> and CA-bundle variables — so <code>run_tests</code> and gates keep the user's target dir, job limit and toolchain. Connection strings such as <code>DATABASE_URL</code> are still dropped; set them in the project's own config, or wrap the command in a script that sets them, when a build needs them.</li> <li>Deny rules in the permission settings now hold for these ways of hiding a command word until the shell runs it: a variable (<code>$v</code>), a substitution, a glob or brace list, escaped ANSI-C quoting, or a shell reading its script from a pipe, here-string or process substitution. Rules in a separate <code>execpolicy.toml</code> file are applied when the command runs, so there such a command is refused at run time rather than before an approval prompt. While any deny rule is configured in the permission settings, such a command is refused instead of being checked against text the shell will rewrite (an approval-always policy asks instead). This also applies to common forms such as <code>source "$HOME/.cargo/env"</code>, <code>eval "$(pyenv init -)"</code> and <code>$PYTHON -m pytest</code>; name the command directly to run it. The same holds when the text does not parse cleanly (an unterminated quote, substitution or heredoc, a <code>case</code> inside <code>$( … )</code>) or when a parse budget runs out. Commands after <code>if</code>, <code>then</code>, <code>while</code>, <code>do</code>, <code>!</code> and similar words, <code>function f { … }</code> bodies, and <code>find -exec</code> payloads are now checked like any other command.</li> <li>Wrapper commands are unwrapped by their real option grammar, so <code>chroot DIR cmd</code>, <code>sudo --user NAME cmd</code> and <code>timeout -s SIG N cmd</code> expose <code>cmd</code> (and any <code>-c</code> payload) to deny rules. Options missing from a wrapper's table are read both with and without a value, BSD and macOS options are covered (<code>env -P</code>, <code>xargs -J</code>, <code>chroot -u</code>), and more wrappers are recognized (<code>caffeinate</code>, <code>arch</code>, <code>sandbox-exec</code>, <code>nsenter</code>, <code>unshare</code>, <code>runuser</code>, <code>flock</code>, <code>watch</code>, <code>wsl</code>, <code>noglob</code>, <code>nocorrect</code>), including <code>.exe</code> spellings. Code passed as a string to <code>trap</code>, <code>su -c</code>, <code>flock -c</code>, <code>script -c</code>, <code>watch</code>, <code>cmd /c</code> and PowerShell <code>-Command</code> is checked as a command line.</li> <li><code>(( … ))</code> arithmetic no longer reads <code><<</code> as a heredoc that hides the lines after it, and an <code>xargs</code> or <code>find -exec</code> replacement string used as the command or as shell code (<code>xargs -I{} sh -c {}</code>) counts as known only at run time.</li> <li><code>task_shell_start</code> and task gate commands are now checked against shell deny and ask rules, like any other shell command.</li> <li>An "approve for session" grant for a shell command covers only flag variants of that command as written; a command with options before the subcommand, a chain, or nested code matches only an identical repeat.</li> <li>The read-only shell surface for sub-agents rejects a word that starts with an unquoted <code>*</code>, whose matches could be read as options; quote the pattern or give it a path prefix (<code>src/*.rs</code>).</li> <li>A trusted or allow prefix such as <code>git status</code> no longer covers options placed before the subcommand (<code>git -c key=value status</code>, <code>git --exec-path=… status</code>), nor a command that runs nested code or whose command word is resolved at run time. Such commands ask instead. Typed deny rules also match a path-qualified command word (<code>/bin/rm</code>).</li> <li>Commands containing parentheses are no longer auto-approved as parallel read-only commands, since some shells treat them as glob qualifiers or command substitution.</li> <li>Sub-agent worktrees stay under the per-repo <code>.codewhale-worktrees/<repo>/</code> root: an absolute <code>worktree_path</code> is now held to the same containment as a relative one, with symlinks resolved before the check. Any start that asks for a worktree keeps the approval card, even for a read-only role. A <code>worktree_base</code> starting with <code>-</code> is refused, and <code>git worktree add</code> now receives its path and base after <code>--</code>.</li> <li>Fleet and reasoning-router names must be plain file names (optionally <code>origin/name</code>); a name with path separators or <code>..</code> is refused before any file is looked up, through one shared check in the workflow crate.</li> <li><code>pandoc_convert</code> and <code>image_ocr</code> apply the same read deny-list and credential-store checks as <code>read</code>, through one shared helper, and pandoc always runs with <code>--sandbox</code>. This needs pandoc 2.15 or newer; an older pandoc gets an upgrade message instead of a conversion.</li> <li>Computer Use: screenshot and zoom output paths must be <code>.png</code>/<code>.jpg</code>/<code>.jpeg</code> files inside the recordings directory, and zoom always crops the last captured raster instead of a caller-named source file.</li> <li>Skill registry sync refuses an index key that is not a single path-safe name before it is used as a cache directory, the same check an installed skill name already gets.</li> <li>A project's <code>.codewhale/config.toml</code> can no longer set <code>notes_path</code>; it is ignored with the other user-only keys. The <code>note</code> tool and <code>/note</code> refuse a notes file that is a symlink or whose directory resolves outside the workspace, and a note is flushed to disk before the tool reports success.</li> <li>Diffs and shows that read repository content (<code>codewhale review</code>, the <code>git_diff</code>/<code>git_show</code> tools, verification, delivery, task attempt records, <code>@diff</code> and the runtime API diff routes) share one flag set: no external diff, no textconv, and submodules compared by commit only, so a submodule's configured filters and diff drivers never run. Reads of the working tree (<code>git_diff</code>, <code>git_show</code>, <code>git_blame</code>, commit planning, verification, task attempt records, <code>@diff</code>/<code>@git</code>) also run through the hardened review command, so the repository's clean filters do not run either. <code>git_blame</code> and read-only shell <code>git blame</code> skip textconv, and read-only shell <code>git</code> reads neutralize the repository's clean filters.</li> <li><code>git_fetch</code> refuses refspecs that would write a local branch or tag: a <code>src:dst</code> destination must be under <code>refs/remotes/</code>, and the two-word <code>tag <name></code> form is rejected.</li> <li>Opening a URL on Windows goes through the URL protocol handler instead of <code>cmd /C start</code>, so characters in the URL are not interpreted by the shell.</li> <li>Skill downloads and the skills registry index are read through a streaming size cap shared with the MCP HTTP transport, instead of buffering the whole body before checking its size.</li> <li>Durable runtime thread, turn and item ids carry a full UUID instead of 32 random bits, so two records can no longer collide and overwrite each other.</li> </ul> <h3>Removed</h3> <ul> <li>Flags, settings and tool parameters that did nothing are gone (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6516</a>). <code>--output-mode</code> is hidden. It is still accepted, prints a warning, and is ignored.</li> <li>The dispatcher no longer exports <code>DEEPSEEK_*</code> copies of its <code>CODEWHALE_*</code> variables. A <code>DEEPSEEK_*</code> variable you set yourself is still read.</li> <li><code>lane start</code> and <code>workflow run --runtime vm|ci</code> are rejected before a lane is created. Older lane records for those runtimes still load.</li> <li>The control socket's <code>relaunch</code> verb is removed; it always returned an error.</li> <li>The <code>speech</code> tool drops <code>stream</code>. <code>stream=true</code> used to fail; it is now ignored, a complete audio file is written, and the result no longer carries <code>"stream": false</code>. The <code>finance</code> tool drops <code>market</code>, and a call that still passes it has it ignored.</li> <li><code>[context].enabled</code>, the seam-manager keys and <code>tui.terminal_probe_timeout_ms</code> no longer load; old configs that carry them still start. The <code>[workshop]</code> docs now describe bounded spillover instead of a synthesis sub-agent.</li> <li>About 2,650 lines of workflow code that nothing ran are deleted: the replay executor, the review-repair loop and experimental search. The <code>replay_diverged</code> status they produced goes with them. The isolated Runtime Chat prompt and the legacy YOLO alias list each have one owner now (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6517</a>).</li> </ul> <h3>Experience</h3> <ul> <li>Typing a first message with no model connected leaves a line in the transcript that says the message was not sent and opens the provider picker.</li> <li>First run picks a chat-capable Ollama model instead of the alphabetically first tag, and says plainly when no model is available yet.</li> <li><code>codewhale doctor</code> leads and ends with one verdict and the next step, and gives the update command for how you actually installed Codewhale. Command-line usage and errors say <code>codewhale</code>.</li> <li>The approval card leads with a plain summary of the action, such as "Run <code>cargo test</code>", and shows workspace-relative paths. The footer labels its values.</li> <li><code>/status</code> warns when the session's pinned model is no longer in its provider's live model list (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6035</a>).</li> <li>Error messages give one true sentence and one next step. The TUI's English copy says agent, Fleet, Permissions and Work consistently, help lists one summary per row, provider rows without a key say "needs key", <code>/setup</code> says what it sets up, and the pet tank rests when it is offline.</li> <li>ACP clients can see the Permissions setting the server started with, including Full Access and how to turn it on, but cannot select it (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6310</a>).</li> <li><code>GET /v1/commands</code> tells clients each command's argument shape, so they do not re-derive composer behaviour from the usage string (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6230</a>).</li> </ul> <h3>Fleet and agents</h3> <ul> <li><code>codewhale fleet run <spec> --check</code> runs every validation a real run would and stops there: nothing is created, launched or spent.</li> <li>A queued agent says why it is waiting, for example when launches are throttled after provider rate limits, and when it stops waiting (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6277</a>).</li> <li>Read-only agents can run chained inspection commands (a leading <code>cd</code>, <code>&&</code>, <code>;</code>, <code>echo</code> separators, <code>2>/dev/null</code>), and a refused command now names the rule it broke and what to do instead. Durable Fleet workers accept the same read-only commands as in-session agents. An agent's time budget starts when it launches, and a queued agent that never gets a slot says it never started (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6015</a>).</li> <li>Stopping an agent that writes files keeps and names the work it had changed, as a budget stop already did (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#5529</a>).</li> <li><code>workflow(fleet:)</code> runs Fleets saved from the Fleet UI, and finds workspace Fleets under <code>.codewhale/fleets</code>.</li> <li>The runtime API can stop a delegated agent run from the desktop.</li> <li>A finished agent's answer is no longer cut off. Its row and its completion notification show the first sentence of its result instead of a <code>## Summary</code> heading or its last tool, and opening the agent shows the whole result, or the full reason it stopped, even when no transcript was captured. Each agent also has one name: a workflow task's label or its dispatch name appears on the rows, the notification and the runtime API alike, never its internal id (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6565</a>).</li> <li>The mobile page shows the thread's agents: a strip naming each one, its state, and what it is doing or what it found, rebuilt when the page reconnects. Sub-agent prompt caching now counts toward the session, including cache-write-only reports. PRICE and <code>/cache</code> show the parent, agents and combined hit rates, each labelled and weighted by all input tokens, including cache writes, and the footer <code>cache N%</code> still means this conversation's own requests (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6565</a>).</li> <li>The dock's GIT, FILES and NOTES views are real. GIT shows the branch and where it stands against its upstream, the changes (with their paths one Enter away), linked worktrees and the last five commits, and it keeps updating during a turn while it is open. It says "not a git repository" only when that is true, reports failed status probes in the view and composer instead of claiming a clean tree, counts every unmerged path as a conflict, and only says there are more changed paths when the list is capped. FILES lists the files this session edited, including writes without diff receipts, and the files it read, with every unique path retained beyond the activity summary's twelve-path preview. FILES and its badge refresh from the current session even before TASKS opens. Edits with receipts show their size and open their diff. NOTES lists your <code>/note</code> notes. The git badge, the Git view and the model's git line now share one <code>git status --porcelain=v2</code> call, so there are fewer git processes than before (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6565</a>).</li> <li>Background work tells you when it ends, even between refreshes. Batched shell notices cover explicitly backgrounded or detached commands; foreground results and old completions from before this TUI session stay quiet. Switching sessions does not repeat a completion notice. Batched notices count completed, failed and stopped work separately; shell commands, task prompts and errors stay in the app, away from lock-screen notifications. A running dev server no longer holds the notice back. Failed, killed and timed-out shells retain their outcomes, and the last eight finished shells stay listed per session. Finished tasks no longer look live or reopen the dock. Background labels follow the UI language, long agent previews keep their full-result pointer, and the quiet indicator uses the engine's clock and limit without marking an active tool as quiet (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6565</a>).</li> </ul> <h3>Plugins</h3> <ul> <li>Codewhale no longer appends plugin recommendations to your messages to the model. Suggestions appear in one place, follow one switch and one budget, and never advertise built-in plugins, generic words or plugins for another operating system.</li> <li><code>/plugin dismissals</code> lists the plugins suggestions skip, and <code>/plugin dismissals reset [<name>]</code> brings them back.</li> <li>Tools from reviewed plugins that declare themselves read-only no longer ask for approval on every call.</li> <li>The bundled Computer Use plugin is 0.12.0, the published upstream release <code>8435692</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6303</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#5856</a>). On macOS the agent uses its own pointer and never drives your cursor. <code>app_script</code> refuses shell escapes. Clicks on irreversible actions such as pay, send or delete need confirmation. Consent decisions cannot ride inside <code>run_actions</code> or trajectory replay, and trajectories redact secure fields. Also new: a shared-computer control lease that pauses agent input while a person drives, and a browser attach mode for a shared Chromium. The vendored README no longer claims delegated agents share the Computer Use session; they never receive its tools.</li> <li>The bundled first-party catalog pins marketplace revision <code>ae3dd2255a9a266365c6125a084f511eb26bc04d</code>. It lists Computer Use 0.12.0 and adds Codewhale for Chrome (Chromewhale) 0.3.0 as a developer preview: you load its Chrome extension unpacked, and like every catalog plugin it installs disabled and untrusted until you review it.</li> </ul> <h3>Release reliability</h3> <ul> <li>Upload the complete release into a private draft, verify every asset's size and SHA-256 digest, then publish. An interrupted retry cannot reuse stale same-size bytes. CNB and GHCR version tags follow canonical publication.</li> <li>Ubuntu Lighthouse bootstrap requires trusted SSH source CIDRs or an explicit public-SSH opt-in before changing the host; malformed IPv6 and broad default networks are refused.</li> </ul> <h3>CI</h3> <ul> <li>State-touching command and session tests seal <code>HOME</code>, <code>USERPROFILE</code> and <code>CODEWHALE_HOME</code> onto temporary directories. Unsealed session, snapshot, artifact, composer-history, audit and built-in-plugin storage resolves into an isolated test root; unrelated worker threads cannot borrow another test's home seal. A child-process sentinel checks that known command-dispatch and session cases leave their ambient home unchanged.</li> <li>Fork pull requests stay under the macOS runner limit and the Actions cache stays under its cap.</li> <li>Release candidates and releases share one parity gate, and a release tag without a release-candidate receipt is refused.</li> <li>Budget ratchets block same-repository pull requests unless the pull request updates the budget with a receipt.</li> <li>A CodeQL advanced-setup workflow is ready for when the repository switches from default setup.</li> </ul> <h2>Contributors</h2> <ul> <li> <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@AdityaVG13</a> — supplied the discovery-cache priority correction adapted from <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6393</a>, keeping highest-ranked tools through cache overflow. Its broader echo and fork-inheritance draft remains open. </li> <li> <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@7jrxt42BxFZo4iAnN4CX</a> — reported indefinite questions cancelled by the TUI watchdog and supplied the timer evidence (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6872</a>). </li> <li> <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@hodeswildsmith455-boop</a> — added OrcaRouter account sign-in with PKCE and its live chat catalog (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6867</a>). </li> <li> <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@LIghtJUNction</a> — added reviewed plugin-provided AI routes with host-owned OAuth PKCE credentials and request-time authority checks (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6805</a>). </li> </ul> Contributors and issue reporters are credited below, including <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@cenab</a>'s provider report. <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Guan0923</a> — accepted case-insensitive HTTP(S) schemes in <code>config doctor</code> without rewriting the configured URL (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6819</a>), and routed the Python and JavaScript execution tools through the session's execution policy (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6820</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@harryvgiunta</a> — added Yolo-Auto as a bundled OpenAI-compatible host, starting on the vendor's recommended <code>qwen3.8-flash</code> model (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6408</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@asto18089</a> — contributed the integrated runtime liveness, context, search, JavaScript execution, stopship scout and pet repairs, preserving their original contributor commits (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6799</a>); made context rule and chain-segment source labels repository-relative (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6739</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@qiuYliangM</a> — made provider-bound project instruction and constitution labels stable across directory moves and kept their absolute paths in operator reports (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6799</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@zhuowp</a> — supplied the process-scoped PowerShell execution-policy repair adapted for Codewhale, preserving machine and user Group Policy precedence (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6745</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Andrea-Bruno</a> — designed the Superfast Decision Gate and contributed its off-by-default shadow classifier (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6604</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6603</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@aiapienthusiast</a> — added Cheaper Inference to the bundled provider catalog (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6761</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@gaord</a> — let a client fork a thread at a named turn (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6580</a>), let undo roll back files for the turn it is undoing (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6483</a>), stopped resume and fork from duplicating threads and sessions (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6406</a>), exposed user-defined provider routes to native clients (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6404</a>), and kept a fork going when a turn lost its tool call (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6664</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a> — moved the docs/work, legal, digest and FAQ pages onto the dictionary spine (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6405</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6417</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6499</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6574</a>), tightened the Chinese-branching ceiling to 18 (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6403</a>), and made Fleet publish without a two-link window (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6431</a>). Also moved the constitution page onto the dictionary spine and kept its install link in the selected locale (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6733</a>), wrapped diff and tool output at grapheme boundaries (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6829</a>), and translated the context inspector rows twelve packs still shipped in English (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6831</a>). Translated the session-only note after model switches across the complete TUI locale packs (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6875</a>). Translated the route-save receipts (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6884</a>) and <code>/workspace</code> replies (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6885</a>), brought the Operate descriptions in fourteen packs up to date (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6886</a>), restored lost accents in pt-BR, es-419 and ca (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6888</a>), let <code>semantic_truncate</code> cut between Han and kana (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6887</a>), and removed the unused session-only route-save choice (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6882</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@aboimpinto</a> — restored a green Linux full-workspace test gate without loosening any test, twice (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6581</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6666</a>). Completed the seventeen-command portable session group, including <code>/structcopy</code> (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6793</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@dajiaohuang</a> — <code>codewhale config set</code> checks a known setting's value against its schema type before saving it (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6568</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@jayanthvee</a> — reported and diagnosed that killing the npm launcher's <code>node.exe</code> ends Windows sessions without cleanup, with reproductions and fix directions (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6827</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@cenab</a> — requested the Tsubasa provider row and supplied its endpoint, key and model values (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6695</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@BX166</a> — reported the AICraft provider row missing its key console, docs link and guidance, and supplied the values (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6616</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@Water-Run</a> — ingested namespaced model-only catalog entries so models present only in the canonical <code>models</code> map reach the offering list (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6400</a>), and retired the blanket dead-code allowance with its unused feature stages, tightening the budget to match (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6402</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a> — designed the <code>tool_call_after</code> execution-receipt contract and its tests on a reference branch, which landed re-implemented on the current hook seam (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6689</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6713</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a> — let making room survive a provider request-body limit (HTTP 413) by shrinking, then replacing, inline images for that one summary pass (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6642</a>). Translated seventeen Tier-2 guides and thirteen developer and internal docs into Simplified Chinese, and connected the localized documentation (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6662</a>, <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6663</a>); added regression coverage for rejecting unknown website locales before dictionary lookup (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6786</a>); made the pinned prompt header follow the viewport's turn and jump on click (<a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">#6830</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/1000044340/4267077/github-release-codewhale-hqcodewhale-v0101-08102026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: openai/codex vrust-v0.162.0 (08.10.2026)</h1> Mon, 12 Oct 2026 20:38:17 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">openai/codex</a>vrust-v0.162.008.10.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>New Features</h2> <ul> <li>Add tools for creating and listing managed Git worktrees from trusted local projects when the worktrees feature is enabled. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50148</a>)</li> <li>Pin tasks in the agent Command Center with <code>p</code> and keep them in a shared Pinned group when supported by the server. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51500</a>)</li> <li>Navigate and copy transcript blocks with <code>/copy</code>, use <code>Ctrl+Insert</code> to copy selections, and tune mouse-wheel scrolling with <code>tui.mouse_scroll_speed</code>. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50434</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50215</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50209</a>)</li> <li>Make URLs clickable in approval headers, questions, MCP prompts, warnings, banners, and verification prompts, including when links wrap across lines. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51439</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51449</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51450</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51451</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51452</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51458</a>)</li> <li>Configure live web access and remote compaction capabilities for custom Responses-compatible model providers. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50459</a>)</li> <li>Add JavaScript helpers for streaming promise results as they settle, plus opt-in ranked tool search in Code Mode. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51126</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51209</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Respect server model and reasoning-summary defaults for new TUI threads while retaining explicit launch overrides. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50013</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50811</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50913</a>)</li> <li>Preserve existing CRLF line endings in <code>apply_patch</code> updates without requiring an opt-in. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51203</a>)</li> <li>Fix Linux sandbox startup with multiple denied files, reject writable sandbox-construction executables, and keep ripgrep configuration from weakening deny-glob masks. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50059</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51211</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51407</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51527</a>)</li> <li>Restore ordinary drive-letter file access on Windows 10 and match Windows sandbox temp permissions to the child process environment. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51511</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51512</a>)</li> <li>Honor server <code>Retry-After</code> advice for retryable Responses and WebSocket failures. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50418</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51440</a>)</li> <li>Fix archive checksum verification when installing through Windows PowerShell with PowerShell 7 module paths present. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51257</a>)</li> </ul> <h2>Chores</h2> <ul> <li>Publish a signed PowerShell installer with Windows releases. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51158</a>)</li> <li>Keep older stable releases and prereleases from replacing newer stable download targets or installer aliases. (<a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51186</a>, <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51425</a>)</li> </ul> <h2>Changelog</h2> Full Changelog: <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">rust-v0.161.0...rust-v0.162.0</a> <ul> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50013</a> Honor server model defaults when starting fresh TUI threads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50018</a> Use descriptor-safe helpers for executable test fixtures <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50019</a> Protect the guardian decisions API key from environment forwarding <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50026</a> Preserve user restrictions in Guardian handoff context <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50035</a> Follow MCP tool pagination in legacy protocol mode <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50039</a> Keep transcript Find results readable after closing the query <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50045</a> Keep transcript Find expansion scoped to the current match <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50046</a> Stabilize Windows voice build cache keys across tool reinstalls <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50050</a> Keep plugin and skill snapshots scoped to each step <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@sayan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50052</a> Preserve question context in recovered TUI answer drafts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50054</a> Check token estimate filtering directly on the tracing subscriber <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@tamird</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50058</a> Upgrade Windows bindings to <code>windows-sys</code> 0.61.2 <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@tamird</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50059</a> Fix Linux sandbox startup with multiple denied files <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@yuzhu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50066</a> Add a bounded Decisions transport for Guardian comparison classification <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50082</a> Enable dynamic tool inheritance for fresh V2 subagents <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@ke-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50083</a> Add paginated reverse lookup for thread attachments <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@joeytrasatti-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50087</a> Preserve queued agent mail across session eviction <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50093</a> Prevent shared instruction providers from delegating to themselves <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bryanashley</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50094</a> Add attachment owner lookup to the app-server <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@joeytrasatti-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50099</a> Add opt-in Decisions comparison for Guardian V2 <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50105</a> Consolidate chat composer footer logic in <code>footer_state</code> <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50109</a> Keep fullscreen prompts bounded and scrollable <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50112</a> Centralize TUI loading glyphs and frame scheduling <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50113</a> Add a native gRPC client for cloud thread resume and attach <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50128</a> Expose the model selected for a running turn's next step <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@sayan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50129</a> Preserve Windows environment variables for remote MCP servers <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aidanv-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50131</a> Add opt-in JSON diagnostics for TCP tunnels <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@richardopenai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50140</a> Use the server permission catalog for TUI permission shortcuts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50148</a> Add managed worktree tools to the TUI <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50162</a> Bound in-flight file opens in exec-server <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50166</a> Upgrade <code>age</code> to 0.12.1 and remove the obsolete advisory exception <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@michaelm-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50177</a> Enable writable file streaming in exec-server <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50183</a> Add <code>dots</code> to issue labeler guidance <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50189</a> Replace the Figma OAuth exception with Mercado Pago <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@mzeng-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50199</a> Restore the account email in <code>/status</code> after account updates <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50200</a> Report the configured TUI mode in <code>codex doctor</code> <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50207</a> Release stable Markdown tables into scrollback during streaming <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50209</a> Make transcript mouse scroll speed configurable <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50215</a> Support Ctrl+Insert for copying TUI selections <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50216</a> Use the shared text editor for command-center task renaming <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50219</a> Bound tmux option probes to one second <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50273</a> Record Guardian V2 Decisions agreement and latency metrics <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50339</a> Add end-to-end coverage for MCP sandbox state enforcement <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bolinfest</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50345</a> Keep the subagent picker consistent with thread archive state <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50348</a> Back off automatic remote control reconnects with jitter <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@cooper-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50354</a> Skip unrelated subtrees during config alias normalization <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@btraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50359</a> Render ANSI styles in TUI hook system messages <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50360</a> Remove initial messages from session configuration events <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50375</a> Use printable ASCII terminal titles under GNU Screen <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50380</a> Fix thread unloading after disconnect during MCP startup <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@yuzhu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50384</a> Allow opting into 16 KiB ARM64 code pages for macOS signing <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@chess-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50389</a> Honor configured keybindings before transcript navigation <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50396</a> Honor pager bindings for transcript page keys <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50402</a> Consolidate command execution output into <code>aggregated_output</code> <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50416</a> Clarify Git worktree choices for new and forked conversations <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50418</a> Honor Retry-After headers in failed Responses events <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50427</a> Cap persisted command output in paginated history at 64 KiB <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50431</a> Preserve terminal hyperlinks in agents overview previews <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50433</a> Allow API-key accounts to use Daybreak in the TUI <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50434</a> Add keyboard copy selection to the owned transcript <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50435</a> Persist additional tool definitions in rollout history <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50437</a> Add a CLI command to uninstall the legacy Windows sandbox <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@chess-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50441</a> Support ordered response items in world-state context updates <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50442</a> Preserve native USD amounts in thread usage responses <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@asohrabi-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50443</a> Stabilize paused-time code-mode service tests <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50445</a> Assert that only direct tool calls emit timing events <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50446</a> Bundle rollout attachments into a gzip tar archive <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@dkovalenko-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50447</a> Remove the provider capability gate for tool namespaces <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50454</a> Measure rollout persistence size reductions <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50458</a> Truncate oversized MCP results in paginated thread history <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50459</a> Add capability overrides for custom model providers <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50462</a> Populate thread previews from delegated task inputs <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50464</a> Add the <code>incremental_tools</code> feature flag <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50465</a> Retry registry authentication outages and jitter executor reconnects <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@apanasenko-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50467</a> Copy transcript selections as literal text while preserving rich HTML <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50470</a> Account for JSON overhead when truncating MCP tool results <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50472</a> Enable Ultrafast service tiers for Amazon Bedrock Astra models <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50477</a> Use the app-server default output cap for TUI workspace commands <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50480</a> Skip managed config loading for registered Windows sandbox refreshes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50499</a> Include installer stderr in daemon update failures <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50503</a> Use Enter to accept transcript Find results and Escape to cancel <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50504</a> Center TUI confirmations over their retained backdrop <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50505</a> Keep Command Center selection adjacent after task removal <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50507</a> Record Windows sandbox service stop diagnostics <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50510</a> Require GovCloud guidance acknowledgment after Bedrock setup <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jackz100</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50516</a> Add scenario coverage for remote <code>/compact</code> context preservation <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50525</a> Reject unknown TUI keys in strict config validation <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50531</a> Persist realtime transcript tails before closure without inference <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@guinness-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50536</a> Keep shared MCP types stable in Code Mode exec descriptions <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50540</a> Send incremental tool catalog updates in Responses Lite <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50546</a> Keep MCP resource helpers available in code mode <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50555</a> Skip daemon auto-start for Windows-mounted WSL homes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50558</a> Avoid reading the current directory when resolving absolute paths <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50559</a> Distinguish daemon release identity from executable contents <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50562</a> Keep Code Mode tool discovery guidance stable across catalog changes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50564</a> Allow transcript selection and copying while bottom modals are open <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50687</a> Keep third-party tools deferred in strict Code Mode Only <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50695</a> Preserve local Markdown link labels in the TUI <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50700</a> Let the transport create the Windows remote-control socket directory <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50720</a> Decode Windows Terminal's mapped Shift+Enter sequence <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50727</a> Show model and reasoning effort near the top of task details <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50741</a> Keep environment-backed tools exposed across readiness changes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@won-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50756</a> Show unavailable slash commands when searched in side conversations <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50764</a> Allow <code>/archive</code> while a turn is running <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50781</a> Restrict TUI MCP startup notifications to owned threads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50782</a> Retry Windows daemon release publication on transient file locks <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50786</a> Remember Command Center grouping across launches <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50788</a> Open slash commands from empty drafts in Vim Normal mode <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bc-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50802</a> Fall back to mklink when Windows daemon junction updates are denied <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50803</a> Use the managed daemon for eligible remote-control launches <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50804</a> Preserve review lifecycle ordering on failure <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50808</a> Prune TUI snapshots and consolidate behavior tests <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50811</a> Honor server reasoning summary defaults in new TUI threads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50913</a> Use server model defaults for connected TUI fresh starts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50940</a> Recover malformed Windows deny-read ACL state safely <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50962</a> Gate stable environment tool exposure behind a feature flag <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50964</a> Track inference tool changes in turn analytics <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#50977</a> Isolate tracing in the strict third-party tool deferral test <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@alishobeiri-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51061</a> Gate Guardian continuation tests on classifier request capture <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51063</a> Honor prior cancellation before starting Codex delegates <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51064</a> Ignore stale refresh responses in agents overview tests <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51065</a> Scope Guardian V2 response timing to snapshot sampling <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51067</a> Use issuing-step context for Guardian MCP elicitation reviews <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51070</a> Preserve trusted-tool context in Guardian Decisions requests <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51117</a> Install full context in compaction replacement history <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51119</a> Clarify incremental tool namespace updates in Responses Lite <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@akira-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51126</a> Add promise settlement streaming helpers to code mode <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@cconger</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51133</a> Allow Guardian Decisions to fall back to <code>OPENAI_API_KEY</code> <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@swastik-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51137</a> Recover Guardian reviews from parent checkpoints <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51139</a> Force fresh Guardian sessions for parent-checkpoint recovery <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51140</a> Isolate Guardian checkpoint recovery flags per review attempt <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51156</a> Send base instructions as Responses input messages <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51157</a> Enforce required environment skills before model inference <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51158</a> Sign the PowerShell installer in Windows releases <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@chess-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51184</a> Remove obsolete Guardian thread-context enables from tests <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51185</a> Retry transient gRPC code-mode session admission failures <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@cassirer-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51186</a> Prevent stable release pointers from moving backward <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@andrewgu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51188</a> Record base instructions in incremental tool history <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51191</a> Clean up Unix app-server control-socket startup lock files <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51192</a> Wait for SIGCONT when resuming the TUI <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51193</a> Test thread archiving before the first turn <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@btraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51194</a> Add browser extension request headers to config requirements <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jn-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51198</a> Allow concurrent release builds while serializing publication <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@andrewgu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51200</a> Upgrade Bazel to 9.2.0 and refresh the module lockfile <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51202</a> Distinguish namespace removals in incremental tool updates <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@akira-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51203</a> Make apply_patch preserve line endings unconditionally <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51206</a> Record initialization analytics for resumed subagents <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@peilin-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51207</a> Gate CLI Daybreak controls and selection behind an opt-in feature <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@julee-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51209</a> Add ranked tool discovery to JavaScript code mode <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zamoshchin-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51211</a> Reject sandbox-writable bubblewrap executables from PATH <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@viyatb-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51215</a> Measure raw MCP tool catalog sizes in telemetry <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51217</a> Preserve review targets and scope misalignment continuation metadata <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@yunhan-wei</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51220</a> Honor the OTLP metrics temporality preference <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@daniel-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51221</a> Separate environment requests from runtime selections <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51223</a> Remove legacy personality template metadata <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@rhan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51230</a> Make session lookup pagination stable and report listing failures <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51235</a> Remove default model labels from TUI model pickers <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51241</a> Add a partial answer message phase <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@rb-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51249</a> Handle partial answers consistently across agent workflows <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@rb-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51253</a> Enforce Fast and Ultra Fast policies independently <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@dpatel-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51256</a> Start the Windows sandbox service during registered Core setup <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51257</a> Fix installer checksum verification under Windows PowerShell <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51260</a> Handle partial answers in realtime routing and thread search <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@rb-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51329</a> Remove partial-history subagent forks <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51330</a> Measure total Guardian approval decision duration <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51331</a> Track sub-agent result delivery outcomes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51332</a> Record multi-agent wait duration by outcome <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51333</a> Record the multi-agent version in turn analytics <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51334</a> Count Guardian denial-limit interruptions in telemetry <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51335</a> Update collaboration snapshots for full-history fork instructions <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51347</a> Measure shell snapshot use and wait time per command <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51350</a> Allow larger shell snapshots when replaying from a file <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51355</a> Add bounded diagnostics for agent spawn failures <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51378</a> Keep Guardian v2 WebSocket pools warm with concurrent replenishment <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51391</a> Make URLs in asynchronous question titles clickable <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51396</a> Let late low-risk scores complete pending Guardian reviews <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51400</a> Prevent later Guardian scores from releasing earlier pending reviews <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51402</a> Preserve turn attribution across recovery and compaction <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@eddie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51407</a> Protect ripgrep lookup during Linux sandbox construction <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@viyatb-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51411</a> Suppress repeated image paste presses in legacy terminals <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51415</a> Expose and persist turn lineage across the app server <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@eddie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51419</a> Preserve turn attribution when queued mail wakes durable sleep <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@eddie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51420</a> Finish idle thread unloads after slow shutdown <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51421</a> Include root turn IDs in host-owned Apps tool calls <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@eddie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51422</a> Accept environment requests at thread and turn settings boundaries <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51425</a> Skip stable installer alias publishing for prereleases <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zsol-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51426</a> Remove the Bazel JVM override for Windows ARM64 voice builds <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51427</a> Prevent invalidated wakeups from starting a turn <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51433</a> Show hook status messages as titles in the hooks browser <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@abhinav-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51439</a> Preserve clickable URLs in TUI approval headers <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51440</a> Honor Retry-After in WebSocket error events <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51441</a> Fix core integration tests for updated turn APIs <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51449</a> Make URLs clickable in TUI user input questions <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51450</a> Make URLs clickable in MCP elicitation prompts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51451</a> Make URLs in the TUI warnings viewer clickable <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51452</a> Make banner URLs clickable across wrapped lines <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51457</a> Preserve status usage hyperlinks when the URL wraps <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51458</a> Make URLs clickable in user verification prompts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51459</a> Preserve wrapped help links in Windows sandbox prompts <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51460</a> Retry realtime sideband attachment while an existing call activates <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@bullman-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51463</a> Record resolved model and reasoning effort in sub-agent activity <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@sdcoffey</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51465</a> Add an optional JSON transcript format for Guardian <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51466</a> Keep Guardian transcript records structured through budget recovery <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51467</a> Keep submission logs useful without exposing payloads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@chess-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51470</a> Raise the managed app-server file descriptor limit on Unix <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51471</a> Preserve clickable URLs in pending input previews <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51472</a> Preserve clickable URLs in TUI selection rows <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51473</a> Preserve URL destinations in wrapped hook details <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51480</a> Preserve tool declaration mode across resumed context windows <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51482</a> Use PathUri for skill identity and path matching <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51483</a> Add correlated, credential-free rendezvous connection diagnostics <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@alexi-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51491</a> Classify executor capability root ownership independently of parsing <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@stevenlee-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51492</a> Remove obsolete fields from persisted turn context <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51493</a> Bind capability roots to environment selections <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51499</a> Load rollout history on a single blocking worker <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51500</a> Add shared task pinning to the agent command center <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51502</a> Bound relay connection attempts and handle pongs during blocked writes <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@alexi-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51503</a> Expose selected environments to MCP contributors <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@mtsui-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51510</a> Preserve live TUI settings when configuration reloads fail <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51511</a> Fix Windows 10 drive-letter opens for no-follow filesystem operations <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51512</a> Align Windows sandbox temp permissions with the child environment <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51515</a> Expose detailed agent tree shutdown failure reports <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@keitht-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51517</a> Pass thread persistence intent to attachment uploads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@kchainani-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51525</a> Preserve the CLI MXC preference in executor config reads <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">#51527</a> Ignore ripgrep configuration when expanding sandbox deny globs <a href="https://tsecurity.de/weiterlesen/1000044312/4267049/github-release-openaicodex-vrust-v01620-08102026/" target="_blank" rel="noopener noreferrer">@viyatb-oai</a></li> </ul></div></div> </article> <article> <h1>Vor 15 Jahren: Der Tod von Dennis Ritchie und das Rätsel seiner Dissertation</h1> Mon, 12 Oct 2026 18:46:03 +0200 Vor 15 Jahren starb Dennis M. Ritchie, Miterfinder von Unix und C. Ein Rückblick auf sein Leben, Wirken und die nie eingereichte Doktorarbeit. <a href="https://tsecurity.de/weiterlesen/1000043027/4265764/vor-15-jahren-der-tod-von-dennis-ritchie-und-das-raetsel-seiner-dissertation/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: can1357/oh-my-pi v18.10.0 (12.10.2026)</h1> Mon, 12 Oct 2026 17:17:38 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">can1357/oh-my-pi</a>v18.10.012.10.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>@oh-my-pi/pi-catalog</h2> <h3>Changed</h3> <ul> <li>Raised the default context window for <code>openai-codex/gpt-6.1-sol</code> and <code>gpt-6.1-sol-wm</code> from 272K to 500K, matching OpenAI's new Codex default; extended context still opens 922K (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15421</a>)</li> </ul> <h2>@oh-my-pi/pi-coding-agent</h2> <h3>Added</h3> <ul> <li>Added <code>/fork</code> support for creating a new Tern pane while a turn is streaming, preserving the original session</li> <li>Added <code>omp session pack</code>, <code>omp session unpack</code> and <code>omp session moved</code> to move a session with its artifacts to another machine and continue it there; resuming the copy left behind forks it instead of continuing it</li> <li>Added <code>omp auth export</code> and <code>omp auth import</code> to carry model sign-ins to another machine</li> <li>Added hiding a pending <code>ask</code> question without answering it: <code>Alt+H</code> (<code>app.ask.hide</code>) or the Hide button in Tern collapses the dialog to one line; the same key, <code>Enter</code>, or Show brings it back (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15400</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Local IPC endpoints (daemon broker, LSP mux, IDA hosts, text prediction, <code>omp stream</code>, Collab discovery, local model workers) now run on a native transport: owner-only on every platform, including Windows named pipes; on Windows, daemons started by an older omp are not reused, so close older sessions after upgrading.</li> <li>Output hidden behind an open <code>ask</code> dialog, command report or todo list now reaches terminal scrollback once it closes, rather than while it is still open (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed every session loading its own copy of the local mnemopi embedding model and keeping it in memory until exit; one server per model is shared across sessions and exits after 15 idle minutes (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#9908</a>)</li> <li>Fixed the first-use mnemopi embedding-model download never completing for sessions shorter than the download; it now finishes in the shared embedding server after the session exits (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#10240</a>)</li> <li>Fixed <code>RpcClient.stop()</code> occasionally waiting forever because the agent process was never signaled.</li> <li>Fixed blank rows opening under the input after an <code>ask</code> dialog, command report or todo list closed in a session that had filled the screen; the transcript now refills the screen (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed blank rows appearing between the last paragraphs of a streamed answer when the turn ended (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h2>@oh-my-pi/pi-natives</h2> <h3>Added</h3> <ul> <li>Added <code>IpcServer</code>, <code>IpcConnection</code>, and <code>ipcEndpoint</code>: a local IPC transport over Unix sockets and Windows named pipes with owner-only access, single-instance binding, stale-endpoint takeover, and newline framing.</li> </ul> <h3>Changed</h3> <ul> <li>Optimized transport performance with task-local write coalescing and batch-based newline processing</li> </ul> <h2>@oh-my-pi/pi-tui</h2> <h3>Breaking Changes</h3> <ul> <li>Removed <code>RuntimeChildrenOptions.transient</code> and <code>Component.retireDisplacedTranscript</code>: the composer now bills all chrome below the transcript at the smallest height it has rendered, so no root opts in or out (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h3>Added</h3> <ul> <li>Added the <code>app.ask.hide</code> keybinding (default <code>Alt+H</code>) and Hide/Show actions on <code>AskDialogComponent</code>, which collapse the dialog to a single line while its question stays pending (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15400</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h3>Changed</h3> <ul> <li>The <code>OMP_TUI_DEBUG</code> control socket now uses the native IPC transport: it is owner-only and no longer replaces a socket another live process is serving.</li> <li>Transcript rows pushed aside by an open dialog, report or HUD now reach scrollback when it closes or newer output pushes them out, instead of while it is open (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>A transcript block straddling the top of the screen now sends only its off-screen rows to scrollback; the rest stays live (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed blank rows opening under the editor after an ask or other inline dialog, command report or todo/loader HUD closed in a session that had filled the screen; the screen now refills with the transcript (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed the editor rising above blank rows when a live tool preview collapses under scrolled-off output; it now stays on the bottom row (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed blank rows opening inside a streamed answer when the working loader went away at the end of a turn (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed a split transcript block dropping punctuation-only rows it reveals after the split (such as a tool pane's rule line on expand); the seam now stops before them instead of treating them as already committed (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15420</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed a split transcript block fingerprinting measured rows instead of the bytes committed to scrollback, which could duplicate a SIXEL image prefix once its pending encode landed (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15420</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Fixed a transcript block straddling the top of the screen losing its off-screen rows when the inline-image limit demoted its images to text in the same frame; those rows now reach scrollback as text</li> </ul> <h3>Removed</h3> <ul> <li>Removed <code>Composer.pinInputToBottom()</code>; the composer keeps the input on the bottom row by itself (<a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a> by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h2>@oh-my-pi/pi-utils</h2> <h3>Added</h3> <ul> <li>Added <code>getMnemopiEmbedRuntimeDir()</code> for the shared mnemopi embedding server endpoints and logs.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed <code>ChildProcess.kill()</code> silently leaving the child running when the native process handle could not be resolved or used; it now signals the child directly and escalates to SIGKILL after the grace period.</li> </ul> <h2>What's Changed</h2> <ul> <li>feat(tui): hide a pending ask dialog without answering by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15400</a></li> <li>fix(tui): keep the transcript filling the screen when chrome below it shrinks by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15405</a></li> <li>fix(tui): harden row-split seam relocation and fingerprint by <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">#15420</a></li> </ul> Full Changelog: <a href="https://tsecurity.de/weiterlesen/1000042142/4264879/github-release-can1357oh-my-pi-v18100-12102026/" target="_blank" rel="noopener noreferrer">v18.9.2...v18.10.0</a></div></div> </article> <article> <h1>GitHub Release: can1357/oh-my-pi v18.10.2 (12.10.2026)</h1> Mon, 12 Oct 2026 17:17:37 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">can1357/oh-my-pi</a>v18.10.212.10.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>@oh-my-pi/pi-agent-core</h2> <h3>Added</h3> <ul> <li>Added <code>AgentLoopConfig.onDetachedToolUpdate</code>: a tool's <code>onUpdate</code> frames that arrive after its run's event stream ended (a returned call whose background job keeps reporting) reach it instead of being dropped; <code>Agent</code> forwards them to its subscribers as <code>tool_execution_update</code> events</li> </ul> <h2>@oh-my-pi/pi-ai</h2> <h3>Added</h3> <ul> <li>Added support for <code>CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS</code> on the <code>anthropic</code> provider: when set, requests omit pre-release fields (<code>context_management</code>, beta tool fields such as <code>strict</code> and <code>defer_loading</code>, task budgets, structured-output format, <code>thinking.block_binding</code>, and Anthropic server compaction) along with their beta headers, so <code>ANTHROPIC_BASE_URL</code> gateways that reject them keep working (<a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#15458</a> by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h2>@oh-my-pi/pi-catalog</h2> <h3>Added</h3> <ul> <li>Added the <code>honors-claude-code-beta-kill-switch</code> axis (<code>compat.honorsClaudeCodeBetaKillSwitch</code>), on for the <code>anthropic</code> provider, so a rule or <code>models.yml</code> override decides which providers honor <code>CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS</code> (<a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#15458</a> by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> </ul> <h2>@oh-my-pi/pi-coding-agent</h2> <h3>Added</h3> <ul> <li>Added <code>CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS</code> support: set it to stop Anthropic requests sending experimental beta fields that a company <code>ANTHROPIC_BASE_URL</code> gateway rejects, such as the Sonnet 5.5 <code>thinking.adaptive.block_binding</code> 400 (<a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#15458</a> by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a>)</li> <li>Added the <code>task.structured</code> setting (default off) for structured task results: when on, the task tool accepts <code>outputSchema</code>/<code>schemaMode</code> and subagents return results through <code>yield</code> as before</li> </ul> <h3>Changed</h3> <ul> <li>Subagents spawned by the task tool now return their final message as plain text, with no <code>yield</code> tool, output schemas, or "Submit Result" fields; eval <code>agent()</code>/workpool spawns still return structured results</li> <li>In Tern, a backgrounded <code>bash</code> command or <code>eval</code> cell keeps filling its own card with live output (In background, with a running clock) and settles it with the job's outcome, Cancelled when the job is killed; <code>wait</code> lists each job on one line (type, id, label, duration) instead of repeating its output</li> <li>ACP clients now see a backgrounded call's job output stream into its tool call, which settles completed or failed with the job</li> </ul> <h3>Fixed</h3> <ul> <li>Fails unstructured task runs that conclude without a final message</li> <li>Background task cards no longer stop updating once the agent ends its turn while the task is still running</li> <li>Transparent images the model receives (small icons, oversized screenshots) keep their transparency instead of turning into a black square, and resized edges no longer pick up a dark fringe</li> </ul> <h2>@oh-my-pi/pi-natives</h2> <h3>Added</h3> <ul> <li>Added in-process <code>env</code>, <code>du</code>, <code>chmod</code>, <code>fold</code>, <code>rmdir</code>, <code>od</code>, <code>df</code>, <code>uptime</code>, <code>id</code>, and <code>dd</code> shell builtins matching GNU coreutils 9.x options, output, and exit codes (<code>chmod</code> and <code>id</code> on Unix only; <code>dd</code> is disabled with the destructive set by <code>PI_DISABLE_UUTILS_DESTRUCTIVE</code>).</li> <li>Added an in-process <code>nl</code> shell builtin (ported from uutils coreutils 0.8.0, matching GNU <code>nl</code>), with header/body/footer numbering styles including <code>pBRE</code> regex styles, logical-page section delimiters, <code>-l</code> blank-line grouping, and <code>ln</code>/<code>rn</code>/<code>rz</code> number formats.</li> </ul> <h2>@oh-my-pi/pi-tui</h2> <h3>Added</h3> <ul> <li>Added opt-in <code>/tree</code> branch navigation across visible branches and nested fork depths; bind <code>app.tree.previousBranch</code> / <code>app.tree.nextBranch</code> (e.g. to <code>Shift+Left</code> / <code>Shift+Right</code>) in <code>keybindings.yml</code> (<a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#12623</a> by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@azain47</a>).</li> </ul> <h3>Changed</h3> <ul> <li>The <code>wait</code> tool's native job rows (<code>omp.wait.job</code>) are a single <code>row</code>: badge, id and label, progress and clock, without the output preview or capture notice beneath</li> <li>The native bash run foot reads In background with a live clock (<code>omp.run.time</code> without <code>stopped</code>) while a parked job's frames stream (<code>details.async.state === "running"</code>, partial), instead of Running</li> <li>Native model pickers (/model, the quick switch and the advisor's) mark providers with their logo (<code>mark.icon: "provider:<id>"</code>, initials where the terminal has none), and every model row leads with its provider's mark</li> </ul> <h3>Removed</h3> <ul> <li>Removed the unused <code>app.tree.foldOrUp</code> / <code>app.tree.unfoldOrDown</code> keybinding ids, which no longer did anything.</li> <li>Added <code>parksAsBackground(toolName, details)</code>, <code>asyncJobState(details)</code>, <code>isSettledJobFrame(details)</code> and <code>settleWithJobFrame(component, frame, toolCallId)</code> (<code>chat/tool-execution</code>): whether a returned call's card stays live for its background job's frames (<code>task</code> always; <code>bash</code> and <code>eval</code> under native rendering), the job state a frame reports, and settling the card with the job's last frame (a cancelled job keeps its output and seals as cancelled)</li> <li><code>BashToolDetails.async.state</code> and <code>EvalToolDetails.async.state</code> gain <code>cancelled</code> for a job killed before it finished</li> </ul> <h2>@oh-my-pi/pi-wire</h2> <h3>Added</h3> <ul> <li>Added <code>TspPickerMark.icon</code>: an icon a picker mark draws instead of its initials when the terminal has it (<code>provider:<id></code> names a model provider's logo)</li> </ul> <h2>What's Changed</h2> <ul> <li>feat(tui): jump across session tree branches by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@azain47</a> in <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#12623</a></li> <li>feat(ai): honor CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS for anthropic gateways by <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">#15458</a></li> </ul> Full Changelog: <a href="https://tsecurity.de/weiterlesen/1000042140/4264877/github-release-can1357oh-my-pi-v18102-12102026/" target="_blank" rel="noopener noreferrer">v18.10.1...v18.10.2</a></div></div> </article> <article> <h1>Why Raw Shell Access Is the Wrong Agent Integration—and What apexe Does Instead</h1> Thu, 01 Oct 2026 15:29:09 +0200 Your organisation probably already owns the capabilities its agents need. They live in git, kubectl, jq, curl, operational scripts, and internal Unix command-line tools. The usual choice is uncomfortable: give an agent shell access, or rebuild every useful command as an API or MCP server. apexe is built for the middle path. It scans an existing... <a href="https://tsecurity.de/weiterlesen/4166804/4222345/why-raw-shell-access-is-the-wrong-agent-integration-and-what-apexe-does-instead/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>CVE-2024-24806 | libuv up to 1.47.x src/unix/getaddrinfo.c uv_getaddrinfo server-side request forgery (GHSA-f74f-cvh7-c6q6 / Nessus ID 209040)</h1> Wed, 30 Sep 2026 01:12:59 +0200 A vulnerability, which was classified as critical, was found in libuv up to 1.47.x. The impacted element is the function uv_getaddrinfo of the file src/unix/getaddrinfo.c. Executing a manipulation can lead to server-side request forgery. This vulnerability is registered as CVE-2024-24806. It is possible to launch the attack remotely. No exploit is... <a href="https://tsecurity.de/weiterlesen/4161754/4217295/cve-2024-24806-libuv-up-to-147x-srcunixgetaddrinfoc-uvgetaddrinfo-server-side-request-forgery-ghsa-f74f-cvh7-c6q6-nessus-id-209040/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Moving off EventON: its timestamps aren't what they look like</h1> Tue, 29 Sep 2026 03:21:44 +0200 EventON is a popular WordPress events calendar, sold on CodeCanyon, with a free Lite version on wordpress.org. If you're moving off it, or just exporting your events, there's one thing to understand before anything else: the start and end times look like normal unix timestamps, and they aren't. Convert them the obvious way and every event moves by... <a href="https://tsecurity.de/weiterlesen/4158899/4214440/moving-off-eventon-its-timestamps-arent-what-they-look-like/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: openai/codex vrust-v0.158.0 (28.09.2026)</h1> Mon, 28 Sep 2026 18:43:15 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">openai/codex</a>vrust-v0.158.028.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>New Features</h2> <ul> <li>Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47639</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47896</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48118</a>)</li> <li>Connect to MCP servers that require pre-registered OAuth client secrets, including through <code>codex mcp add --oauth-client-secret</code>. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47891</a>)</li> <li>Secure direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47601</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47648</a>)</li> <li>Image generation and editing can explicitly request transparent backgrounds, and edits now accept file-backed conversation images. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47484</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47956</a>)</li> <li>Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47799</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48073</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fixed Windows sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47672</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47695</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47919</a>)</li> <li>Fixed Linux sandbox startup with nested writable roots and preserved Git metadata protections across writable roots on Linux and macOS. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47623</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47974</a>)</li> <li>macOS patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47879</a>)</li> <li>Approval reviews now retry when new user input arrives, so a status question does not automatically abort a pending action. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47819</a>)</li> <li>Mermaid flowcharts now render quoted labels and ampersands; unsupported diagrams explain why they fall back to source. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47572</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47678</a>)</li> <li>Command completion events now include early output and report process-launch failures to clients. (<a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47529</a>, <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47665</a>)</li> </ul> <h2>Changelog</h2> Full Changelog: <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">rust-v0.157.0...rust-v0.158.0</a> <ul> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47441</a> Use secondary text styling for the transcript footer shortcut hint <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47447</a> Extract WebSocket authentication into <code>codex-websocket-auth</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@euroelessar</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47458</a> Parallelize instruction refresh and tool preparation <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@hlevy-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47484</a> Add explicit background control to image generation <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@alicec-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47520</a> Route session agent operations through <code>AgentControl</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47529</a> Emit command lifecycle events for unified exec launch failures <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@steipete-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47536</a> Route agent lookups and V2 context through <code>AgentControl</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47539</a> Test interrupted one-shot command launch failure persistence <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47540</a> Add an option to disable multi-agent v2 direct messaging <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47565</a> Classify rollout read failures by reason and progress <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47568</a> Record sandbox backends in command execution analytics <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@iceweasel-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47571</a> Wait for idle before injecting remote compaction test history <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47572</a> Explain Mermaid rendering fallbacks in the TUI <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47582</a> Retain assistant context for Guardian authorization reviews <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47584</a> Preserve streamed assistant message order in retained context <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47585</a> Preserve delivered assistant messages in Guardian retained context <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47589</a> Keep unfinished link destinations out of rich streaming previews <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47590</a> Serialize numeric custom reasoning effort as JSON numbers <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@dylan-hurd-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47591</a> Stream daemon executable hashing off the async runtime <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47596</a> Refresh realtime context for each model request <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@reia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47597</a> Guard prerelease channel and canary updates against older versions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47601</a> Add opt-in WebSocket authentication to exec-server <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@euroelessar</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47603</a> Add a reap-only drop policy for child processes <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47604</a> Extend child commands with session and descriptor controls <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47605</a> Route pipe processes through the shared child launcher <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47610</a> Use native POSIX spawning for command hooks <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47611</a> Use the shared process launcher for Unix shell snapshots <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47612</a> Launch Linux pipe processes through a fresh setup helper <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@freeqaz-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47613</a> Expand Linux spawn-helper lifecycle test coverage <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47617</a> Route Linux PTY launches through the process setup helper <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47618</a> Prefer Shift-arrow hints for queued messages and questions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47619</a> Add bounded buffering for global operation metrics <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47620</a> Add portable project trust lookup APIs <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47623</a> Fix read-only metadata mount ordering for nested writable roots <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47624</a> Recognize <code>user_message</code> tools in Guardian authorization context <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@ankushg</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47625</a> Allow history and notes without experimental context capability <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@pmccrary-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47629</a> Route V2 child loading through <code>AgentControl</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47630</a> Bind Guardian reviews to the action's target environment <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47633</a> Route message board agent resolution through the selected controller <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47635</a> Overlap startup WebSocket preconnect with tool discovery <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@bromano-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47638</a> Classify retryable exec-server preparation errors by type <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@mtsui-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47639</a> Add configurable copy-on-select for transcript selections <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47641</a> Honor Retry-After and preserve server retry deadlines <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47642</a> Add model-specific prefixes to indirect tool descriptions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@rhan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47647</a> Apply Guardian computer-use review to the Browser connector <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@johnl-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47648</a> Support bearer tokens for app-server executor connections <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@euroelessar</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47649</a> Add opt-in OTLP logging for final agent responses <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@xli-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47653</a> Attach inherited rollout history to diagnostic reports <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@dkovalenko-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47654</a> Make Linux descriptor cleanup fork-safe <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@yuzhu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47655</a> Bump the exec-server stable compatibility test to Codex 0.156.1 <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47657</a> Restrict the default Bedrock GovCloud model catalog <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jackz100</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47662</a> Expose tool dispatch and timing observations to extensions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@euroelessar</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47663</a> Preserve managed network policy in route-aware transports <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jackz100</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47665</a> Preserve early unified exec output in completion events <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sdcoffey</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47670</a> Support model-specific descriptions for agent message board tools <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@eknight-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47672</a> Fix no-reparse directory opens on Windows 10 <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47673</a> Clarify registered Windows sandbox setup errors <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47677</a> Support model catalog overrides for MCP resource tool specs <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@rhan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47678</a> Support quoted labels and ampersands in Mermaid flowcharts <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47679</a> Add extension hooks for model requests and response streams <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@euroelessar</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47680</a> Add exec-server RPC timing and process startup tracing <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47683</a> Add executor capability discovery V2 infrastructure <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@TAFOYA-OAI</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47686</a> Make thread-owned Guardian context always enabled <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47688</a> Remove legacy Guardian authorization evidence paths <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47689</a> Make Guardian thread context capture unconditional <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47690</a> Remove obsolete Guardian context capture mode branches <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47691</a> Materialize rollout persistence for pending inter-agent messages <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@dermanyang-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47693</a> Configure curl retries for DotSlash installation in CI <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47695</a> Repair rejected Windows sandbox credentials during provisioning <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47696</a> Avoid the shutdown timeout in the lagged-event test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jgershen-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47698</a> Allow WebSocket test server shutdown while waiting for requests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jgershen-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47701</a> Allow idle threads to prewarm and repair WebSocket connections <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@vkg-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47703</a> Preserve account network policy for ChatGPT backend requests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jackz100</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47704</a> Fix spawn flag typing and isolate project configuration tests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47709</a> Route resume prewarm through the cached WebSocket session <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@vkg-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47712</a> Update unified exec output buffers atomically <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sdcoffey</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47713</a> Reduce dependency coupling in shared configuration crates <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47714</a> Preserve tool result metadata more selectively under size limits <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@ningyi-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47717</a> Avoid recursive TUI event dispatch for model picker selections <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47741</a> Attribute tool telemetry to the invoking turn's product SKU <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@rennie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47742</a> Honor network policy in history notes and image generation extensions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jackz100</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47745</a> Skip startup prewarm preparation when the WebSocket is ready <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@vkg-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47748</a> Align Cargo and Bazel Rust debug information defaults <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47751</a> Reduce generic code duplication in RPC and Markdown rendering <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47755</a> Centralize typed app-server response decoding <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47757</a> Refactor tool telemetry product SKU matching to use an allowlist <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@rennie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47758</a> Preserve more tool metadata within outgoing message budgets <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@ningyi-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47773</a> Honor catalog schemas for asynchronous user input <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@rhan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47797</a> Support close-on-exec attachments without changing PTY semantics <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47799</a> Enable terminal input approval by default <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47808</a> Allow hosts to provide agent controllers through ThreadManager <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47811</a> Preserve explicit user goal updates in Guardian authorization <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47813</a> Fix sleep interruption test event handling and fixture lifetime <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47814</a> Fix a lost wakeup in the unified exec termination test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47817</a> Stabilize thread resume and memory dual-write tests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47819</a> Retry Guardian reviews when authorization changes <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@teddywyly-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47820</a> Add integration coverage for host agent controllers <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47824</a> Allow four concurrent threads in the multi-agent resume test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47828</a> Wait for login completion in recommended plugin tests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47830</a> Bind Guardian async scores to target environment permissions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47832</a> Stabilize Rosetta test timing and retry delay telemetry <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47847</a> Keep the TUI responsive during clipboard copies <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47851</a> Preserve human overrides across repeated heartbeat instructions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47852</a> Avoid blocking async proxy resolution on the system proxy cache <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47856</a> Initialize media estimates outside the global cache lock <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47858</a> Validate loaded plugins outside the cache lock <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47861</a> Avoid nested read locking when rendering browser sign-in <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47867</a> Render remote permission paths using executor context <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@iceweasel-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47870</a> Add opt-in OTLP logging for Guardian assessments <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47871</a> Fix PID reservation test race and update guardian heartbeat snapshot <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47873</a> Measure deferred tool namespace fragments before and after truncation <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@mzeng-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47879</a> Fix macOS system-alias matching in patch permission checks <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47881</a> Use Tokio's clock for TUI paste timing <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47886</a> Preserve diagnostic logs when SQLite logging fails <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@dkovalenko-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47887</a> Warn users when SQLite diagnostic log writes fail <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@dkovalenko-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47889</a> Include TUI client logs in diagnostic uploads <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47891</a> Support client secrets for pre-registered MCP OAuth clients <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@willwang-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47894</a> Clean up temporary Codex homes after TUI tests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47896</a> Preserve Markdown formatting when copying transcript selections <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47898</a> Preserve local-binding inheritance in environment network policies <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47899</a> Add diagnostic reasons to MCP attribution errors <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@peilin-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47900</a> Default local threads to paginated history <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47901</a> Add bounded credential-storage telemetry helpers <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47902</a> Avoid repeated table clones during config merging <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47903</a> Move config key alias normalization ahead of merging <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47904</a> Support nested canonical paths in config key aliases <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47908</a> Alias <code>tui.whimsy</code> to <code>tui.effects.starfield</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@imac-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47912</a> Fix attestation routing during thread startup <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@charliemarsh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47913</a> Add an opt-in flag to defer mailbox preemption <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47915</a> Reuse verified V8 checksum manifests from the artifact cache <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47918</a> Parameterize the turn-start originator header test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47919</a> Transport large Windows sandbox launch payloads through the environment <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@malsamiri-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47920</a> Allow directory moves under global Seatbelt basename denies <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@chess-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47922</a> Allow full-access Windows setup to provision through registered Core <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@zm-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47924</a> Make project trust lookup paths explicit and defer root resolution <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@seanh-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47926</a> Retry file blob uploads on HTTP 502 and 504 <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@mtsui-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47927</a> Use <code>127.0.0.1</code> for local login redirects <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@willwang-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47932</a> Remove GPT-5.4 from bundled catalogs and preserve migration prompts <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@andrewgu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47934</a> Apply the unchanged-model compaction shortcut to all session sources <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@hlevy-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47935</a> Allow cached catalogs to satisfy MCP startup readiness <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@hlevy-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47936</a> Make MCP and Code Mode input schema budgets configurable <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@vivi</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47937</a> Add direct replies for thread settings updates <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sayan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47939</a> Separate selected plugin identities from MCP contributions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sayan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47943</a> Remove unused Windows world-writable audit code <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@iceweasel-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47945</a> Parameterize the thread initialization analytics test by originator <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@eddie-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47946</a> Add an in-memory agent message board for ephemeral sessions <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47947</a> Expand root authorization context to 16 messages <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47951</a> Use prebuilt V8 archives for Bazel on macOS and GNU Linux <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47952</a> Prune expired in-memory message board registry entries <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47954</a> Move fullscreen startup tips into the transcript <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47956</a> Support file references in image edit requests <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@kchainani-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47957</a> Bound tool-call observations to the outgoing Responses message budget <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@ningyi-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47962</a> Request transparent huge pages for Cargo and eligible Bazel rustc jobs <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aibrahim-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47964</a> Preserve the client-agent header for Amazon Bedrock Runtime <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47967</a> Surface Flex capacity failures as a distinct terminal error <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sdcoffey</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47968</a> Handle Btrfs device mismatches when masking daemon sockets <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47970</a> Expose current environment selections for a running turn <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@sayan-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47971</a> Add Pro Max plan support and update Pro display names <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47974</a> Preserve Git directory protections across writable roots <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aionescu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47975</a> Prevent stale voice answers from reappearing during speech recovery <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47981</a> Prepare MCP calls directly from advertised tool identities <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@hlevy-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47984</a> Add multi-agent spawn latency and failure metrics <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@owenlin0</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47988</a> Reuse MCP handlers across equivalent bindings <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@hlevy-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#47989</a> Add startup-only PID namespace inheritance to exec-server <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@open-matt</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48004</a> Respect configured authentication in the thread manager sample <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@celia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48015</a> Validate tool suggestion install URLs before showing the app link <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@aionescu-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48017</a> Test same-cell permission grants and strict review in code mode <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@anp-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48035</a> Remove plugin extension metadata from discovery and summaries <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@victor-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48060</a> Deduplicate retained instructions across Guardian reviews <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48069</a> Handle early command yields in the Guardian network approval test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48072</a> Skip message-board notification previews when there are no recipients <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48073</a> Avoid stdin approval for runtime-only permission grants <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48077</a> Add Serde support to agent message board request types <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48078</a> Replay exec-server shell snapshots through unnamed files <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48098</a> Preserve recent authorization context for Guardian reviews <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48099</a> Honor shell environment policy in legacy snapshots <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48100</a> Add an HTTP client for remote agent message boards <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@jif-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48101</a> Show multiline command previews in <code>/ps</code> <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48109</a> Deduplicate retained instructions against Guardian transcripts <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48110</a> Deduplicate retained instructions in async Guardian context <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48115</a> Preserve user text parts during local compaction <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48116</a> Allow reasoning shortcuts to reach Max <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48118</a> Add configurable right-click paste to the fullscreen TUI <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@fcoury-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48119</a> Prevent worker completion races in the guardian authorization test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48121</a> Keep startup drafts visible during command center session handoff <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48123</a> Add early yielding for code-mode observations <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@pakrym-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48130</a> Use request notifications in the cloud config loader lifetime test <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@felixxia-oai</a></li> <li><a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">#48132</a> Allow Left to open the command center from read-only conversations <a href="https://tsecurity.de/weiterlesen/4157014/4212555/github-release-openaicodex-vrust-v01580-28092026/" target="_blank" rel="noopener noreferrer">@etraut-openai</a></li> </ul></div></div> </article> <article> <h1>GitHub Release: can1357/oh-my-pi v18.4.0 (28.09.2026)</h1> Mon, 28 Sep 2026 15:46:07 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">can1357/oh-my-pi</a>v18.4.028.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>@oh-my-pi/pi-agent-core</h2> <h3>Changed</h3> <ul> <li>Updated telemetry attribute names from the <code>pi.*</code> namespace to the <code>omp.*</code> namespace.</li> </ul> <h2>@oh-my-pi/pi-ai</h2> <h3>Breaking Changes</h3> <ul> <li>Changed <code>LimitsApi.rotate()</code> to return a <code>CredentialRotation</code> object (<code>{ switched, afterSiblingWait? }</code>) instead of a boolean. Check <code>.switched</code> explicitly, since the returned object is always truthy.</li> </ul> <h3>Added</h3> <ul> <li>Added image metadata to hosted OpenAI image-generation results, including the model used and each generated image’s dimensions and quality.</li> </ul> <h3>Changed</h3> <ul> <li>Redesigned the browser page displayed during OAuth login.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed Anthropic accounts remaining blocked after quota resets, including for broker-connected clients, while preserving independent authentication and model-limit restrictions.</li> <li>Fixed concurrent usage refreshes repeatedly probing providers after failures, reducing unnecessary usage-endpoint requests.</li> <li>Fixed Gemini and Antigravity usage and cost reporting when upstream responses omit prompt-token counts or report more cached tokens than prompt tokens.</li> <li>Fixed credential failover after authentication errors so stored credentials rotate through every distinct sibling instead of stopping after one attempt; rotation can also wait briefly for a temporarily blocked healthy sibling to become available.</li> <li>Fixed native judge responses without token counts producing invalid usage and cost values.</li> <li>Fixed Cursor usage, cost, and context accounting to include final input, cache, reasoning, and output metrics, improving compaction and handoff sizing.</li> <li>Fixed Cursor MCP tool calls routed through external executors being returned as text instead of tool calls.</li> <li>Fixed Cursor shell-tool timeouts being displayed in milliseconds rather than seconds.</li> <li>Fixed fetch requests over Unix sockets when <code>PI_PROXY</code> is configured.</li> <li>Fixed Ollama chat turns being recorded with zero cost; usage is now priced using the model’s cost information.</li> <li>Fixed Anthropic requests failing after native compaction when per-message effort settings were present; effort controls are now handled correctly with compaction.</li> </ul> <h2>@oh-my-pi/pi-catalog</h2> <h3>Fixed</h3> <ul> <li>Corrected Cerebras model pricing so cached input tokens are charged at the model’s input rate, consistent with Cerebras billing.</li> </ul> <h2>@oh-my-pi/pi-coding-agent</h2> <h3>Added</h3> <ul> <li>Added the <code>telemetry.otlpExportEnabled</code> setting under Settings → Providers → Privacy to disable OTLP trace, log, and metric export even when <code>OTEL_*</code> endpoints are configured; exporting remains enabled by default.</li> <li>Added a first-launch warning when Python evaluation is enabled but no working Python interpreter is available, with guidance for configuring <code>python.interpreter</code> and checking the installation with <code>omp setup python --check</code>.</li> </ul> <h3>Changed</h3> <ul> <li>Updated <code>omp stats</code> and <code>/stats</code> to open the redesigned dashboard immediately while session data synchronizes in the background with live progress; <code>--json</code> and <code>--summary</code> continue to synchronize before producing output.</li> <li>Replaced the stats dashboard’s Behavior page with a Frustration page that can classify messages using the <code>judge</code> model role, showing an estimated cost before analysis and recording <code>/stats</code> spending in the current session.</li> <li>Clarified the <code>eval</code> tool documentation to explain that its kernel may be shared with the parent session and concurrent task subagents.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed <code>/tree</code> reopening saved Ask results instead of navigating past them when an optional preview was saved as <code>null</code>.</li> <li>Fixed the legacy <code>createGrepTool()</code> API when searching with both a file path and a <code>glob</code> filter.</li> <li>Improved task and subagent reliability: eligible saved usage resets are now redeemed automatically when polling is throttled or transient failures occur, concurrent tasks share confirmed resets, headless subagents retain assignments across session transitions, tagged <code>^model</code> agents are available to nested subagents, and <code>wait</code> returns promptly with information about still-running work when no owned jobs are available.</li> <li>Fixed SDK requests using <code>ApiKeyResolver</code> to wait for a nearby healthy credential when a drained account’s quota block is about to expire, instead of immediately failing with a multi-hour quota error.</li> <li>Fixed Anthropic requests failing after native compaction when experimental context notes were enabled.</li> <li>Fixed Windows path handling for 8.3 short paths, including project-directory detection and home-directory display in status, tool labels, and errors.</li> <li>Fixed <code>edit</code> <code>PUT >N</code> producing syntactically invalid code when inserting shallower constructs near closing braces.</li> <li>Fixed Windows one-shot commands, including <code>omp update</code>, incorrectly reporting successful completion as an error; also fixed this behavior when no user npm or Bun configuration file exists.</li> <li>Fixed missing judge token counts corrupting session usage totals and displaying <code>$NaN</code>.</li> <li>Fixed Cursor sessions under-reporting token usage and cost, compacting based on the wrong context measurement, and applying shell-command timeouts in the wrong units.</li> <li>Updated goal mode to wait for user input when all remaining todos are blocked instead of repeatedly requesting approval.</li> <li>Fixed <code>pi-background-tasks</code> 2.6.0 and later failing to load due to a missing legacy <code>pi-ai</code> compatibility export.</li> <li>Fixed blob broker requests when <code>PI_PROXY</code> is configured.</li> <li>Fixed <code>generate_image</code> reporting the catalog model instead of the image model actually used by the ChatGPT/Codex backend; saved image metadata now reflects the provider-returned size and quality.</li> <li>Fixed fast-model fallback selection so it no longer chooses Gemini or MiniMax models when no <code>smol</code> role is configured.</li> <li>Fixed extension tool renderers using upstream pi’s <code>renderCall(args, theme, context)</code> signature failing to render.</li> <li>Fixed Nix flake and NixOS module builds failing because the native package version stamp was not recognized.</li> <li>Fixed Nix dependency-lock checks failing after obsolete stats chart dependencies were removed.</li> </ul> <h2>@oh-my-pi/collab-web</h2> <h3>Changed</h3> <ul> <li>Redesigned the web client: black chassis with one inset session panel, glass top bar with the omp mark and a live status pill, a docked composer card, prompts shown as cards in the transcript, a sectioned agents rail, and a floating agent drawer; the connect screen was rebuilt too</li> </ul> <h2>@oh-my-pi/pi-natives</h2> <h3>Added</h3> <ul> <li>Added Windows path utilities for converting between long and 8.3 short path spellings without resolving symlinks or junctions. Import them from <code>@oh-my-pi/pi-natives/path</code>.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed the native <code>xargs</code> builtin so <code>-P</code>/<code>--max-procs</code> correctly limits parallel command execution, including GNU-compatible <code>-P 0</code> behavior.</li> <li>Improved snapcompact rendering performance for stretched shapes on Windows x64, Intel Macs, and Linux CPUs without AVX2, with no visual changes.</li> </ul> <h2>@oh-my-pi/omp-stats</h2> <h3>Changed</h3> <ul> <li>Redesigned the dashboard: new layout, navigation (<code>g</code> + letter to jump, <code>1</code>–<code>6</code> to pick a range), sortable tables and in-house charts on every page</li> <li>The dashboard opens immediately and ingests sessions in the background, most recent activity first, with live progress in the header; pages update as data lands and new session activity appears within seconds</li> <li>Switching time ranges is now near-instant: range queries read hourly rollups instead of scanning every request (seconds → milliseconds on large histories)</li> <li>Frustration judge runs now scale how many requests they keep in flight (up to 256, backing off on rate limits and retrying after a short delay) and save verdicts in batches; the progress line shows the rate and requests in flight</li> <li>Provider subscription windows load separately from the rest of the Providers page, and the Projects page lists the 2,000 busiest folders</li> <li>Replaced the dashboard's Behavior page with a Frustration page showing, per model version, how often users are annoyed, annoyed at the assistant, and angry at it; a button judges unclassified messages with the host's <code>judge</code> model (after a cost estimate) and the chart refines live as verdicts arrive</li> </ul> <h3>Fixed</h3> <ul> <li>Made session-statistics synchronization atomic to prevent duplicate entries when synchronization is interrupted.</li> <li>Improved the speed and reliability of initial and repeat <code>omp stats</code> imports, including large session histories and already-indexed histories.</li> </ul> <h2>@oh-my-pi/pi-tui</h2> <h3>Fixed</h3> <ul> <li>Prevented interrupted wait operations from appearing in the transcript when a queued completion or message is received.</li> </ul> <h2>What's Changed</h2> <ul> <li>perf(pi-natives): stopped snapcompact resize lowering mul_add to libm fmaf on x86-64-v2 by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13496</a></li> <li>fix(coding-agent): read optional registry config via fs.promises in omp update by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13514</a></li> <li>fix(cli): kept exit code when loop resumed after beforeExit by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13472</a></li> <li>fix(coding-agent): wait ladder restored to old hub behavior by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13516</a></li> <li>fix(windows): normalize working directories and abbreviate short home paths by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@CoderTCY</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13394</a></li> <li>feat(telemetry): add opt-out setting override to disable OTLP export by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@krizh-p</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13444</a></li> <li>docs(coding-agent): say the eval kernel is shared with concurrent task subagents by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@radkawar</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13521</a></li> <li>fix(pi-edit): keep PUT >N inserts before a closer when moving them breaks the parse by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@radkawar</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13520</a></li> <li>feat(coding-agent): eval backend missing by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13529</a></li> <li>test: remove useless tests by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13539</a></li> <li>fix(natives): allowed const-fn lint on windows path exports by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13548</a></li> <li>fix(task): retried dropped headless prompts before yield by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13541</a></li> <li>fix(goal): stop continuations while todos are blocked by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13497</a></li> <li>docs(bash): clarified shellpath execution scope by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13420</a></li> <li>fix(judgment): handled missing judge token counts by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13492</a></li> <li>fix(nix): stamped the native addon version in the nix build by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13506</a></li> <li>fix(ai): price ollama-chat terminal usage from the model cost card by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13057</a></li> <li>fix(extensions): accept pi-order renderCall theme argument by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13086</a></li> <li>fix(coding-agent): stopped smol mini pattern matching gemini models by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13410</a></li> <li>fix(coding-agent): reported the image model the codex backend ran by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13404</a></li> <li>fix(ai): bypassed proxy for unix-socket fetches by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13510</a></li> <li>fix(coding-agent): restore anthropic compat adapter by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13251</a></li> <li>fix(ai,coding-agent): recovered cursor turn usage and tool handoffs by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13085</a></li> <li>fix(ai): waited out briefly blocked siblings before failing rotation by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13409</a></li> <li>fix(ai): restore exec-resolved marking for streamed cursor MCP calls by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13554</a></li> <li>fix(ai): drop unreachable cursor exec-resolved branch and its stale test by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13563</a></li> <li>docs(changelog): note cursor MCP exec-resolution cleanup by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13565</a></li> <li>fix(ai): rotated 401s through every distinct stored sibling by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13561</a></li> <li>fix(ai,coding-agent): keep the Anthropic compaction block first in the request by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@H4vC</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13569</a></li> <li>fix(tui): restored saved ask questions with null previews by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13573</a></li> <li>fix(coding-agent): corrected legacy grep file glob handling by <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@roboomp</a> in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13574</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">@krizh-p</a> made their first contribution in <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">#13444</a></li> </ul> Full Changelog: <a href="https://tsecurity.de/weiterlesen/4155565/4211106/github-release-can1357oh-my-pi-v1840-28092026/" target="_blank" rel="noopener noreferrer">v18.3.5...v18.4.0</a></div></div> </article> <article> <h1>CVE-2026-58090 | FreeBSD Kernel up to p2/p12 Unix Socket use after free (EUVD-2026-66235 / WID-SEC-2026-3034)</h1> Fri, 25 Sep 2026 04:30:11 +0200 A vulnerability was found in FreeBSD Kernel up to p2/p12. It has been rated as very critical. This affects an unknown part of the component Unix Socket. Performing a manipulation results in use after free. This vulnerability is identified as CVE-2026-58090. The attack is only possible with local access. There is not any exploit available.... <a href="https://tsecurity.de/weiterlesen/4155277/4210818/cve-2026-58090-freebsd-kernel-up-to-p2p12-unix-socket-use-after-free-euvd-2026-66235-wid-sec-2026-3034/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Ah, a new kid in the block....systemd-report!</h1> Fri, 25 Sep 2026 04:27:37 +0200 submitted by /u/unixbhaskar [link] [comments] <a href="https://tsecurity.de/weiterlesen/4155247/4210788/ah-a-new-kid-in-the-blocksystemd-report/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Developers are still rejecting Windows, poll finds, even as Microsoft rebuilds Windows 11 for them</h1> Thu, 24 Sep 2026 17:19:24 +0200 Apart from fixing their OS, 2026 for Microsoft was spent making Windows more attractive to developers. WSL got faster, Linux containers are now a built-in part of Windows 11, Microsoft shipped Linux-like Coreutils, and the more recent of them, Windows Developer Configurations, can turn a fresh PC into a ready-to-code machine with one command. However, a new developer poll, spotted by Windows Latest, looks to render those efforts futile. Gergely Orosz, who runs The Pragmatic Engineer, asked his audience on X about which OS they use to build software, and got roughly 4,000 responses. macOS took a staggering 61.6%, Linux 24.2%, and Windows 12.8% <figure aria-describedby="caption-attachment-95198" class="wp-caption aligncenter"><figcaption class="wp-caption-text">Poll on what OS developers are using to build software by Gergely Orosz. Source: Screenshot from X</figcaption></figure> Yes, Windows came in a distant third. Another poll on LinkedIn for research for the same newsletter received 6000 votes, with the numbers being 66%, 20%, and 12%, which is similar as the ones on X. <figure aria-describedby="caption-attachment-95199" class="wp-caption aligncenter"><figcaption class="wp-caption-text">Poll numbers collected by The Pragmatic Engineer newsletter about software used by developers. Source: LinkedIn</figcaption></figure> Of course, this isn’t a survey of every developer in the world. Orosz described the audience as his “bubble,” made up largely of developers at startups and Big Tech. It does not overturn the much larger surveys where Windows is still widely used. But I feel this is an uncomfortable situation for Microsoft. Redmond is doing so much to make Windows developer-friendly, and yet the developers are still reaching for Macs and Linux boxes. <h2>The 12% number for Windows is more of a preference than a market share</h2> The <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">2025 Stack Overflow Developer Survey</a>, with tens of thousands of respondents globally, brings us back to the real world. It found Windows to be the most widely used primary operating system among professional developers, at roughly 49.5%, compared with 32.9% for macOS. And it being a multiple selections survey, makes it fundamentally different from Orosz’s single-choice poll. You cannot put 12.8% next to 49.5% and declare one of them wrong. Either way, this gap between the two surveys suggests Windows is particularly weak among the highly visible <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">startup and Big Tech crowd</a>, even though it is still widely used across the global developer population. <h3>The Statcounter chart for OS market share is misleading</h3> The screenshot posted by <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Omarchy creator</a>, which was what triggered Orosz to explain his poll, shows Statcounter’s US desktop chart with Linux near 18% and Windows above 50%. <figure aria-describedby="caption-attachment-95203" class="wp-caption aligncenter"><figcaption class="wp-caption-text">Source: Statcounter</figcaption></figure> Well, Statcounter measures page views, not people or developer machines, although its methodology says it tries to remove bot activity from a sample of billions of monthly page views. Also, Statcounter still lists OS X and macOS as separate operating systems, years after Apple renamed OS X to macOS. Windows Latest has flagged this kind of misreading before, when a viral screenshot claimed <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Windows had dropped from 79% to 56% in two months</a>. It turned out to be a classification error that Statcounter later corrected, not an exodus from Windows. We also checked a viral news story about a <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">spike in Linux against Cloudflare’s human versus automated traffic data</a> and found Linux at around 4.7% for human-only North American traffic, while automated traffic pushed it as high as 26% on individual days. <h2>Why do developers keep choosing macOS and Linux?</h2> One word: Unix Yes, MacBooks have their charm, but more importantly, macOS gives developers a Unix-based environment with familiar command-line tools and package managers, wrapped in a desktop that mostly stays out of the way, without bloatware and upsells. It also helps that the M-series chips are the best in class at performance and battery life. <figure aria-describedby="caption-attachment-95204" class="wp-caption aligncenter"><figcaption class="wp-caption-text">Source: Apple</figcaption></figure> There is also Xcode that has always required macOS, and it provides the only SDKs and simulators for iOS, iPadOS, watchOS, and visionOS. For anyone building Apple-platform software, choosing a Mac is the only option. And if X posts are anything to go by, Apple users are more likely to pay for apps, and hence give more revenue to the developers. <h3>Linux is closer to where modern software runs today</h3> Developers working with servers, containers, cloud infrastructure, and plenty of AI workloads want their development environment to resemble the Linux environments where their software eventually ships, which explains why Linux is preferred around Docker, Kubernetes, Python, and cloud infrastructure. Microsoft’s <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">WSL support documents</a> mention Linux environments, containers, and GPU acceleration, while also warning that storing project files on the Windows filesystem while running Linux build tools through WSL introduces I/O overhead. <div class="wp-video"><a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">https://www.windowslatest.com/wp-content/uploads/2026/07/testing-GPU-access-inside-a-WSL-container.mp4</a></video></div> <h3>Windows is often very good at the things Microsoft controls</h3> Windows still has enormous advantages. Visual Studio is still one of the dominant development environments, .NET runs officially across Windows, Linux, and macOS, and Windows keeps a huge enterprise footprint along with clear dominance in PC gaming. WSL gives developers Linux access without abandoning Windows completely, and Microsoft has poured a lot of resources into Dev Drive, Windows Terminal, WinGet, and developer tooling. <div class="wp-video"><a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">https://www.windowslatest.com/wp-content/uploads/2026/08/Windows-Subsystem-for-Linux-WSL-is-now-experimentally-supported-in-the-GitHub-Copilot-app.mp4</a></video></div> The problem is that many developers do not want Windows because they need Windows. They want a Unix-like environment, and Microsoft has increasingly responded by putting Linux inside Windows. <h2>Microsoft is practically rebuilding Windows around developers and AI</h2> Steve Ballmer once screamed “developers, developers, developers” across a stage. It worked then, but two decades later, Microsoft is still chasing them, though the problem can’t be any more different. <h3>WSL is no longer Microsoft’s side project</h3> Microsoft has spent 2026 <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">upgrading WSL with faster file access</a>, better networking, and easier setup, describing it as foundational for running Linux workloads on Windows, work that led to <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">WSL Containers</a>, a built-in wslc tool for building and running Linux containers that removes the need for third-party tools like Docker Desktop. <figure aria-describedby="caption-attachment-91816" class="wp-caption aligncenter"><figcaption class="wp-caption-text">WSL Containers in action on Windows 11. Credit: Windows Latest</figcaption></figure> Funnily enough, Canonical’s VP of Engineering, Jon Seager, told The Pragmatic Engineer that <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Ubuntu usage inside WSL is growing faster than native Ubuntu desktop installs</a>, and expects WSL to overtake native Ubuntu within months, driven largely by developers handed Windows laptops by their employers who then need Linux for AI and machine learning work. <figure aria-describedby="caption-attachment-88457" class="wp-caption aligncenter"><figcaption class="wp-caption-text">Ubuntu running via Windows Subsystem for Linux. Source: Ubuntu</figcaption></figure> Microsoft built WSL so developers would not have to leave Windows. It may be succeeding in one sense, but the fact that Microsoft had to do this at all tells us exactly what problem it was solving! <h3>Build 2026 went full-throttle into developer tooling</h3> At Build 2026, Microsoft <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">pledged to make Windows 11 the OS for building AI</a>, shipping Coreutils for Windows (a Rust-based reimplementation of GNU command-line utilities that run natively on Windows), along with Windows Developer Configurations, powered by WinGet, that set up VS Code, GitHub Copilot, WSL, and PowerShell 7 with one command. The same wave included Windows Development Skills for agentic native app development, an experimental Intelligent Terminal, and Microsoft Execution Containers, a policy-driven layer that lets developers control what an AI agent can touch on a device. <h3>Project Zenith admits AI developers need a quieter Windows</h3> Announced September 4, 2026, <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Project Zenith is Windows</a> with different defaults, requiring at least 64GB of unified memory and 250GB/s of bandwidth so it can run 30-billion-parameter coding models locally. Microsoft calls it “ready-to-code,” pinning Windows Terminal and VS Code to the taskbar and preinstalling GitHub Copilot, PowerToys, and Windows Dev Skills. Microsoft is also throwing AI-focused hardware to lure in developers. The <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Surface RTX Spark Dev Box</a> and the <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Surface Laptop Ultra</a> both pair NVIDIA RTX Spark with large unified-memory configurations and CUDA support, aimed squarely at local AI development. Yusuf Mehdi has pledged to spend his final year <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">reimagining Windows for the agentic era</a> before he leaves, and Microsoft is <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">expected to talk more about this direction at its October Windows event</a>, the software giant’s first major Windows event in two years. Contrary to popular belief, Microsoft is not ignoring developers. It is adding Linux containers, improving WSL, shipping Linux-like command-line tools, building developer-specific Windows configurations, and putting AI-focused hardware to back it all. Yet an informal poll of 10,000 votes shows that Windows is still far behind macOS and Linux. Windows is clearly capable of being a good developer platform. The harder problem is convincing developers they should want it as their development environment. The post <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Developers are still rejecting Windows, poll finds, even as Microsoft rebuilds Windows 11 for them</a> appeared first on <a href="https://tsecurity.de/weiterlesen/4154280/4209821/developers-are-still-rejecting-windows-poll-finds-even-as-microsoft-rebuilds-windows-11-for-them/" target="_blank" rel="noopener noreferrer">Windows Latest</a> </article> <article> <h1>WebiProg: Server Outsourcing & Cloud Integration für sichere und skalierbare IT-Infrastrukturen</h1> Thu, 24 Sep 2026 17:19:11 +0200 ... Server-Systeme. Dabei werden sowohl Windows Server als auch Linux- und Unix-Umgebungen sowie virtuelle Server auf Basis von VPS und VDS betreut. <a href="https://tsecurity.de/weiterlesen/4154256/4209797/webiprog-server-outsourcing-cloud-integration-fuer-sichere-und-skalierbare-it-infrastrukturen/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>5 Rust-Written CLI Tools That Replace Legacy Unix Commands on Linux</h1> Thu, 24 Sep 2026 17:13:14 +0200 Discover five production-ready Rust CLI tools that replace legacy Unix commands with faster, more intelligent alternatives. From syntax highlighting to fuzzy directory navigation, these tools transform terminal productivity. <a href="https://tsecurity.de/weiterlesen/4154070/4209611/5-rust-written-cli-tools-that-replace-legacy-unix-commands-on-linux/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: icsharpcode/ILSpy v11.1 (23.09.2026)</h1> Thu, 24 Sep 2026 17:09:25 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">icsharpcode/ILSpy</a>v11.123.09.2026@christophwille</div><div class="github-feed-changelog">Want to learn how we built the Avalonia port of ILSpy? Join us October 6th for <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">Move over, WPF! Avalonia for X-Plat Desktop Apps (with a lot of AI help) </a> A major focus of this release was to find the small (and not so small) bugs of the decompiler via a revamp of our testing by adding two new tools that allow mass-testing (for more information see <code>TestTools/README.md</code>): <ul> <li><code>nugetfuzz</code>: downloads packages from nuget.org and runs them through a DEBUG build of <code>ilspycmd</code> (sanity checks/assertions enabled). It records: crash, assertion fail, warnings in the decompiler output (as comment "IL_<nnnn>: ...") as well as any residue of compiler-generated identifiers in C# code (hints at missing language feature/pattern support).</li> <li><code>decompdiff</code>: runs an assembly through two different versions of the decompiler (driven via <code>ilspycmd</code>) and calculates a diff of the generated source code.</li> </ul> You should see better decompilation results as an effect of this push and the general push of fixing previously reported decompiler bugs by users. New Language Features <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4014</a>: Emit C# 7.1 default literals where the context supplies the type</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3930</a>: Decompile C# 14 implicit span conversions (first-class span types)</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3975</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3624</a>: decompile semi-auto properties with the C# 14 field keyword</li> </ul> User Interface <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4039</a>: Fix five Avalonia UI regressions: mouse navigation, derived types, Enter, Delete, Analyze in the Analyzer pane</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4056</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4054</a>: Accept drops from sources that do not permit the Move effect</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4150</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4146</a>: keep Options section names readable on hover</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3998</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3996</a>: edit the display font size in points, not pixels</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4154</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3526</a>: show WPF resource entry names unescaped</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4139</a>: Scroll a node's new children into view when it is expanded</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4129</a>: Reject the name of an existing list in the assembly list prompt</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4116</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2093</a>: find a navigation target in a reference assembly too</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4117</a>: Empty the panes when the assembly list is cleared</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4044</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4040</a>: Compose accessibility and static overlays onto search result icons</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4025</a>: Fix package search and navigation follow-ups from <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4023</a></li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3997</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3993</a>, <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3994</a>: main-menu shortcuts and dark-mode hover tooltips</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4002</a>: Give dark-theme syntax colors a perceptual contrast floor</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3989</a>: Prevent double dark conversion of syntax colors</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3988</a>: Keep the editor zoom separate from the configured font size</li> </ul> Contributions <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4133</a>: Remove the delegate cache left by a discarded method-group conversion — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@dualfroz</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4134</a>: Recognize a VB exception filter's type test — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@dualfroz</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4053</a>: Handle unresolved value-type call targets — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@sonyps5201314</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4022</a>: Improve floating-point fraction and negative constant reconstruction — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@SychicBoy</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3897</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3894</a>: keep lambda parameter typing consistent — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@sailro</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3888</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3853</a>: infer scoped locals from ref safety — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@sailro</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3887</a>: Model scoped and UnscopedRef lifetimes in the type system — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@sailro</a>, thank you!</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3980</a>: Keep instance-dependent assignments in constructors — <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">@sailro</a>, thank you!</li> </ul> Performance <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4156</a>: Keep the UI responsive while searching and drawing reference nodes</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4106</a>: Read the file system once per reference closure, not per reference</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4023</a>: Search inside packages without stalling, and navigate to what it finds</li> </ul> Enhancements <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4158</a>: Invent a syntax for <code>ldtoken</code>.</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4147</a>: Share the lookup and overload-resolution stages</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4144</a>: Share one escalation loop across the member-reference builders</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4091</a>: Split StackType.O into StackType.Obj+StackType.VT</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4113</a>: Remove ITypeReference</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4090</a>: Extend InferType() to every ILInstruction</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4089</a>: Always pass the type system into InferType().</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4085</a>: Pass the compilation to ILInstruction.CheckInvariant</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4077</a>: Improvements for type inference</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4075</a>: Infer the C# type of ldlen</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4064</a>: Expand nested conditional operators back into if-else</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4062</a>: Detect local functions renamed by obfuscators</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4070</a>: Drop isReferenceType when erasing unknown types</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4071</a>: Improve types for variables generated from stack slots</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4068</a>: Type inference for switch-expressions</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4065</a>: Insert casts in switch expression to ensure a best common type exists</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4047</a>: Bound every .resources length against the remaining stream before allocating</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4048</a>: Never size bundle entry decompression from the manifest's declared size</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4046</a>: Cap LightJson parser nesting depth to prevent stack overflow</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4006</a>: Tidy up the resolve-result hierarchy and document the tuple-cast rule</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4005</a>: Merge tuple element names during type inference</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4008</a>: Make ThisResolveResult an ILVariableResolveResult of the this parameter</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3974</a>: Extend UseLambdaSyntax to emit statement lambdas</li> </ul> ILSpyCmd <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4101</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3154</a>: accept single-file bundles as ilspycmd input</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4063</a>: Accept member IDs without a signature in --navigateto</li> </ul> Documentation <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4112</a>: Update Unix/Mac setup guidance</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4067</a>: Add code review guidance and require Assisted-by on every agent commit</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4051</a>: Require spec references and design sign-off for engine changes</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3999</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3664</a>: Move ipynb to Verso and adapt to v11 API surface</li> </ul> Testing / Infrastructure <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4161</a>: Rule out non-Framework processes without reading their modules</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4131</a>: Make every nugetfuzz finding traceable to the assembly it came from</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4128</a>: Report compiler-generated names leaking into decompiled output</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4125</a>: September 2026 NuGet Updates</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4115</a>: decompdiff: build both sides by default, add --no-build</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4104</a>: Fix decompdiff bad diffs</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4097</a>: Wait for the resolved dependencies, not for the application to go idle</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4088</a>: Widen decompdiff reference probing and prune unfixable misses</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4087</a>: Report field naming violations as suggestions</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4081</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4079</a>: make stable Roslyn restorable from the solution directory</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4083</a>: Synchronize headless UI tests on idle and hit-tested clicks</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4078</a>: Run decompdiff against git refs, and build a corpus from nuget's most-downloaded packages</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4069</a>: Update NuGet packages; adapt to Dock.Serializer.SystemTextJson 12.1.0.6</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4074</a>: Bind each corpus assembly against its own reference-assembly pack</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4073</a>: Wait for the click target instead of counting frames</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4060</a>: Pin the deconstruction shapes the transform has to keep matching</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4050</a>: <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2764</a>: Add regression test for duplicate assembly references</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4032</a>: Tie the .NET Framework fixture host to the test host's lifetime</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4033</a>: Use server GC for the decompiler test suite (workstation GC on the shared Windows CI runner)</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4035</a>: Render a frame while the headless UI tests wait</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4029</a>: Walk the whole decompiler pipeline in the Debug Steps pane</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4013</a>: Add ILAst output to ilspycmd debug builds</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4012</a>: Stop ILSpy.Tests from retaining every test's app graph (15 GB -> 0.7 GB)</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4020</a>: Add TestTools with the nugetfuzz and decompdiff corpus tools</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4009</a>: Aim the tree-gesture pointer tests at a hit-testable row</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4007</a>: Fix pre-commit hook failure when package source mapping is active</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3991</a>: Cover the field-keyword name collisions with fixtures</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3982</a>: Remove UI tests that only restate the code they cover</li> </ul> Bug Fixes <ul> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4162</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3316</a>: keep unresolved plain XAML properties plain</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4119</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2372</a>: report a field's address loads on their own</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4043</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3282</a>: leave out trailing optional arguments in indexer accesses</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4132</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3320</a>: detect dynamic await in pre-Roslyn state machines</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4130</a>: Look past comment placeholders when matching statement sequences</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4127</a>: Ignore nullability when comparing backing field and property type of auto properties</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4124</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2823</a> and add a PDB verification mode to nugetfuzz</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4111</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3568</a>: read a record's member order off its generated members</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4110</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2930</a>: follow references past the ones a document's assembly names</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4109</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2919</a>: keep a settings file that cannot be parsed</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4108</a>: Fix the parts of <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2253</a> that still reproduce</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4105</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2080</a>: resolve GAC references onto the installed version</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4103</a>: <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3315</a>, <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2253</a>: make exported WPF projects build without hand edits</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4102</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3315</a>: make exported WPF projects reproduce their resources</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4100</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3008</a>: local function forwarding a display class loses its scope</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4098</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#2054</a>: repair a chain of type forwarders that cycles</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4096</a>: Fix two BAML bugs that make the decompiled XAML unwritable</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4057</a>: Fix uncompilable lambda parameter lists</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4086</a>: Parenthesize a ref-conditional assignment target</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4084</a>: Fix the C# 14 field keyword being printed next to a surviving backing field</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4080</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3714</a>: declare a local function in its innermost capture scope</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4072</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3704</a>: keep the static type of a dynamic call target</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4021</a>: Add an async/await pattern test suite and fix the await operand conversions it found</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4024</a>: Avoid using query expressions if there's indications that lambda parameter types cannot be omitted.</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3964</a>: Delay exceptions when copy-propagating an address into a StObj target</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3920</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#1142</a>: recover enum members for out-of-range constant operands</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3995</a>: Report a call as unresolvable when nothing matched at all</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4000</a>: Fix <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3729</a>: recognize value-type ctor call on unresolved declaring type</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#4001</a>: Print the init-only marker after the set keyword again</li> <li>PR <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">#3973</a>: Fix the remaining deconstruction issues</li> </ul> For a full list of changes click <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">here</a>. This release is based on <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">.NET 10.0</a>. Please make sure that you have it installed on your machine beforehand. Note for Mac users: see <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">https://github.com/icsharpcode/ILSpy/wiki/Build-Artifacts#running-the-macos-artifact</a> because the ILSpy.app is neither signed nor notarized. Want to learn how we do PR reviews these days? Check out <a href="https://tsecurity.de/weiterlesen/4154024/4209565/github-release-icsharpcodeilspy-v111-23092026/" target="_blank" rel="noopener noreferrer">Stampeded</a>.</div></div> </article> <article> <h1>Unix-Betriebssystem: NetBSD 10.2 verbessert Hardware-Unterstützung & Sicherheit</h1> Thu, 24 Sep 2026 08:02:18 +0200 Mit NetBSD 10.2 steht das zweite Point-Release dieser Ausgabe des Unix-Betriebssystems zum Download bereit. Im Fokus des Updates stehen ein verbesserter Hardware-Support, Sicherheitspatches sowie Aktualisierungen von Systemkomponenten. <a href="https://tsecurity.de/weiterlesen/4146486/4202027/unix-betriebssystem-netbsd-102-verbessert-hardware-unterstuetzung-sicherheit/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>A 1980s PDP-11 is still running Unix – and now you can watch</h1> Wed, 23 Sep 2026 17:56:21 +0200 Fresh from releasing TMOG, his take on a cross-platform Task Manager upgrade, former Microsoft engineer Dave Plummer has put his PDP-11 on the web. The PDP-11 is a family of minicomputers from Digital Equipment Corporation that became a fixture of computing labs and early Unix history. Plummer's machine is real 1980s hardware, still running a... <a href="https://tsecurity.de/weiterlesen/4136169/4191710/a-1980s-pdp-11-is-still-running-unix-and-now-you-can-watch/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Amiga Unix: Vergessenes Commodore-System soll bewahrt werden</h1> Wed, 23 Sep 2026 12:33:41 +0200 Amiga Unix war ein kurzlebiges und unbekanntes Workstation-Betriebssystem, das von einigen Entwicklern nicht aufgegeben wird. (Amiga, Dateisystem) <a href="https://tsecurity.de/weiterlesen/4133226/4188767/amiga-unix-vergessenes-commodore-system-soll-bewahrt-werden/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Commodore's forgotten Amiga Unix gets a modern revival</h1> Tue, 22 Sep 2026 11:35:21 +0200 A vintage Unix window manager and an entire vintage UNIX operating system that uses it have received modern updates. Yes, AI helped, but we're here for it. The Commodore Amiga is one of the best-loved computers of the 1980s: The Register celebrated its 30th anniversary in 2015. Its many fans remember it primarily as a home computer and, in its... <a href="https://tsecurity.de/weiterlesen/4119808/4175349/commodores-forgotten-amiga-unix-gets-a-modern-revival/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Gopass: Open-source command-line password manager for teams</h1> Mon, 21 Sep 2026 07:05:21 +0200 Gopass is a free, open-source password manager that stores credentials in an encrypted store and runs from the command line. Its maintainers built it as a drop-in replacement for pass, the standard Unix password manager. Out of the box, Gopass encrypts each secret with GPG and keeps the store in a git repository. Git gives a team a record of every... <a href="https://tsecurity.de/weiterlesen/4108470/4164011/gopass-open-source-command-line-password-manager-for-teams/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>zi v2.2.1</h1> Mon, 21 Sep 2026 00:07:47 +0200 ✨ A Swiss Army Knife for Zsh - Unix Shell <a href="https://tsecurity.de/weiterlesen/4106849/4162390/zi-v221/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>What YouTubers do y'all watch?</h1> Sun, 20 Sep 2026 08:23:09 +0200 It seems like pretty often I find a new YouTuber in the Linux or just the old computers/tinkering/UNIX-Like community that is just like a huge bigot or has a super edgelord 4chan esque community. it's really annoying especially for the most recent one I found because I liked his videos and then I went to his discord and found alllllll that. so I... <a href="https://tsecurity.de/weiterlesen/4103603/4159144/what-youtubers-do-yall-watch/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: falcosecurity/falco v0.45.0-rc4 (18.09.2026)</h1> Fri, 18 Sep 2026 12:23:33 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/4098648/4154189/github-release-falcosecurityfalco-v0450-rc4-18092026/" target="_blank" rel="noopener noreferrer">falcosecurity/falco</a>v0.45.0-rc418.09.2026@leogr</div><div class="github-feed-changelog">feat(falco): expose reload status and Unix socket control Add process identity, reload generations, and readiness observation through GET /reload for Falco Operator integration. Publish readiness after all enabled sources start and distinguish rejected validation from application. Add an opt-in Linux Unix socket listener. POST /reload queues a request and returns 202 with a generation baseline; clients poll GET /reload for the outcome. Keep POST exclusive to the Unix socket and document TCP observation independently of reload_control. Protect the socket with directory ownership, permissions, path checks, and exclusive listener ownership. Validate its directory during dry-run before stopping the active runtime, repeat checks at startup, and reject multipart bodies. Cover status semantics, HTTP behavior, credential isolation, cleanup, invalid directories, and real reloads with the existing C++ test suite. Signed-off-by: c2ndev <cannarella.dev@gmail.com></div></div> </article> <article> <h1>CVE-2026-73411 | ericcornelissen Shescape up to 2.1.13/3.0.0 dash.js getEscapeFunction information disclosure</h1> Sun, 13 Sep 2026 14:20:25 +0200 A vulnerability was found in ericcornelissen Shescape up to 2.1.13/3.0.0. It has been classified as problematic. This impacts the function getEscapeFunction of the file src/internal/unix/dash.js. This manipulation causes information disclosure. This vulnerability appears as CVE-2026-73411. The attack may be initiated remotely. There is no... <a href="https://tsecurity.de/weiterlesen/4044338/4099879/cve-2026-73411-ericcornelissen-shescape-up-to-2113300-dashjs-getescapefunction-information-disclosure/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Fascinating Article About Linux</h1> Sun, 13 Sep 2026 14:01:43 +0200 I don't use Linux, I haven't touched anything UNIX-related in decades, but this is a fascinating article worth reading: https://www.xda-developers.com/at-t-sued-berkeley-186-lines-unix-code-handed-market-linux/ submitted by /u/DeliciousCut4854 [link] [comments] <a href="https://tsecurity.de/weiterlesen/4043312/4098853/fascinating-article-about-linux/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Debian 13.7 point released...</h1> Sat, 12 Sep 2026 23:02:04 +0200 submitted by /u/unixbhaskar [link] [comments] <a href="https://tsecurity.de/weiterlesen/4028388/4083929/debian-137-point-released/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>CVE-2026-65183 | Apache Tomcat up to 9.0.120/10.1.57/11.0.24 Unix Domain Socket toctou (Nessus ID 344996)</h1> Sat, 12 Sep 2026 21:46:39 +0200 A vulnerability described as problematic has been identified in Apache Tomcat up to 9.0.120/10.1.57/11.0.24. The impacted element is an unknown function of the component Unix Domain Socket. The manipulation results in time-of-check time-of-use. This vulnerability was named CVE-2026-65183. The attack needs to be approached locally. There is no... <a href="https://tsecurity.de/weiterlesen/4027611/4083152/cve-2026-65183-apache-tomcat-up-to-901201015711024-unix-domain-socket-toctou-nessus-id-344996/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Yall like my fan art?</h1> Sat, 12 Sep 2026 21:32:37 +0200 I just drew this, and I’m not the best artist. Since I need to fill this up with a bunch of characters, I use arch + hyprland btw. Sometime soon I plan to post my rice on r/linuxporn, because linux doesn’t belong on Unixporn bc it’s gnu which isn’t Unix, but whatever. I hope you have a great day, and sorry for the rant. submitted by /u/Nuviket... <a href="https://tsecurity.de/weiterlesen/4026592/4082133/yall-like-my-fan-art/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>media.ccc.de: MRMCD2026 - Of Wayland, MicroVMs and more: Running Linux applications on OSX.</h1> Sat, 12 Sep 2026 17:04:13 +0200 YouTube Video<div class="youtube-description">https://media.ccc.de/v/2026-638-of-wayland-microvms-and-more-running-linux-applications-on-osx Apple's M-Series chips are very fast and popular, but it can be pretty difficult to run any software not made for their platform on these machines. This is a deep-dive into writing and using various translation layers to integrate Linux applications seemlessly into Mac OS X. If you happen to have access to a Mac powered by Apple Silicon, chances are you got frustrated with theses machines. On one side they are pretty fast, on the other running anything not sanctioned by Apple gets annoying just as quick. Even if you get all the security measures out of your way, you are still left with a platform, that has put up a bunch of barriers simply by doing things differently and refusing to adhere to common standards. OS X has it's own accelerated graphics api, spotty unix conformance, it's own UI toolkit and much more. Even though the ARM platform has gotten more common in recent years in desktop-grade machines, these chips also run on an unusual 16-bit page size. Which means not many previously existing binaries run without some kind of emulation or translation and Apple only provides those for older OS X software. You can deal with these by using virtual machines of course, but integration into the rest of the OS is usually severly lacking. In this talk we explore ways to overcome each and every one of these barriers one by one to make unmodified linux applications feel right at home on Mac OS X through a combination of various translation layers and other technologies. Drakulix https://talks.mrmcd.net/2026/talk/N9SNKN/ #mrmcd26 #InfrastructureandSoftware https://creativecommons.org/licenses/by-sa/4.0/</div> </article> <article> <h1>Which DE doesn't suck?</h1> Sat, 12 Sep 2026 00:01:58 +0200 So I install Rocky Linux 10 and try out the default environment (Gnome 49.4) and it is maybe the most broken and hostile UX in a DE in my life**. So what 2026 DE for Rocky LInux doesn't suck in its out-of-the-box configuration, and makes it easy to make the most common customizations? I'm a Unix user from way back, and have used Linux desktops,... <a href="https://tsecurity.de/weiterlesen/4005152/4060687/which-de-doesnt-suck/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Signaling from within: how eBPF interacts with signals</h1> Fri, 11 Sep 2026 06:27:08 +0200 Background Signals have been around since the UNIX First Edition in 1971 and while its semantics and system calls suffered changes throughout the years, its uses and application have remained largely the same. Usually, when we talk about signal semantics, we're talking about what userland can observe and interact with. After all, we mostly... <a href="https://tsecurity.de/weiterlesen/3995846/4051381/signaling-from-within-how-ebpf-interacts-with-signals/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Unlocking Power Safely: Privilege Escalation via Linux Process Capabilities</h1> Fri, 11 Sep 2026 06:27:00 +0200 Preamble In the realm of Linux security, administrators constantly grapple with a delicate balance between safeguarding sensitive system resources and accessibility. One helpful avenue that has garnered considerable attention in recent years is privilege escalation via Linux process capabilities. While traditional Unix-like permissions offer... <a href="https://tsecurity.de/weiterlesen/3995837/4051372/unlocking-power-safely-privilege-escalation-via-linux-process-capabilities/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>FreeBSD 14.5 erleichtert den Umstieg von Linux-Software</h1> Fri, 11 Sep 2026 02:12:36 +0200 FreeBSD 14.5-RELEASE bringt Linux-kompatibles inotify, aktualisierte Toolchains und behebt UEFI-Boot-Probleme. <a href="https://tsecurity.de/weiterlesen/3992603/4048138/freebsd-145-erleichtert-den-umstieg-von-linux-software/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>uac v3.4.0</h1> Fri, 11 Sep 2026 02:08:54 +0200 Portable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition, process hashing, and bodyfile creation via customizable YAML profiles. <a href="https://tsecurity.de/weiterlesen/3992399/4047934/uac-v340/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: openai/codex vrust-v0.154.0 (10.09.2026)</h1> Fri, 11 Sep 2026 02:07:59 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">openai/codex</a>vrust-v0.154.010.09.2026@github-actions[bot]</div><div class="github-feed-changelog"><h2>New Features</h2> <ul> <li>GPT-6-Astra is now available in the model picker and Amazon Bedrock catalogs. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42879</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42619</a>)</li> <li>Experimental worktree support lets you create isolated checkouts for new or forked sessions using <code>--worktree</code> or <code>/worktree</code>, then browse and resume them. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42652</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43069</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43120</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43286</a>)</li> <li>Answer questions inline while Codex continues working, using suggested choices or custom text without losing your main draft. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42891</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42894</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42897</a>)</li> <li>Windows sessions can now share a background Codex server, with daemon lifecycle commands and managed updates. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42405</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42392</a>)</li> <li>Vim editing gains <code>R</code> replace mode with undo and dot-repeat, plus more reliable Escape handling in legacy terminals. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42194</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42584</a>)</li> <li>Copying responses preserves formatting in rich-text apps, and <code>/copy</code> can copy status output or individual session fields. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42847</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43055</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Existing sessions pick up newly installed plugin tools and refresh skills and hooks after external plugin upgrades or rollbacks. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42284</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42593</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42990</a>)</li> <li>MCP connections coordinate OAuth token refreshes and surface login challenges when refresh fails, without automatically replaying rejected tool calls. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42413</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42552</a>)</li> <li>Startup avoids running workspace-controlled helpers before trust is established, and the macOS sandbox blocks terminal input injection. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42324</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42590</a>)</li> <li>Remote resume and fork operations preserve saved permissions; fresh sessions and forks respect server model defaults unless explicitly overridden. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43330</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43177</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43355</a>)</li> <li>Resuming a conversation open in another app now shows a read-only transcript with a retry option while preserving your draft. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43253</a>)</li> <li>Automatic approval reviews better preserve authorization context through compaction and reject approvals invalidated by new user instructions or answers. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42844</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42852</a>, <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43442</a>)</li> </ul> <h2>Documentation</h2> <ul> <li>Updated the bundled OpenAI Docs skill with GPT-6-Astra migration, compatibility, and prompting guidance. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42931</a>)</li> </ul> <h2>Chores</h2> <ul> <li>The deprecated <code>codex mcp-server</code> entry point is no longer available. (<a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42993</a>)</li> </ul> <h2>Changelog</h2> Full Changelog: <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">rust-v0.153.0...rust-v0.154.0</a> <ul> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42188</a> Fix punctuation in npm packaging documentation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42192</a> Use native spawning for bare macOS MCP commands <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42194</a> Add Vim replace mode to the TUI composer <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42196</a> Add managed worktree creation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42199</a> Refactor shared TUI input routing <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42202</a> Separate TUI preferences from server configuration <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42204</a> Add macOS voice runtime projection <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42207</a> Retry TUI reconnects while threads are closing <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42208</a> Add GNU Linux voice runtime preparation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42209</a> Add Windows voice runtime preparation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42247</a> Track history notes thread hint outcomes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42256</a> Skip Guardian scoring in User approval mode <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42270</a> Report the exec-server release version in environment info <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42284</a> Refresh plugin skills after out-of-process version changes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42288</a> Fetch rules_rs zlib packages from Ubuntu snapshots <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42290</a> Expand Guardian history coverage across resume and rollback <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42293</a> Preserve verified answers across history compaction <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42298</a> Preserve retained answers across steer rollbacks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42306</a> Stabilize the detached exec-server session resume test <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42309</a> Separate Windows sandbox provisioning from ACL refresh <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42314</a> Preserve target-native cwd in permission approval requests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42316</a> Refactor exec-server startup futures <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42318</a> Support packaged managed Codex binary paths <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42319</a> Show live context compaction status in the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42320</a> Make the app-server thread unload delay configurable <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42324</a> Avoid executing PATH helpers before workspace trust <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42325</a> Render completed assistant messages directly during replay <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42326</a> Harden Windows control socket rendezvous <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42328</a> Support durable reasoning configuration updates <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42330</a> Protect Windows sandbox binaries from inherited write access <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42332</a> Package prepared runtimes with the voice host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42334</a> Add a Windows sandbox provisioning protocol <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42337</a> Add an authenticated Windows sandbox provisioning client <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42341</a> Add Windows sandbox service lifecycle scaffolding <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42342</a> Harden Windows sandbox provisioning file handling <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42344</a> Prepare managed policy validation for Windows sandbox provisioning <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42348</a> Add Windows sandbox client authentication <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42351</a> Enable authenticated Windows sandbox provisioning <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42353</a> Add experimental Windows sandbox service provisioning <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42354</a> Add free-form asynchronous user messages <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42356</a> Initialize questions in buffered replay test messages <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42358</a> Extend rate limit reads with usage capabilities <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42364</a> Support graceful daemon shutdown on Windows <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42366</a> List managed worktrees for a repository <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42369</a> Keep SQLite history projection moving past invalid records <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42370</a> Improve MCP server startup error logging <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42372</a> Add Luna Reserve usage fallback to the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42373</a> Add attributed exec process lifecycle telemetry <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42374</a> Extract PID startup into a dedicated module <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42375</a> Clean up Windows sandbox resources on app uninstall <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42377</a> Make app-server realtime sessions always available <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42378</a> Route rollout reads through the canonical JSON decoder <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42380</a> Require confirmation for safety-buffered retries <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42381</a> Support managed app-server lifecycle on Windows <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42383</a> Update rmcp to 3.2.0 <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42384</a> Add an RMCP OAuth credential store adapter <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42385</a> Add experimental context management activation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42386</a> Expose loaded thread environments in app-server responses <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42388</a> Recover deferred environments after provisioning failure <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42391</a> Authorize <code>apply_patch</code> in the executor path context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42392</a> Support managed daemon updates on Windows <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42395</a> Expose the Codex version to commands and turn metadata <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42397</a> Extract focused TUI logic into submodules <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42399</a> Preserve restored input after resolved misalignment errors <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42401</a> Discover TUI collaboration modes from the app server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42403</a> Expose the last accepted environment ready report <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42404</a> Read voice helper frames independently of pipe chunks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42405</a> Support the app-server daemon on Windows <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42406</a> Honor explicit plugin mentions during MCP startup <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42408</a> Harden embedded composer input handling <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42410</a> Allow reviewing and continuing misalignment-paused chats <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42413</a> Enable coordinated MCP OAuth refresh <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42417</a> Expose managed application network requirements <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42419</a> Add session resume to the agent command center <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42422</a> Honor model requirements in Guardian computer-use scoring <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42425</a> Discover TUI experimental features from the server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42428</a> Use the shared composer in the agent command center <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42432</a> Box the TUI resume picker future <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42445</a> Include originator in plugin measurement analytics <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42451</a> Acknowledge pending TUI steers by submission ID <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42453</a> Discover permission profiles from the app server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42455</a> Show live task details in the agent command center <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42458</a> Expose thread originators through the app-server API <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42529</a> Register the Guardian thread context feature flag <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42552</a> Preserve MCP authentication challenges on tool calls <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42577</a> Preserve target-native paths in command approvals <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42579</a> Persist verified user answers in Guardian thread context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42584</a> Recover Vim escape input in legacy terminals <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42588</a> Require Guardian review for incompatible compaction checkpoints <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42590</a> Harden the macOS sandbox against terminal input injection <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42593</a> Reload user config after local plugin installation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42596</a> Record Windows sandbox private desktop usage <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42598</a> Report MCP tool discovery errors in server status <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42602</a> Deprecate detached review delivery <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42603</a> Expose global metrics installation in <code>codex-otel</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42606</a> Support trusted headers for remote exec WebSockets <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42607</a> Add GPT-6-Astra to the bundled model catalog <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42609</a> Condense TUI startup warnings <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42619</a> Add GPT-6-Astra to Amazon Bedrock catalogs <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42623</a> Bound Noise handshakes by the exec server initialization timeout <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42624</a> Centralize prompt image detail modes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42631</a> Initialize the packaged GStreamer runtime in the voice host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42634</a> Add an injectable attachment store to ThreadManager <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42638</a> Update GPT-6-Astra Fast tier speed description <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42639</a> Warn when saved model defaults are overridden <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42640</a> Harden TUI parsing of assistant markup <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42641</a> Restore the inline TUI after full-screen overlays <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42650</a> Render assistant file citations as local links <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42652</a> Add managed worktrees to <code>codex exec</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42654</a> Update the stable exec-server test to Codex 0.153.1 <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42657</a> Use a generic fallback model name in status tests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42667</a> Tailor TUI cyber refusal notices to Daybreak eligibility <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42668</a> Cancel remote control enrollment on stdio shutdown <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42671</a> Preserve TUI sessions while starting replacement threads <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42674</a> Persist server-advertised experimental features from the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42676</a> Add WebRTC negotiation to the voice host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42677</a> Narrow async user message guidance <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42682</a> Fix the worktrees experimental feature test fixture <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42716</a> Allow trusted symlinks beneath CODEX_HOME on macOS <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42718</a> Gate unified exec TTY support behind a feature flag <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42741</a> Make the TUI symlink startup test Bazel-compatible <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42744</a> Honor model-provided Guardian review policies <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42746</a> Handle pending network reviews after process completion <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42749</a> Improve automatic thread naming in the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42752</a> Preserve response IDs for fast collaborator tool events <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42755</a> Stabilize the interactive tmux startup safety test <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42758</a> Propagate response tickets to Guardian reviews <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42762</a> Retain user instructions in guardian thread context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42767</a> Avoid port races in streamable HTTP tests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42770</a> Preserve acceptance order in retained thread context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42773</a> Avoid holding metadata permit during cold resume config load <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42781</a> Add direct SigV4 transport to exec-server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42791</a> Keep TUI prompt history tied to local settings <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42792</a> Extract the note input view into its own module <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42798</a> Add data-use disclosures to the user report dialog <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42801</a> Keep the Windows sandbox command runner hidden <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42807</a> Add request-scoped Guardian approval decisions <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42811</a> Enable staging login issuer overrides in packaged builds <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42814</a> Support custom report event titles <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42819</a> Route Guardian approvals independently of async scoring <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42821</a> Report managed filesystem policy in <code>codex doctor</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42823</a> Expose managed WebMCP policy through the app server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42824</a> Refine user input guidance for GPT-6 <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42832</a> Preserve root authorization context in Guardian reviews <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42833</a> Preserve SystemRoot for Windows sandbox wrapper setup <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42835</a> Preserve Windows managed deny reads in the sandbox CLI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42836</a> Make GPT-6-Astra user input guidance conditional <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42838</a> Preserve executor paths in Guardian approval reviews <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42841</a> Add a native Windows MXC sandbox adapter <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42842</a> Add Astra sparkle effects to the TUI composer <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42844</a> Retain user instructions in Guardian context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42847</a> Preserve Markdown formatting when copying TUI responses <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42850</a> Use jemalloc for Linux musl binaries <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42852</a> Harden Guardian reviews after context compaction <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42854</a> Persist Daybreak preferences in thread metadata <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42863</a> Preserve precedence across feature requirement aliases <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42870</a> Avoid redundant filesystem sandbox path resolution <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42879</a> List GPT-6-Astra in the model picker <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42883</a> Add client-side exec-server RPC attempt metrics <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42889</a> Add TUI building blocks for inline async question editing <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42891</a> Integrate asynchronous questions into the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42894</a> Support selectable answers for asynchronous TUI questions <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42897</a> Add inline Other answers to async question choices <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42900</a> Establish root turn identity for independent tasks and memory requests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42903</a> Preserve TUI question state and integrate history and queue navigation <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42904</a> Use static instructions for the Default collaboration mode <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42931</a> Update OpenAI Docs skill guidance for GPT-6 Astra <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42933</a> Wait for turn analytics before shutting down the Guardian v2 test <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42990</a> Refresh session hooks after external plugin updates <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#42993</a> Remove the deprecated <code>codex mcp-server</code> command <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43000</a> Preserve the resolved multi-agent version when reverting threads <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43002</a> Replace Guardian tickets with parent response IDs <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43005</a> Add Guardian V2 failure reasons and connection timing metrics <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43031</a> Keep refreshed MCP tool catalogs with their clients <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43039</a> Refresh live thread tools through <code>app/installed</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43043</a> Avoid filesystem scans when seeding the agents overview <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43055</a> Allow <code>/copy</code> to copy status output and individual fields <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43069</a> Support managed worktrees for interactive sessions and forks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43070</a> Clarify comments in CI setup and the Rust workflow <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43074</a> Show a retryable error when the apps popup fails to load <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43079</a> Add opt-in local audio devices to the voice helper <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43083</a> Supply Bazel-managed CMake and Ninja for the bundled Opus build <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43090</a> Send processed microphone audio over RTP in voice-host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43097</a> Add a helper-backed realtime WebRTC session API <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43099</a> Add receipt-verified native voice SDK export <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43100</a> Add bounded incoming Opus RTP handling to the voice host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43102</a> Include GIO in voice SDKs and native runtimes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43104</a> Move Guardian thread context into <code>guardianv2</code> configuration <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43109</a> Add explicit toolchain inputs for native voice builds <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43110</a> Record reasoning effort changes in conversation history behind a flag <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43111</a> Add a Bazel target for native voice dependencies <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43113</a> Save subagent and memory opt-ins through the app server <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43114</a> Add Bazel preparation for native voice runtimes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43117</a> Link Unix Bazel bindings against the prepared voice runtime <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43120</a> Add managed worktree creation to TUI session commands <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43121</a> Require a prepared runtime when assembling voice helper packages <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43125</a> Add explicit Windows tool selection for native voice builds <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43126</a> Expose native Windows build tools through Bazel targets <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43144</a> Add Windows MSVC Bazel targets for native voice libraries <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43147</a> Gate experimental context by model capability at session startup <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43177</a> Use server model defaults for fresh TUI startup <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43178</a> Allow guarded legacy resume with background migration enabled <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43244</a> Add bounded GStreamer playback components to the voice host <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43248</a> Connect voice-host RTP audio to speaker playback <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43253</a> Show read-only conversations when resume encounters an active writer <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43261</a> Use server defaults when starting TUI background tasks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43265</a> Add experimental user verification API contracts <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43279</a> Include linked worktrees in TUI session discovery <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43281</a> Move npm package staging into a separate release workflow job <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43282</a> Make Bazel binary stamping opt-in <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43286</a> Add a managed worktree browser to the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43289</a> Add capability-gated MCP user-verification handling <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43298</a> Defer managed worktree transitions to fresh TUI loop iterations <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43304</a> Isolate Bazel build commit metadata from Rust compilation inputs <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43308</a> Replace Windows app-server shutdown files with socket requests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43315</a> Resolve session labels uniquely before acting on them <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43325</a> Sort JSON schema object keys for consistent Cargo and Bazel output <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43330</a> Preserve saved permissions when resuming or forking remote tasks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43340</a> Enable remote named permission profile selection in the TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43352</a> Add opt-in MCP user-verification transport <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43355</a> Let the app server resolve implicit model settings for CLI forks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43359</a> Show the server's model provider ID in TUI status <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43360</a> Use app-server metadata for TUI session restoration <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43376</a> Defer resume picker and directory changes to a fresh TUI stack <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43408</a> Avoid WebSocket connection waits in Guardian v2 classification <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43419</a> Initialize <code>cwd</code> in TUI resume and fork test fixtures <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43421</a> Remove the app-server README and its contributor guidance references <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43423</a> Remove the app-server docs update requirement from <code>AGENTS.md</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43426</a> Handle Luna HTTP requests in guardian history tests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43428</a> Notify opted-in stdio MCP servers of auth changes <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43432</a> Route approvals through the extension decision API <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43442</a> Keep Guardian review evidence consistent and reject stale approvals <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43444</a> Pin V8 release manifests and prevent published release replacement <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43447</a> Route MCP elicitations through the shared approval decision path <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43454</a> Add diagnostic labels to shell snapshot capture metrics <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43456</a> Wait for thread idle before rollback in model-switching tests <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43458</a> Centralize Guardian context mode and checkpoint policy <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43462</a> Remove legacy Guardian approval review paths <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43472</a> Recover missing Guardian root instructions in acceptance order <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43478</a> Retain inherited Guardian instructions in standalone forks <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43490</a> Expose shared Guardian reviewer helpers through <code>guardian_review</code> <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43491</a> Include unloaded children in multi-agent v2 environment context <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43494</a> Limit archive rollout reads to requested threads <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43495</a> Allow internal sessions to fork from selected history <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43504</a> Treat zombie processes as inactive in the Unix PID backend <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43513</a> Expose a stable executor build identity in environment metadata <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> <li><a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">#43519</a> Set <code>recursion_limit</code> to 256 for app-server, exec, and TUI <a href="https://tsecurity.de/weiterlesen/3992354/4047889/github-release-openaicodex-vrust-v01540-10092026/" target="_blank" rel="noopener noreferrer">@copyberry</a></li> </ul></div></div> </article> <article> <h1>Linux Kernel Internals</h1> Fri, 11 Sep 2026 00:21:46 +0200 submitted by /u/unixbhaskar [link] [comments] <a href="https://tsecurity.de/weiterlesen/3991745/4047280/linux-kernel-internals/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>"Unix timestamp to Excel date: why serial 60 is a day that never existed"</h1> Mon, 07 Sep 2026 03:39:08 +0200 You paste 1756771200 into a spreadsheet and want to see a date. Or you export a sheet and your API receives a column of numbers like 46236.5 instead of dates. Both directions look trivial and both go wrong in the same three places: the epoch, the unit, and one fake day in February 1900. What the two numbers actually count A Unix timestamp is the... <a href="https://tsecurity.de/weiterlesen/3973930/4029464/unix-timestamp-to-excel-date-why-serial-60-is-a-day-that-never-existed/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Nushell in three spoonfuls: when does a structured shell actually help an agent?</h1> Mon, 07 Sep 2026 02:41:08 +0200 Prelude — Does structure actually help? In late August 2026, I heard Lorenzo Carbonell of atareao.es discuss Nushell and its advantage when working with structured data. One question stayed with me: could that structure genuinely improve my workflow? The Unix shell works well, but many of its pipelines depend on text, column positions, and options... <a href="https://tsecurity.de/weiterlesen/3971566/4027100/nushell-in-three-spoonfuls-when-does-a-structured-shell-actually-help-an-agent/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Spielserver: Unity und Mirror senken Betriebskosten signifikant - Börse Express</h1> Mon, 07 Sep 2026 02:01:43 +0200 Als sicherere Alternative für die lokale Kommunikation auf dem Server werden in Fachkreisen Unix-Domain-Sockets empfohlen. Die Verwaltung von ... <a href="https://tsecurity.de/weiterlesen/3969623/4025157/spielserver-unity-und-mirror-senken-betriebskosten-signifikant-boerse-express/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>HPR4721: HPR Community News for August 2026</h1> Mon, 07 Sep 2026 02:01:19 +0200 This show has been flagged as Explicit by the host. <h2>New hosts</h2> Welcome to our new hosts: <ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></li> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">number9</a></li> </ul> <h2>Last Month's Shows</h2> <table> <tr> <th>Id</th> <th>Day</th> <th>Date</th> <th>Title</th> <th>Host</th> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4696</a></td> <td>Mon</td> <td class="shrink">2026-08-03</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Community News for July 2026</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Volunteers</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4697</a></td> <td>Tue</td> <td class="shrink">2026-08-04</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Correcting the Dates of Files</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Vance</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4698</a></td> <td>Wed</td> <td class="shrink">2026-08-05</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">ID3 Tags and Vorbis Comments</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4699</a></td> <td>Thu</td> <td class="shrink">2026-08-06</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Sunshine, Moonlight, Playnite !?</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">operat0r</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4700</a></td> <td>Fri</td> <td class="shrink">2026-08-07</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Robert A. Heinlein: The Juveniles</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4701</a></td> <td>Mon</td> <td class="shrink">2026-08-10</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Elsbeth muses with Lee on her experiences and opinions on AI</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Elsbeth</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4702</a></td> <td>Tue</td> <td class="shrink">2026-08-11</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">MakeACopy is an open-source document scanner app for Android</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ken Fallon</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4703</a></td> <td>Wed</td> <td class="shrink">2026-08-12</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ebooks and Audiobooks</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4704</a></td> <td>Thu</td> <td class="shrink">2026-08-13</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Beer Garden 17 - Double DDH IPAs</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4705</a></td> <td>Fri</td> <td class="shrink">2026-08-14</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Free Software Is Wasted On You Teens</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Trollercoaster</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4706</a></td> <td>Mon</td> <td class="shrink">2026-08-17</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Quirks and Customisations</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Lee</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4707</a></td> <td>Tue</td> <td class="shrink">2026-08-18</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">UNIX Curio #12 - expr</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Vance</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4708</a></td> <td>Wed</td> <td class="shrink">2026-08-19</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Programmable Logic Controls - Episode 1</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4709</a></td> <td>Thu</td> <td class="shrink">2026-08-20</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Peertube: my two penneth</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4710</a></td> <td>Fri</td> <td class="shrink">2026-08-21</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Civilization VI</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4711</a></td> <td>Mon</td> <td class="shrink">2026-08-24</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Second-Hand Phone</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TrumpetJohn</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4712</a></td> <td>Tue</td> <td class="shrink">2026-08-25</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">friedcamp interviews part 1: Wim van Gool</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4713</a></td> <td>Wed</td> <td class="shrink">2026-08-26</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">July2026 Community News response, and Future Plans</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TheDUDE</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4714</a></td> <td>Thu</td> <td class="shrink">2026-08-27</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Beer Garden 18 - Amber Ale</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kevie</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4715</a></td> <td>Fri</td> <td class="shrink">2026-08-28</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">friedcamp interviews part 2: Thomas Farstrike</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a></td> </tr> <tr> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">4716</a></td> <td>Mon</td> <td class="shrink">2026-08-31</td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">PocketMod</a></td> <td><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TrumpetJohn</a></td> </tr> </table> <h2>Comments this month</h2> <h3>Past shows</h3> <ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr3708</a> (2022-10-19) "Insomnia as a Hobby" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TrumpetJohn</a>. </li> <ul> <li>Robert St.Preux said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Insomnia as a hobby</a>" (2026-08-30 00:56:59) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr3766</a> (2023-01-09) "ACER Nitro 5 laptop review" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Bookewyrmm</a>. </li> <ul> <li>wevaba6950 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">A refreshing contrast between enterprise gear and low-power hardware</a>" (2026-08-10 09:19:47) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: a refreshing contrast...</a>" (2026-08-12 02:54:05) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4581</a> (2026-02-23) "Sharp Intake of Breath City (A.K.A.) How I learnt to stop worrying about the fork bomb" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">not_toby</a>. </li> <ul> <li>Windigo said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Fantastic episode</a>" (2026-08-08 16:51:00) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4655</a> (2026-06-05) "Tips for Glasses" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">norrist</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Glasses and age</a>" (2026-08-06 11:41:39) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4676</a> (2026-07-06) "HPR Community News for June 2026" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Volunteers</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4657 :: UNIX Curio #8</a>" (2026-08-02 19:29:26) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4677</a> (2026-07-07) "UNIX Curio #10 - Checksums and Hashes" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Vance</a>. </li> <ul> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Checksums and HPR4677</a>" (2026-07-31 00:37:40) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4678</a> (2026-07-08) "High Resolution Elapsed Time in Shell Scripts" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to Whiskeyjack and candycanearter07 </a>" (2026-08-03 10:12:47) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4692</a> (2026-07-28) "Noise Music Tutorial 2: Using Audacity to Make Noise" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TheDUDE</a>. </li> <ul> <li>Windigo said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Audacity for noise music</a>" (2026-08-06 16:09:59) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: Audacity for noise music</a>" (2026-08-12 18:55:18) </li> </ul> </ul> <h3>This month's shows</h3> <ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4696</a> (2026-08-03) "HPR Community News for July 2026" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR Volunteers</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Amateur Radio Field Days</a>" (2026-08-02 11:50:11) </li> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4673 First contact</a>" (2026-08-03 10:16:09) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: mic issues</a>" (2026-08-03 22:21:42) </li> <li>Th3Dud3 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">response to Kevin not being able to get cream ale</a>" (2026-08-06 00:12:38) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4697</a> (2026-08-04) "Correcting the Dates of Files" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Vance</a>. </li> <ul> <li>Jim DeVore said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Useful episode!</a>" (2026-08-04 10:53:12) </li> <li>Vance said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Modifying metadata</a>" (2026-08-07 01:44:51) </li> <li>Henrik Hemrin said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Exif in digiKam</a>" (2026-08-08 19:20:13) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">useful!</a>" (2026-08-10 16:08:18) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4698</a> (2026-08-05) "ID3 Tags and Vorbis Comments" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a>. </li> <ul> <li>xmanmonk said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Great episode!</a>" (2026-08-05 15:19:01) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">quirks in hpr</a>" (2026-08-05 15:52:18) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to xmanmonk in HPR4698 - ID3 Tags</a>" (2026-08-06 00:12:26) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to candycanearter07 in HPR4698 ID3 tags</a>" (2026-08-06 00:28:48) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4703</a> (2026-08-12) "Ebooks and Audiobooks" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Ahuka</a>. </li> <ul> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">useful!!</a>" (2026-08-12 02:30:58) </li> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Audiobooks and Audible</a>" (2026-08-12 09:06:40) </li> <li>Jack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Misleading</a>" (2026-08-12 17:05:21) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4705</a> (2026-08-14) "Free Software Is Wasted On You Teens" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Trollercoaster</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Brilliant! </a>" (2026-08-03 14:08:08) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">One left in my six pack</a>" (2026-08-14 07:53:38) </li> <li>old guy said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">:-)</a>" (2026-08-14 09:24:15) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">old guys together</a>" (2026-08-14 13:14:48) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">good satire again</a>" (2026-08-14 21:42:55) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Who's talking about satire?</a>" (2026-08-15 07:54:33) </li> <li>Trollercoaster (our of character) said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Woopsie</a>" (2026-08-16 19:25:41) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4706</a> (2026-08-17) "Quirks and Customisations" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Lee</a>. </li> <ul> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">cool ep!</a>" (2026-08-30 20:15:40) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4707</a> (2026-08-18) "UNIX Curio #12 - expr" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Vance</a>. </li> <ul> <li>xmanmonk said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Another great show</a>" (2026-08-18 22:22:56) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR4707 Unix curio - dc</a>" (2026-08-19 14:31:02) </li> <li>Vance said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">dc</a>" (2026-08-20 04:47:32) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR4707 Unix curio - Stack Machines</a>" (2026-08-21 16:00:48) </li> <li>Trollercoaster said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Suggestion for Linux Curio</a>" (2026-08-27 10:42:43) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Obscure X Window programs</a>" (2026-08-27 16:16:15) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: Suggestion for Linux Curio</a>" (2026-08-27 18:13:51) </li> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: Suggestion for Linux Curio</a>" (2026-08-28 10:07:31) </li> <li>Vance said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Thanks for the ideas</a>" (2026-08-28 16:39:28) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to Vance on episode research</a>" (2026-08-30 04:14:01) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">re: re: Suggestion for Linux Curio</a>" (2026-08-30 12:06:31) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4708</a> (2026-08-19) "Programmable Logic Controls - Episode 1" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Whiskeyjack</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Thanks you</a>" (2026-08-08 10:49:34) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to Archer72 on HPR4708 - PLCs Episode 1</a>" (2026-08-08 17:11:10) </li> <li>Trey said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Memories of Ladder Logic</a>" (2026-08-19 13:01:41) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to Trey on HPR4708 - PLCs Episode 1</a>" (2026-08-20 02:02:44) </li> <li>Trey said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Cyber in ICS</a>" (2026-09-02 22:31:51) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Reply to Trey on Cyber in ICS</a>" (2026-09-03 15:24:51) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4709</a> (2026-08-20) "Peertube: my two penneth" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kevie</a>. </li> <ul> <li>xmanmonk said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Thanks for the episode</a>" (2026-08-20 19:15:57) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4711</a> (2026-08-24) "Second-Hand Phone" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TrumpetJohn</a>. </li> <ul> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">interesting!</a>" (2026-08-24 19:17:44) </li> <li>Whiskeyjack said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">HPR4711 - TCL Flip phone</a>" (2026-08-24 22:22:11) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4712</a> (2026-08-25) "friedcamp interviews part 1: Wim van Gool" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Kristoff</a>. </li> <ul> <li>Archer72 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Interview</a>" (2026-08-26 23:11:49) </li> <li>Laindir said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Fascinating interview!</a>" (2026-08-26 23:18:33) </li> </ul> <li><a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">hpr4716</a> (2026-08-31) "PocketMod" by <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">TrumpetJohn</a>. </li> <ul> <li>Kightlinger said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">I love PocketMods!</a>" (2026-08-31 17:35:43) </li> <li>candycanearter07 said: "<a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">analog solutions</a>" (2026-08-31 20:52:55) </li> </ul> </ul> <h2>Mailing List discussions</h2> Policy decisions surrounding HPR are taken by the community as a whole. This discussion takes place on the <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Mailing List</a> which is open to all HPR listeners and contributors. The discussions are open and available on the HPR server under <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Mailman</a>. The threaded discussions this month can be found here: <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">https://lists.hackerpublicradio.com/pipermail/hpr/2026-August/thread.html</a> <h2>Events Calendar</h2> With the kind permission of LWN.net we are linking to <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">The LWN.net Community Calendar</a>. Quoting the site: <blockquote>This is the LWN.net community event calendar, where we track events of interest to people using and developing Linux and free software. Clicking on individual events will take you to the appropriate web page.</blockquote> <a href="https://tsecurity.de/weiterlesen/3969488/4025022/hpr4721-hpr-community-news-for-august-2026/" target="_blank" rel="noopener noreferrer">Provide feedback on this episode</a>. </article> <article> <h1>Aha! Good stuffs are coming! Slackware Linux 16 in the offing!!</h1> Sun, 06 Sep 2026 02:01:10 +0200 submitted by /u/unixbhaskar [link] [comments] <a href="https://tsecurity.de/weiterlesen/3928647/3984181/aha-good-stuffs-are-coming-slackware-linux-16-in-the-offing/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>Security Weekly - A CRA Resource: Your Linux System Can Lie To You</h1> Fri, 04 Sep 2026 16:35:54 +0200 YouTube Video<div class="youtube-description">On a compromised Linux or Unix system, an attacker may manipulate the tools and mechanisms investigators rely on. A command such as ps could potentially return altered information through modified binaries, hooked system calls, libraries, or kernel-level tampering. If the utilities on disk cannot be trusted, neither can their view of the system. Bringing trusted binaries—or otherwise using independent collection mechanisms—can reduce that risk during investigation. When investigating a potentially compromised Linux system, how much should you trust the tools already installed on it? Subscribe to our podcasts: https://securityweekly.com/subscribe #LinuxSecurity #ThreatHunting #IncidentResponse #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec</div> </article> <article> <h1>Linux kernel book ......bloody well written, too</h1> Fri, 04 Sep 2026 12:16:29 +0200 submitted by /u/unixbhaskar [link] [comments] <a href="https://tsecurity.de/weiterlesen/3899541/3955072/linux-kernel-book-bloody-well-written-too/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: can1357/oh-my-pi v18.1.9 (04.09.2026)</h1> Fri, 04 Sep 2026 08:11:45 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3898766/3954297/github-release-can1357oh-my-pi-v1819-04092026/" target="_blank" rel="noopener noreferrer">can1357/oh-my-pi</a>v18.1.904.09.2026@can1357</div><div class="github-feed-changelog"><ul> <li><code>windows_sys::core::GUID</code> has no <code>zeroed</code>; use its <code>Default</code> impl. Silenced the unused <code>mode</code> parameter on non-unix in <code>atomic_write</code>, where no per-file mode bits exist.</li> </ul></div></div> </article> <article> <h1>suricata_exporter v0.6.0</h1> Thu, 03 Sep 2026 18:22:03 +0200 Prometheus exporter for Suricata IDS/IPS metrics via Unix socket, enabling real-time monitoring and alerting for decoder, flow, and application layer statistics. <a href="https://tsecurity.de/weiterlesen/3893404/3948933/suricataexporter-v060/" target="_blank" rel="noopener noreferrer">Weiterlesen</a> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.2 (30.07.2026)</h1> Wed, 02 Sep 2026 11:48:59 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.230.07.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, all three entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code>, <code>codew</code>, and <code>codewhale-tui</code> binaries from this Release and places them in the same directory. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.2</pre> The image ships the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli codewhale-tui --locked</pre> Both crates are required — <code>codewhale-cli</code> produces the <code>codewhale</code> dispatcher and <code>codew</code> shim, while <code>codewhale-tui</code> produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a <code>MISSING_COMPANION_BINARY</code> error. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale-tui.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived binaries attached below (<code>codewhale-<platform></code>, <code>codew-<platform></code>, and <code>codewhale-tui-<platform></code>) — the npm wrapper and the in-app <code>codewhale update</code> download the matched runtime binaries, whereas the <code>.tar.gz</code> / <code>.zip</code> archives above are the recommended manual download and additionally bundle an install script. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.2</h2> This is the Codewhale v0.9.2 source candidate. It is not a published release until the matching tag, packages, checksums, and release assets exist. <h3>Changed — behavior</h3> <ul> <li> Legacy <code>model = auto</code> no longer elects a network classifier on its own. Holding a DeepSeek API key used to silently select <code>deepseek-v4-flash</code> as the classifier for every Auto turn — a per-turn cost on a route nobody asked for, and one provider privileged over the rest. Auto now stays local and free unless an explicit <code>[auto.router]</code> block names a provider and model. If you relied on the implicit default, restore it explicitly: <pre>[auto.router] provider = "deepseek" model = "deepseek-v4-flash"</pre> <code>[auto.router]</code> remains legacy <code>model = auto</code> configuration. It is unrelated to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by name from a Fleet file and decides only how hard an already-frozen route thinks. </li> </ul> Landed since v0.9.1, not yet released. A cluster of defects found by a read-through audit of the policy engine, the MCP proxy, the session index, and the app-server bridge — several of them cases where the wrong outcome was reached silently, behind a response or a log line that looked fine. The release also adds opt-in session, reasoning, localization, and inspectability surfaces; existing defaults remain stable unless an entry below explicitly says otherwise. <h3>Added</h3> <ul> <li> <code>/permissions</code> now lists the active user permission-rule source, each rule's effective matcher and global/repository scope, and whether that scope applies in the current workspace. <code>/permissions remove <number></code> previews deletion and requires a snapshot-bound confirmation token, so a concurrent edit cannot move a different rule under the confirmed index. Appends and removals share one adjacent lock, preserve unrelated TOML formatting and comments, atomically replace <code>permissions.toml</code>, and reload the live user ruleset without clearing session-only approvals. <code>/config ask-rules</code> remains a compatibility entry; rule creation, glob/directory rules, and deny persistence remain out of scope (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1186</a>, PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4960</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@greyfreedom</a>). </li> <li> <code>/preview-request</code> (aliases <code>/dryrun</code> and <code>/preview_request</code>) is a human-only, provider-free inspection of the next primary turn. Production dispatch and preview share one prepared-request seam across Chat Completions, Anthropic Messages, and OpenAI Responses, so the manifest reads the final wire model, reasoning controls, tool choice, tool schemas, and body hash from the same value production sends. Route, tool, or body facts that require Auto's provider classifier, an MCP connection, mutable hooks, compaction, or queued runtime injections remain typed unavailable. The manifest reports exact primary role/lane identity, upstream route-source provenance, requested and effective reasoning, canonical JSON sizes, conservative offline estimates, and provider-reported usage as unavailable because no request ran. It never adds a model-visible tool, sends a provider call, or prints prompt, message, credential, endpoint-path, or workspace-path content. The explicit <code>/preview-request base-prompt</code> mode prints only the exact effective base prompt; effective system text remains protected behind its final hash. The exact body includes the same authoritative transient Work/To-do tail used by production, including graph-backed state newer than the legacy projection. Preflight preserves production's separately framed base-plus-Work estimate, and fails closed when the authoritative projection is unavailable. An exhausted active goal token budget also produces a typed unavailable result before any outbound request is built. (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1004</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#3928</a>; dry-run concept harvested from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1099</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@GTC2080</a> / TaoMu.) </li> <li> Slash commands, hotbar actions, and CLI entrypoints for the same Lane/Fleet lifecycle operation now share one typed control-plane contract (<code>codewhale-lane::control</code>): a stable <code><domain>.<verb></code> id, read-vs-write authority, persistence scope, exact-identity target selection, retryability, lifecycle outcome, and one bounded, sanitized receipt. <code>docs/COMMAND_CONTROL_PLANE.md</code> documents it (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> <code>/lane [list|status|interrupt|restart|resume]</code> — durable Lane control from the composer, backed by the same executor <code>codewhale lane …</code> calls. <code>codewhale lane interrupt|restart|resume</code> are the matching CLI verbs; <code>lane stop</code> stays as a compatibility spelling of <code>lane interrupt</code>. Appending <code>@<lifecycle-seq></code> to a lane id fences a write to the exact durable generation you observed, so a concurrent transition is rejected as a conflict rather than acted on (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> <code>codewhale fleet list</code> and <code>/fleet [list|status|interrupt|resume]</code> — durable Fleet run inspection and control from either surface, through shared DTOs that carry the exact provider, provider-table id, model, effective reasoning tier, and route source when the ledger records them, and a typed <code>not_recorded</code> / <code>not_applicable</code> / <code>redacted</code> reason when it does not. Requested-vs-effective reasoning is never back-filled: the ledger persists the effective tier only, so the requested tier reports <code>not_recorded</code> (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4022</a>). </li> <li> The bundled skill pack now ships a <code>help</code> skill (catalog generation 7). It is <code>invocation: explicit-only</code>, so it never enters the model's ambient catalogue and costs no prompt budget. Its body is a routing card that points at the surfaces this build actually exposes — <code>/help</code> and <code>/help <command></code>, <code>/skills</code> and <code>/skills inspect</code>, <code>/config</code>, <code>doctor</code>, and the <code>docs/</code> tree when the workspace is a Codewhale checkout — and explicitly forbids pasting a command list or settings table into context (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4698</a>). </li> <li> <code>crates/tui/assets/skills-catalog-matrix.json</code>: an authored, provider-free expectation matrix covering every bundled skill (tier, invocation, aliases, ambient-catalogue eligibility, shadowed aliases). Contract tests in <code>crates/tui/src/skills/catalog_matrix.rs</code> assert a bijection between the fixture and the shipped bundle, so the starter pack cannot change without an explicit fixture update. The matrix covers positive eligibility and explicit load, non-activation negatives, alias resolution, explicit-only exclusion, alias-vs-canonical collision precedence, and prompt-budget invariants (no duplicate catalogue entries, no aliases as extra entries, and the shipped pack fitting inside the 12 000-char budget with no omitted-skills line). These are deterministic registry/catalog/resolver assertions and make no claim about semantic model routing (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4698</a>). </li> <li> Locale-routing coverage for the complete bundled catalog across every shipped locale (<code>en</code>, <code>ja</code>, <code>zh-Hans</code>, <code>zh-Hant</code>, <code>pt-BR</code>, <code>es-419</code>, <code>vi</code>, <code>ko</code>). No bundled skill ships a localized routing description and none was invented; the tested contract is deterministic fallback to the canonical English description, with the rendered catalogue byte-identical across locales. Exact-tag match, primary-subtag fallback, and English fallback are covered against a synthetic authored fixture, and the parity test fails if a bundled skill ever gains localized metadata without source-backed coverage (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4698</a>). </li> <li> <code>docs/LIVE_SMOKE.md</code>: copy-pasteable, opt-in live-smoke instructions for Kimi K3 and a second provider/model (DeepSeek). The runs are manual only — nothing in CI, tests, or skills invokes them. They use <code>env -i</code> plus a throwaway <code>CODEWHALE_HOME</code>; <code>HOME</code> is left unset rather than repurposed, and ambient provider variables are not forwarded. The operator names the credential variable explicitly, and the isolated child reads its value with echo off, restores the prior terminal state on exit or interruption, and never persists the value or puts it in a command argument. The page states the expected route/model/reasoning/tool receipt fields while treating provider errors as unclassified until provider configuration, authentication/entitlement, and harness behavior have been corroborated independently (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4698</a>). </li> <li> Approval cards can now remember eligible safe shell and file-write approvals as exact <code>allow</code> rules scoped to the current repository. Remembered shell commands use complete-command matching, validated file and patch paths remain workspace-relative, and dangerous, critical, or repo-law-held requests stay ineligible and continue to require review. </li> <li> <code>tui.header_items</code> (array of strings, optional, default <code>[]</code>): an opt-in header chip showing cumulative session token usage as input / cache-hit / output. Set <code>header_items = ["tokens"]</code> under <code>[tui]</code> to enable it. The chip is the only elidable element of the header — the git label, context meter, and version stamp keep their space, and narrow terminals drop the chip rather than the baseline chrome. Unknown entries are warned about and skipped so configs written by newer builds stay loadable by older ones (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4520</a> requested by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@eugenicum</a>; PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4610</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@XhesicaFrost</a>, harvested with co-authorship). </li> <li> <code>thinking_default_expanded</code> lets reasoning blocks start open while keeping Space as the per-block toggle. The setting is persisted, available through native and runtime configuration, and documented for SSH/tmux accessibility (issue <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4925</a> and PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4928</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@M-Maciej</a>). </li> <li> The transcript renders a conservative subset of LaTeX math as readable Unicode without rewriting fenced/inline code, ordinary currency, escaped dollars, or unknown commands. The contribution from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4973</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a> was hardened and landed through PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4974</a>; reported by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@antarikshraya</a> in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4957</a>. </li> <li> Session control now includes a sessions rail, shared archive projection, picker archive controls, and opt-in interactive auto-resume with explicit handoff behavior. The work closes the remaining session-browsing direction from <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#2934</a>; thanks <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@cy2311</a> for the original report. </li> <li> The bundled contributor-onboarding skill can sync contribution context, select the appropriate gate, and prepare a digest without inflating the ambient skill catalog. It follows the contributor-navigation request in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4227</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@JayBeest</a>. </li> <li> Bahasa Indonesia now has a complete repository documentation suite and a registered website dictionary alongside the shipped TUI locale (PRs <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4962</a> and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4972</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@atmosuwiryo</a>, closing <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4789</a>). </li> <li> Reasoning content can keep its rail, italics, cursor, and expansion controls while disabling only the warm background highlight. The independent setting is persisted and localized (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4089</a>; reported by @elijahchan2019). </li> <li> StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the two endpoint/billing routes distinct, and localizes the choice across the complete packs (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4526</a>; reported by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@whp233</a>). </li> <li> OpenCode Zen is a separate model-aware API-key provider. Its curated catalog selects Responses, Anthropic Messages, or Chat Completions per model; unsupported Gemini and unknown models fail closed, and missing Zen credentials never fall through to ChatGPT/Codex OAuth guidance. The implementation from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4467</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@snail-vs</a> (snailoniu) is preserved in the candidate. </li> <li> Markdown exports correlate prompts with stable workspace restore-point ids and say when correlation is unavailable or ambiguous, completing the remaining restoration/export direction from <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#2494</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@wywsoor</a>. </li> </ul> <h3>Fixed</h3> <ul> <li> Permission setup now consistently presents the product postures Ask, Auto-Review, and Full Access instead of leaking the internal <code>never</code> token. The same resolved sandbox policy now drives execution and UI receipts: Plan stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access is actually unsandboxed unless a stricter effective configuration wins. </li> <li> Fleet setup no longer stalls when a user explicitly selects a configured Codex or Grok external-consent route. The selected route is activated and validated before saving, roster roles open directly on their Model step, Review saves on the first Enter, and new profiles default to the personal profile directory that the roster loads on the next session. </li> <li> Provider credential dialogs now share one wrapping, secret-safe API-key surface across every non-OAuth provider. A key already present in durable storage is reported as configured without rendering it, typing or pasting is clearly framed as replacement, narrow help text remains visible, and Codex and Grok OAuth flows remain token-free in this modal. </li> <li> Ctrl+O again opens the complete recorded reasoning detail for the selected, active, or latest reasoning block. The whole-turn Turn Inspector moved to Ctrl+Alt+O and <code>/turn inspect</code>, removing the shortcut collision while keeping raw leaf detail and post-flush reasoning discoverable. </li> <li> Failed child agents now deliver a distinct high-priority failure receipt to their owning parent with a sanitized failure class, elapsed work, and a full transcript handle. Parent-to-child message, follow-up, and interrupt tools now use one hierarchy-checked mailbox path, and persisted nested completion envelopes remain safely restorable across instruction-text revisions. </li> <li> Background-shell completion events now carry only bounded tails plus a retrievable exact-evidence handle. Terminal foreground Bash results are acknowledged at the direct tool-result boundary and are no longer emitted a second time as background completion artifacts. </li> <li> Providerless Fleet and child-agent fixed-model routes now reject only high-confidence foreign-provider model ids before creating a worktree, while explicit provider/model pairs, custom and local endpoints, unknown ids, and aggregator wire-id resolution retain their intended behavior. </li> <li> Manual compaction now preserves and reports the supplied provider failure class instead of replacing it with an opaque generic error. This does not infer quota exhaustion when the recorded failure does not prove it. </li> <li> The ambient jellyfish keep complete, readable silhouettes while animating, and the website favicon now uses the Signal Current desktop tile instead of the legacy whale mark. </li> <li> ACP JSON-RPC responses preserve numeric request ids for avante.nvim while retaining the negotiated string-id exception for Zed (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4929</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@atmosuwiryo</a>). </li> <li> Restored shell cells whose job no longer exists stop displaying live spinners and settle into a truthful stale/no-output state across transcript, phase strip, and sidebar (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4937</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@LI-Jialu</a>, closing <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4547</a>). </li> <li> Interrupted checkpoints and timed recovery snapshots remain checkpoints instead of being promoted into orphan session files, preventing duplicate <code>/resume</code> entries (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4963</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>). </li> <li> Every shipped locale is admitted by the typed settings schema and native chooser, with complete/partial status kept independent and tested (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4856</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>, closing <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4786</a>). Context-menu hover hit-testing also accounts for its title row (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4897</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@XhesicaFrost</a>; reported by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a> in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4803</a>). </li> <li> OSC 52 and SSH/tmux clipboard transport run on one bounded background worker rather than blocking input and rendering on the TUI loop; late transport failures still surface through the status path (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4896</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>, closing <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4159</a>). </li> <li> Non-streaming model calls receive a generation-length response budget rather than the SSE header-open timeout, while actual SSE opens share the bounded cross-provider transport seam. The equivalent fix direction came from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4743</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@vibecoding-skills</a>. </li> <li> Resumed sessions diagnose a deleted inherited workspace before shell launch instead of failing as an opaque Windows process error (report <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4100</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@redjade75723</a>). DeepSeek native tool-call wrapper tokens are also scrubbed from visible streaming and completed output as a grounded fail-soft follow-up to report <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#3880</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@hardy922</a>; that report's exact emitted marker remained unconfirmed. </li> <li> Auto model routing now preserves the user's requested reasoning effort through startup, provider/model changes, session restore, the picker, Ctrl+T, and Hotbar actions. The tier is normalized only after the concrete provider route is known instead of being silently replaced by Auto (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4941</a>, PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4961</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>). </li> <li> Auto-compaction now defaults on for every known model context window, including Kimi K3's 1,048,576-token routes. Persisting only an <code>auto_compact_threshold</code> or <code>auto_compact_threshold_percent</code> now counts as opt-in intent, while an explicit <code>auto_compact = false</code> remains authoritative. <code>/config</code> reports the effective state, percentage, and computed token trigger. </li> <li> Per-provider <code>context_window</code> overrides are now documented and visible in <code>/config</code>, provider setup help, diagnostics, and the example configuration. The effective override consistently drives preflight budgeting, the context meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their Coding Plan tier has the smaller window. </li> <li> Agent Details now projects status, model, elapsed time, and step counts from the same row snapshot as the primary agents list, eliminating contradictory worker state between the two surfaces. </li> <li> Composer submission and its hints now share one state machine. Portable terminals use Enter to queue during a running turn and Enter again to steer; Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is no longer advertised as universally available. </li> <li> <code>edit_file</code> now matches LF-only model search text against CRLF files, preserves the file's line-ending style for replacement text, and still rejects newline-normalized duplicate matches as non-unique (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4764</a>). Implemented in PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4942</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@nightt5879</a>; reported and root-caused by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@LmeSzinc</a>. </li> <li> <code>/fleet status</code> read the current TUI session's sub-agents while <code>codewhale fleet status</code> read the durable <code>.codewhale/fleet.jsonl</code> ledger — two different things wearing one name, so a run started by <code>codewhale fleet run</code> never appeared in the TUI. <code>/fleet status</code> now reads the durable ledger through the same code path as the CLI; the session view keeps its own name as <code>/fleet workers</code> (<code>/subagents</code> and <code>n</code> still work). When a workspace has no ledger, both surfaces report a typed <code>no_fleet_ledger</code> reason instead of an empty-looking "all clear", and neither creates the ledger as a side effect of reading it (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4022</a>). </li> <li> <code>codewhale fleet status</code> (and <code>list</code>/<code>interrupt</code>/<code>resume</code>) created <code>.codewhale/fleet.jsonl</code> as a side effect of opening the manager, then reported <code>no_fleet_ledger</code> for the file it had just made — so the second invocation showed an empty Fleet where none existed. The CLI now refuses those verbs before the manager is constructed, matching <code>/fleet</code> (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4022</a>). </li> <li> <code>fleet resume <run-id></code> accepted any string. An id absent from the ledger reconciled nothing but still wrote a run-status record keyed by whatever was typed, and reported <code>no_change</code>. Unknown ids are now refused as <code>not_found</code> before any durable write (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4022</a>). </li> <li> <code>lane interrupt</code> reported <code>transitioned</code> even when it changed nothing — another process's stop looked like our own. The Runtime backend now reports whether this call performed the transition, and a no-op is <code>no_change</code>. The <code>@<lifecycle-seq></code> fence is also evaluated inside the registry's per-Lane lock rather than before it, so a stale fence refuses without running Runtime teardown instead of racing between the check and the stop (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> <code>/lane</code> no longer runs Runtime teardown on the TUI composer thread. Reads on the slash surface skip reconciliation (which probes tmux and takes a lock) and say so on the receipt instead of implying freshness; <code>lane interrupt</code> is CLI-only until that work runs off-thread, and reports <code>surface_not_supported</code> naming <code>codewhale lane interrupt</code> (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4022</a>). </li> <li> The hotbar is no longer modelled as a third control surface. A slot binds a slash command and fires it with no argument, so it runs as the slash surface; the contract now declares which verb a bare press actually reaches (<code>hotbar_bare_dispatch</code>, true only for <code>lane.list</code>) instead of advertising target-taking verbs as hotbar-reachable (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> <code>codewhale lane list --json</code> and <code>lane status --json</code> keep emitting the <code>LaneRecord</code> shape they always have — the receipt did not replace it. The human <code>lane status</code> output also regained <code>branch</code>, <code>session</code>, <code>socket</code>, <code>attach</code>, and <code>log</code>, which the first cut of the shared DTO had dropped (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> No surface advertises a backend it does not have. <code>lane restart</code> and <code>lane resume</code> have no implementation — a Lane is re-created by <code>codewhale lane start</code>, and a stopped Lane's Runtime session is gone — so all three surfaces refuse them with <code>backend_not_implemented</code> and say why. <code>fleet restart</code> drives the manager loop to completion, which only the CLI runs, so <code>/fleet restart</code> reports <code>surface_not_supported</code> and names the CLI command rather than quietly doing a smaller thing (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1888</a>). </li> <li> Deny rules in <code>permissions.toml</code> no longer miss a command because of an intervening flag: deny matching is token-based with flag-skipping and backtracking, so a <code>git push</code> rule still catches <code>git -c foo=bar push</code>. Path matching folds case only on platforms whose filesystems are case-insensitive, and the default approval branch no longer proposes the working directory as a network host. </li> <li> MCP tool calls run once. A failed call is no longer retried as if it were a failed lookup, qualified-name resolution collects every match and reports an ambiguity instead of taking whichever the hash map yielded first, and registering a server whose name collides with an existing one after sanitization is now an error rather than a silent overwrite. The equivalent call-once fix direction came from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4756</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@adity982</a>. </li> <li> The session index survives a torn line: an unparseable entry is skipped rather than aborting the whole read, appends carry their data through to disk, and appends and compaction share a lock so a compaction can no longer race an append into a lost record. </li> <li> <code>Edit</code> counts as a write tool for workflow elevation, and the TUI's write/shell classification now delegates to one shared allowlist rather than keeping a second copy that could drift. </li> <li> A rejected <code>app/config/set</code> stays a no-op. Previously an invalid value still tore down the cached runtime bridge, killing the child runtime and orphaning every other in-flight stdio thread behind a response that correctly reported failure. </li> <li> A malformed project <code>config.toml</code> is no longer indistinguishable from having no project config. Because a project config may only tighten approval and sandbox policy, silently discarding a broken one dropped a repository's restrictions back to the looser user defaults; the setup wizard now says so, naming the file but never quoting its contents. </li> <li> An expired lane worktree no longer leaves its branch behind, which made reusing the same lane name fail with "branch already exists". A branch still carrying unmerged commits is kept — a TTL lapsing is not consent to delete someone's work. </li> <li> An in-flight <code>thread/message</code> turn can be stopped. The stdio loop keeps reading while a turn streams, so the new <code>thread/interrupt</code> request (and <code>shutdown</code>) can reach a runaway turn instead of waiting on the very turn they were meant to stop. </li> <li> Precedence is stated only in the constitution's "Whose word wins" section. Memory hygiene no longer ships an inverted Tier list that put the constitution above the user's current request; approval, compaction, and personality overlays describe behavior without rank vocabulary; and the authority recap points at the single source rather than restating a second ladder. </li> <li> <code><turn_meta></code> carries facts (mode, posture, model, workspace), not mode doctrine or permission-question essays re-asserted every user message. </li> <li> The project context pack (pretty-printed workspace tree) is off by default and opt-in via <code>[context] project_pack = true</code>. Language law is compressed while keeping the English-constitution / user-language-reply contract. </li> <li> Modal lists and config pickers wrap selection at both ends (Down past the last row returns to the top). Home-directory resolution prefers <code>HOME</code>/<code>USERPROFILE</code> via <code>effective_home_dir</code> across remaining call sites so Windows tests that fake the home env vars match production paths. The equivalent home-directory sweep came from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4760</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@EvanProgramming</a>. </li> </ul> <h3>Changed</h3> <ul> <li> Prefix-cache tool catalog entries store only the SHA-256 digest, not the joined catalog string. Unused plan-transition validation helpers are removed. </li> <li> Settings sections now hold only what they claim (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4751</a>). Fleet keeps Fleet/member concerns; <code>/goal</code> moved to a Session section and Workflow orchestration to its own Workflow section. The inert DeepSeek-only <code>default_model</code> fallback moved out of Model settings into an explicit Legacy section — exact-Fleet users switch Fleets, not fallback models; the config field is retained because the runtime still reads it. This is presentation only: the persisted keys (<code>goal_command</code>, <code>workflow</code>, <code>default_model</code>), their values, scopes, and runtime behavior are unchanged. </li> <li> Auto model routing is scoped to the active provider. The classifier inventory no longer discloses other providers' runnable routes (or the fact that their credentials exist), a classifier reply naming another provider is refused, the local heuristic no longer falls back to a different provider when the active one is unusable, and the implicit DeepSeek-flash classifier is skipped for non-DeepSeek sessions. Auto receipts and the model picker hint report the active-provider-only scope instead of "runnable providers". Cross-provider Auto is available only through the persisted <code>[auto] cross_provider = true</code> opt-in (an explicit <code>[auto.router]</code> route remains its own opt-in for the classifier call). Same-provider strong/fast selection and <code>[auto] cost_saving</code> are unchanged. </li> <li> The QA pseudo-terminal acceptance harness now parses frames with <code>rio-vt</code> behind its existing neutral frame/color surface, retaining the assertions while removing the <code>vt100</code> dependency (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4931</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@raphamorim</a>). </li> <li> Anthropic Messages and OpenAI Responses stream opening now share the <code>client/stream_entry.rs</code> seam already used by Chat Completions: one bounded response-header wait, shared dual/HTTP-1.1 policy selection, at most one HTTP/1.1 fallback on a classified HTTP/2 header stall, and common idle-timeout diagnostics. Wire-specific authentication, headers, endpoints, decoding, and rate-limit behavior remain at each adapter edge. The timeout-placement diagnosis and fix direction came from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4743</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@vibecoding-skills</a>. </li> </ul> <h3>Security</h3> <ul> <li>Release containers now publish an SBOM attestation and pin maximum-mode provenance explicitly so supply-chain metadata cannot silently weaken with a builder-default change (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4958</a> by <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@kobihikri</a>).</li> </ul> <h2>Contributors</h2> Thank you to the contributors whose code, reports, and reviews shaped v0.9.2: <ul> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@greyfreedom</a> — exact repository-scoped allow grants and cross-platform path semantics (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4761</a>), plus safe permission-rule listing and snapshot-bound removal (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4960</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@nightt5879</a> — off-event-loop clipboard writes (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4896</a>), complete locale exposure in settings (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4856</a>), CRLF-safe edits (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4942</a>), and reasoning-effort preservation across automatic model routing (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4961</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@XhesicaFrost</a> — the configurable session-token header (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4610</a>) and context-menu hover alignment (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4897</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@cyq1017</a> — the hooks configuration/executor split from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4087</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@snail-vs</a> (snailoniu) — OpenCode Zen's model-aware routes, authentication, documentation, and test isolation from closed PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4467</a>, whose contributor commits are preserved in the candidate.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a> — the zh-Hans translation quality review harvested from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4908</a>, duplicate-session fix in PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4963</a>, LaTeX implementation from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4973</a> landed through <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4974</a>, and the context-menu reproduction in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4803</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@GTC2080</a> — the request-preview concept from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#1099</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> — non-UTF-8 <code>fetch_url</code> decoding direction from PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4909</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@fleitz</a> — required source-candidate credit for the canonical <code>Bash</code> no-<code>cwd</code> workspace fix and regression in PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4673</a> (issue <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4674</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@LmeSzinc</a> — the Windows CRLF <code>edit_file</code> reproduction, root-cause analysis, and affected-code anchors in issue <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4764</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@atmosuwiryo</a> — ACP numeric-id compatibility (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4929</a>) and the Indonesian documentation and website locale (PRs <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4962</a> and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4972</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@M-Maciej</a> — the expanded-by-default reasoning setting and its original report (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4928</a>, issue <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4925</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@raphamorim</a> — migration of the QA PTY frame parser to <code>rio-vt</code> (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4931</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@LI-Jialu</a> — truthful finalization of restored stale shell cells (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4937</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@kobihikri</a> — release-container SBOM and explicit provenance mode (PR <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4958</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@EvanProgramming</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@adity982</a>, and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@vibecoding-skills</a> — equivalent fix direction for the effective-home sweep (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4760</a>), MCP call-once behavior (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4756</a>), and streaming/non-streaming timeout split (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4743</a>).</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@antarikshraya</a> — the LaTeX transcript rendering report in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4957</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@eugenicum</a> — the token-header request and output-presentation measurements in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4520</a> and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4468</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@whp233</a> — the StepFun/OpenCode subscription-route request in <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4526</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@redjade75723</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@hardy922</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@JayBeest</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@elijahchan2019</a>, <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@cy2311</a>, and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">@wywsoor</a> — reports and product direction behind the stale-workspace diagnosis (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4100</a>), native-tool-token filtering (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#3880</a>), contributor onboarding (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4227</a>), optional reasoning highlight (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#4089</a>), session control (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#2934</a>), and export/restore correlation (<a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">#2494</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880048/3935571/github-release-hmbowncodewhale-v092-30072026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.3 (31.07.2026)</h1> Wed, 02 Sep 2026 11:48:58 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.331.07.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, all three entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code>, <code>codew</code>, and <code>codewhale-tui</code> binaries from this Release and places them in the same directory. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.3</pre> The image ships the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli codewhale-tui --locked</pre> Both crates are required — <code>codewhale-cli</code> produces the <code>codewhale</code> dispatcher and <code>codew</code> shim, while <code>codewhale-tui</code> produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a <code>MISSING_COMPANION_BINARY</code> error. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale-tui.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived binaries attached below (<code>codewhale-<platform></code>, <code>codew-<platform></code>, and <code>codewhale-tui-<platform></code>) — the npm wrapper and the in-app <code>codewhale update</code> download the matched runtime binaries, whereas the <code>.tar.gz</code> / <code>.zip</code> archives above are the recommended manual download and additionally bundle an install script. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.3</h2> This is the Codewhale v0.9.3 source candidate. It is not a published release until the matching tag, packages, checksums, and release assets exist. DeepSeek V4 Flash is now a first-class Codewhale route, and the agent-facing tool surface has been reduced to the canonical action tools that current models actually need. This release also hardens credential, authorization, durability, compaction, and macOS File Provider boundaries while deleting stale runtime and dependency surface. <h3>Added</h3> <ul> <li>Native <code>deepseek-v4-flash</code> support over DeepSeek's Responses API, including stateless reasoning-item replay, semantic SSE terminal events, structured function calls and outputs, <code>apply_patch</code>, and model-aware wire-format selection. Exact current Flash IDs use Responses; future direct <code>deepseek-vN-*</code> model IDs inherit that route conservatively, while custom DeepSeek-compatible endpoints retain Chat Completions unless configured otherwise.</li> <li>A pipe-only <code>codewhale auth print-api-key</code> handoff for explicitly selected providers. It shares Codewhale's home-scoped credential authority, refuses terminal output, and prevents sentinel placeholders from becoming live credentials.</li> <li>Per-turn <code>max_tool_calls</code> enforcement at the engine admission gate, plus a named-file write scope with a separate read seam. The runtime now rejects over-budget calls before execution and keeps the operator's write boundary explicit (<a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4415</a>).</li> <li>Runtime-contract, source-structure, and persistence-backlog ratchets that name drift instead of allowing large ownership surfaces to grow silently (<a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#3921</a>, <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4785</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Model-visible built-ins now use the canonical <code>Bash</code>, <code>File</code>, and <code>Run</code> action schemas. <code>apply_patch</code> remains available as the one direct custom edit tool supported by DeepSeek Responses. The bundled stop-ship workflow, Fleet fixtures, shell shortcut, and engine tests use the same canonical vocabulary.</li> <li>Canonical <code>File { action: "write" }</code> requests now pass through the same semantic repo-law checks as the former write path. Approval, Full Access, and workflow execution cannot bypass the repository safety floor by choosing the canonical schema.</li> <li>Codewhale home resolution is shared across the CLI, TUI, state, and secret stores. <code>doctor</code> is offline by default, distinguishes credential source from availability, and reports one consistent path snapshot.</li> <li>Durable runtime event writes are serialized across simultaneous processes, blocking history waits move off async workers, and provider quota exhaustion remains typed and retryable through compaction (<a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4522</a>).</li> <li>Skill discovery caches the merged catalog behind watched-mtime validation; large skill, engine, subagent, UI, and ambient-ocean test blocks now live in owned test seams.</li> <li>Reasoning summaries stay in the user's language, complete jellyfish silhouettes relocate around transcript text, and cached ocean frames include their palette identity (<a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4807</a>).</li> <li>The authorization-order contract now documents and tests how modes, hooks, permission rules, safety floors, repo law, approvals, and sandboxing compose (PR <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4980</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>macOS sandbox extensions cover CloudStorage/File Provider workspaces without broadening unrelated paths; thanks <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">@Watcher24</a> for the <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4085</a> report and reproduction.</li> <li>Foreground shell state detaches before steering, so an interrupted command cannot keep owning the composer (PR <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4979</a>).</li> <li>MCP application-level failures and malformed error envelopes fail closed instead of looking like successful tool output.</li> <li>Optional PDF failures are truthful and PDF classification no longer misses supported inputs.</li> <li>Bracketed-paste contents are redacted from traces, and credential diagnostics never treat placeholder sentinels as usable keys.</li> </ul> <h3>Removed</h3> <ul> <li>The legacy callable aliases <code>exec_shell</code>, <code>run_shell_command</code>, <code>read_file</code>, <code>write_file</code>, <code>list_dir</code>, <code>grep_files</code>, <code>file_search</code>, and the duplicate Work/RLM registrations. Historical transcript and policy semantics remain readable, but new model turns receive only the canonical action surface.</li> <li>The bundled PDF parser dependency chain, replacing it with the smaller optional extraction boundary tracked by <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4382</a>.</li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">Turisla</a> (<code>@greyfreedom</code>) documented and locked the authorization-order contract in PR <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4980</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">Nightt</a> (<code>@nightt5879</code>) fixed foreground shell detachment before steering in PR <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4979</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">Watcher24</a> (<code>@Watcher24</code>) provided the macOS File Provider report and reproduction for <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4085</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">Fred Leitz</a> (<code>@fleitz</code>) retains required source-candidate credit for the canonical <code>Bash</code> workspace fix from PR <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4673</a> and issue <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">#4674</a>.</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880047/3935570/github-release-hmbowncodewhale-v093-31072026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.4 (08.08.2026)</h1> Wed, 02 Sep 2026 11:48:55 +0200 <div class="github-feed-entry"><div class="github-feed-badges">🛡️ Security Fix <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.408.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, all three entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code>, <code>codew</code>, and <code>codewhale-tui</code> binaries from this Release and places them in the same directory. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.4</pre> The image ships the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli codewhale-tui --locked</pre> Both crates are required — <code>codewhale-cli</code> produces the <code>codewhale</code> dispatcher and <code>codew</code> shim, while <code>codewhale-tui</code> produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a <code>MISSING_COMPANION_BINARY</code> error. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the <code>codewhale</code> dispatcher, <code>codew</code> shim, and <code>codewhale-tui</code> runtime, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code>, <code>codew.exe</code>, and <code>codewhale-tui.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived binaries attached below (<code>codewhale-<platform></code>, <code>codew-<platform></code>, and <code>codewhale-tui-<platform></code>) — the npm wrapper and the in-app <code>codewhale update</code> download the matched runtime binaries, whereas the <code>.tar.gz</code> / <code>.zip</code> archives above are the recommended manual download and additionally bundle an install script. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.4</h2> Codewhale v0.9.4 ships the release-train harness work: the familiar Fleet roster/setup face with a clear operator-leader and user/folder scope, a work strip that keeps actionable agents instead of a permanent archive, waiting policy that forbids polling without freezing independent work, calmer tool output and session recovery, account/Workflow-search/ automation/handoff surfaces, a shorter translation-ready website, and release-blocker fixes across permissions, DeepSeek Responses, SQLite, File edits, terminal width, and Windows installation. <h3>Added</h3> <ul> <li> Memory maintenance: <code>remember</code> gains <code>revise</code> and <code>retire</code> beside the default <code>append</code>. Both name the exact note they target and both require the evidence for the change. Append-only memory decays — a correction sits behind the note it contradicts and both keep reaching the model — so the model can now keep its own durable notes true instead of only adding to them. </li> <li> An audit trail for durable state the model writes about you. Every in-place memory edit is journalled to <code>memory/JOURNAL.md</code>, and every continual-harness <code>refine</code> / <code>remove</code> to a <code>JOURNAL.md</code> beside its state, each with before, after, and evidence. Harness removal previously left no record at all even though the entry leaves state entirely, so the journal is now the only place its content survives. </li> <li> A first-run tip that says so: the first time Codewhale saves something durable it points at <code>/memory</code>, translated into all fifteen complete locale packs. This state shaped later sessions and nothing ever mentioned it existed. </li> <li> Sub-agent checkpoint resume: <code>agents/followup</code> resumes an <code>interrupted_continuable</code> child from its checkpoint into a fresh agent loop — new agent id, original prompt plus the prior conversation tail — when a runtime is attached, and otherwise keeps queue-only semantics with the <code>continuation_handle</code> returned; a second followup on the same interrupted id returns the existing resumed target instead of spawning a duplicate (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5242</a>). </li> <li> MCP Registry discovery with Registry-first tool selection: <code>registry_sync</code> surfaces the eligible local stdio catalog as a complete model-side candidate set, connect-failure messages classify early-exit and usage-help output and point recovery at the next Registry candidate, and a bundled <code>mcp-discovery</code> skill documents the flow (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5238</a>). </li> <li> Progressive fresh-context disclosure: fresh sessions ship a minimal constitutional kernel — ground truth, user intent and scope, truthful completion, guarantees in mechanism, and precedence — with procedural playbooks disclosed on demand, an opt-in project context pack (<code>project_context_pack_enabled</code>) counted in context reports, and <code>load_skill</code> catalogue discovery via <code>name="list"</code>; the measured fresh-context budget drops by roughly 40% (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5077</a>). </li> <li> Named Fleet store v2: one self-contained TOML Fleet per configuration (<code>schema = "fleet"</code>), with scope-explicit selection (user-global default vs folder override), migration receipts from legacy role profiles, and atomic saves that refuse to clobber a different Fleet on the same slug. </li> <li> Scout replaces the user-facing "faster" control: catalog-verified fast siblings only, never a guessed model name; pinned Scout survives operator changes. </li> <li> Truthful model-picker rows: vision/tools/limits chips only when the catalog knows, with provider → family → exact model grouping. </li> <li> Opt-in product telemetry, off by default. A first-run notice asks once, on a terminal, with declining pre-selected — Enter declines. Nothing is collected unless both <code>telemetry = true</code> and a recorded "Enable" answer are present, so a <code>telemetry = true</code> written before this release stays inert: the key has been settable and inert for a long time, and setting it was never consent. An enabled session sends its batches to the first-party ingest endpoint, <code>https://telemetry.codewhale.net/v1/telemetry</code>, which is the shipped default for <code>telemetry_endpoint</code>. That is a Cloudflare Worker whose complete source is in this repository under <code>telemetry-ingest/</code>; it writes to Workers Analytics Engine, whose row is exactly <code>_sample_interval</code>, <code>blob1</code>–<code>blob20</code>, <code>dataset</code>, <code>double1</code>–<code>double20</code>, <code>index1</code>, and <code>timestamp</code> — there is no IP, country, or geo column, so storing one is structurally impossible rather than merely disabled. The handler reads two request headers, never touches the request's geo properties, logs nothing, and validates against a closed field set that rejects an entire batch carrying any unpublished key. Cloudflare's retention for that data is a fixed three months. Setting <code>telemetry_endpoint = ""</code> instead writes each batch to <code>$CODEWHALE_HOME/telemetry/dryrun.jsonl</code> and constructs no HTTP client at all, so you can read exactly what would have been sent. Turning it off is an answer, not a flag: it deletes the random install id, truncates every buffered event, and leaves a permanent tombstone that a session already running re-checks before it appends and before it sends. A failed wipe fails closed. <code>CODEWHALE_TELEMETRY=0</code> is a hard floor that beats <code>--telemetry true</code> and the config key, and a value the parser cannot read also resolves to off. Fleet workers are hard-off. A repo-local <code>.codewhale/config.toml</code> can set neither key. Never collected: prompts, completions, tool arguments, diffs, file contents, filenames, paths, git remotes, repo or branch names, memory entries, chat history, credentials (not even a boolean asserting one exists), model ids, custom provider table names, MCP server names, error or panic message bodies, per-event timestamps, keystrokes, clipboard, screenshots, or location. The full schema is <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer"><code>docs/TELEMETRY.md</code></a>, and a test parses the field names out of that file and asserts set equality with the structs the serializer uses. This supersedes the roadmap's previous "no Codewhale product telemetry" entry, which moves from "Ruled out" to an opt-in framing. What stays ruled out: always-on or silent telemetry, per-keystroke or per-tool-call phone-home, and any third-party ad or analytics SDK in the runtime binary. </li> <li> Registered <code>GLM-5.3</code> (direct Z.ai) and <code>z-ai/glm-5.3</code> (OpenRouter) as selectable GLM routes, with their aliases (<code>glm-5.3</code>, <code>glm-5-3</code>, <code>zai-glm-5.3</code>, <code>zai-glm-5-3</code>). Z.ai had not released GLM-5.3 as of 2026-08-03 — the ids are registered so they resolve to the Z.ai/OpenRouter routes instead of being rewritten to another vendor's model, and they will fail upstream until Z.ai ships the model. Metadata (context, output, reasoning controls) is inherited wholesale from <code>GLM-5.2</code> pending official Z.ai release metadata; pricing is intentionally absent, and <code>GLM-5.2</code> remains the default Z.ai model. No third-party gateway roster gained the model: OpenCode Zen, OpenCode Go, Alibaba Model Studio, and TelecomJS publish no glm-5.3 entry, so Codewhale advertises none. </li> <li> Managed Codewhale account commands (<code>account login</code>, <code>status</code>, <code>logout</code>, and <code>keys</code>) with browser device flow, profile- and origin-scoped secure sessions, refresh/revocation, redacted BYOK-vault management, and a token-free Runtime account receipt. Provider authentication remains separate, and <code>cloud</code> remains a compatibility alias. </li> <li> <code>/automation</code> operator controls to list, inspect, pause, resume, delete, and run durable automations. Creation remains on the approval-gated model-visible <code>automation</code> tool. </li> <li> A provider-neutral <code>WorkflowSearchSpec</code> authoring and freeze boundary, plus structured 2–16-candidate experimental search in the best-of-N Workflow starter. It freezes baseline, route, evidence, evaluator, gate, score, budget, and review policy before admission; it validates gate/scoring commands but does not execute or certify them itself. </li> <li> The bundled generation-9 <code>handoff</code> skill for compact, decision-ready continuation across sessions. </li> <li> Expanded terminal LaTeX rendering for aligned and matrix environments, cases, arrays, text/font/accent commands, brackets, symbols, and command-aware scripts (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#4981</a>). </li> <li> Exact 40-character build provenance and secure account-session capability receipts on <code>/v1/runtime/info</code>; unknown source provenance continues to fail closed. </li> <li> Acceptance-level Gherkin coverage locking the existing user-command precedence, alias shadowing, fallback, and invalid-command error contract (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#4992</a>). </li> <li> Agent Plugins v1.0.0: consume, publish, and slugify packaged sub-agent briefs, with an install/update/uninstall on-ramp in the TUI (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5182</a>). A plugin bundles a prompt, posture, and routing as one shareable artifact; on-disk migration of the older <code>plugin.toml</code> scaffold is deliberately out of scope for this train. </li> <li> <code>send_later</code>: a model-callable one-shot delayed continuation tool, so the model can schedule a single future nudge without an operator-approved durable automation (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5138</a>). </li> <li> <code>/advisor</code>: an opt-in background advisor watcher for live turns (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5139</a>). </li> <li> Notification quiet mode with per-category switches and action-first copy (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5066</a>). </li> <li> Automation scheduling forms — one-shot <code>ONCE</code>, five-field cron, and honest watcher modes — created through the approval-gated <code>automation</code> tool (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5183</a>). </li> <li> Sub-agent <code>resume_from</code> continuation chains (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5142</a>), child-result diff-tainting when a claimed diff is not visible to git, per-turn usage receipts on the exec stream-json stream, and spawn receipts that report the model each sub-agent actually ran on. </li> <li> Transport resilience: sub-agent exec transport retries with a 600 s default (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5210</a>), SSE header stalls retryable instead of fatal, and headless turn resume after mid-stream network drops with an <code>EX_TEMPFAIL</code> exit. </li> <li> Session durability and control: a deterministic compaction continuation contract (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5064</a>), persisting interrupted output (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5206</a>), stop-word cancellation (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5207</a>), token-counter refresh (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5204</a>), deny-by-default approval cards (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5090</a>), and the Operate completion gate (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5067</a>). </li> <li> zh-Hant promoted to a full shipped locale with complete <code>en.json</code> parity (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5143</a>). </li> <li> A persistent update-available chip in the header, with the startup update check throttled and naming the right command. </li> <li> RLM static intent extraction for code blocks (<code>rlm_block_intent.rs</code>) landed as groundwork for a future code-mode approval flow; it is not yet wired into the turn pipeline and ships dormant by design. </li> </ul> <h3>Changed</h3> <ul> <li> <code>/fleet</code> is the familiar roster/setup face again. The operator row is the Fleet leader (session model); the header names the selected saved Fleet and whether it is user-global or folder-scoped. Named-Fleet switching lives under <code>/fleet fleets</code> (Enter selects in the row's own scope). Session route changes stay temporary until <code>/fleet save</code>, <code>/fleet save-as</code>, or <code>/model save-default</code>. </li> <li> Waiting-for-subagents directions forbid peek/status polling and sleep-as-wait, but allow independent work that does not depend on a child's result — the parent no longer freezes mid-turn with useful non-conflicting work available. </li> <li> <code>workflow run</code> no longer requires <code>--fleet</code>; a saved Fleet is an optional pin layer over roles + the session route. </li> <li> Homepage and getting-started copy is shorter and scannable across locales, with dictionary key and <code>{brand}</code> token parity preserved. </li> <li> Tool results now render as ordinary bounded previews with real expansion; storage, retention-ledger, and internal evidence language no longer leak into normal transcripts. </li> <li> Prose wrapping, goal state, modal questions, composer-tail behavior, and ambient motion now follow one deterministic interface contract across narrow terminals and fast streams. </li> <li> Scout and reviewer Fleet roles gain network access and the bounded verification surface for real reconnaissance while retaining the no-write, no-raw-shell security floor. </li> <li> Workflow runs may describe up to 1,000 tasks while admitting at most 16 live tasks at once through the host concurrency gate. Tournament ordering now supports explicit score-first selection while retaining its cost-first default. </li> <li> Runtime permission compatibility inputs resolve to one live <code>permission_posture</code>. Auto-Review can proceed without approval or structured question modals, unresolved holds fail closed, and a call planned under stale authority is retried after a posture change (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5025</a>). </li> <li> Duplicate and drifting per-turn metadata has been removed in favor of runtime-owned authority, and large inline account and skill tests now live in owned test seams. </li> <li> Pinned Ratatui to 0.30.0 and ratatui-core to 0.1.0. ratatui-core 0.1.1+ makes <code>Terminal::clear()</code> issue a blocking cursor-position report that raced the TUI input loop and could kill first launch; both pins are load-bearing, because 0.30.0 declares <code>ratatui-core ^0.1</code> and would otherwise resolve forward on its own (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5192</a> by <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@bistack</a>; upstream <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">ratatui/ratatui#2640</a>). </li> <li> Updated globset to 0.4.19, clap-complete to 4.6.8, futures-util to 0.3.33, libc to 0.2.189, actions/stale to 11.0.0, and docker/login-action to 4.5.2. The locked graph also includes the event-listener 5.4.2 fix for RUSTSEC-2026-0221. </li> <li> The progress surface now speaks plainly everywhere: the last user-visible "Work update is pending" notices say "To-do list", the tool constructor and the docs name <code>todo_write</code> as the single canonical progress tool, and <code>work_update</code>, <code>TodoWrite</code>, and <code>todo</code> stay registered as hidden compatibility aliases so saved transcripts keep replaying. </li> <li> Sub-agent and <code>agents/wait</code> waits stay short by default and by cap: blocking waits default to 30 s and refuse to block past 120 s, because a blocked wait deafens the session to typed input and settled children already report back as <code><codewhale:subagent.done></code> sentinels. </li> <li> <code>Bash</code> <code>action=wait</code> honors <code>timeout_secs</code> (seconds) and bare <code>timeout</code> (milliseconds) alongside canonical <code>timeout_ms</code>, and <code>block</code> as an alias for <code>wait</code>, so a habit formed on other wait tools gets the duration it asked for instead of silently falling back to the 30 s default; the result metadata reports the real <code>wait_timeout_ms</code> applied. </li> </ul> <h3>Fixed</h3> <ul> <li> The memory journal is no longer indexed as memory. It is Markdown in the memory tree, so the source walk collected it and every retired note re-entered the searchable set under its <code>before:</code> line — putting the exact facts a revision had just removed back into the prompt. </li> <li> <code>memory_path</code> pointed at an already-native store no longer derives a second store nested inside it, which silently wrote somewhere other than the file the user named. </li> <li> <code>muse</code> and <code>muse-spark</code> resolved to <code>muse-spark-1.1</code> in the agent registry while config had defaulted to <code>muse-spark-1.2</code>, so the CLI and app-server routed those aliases somewhere the configured default never pointed. The registry now carries 1.2 and the contributor variant. </li> <li> An explicit <code>type=builder</code> (or its <code>implementer</code> alias) plus <code>write_authority=read_only</code> now fails closed at spawn instead of launching a labeled write role that silently had only recon tools and then self-BLOCKED after burning a turn (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5123</a>). The check is deliberately narrow, because two neighbouring combinations are legitimate and stay legal: <ul> <li><code>type=worker</code> + <code>read_only</code> — worker is the unnamed default (it renders as <code>general</code>) and takes its capability from authority, not from its name, so a read-only worker is an ordinary general-purpose child. Worker, scout, reviewer, and verifier remain the four canonical read-only Fleet roles.</li> <li>any <code>role</code> + <code>read_only</code> — <code>role</code> is an identity for roster resolution, not a capability claim, so an acceptance Workflow can still resolve <code>implementer</code> to its saved profile while scoping that child to verification.</li> </ul> Callers that spelled a read-only narrowing as <code>type: "implementer"</code> should move it to <code>role: "implementer"</code>. </li> <li> User-global credentials survive an explicit workspace <code>CODEWHALE_CONFIG_PATH</code> that selects a route with no local key — readiness probes the user-global provider table before concluding a key is missing. </li> <li> Sub-agent token figures on the work bar accumulate input+output (the same total the worker budget uses) instead of completion tokens alone; elapsed time still freezes when the child settles. </li> <li> Live work-bar rows for sub-agents show how many to-dos they still have left (<code>N left</code>) when the child's own ledger has unsettled items — never a fabricated zero when no list exists. </li> <li> Surfaces no longer claim an OS sandbox on platforms that cannot enforce one. The policy resolver takes no platform input, so on default Linux (bubblewrap is opt-in) and on all Windows the header chip read <code>files: workspace</code> and <code>/status</code> read <code>sandbox workspace-write</code> while nothing was restricted. Both now resolve the real backend and say <code>(unenforced)</code>. </li> <li> <code>tool_category</code> hook conditions matched only retired tool names, so a <code>category = "shell"</code> deny hook — the security control <code>docs/HOOKS.md</code> documents — silently never fired. Categories now use the registered names, and multi-action tools classify by action. </li> <li> A <code>Retry-After</code> header of <code>-5</code>, <code>nan</code>, or <code>1e300</code> crashed the request task (<code>Duration::from_secs_f64</code> panics on a negative). Parsing is now guarded and bounded to one hour. </li> <li> Bearer tokens no longer leak into operator-visible receipts. <code>Authorization: Bearer <jwt></code> split into two tokens and the JWT matched no redaction rule; prefix matching was also case-sensitive, so <code>SK-live-…</code> survived. </li> <li> <code>prune_older_than</code> destroyed the NEWEST rollback snapshots and kept the old ones — on every boot, for any workspace with snapshots spanning the retention window. Both prune paths now share one orphan-chain rebuild and preserve each survivor's real timestamp. </li> <li> An absolute or relative command path no longer defeats every execpolicy deny rule (<code>/bin/rm -rf /</code> did not match a <code>rm -rf /</code> rule), and a typed <code>Allow</code> rule no longer auto-approves a chained suffix such as <code>git log ; curl … | sh</code>. </li> <li> Wrong types on <code>File</code> read range params and <code>Bash</code> stdin/cwd/task_id are now errors instead of silent defaults — a <code>start_line:"1200"</code> string used to return the head of the file, and a non-string <code>stdin</code> ran the command with no stdin and reported success. </li> <li> Multibyte tool ids no longer panic the context inspector, wide (CJK) text no longer overflows the decision card, and a hostname like <code>127.evil.example.com</code> is no longer treated as loopback. </li> <li> Refusals name calls the model can actually make (<code>rlm action='open'</code> rather than a retired <code>rlm_open</code>; <code>Bash</code> rather than <code>exec_shell</code>). </li> <li> Sub-agent dispatch no longer aborts the process. The Tokio runtime was built by <code>#[tokio::main]</code>, leaving every worker thread on the 2 MiB default while only the owner thread received the explicit 16 MiB stack — and the engine runs on a worker. A debug-build <code>agent</code> dispatch exceeded that stack and raised SIGABRT, which is not a panic and so could not be caught; the process died mid-spawn with no child request ever issued. Release builds were unaffected. </li> <li> Fleet profiles that pin a provider no longer leak a bare model id onto the session route. <code>model_overrides</code> exported each role's model while dropping its provider, so a scout pinned to another provider's model was dispatched against the active client and denied at the wire — visible as an instant auth failure on the first sub-agent of a fan-out. </li> <li> The rail's Pinned panel no longer spends four rows saying "No active work". An empty panel now collapses like the Tasks panel always has, and the settings migration no longer folds the default <code>sidebar_focus = "auto"</code> into a pinned always-on strip, which had silently handed that panel to every user who had a settings file at all. (An empty panel collapses; a panel holding settled to-dos or finished workers is not empty — see the standing-register entry below.) </li> <li> The work bar keeps settled to-dos and an honest Subagents header, while completed/cancelled workers collapse out of the Top strip so fan-outs do not permanently eat the transcript. Failed or interrupted workers stay visible (they still need attention). Settled agents remain reachable through the Agents panel and catalog. To-do rows say their state in words (pending / in progress / completed / cancelled), and sub-agent rows carry type, objective, elapsed, and input+output tokens. Every work row is a door in every rail panel and placement: click and Enter open the row's world (work inspector / agent details — finished agents included) instead of doing nothing. A click after the detail pager closed itself reopens the detail rather than being swallowed by a stale toggle. </li> <li> The rail strip yields its rows to the transcript when the terminal cannot seat both, so the idle ocean survives at 24 rows instead of being evicted. </li> <li> <code>code_execution</code> and <code>js_execution</code> no longer describe themselves to the model as sandboxed. Both are ordinary local subprocesses with no seccomp, jail, or container (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5221</a> by <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a> and <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@asto18089</a>). </li> <li> Model Studio reasoning controls now fail closed on the host rather than on the provider enum, so a custom <code>base_url</code> no longer receives Alibaba-specific <code>enable_thinking</code> fields, and <code>qwen3.8-max</code> is no longer sent a thinking switch it does not accept (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5233</a> by <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@Inference1</a>, closing <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5203</a>). </li> <li> <code>config.example.toml</code> no longer claims Shift+Tab cycles the reasoning tier. Shift+Tab cycles the permission posture; Ctrl+T cycles reasoning (found by <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@vFONGv</a>, PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5229</a>). </li> <li> Alibaba Model Studio reasoning controls are now route- and model-scoped instead of provider-wide (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5203</a>, harvested from <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5233</a> by <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">@Inference1</a>). Codewhale sends <code>enable_thinking</code> / <code>preserve_thinking</code> / <code>reasoning_effort</code> only when the configured <code>base_url</code> is a verified Alibaba Chat Completions host, so pointing a <code>modelstudio-*</code> provider ID at a custom gateway no longer injects DashScope's dialect into it. <code>qwen3.8-max</code> and <code>qwen3.8-max-preview</code> are thinking-only and no longer receive an <code>enable_thinking: false</code> they cannot honor; <code>preserve_thinking</code> is sent for the models documented to accept it, so their reasoning trace survives into the next turn; and <code>deepseek-v4*</code> / <code>glm-5.x</code> map the reasoning tier onto the documented <code>high</code> / <code>max</code> ladder. </li> <li> xAI device login now recovers from a config that points at a missing Codewhale-owned credential generation instead of failing every attempt with a generic activation error, and finalize failures report the full error chain (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5032</a>). </li> <li> API keys saved to the secret store no longer read as unconfigured for providers that are not currently active; a configured Kimi/Moonshot key survives provider switches and restarts without re-entry (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5033</a>). </li> <li> Switching to the Codex provider with no saved model now lands on the live roster's flagship model instead of a stale static default (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5034</a>). </li> <li> Worktree-isolated Fleet builders no longer contend on the per-workspace delegated-coordination lock, and a failed lock acquisition is retried on use instead of being memoized for the life of the process (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5036</a>). </li> <li> Fleet dispatch now rebinds the child client when the resolved profile model requires a different wire protocol (DeepSeek flash on Responses), instead of failing deterministically on the worker's first request (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5042</a>). </li> <li> DeepSeek Responses now sends <code>reasoning.effort: "none"</code> for the Off tier, shows a truthful notice instead of silently discarding server-side <code>web_search_call</code> items, and parses cache-hit, cache-miss, cache-write, and pricing telemetry while retaining the OpenAI-style nested fallback. </li> <li> File edits now explain no-op and missing-search failures, reject newly unbalanced C/C++ preprocessor replacements, handle the reported CRLF/non-ASCII cases, and safely relocate stale unified-diff hunks only when whole-file context is unique (PRs <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5008</a> and <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5030</a>). </li> <li> Circled digits, enclosed alphanumerics, and keycap graphemes use consistent two-column measurement in Codewhale, Ratatui, and CJK terminals, preventing missing-character and phantom-space corruption (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5001</a>). </li> <li> SQLite connections install their busy timeout before locking setup and avoid rewriting persistent WAL mode on every open, removing the concurrent-open release-gate failure. </li> <li> The Windows installer preserves long current-user <code>PATH</code> values, their registry type, and unrelated entries across install and uninstall (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5006</a>). </li> <li> Provider configuration no longer contains user-reachable panic paths when metadata or prior credential state is missing. </li> <li> Resuming a session restores composer text only from a same-session persisted draft; submitted prompts and internal background-runtime envelopes remain in history instead of appearing in the composer (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5029</a>). </li> <li> Shared CI now handles bot-authored issue-link checks, provisions cargo-deny's toolchain, and fetches the locked test graph before offline runtime-budget validation. </li> <li> Re-quote each linker argument in the Windows OpenHarmony clang launcher so a spaced SDK path (e.g. the default <code>D:\DevEco Studio\...</code> install) keeps its <code>--sysroot</code> intact through the final Rust link, and extend the no-SDK release guard to keep the re-quoting contract (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5095</a>). </li> <li> The shell tool reports the real elapsed wait time in its result content instead of echoing the requested timeout (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5240</a>). </li> <li> Transcript wheel scrolling under iTerm2: xterm alternate-scroll (DECSET 1007) now stays off while mouse capture is active, so wheel events arrive as mouse events instead of being converted into arrow keys (<a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5223</a>, PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5234</a>). </li> <li> A stalled model stream no longer ends the turn as <code>Completed</code> over a frozen reasoning block: a mid-stream chunk-timeout now counts toward the stream-error budget, so a stall with nothing streamed retries the request transparently, and a stall that exhausts the retry budget fails the turn with the real reason instead of reporting success. </li> <li> A finished background shell task now wakes the engine even when no goal is active: the idle loop starts an ordinary runtime turn so the completion reaches the model immediately instead of sitting unclaimed until the user types (a dead provider route claims the completion once and reports where the output lives instead of re-arming the same error every tick). </li> <li> Sub-agent final reports that exceed the summary budget are now spilled to a session artifact, and the truncation footer names the <code>retrieve_tool_result</code> ref for the elided middle instead of telling the model the bytes are unrecoverable; write failures degrade to the honest no-ref footer. </li> <li> An interactive mid-stream network drop after partial output no longer fails the turn: the partial reply is preserved as a committed assistant message, a runtime continuation message is appended, and the request is re-issued bounded by the stream-retry budget. </li> <li> Large pasted input is no longer sent to the model twice as inline text and as a backup <code>.md</code> paste file; the submitted message now carries only the <code>@</code>-mention so the model reads the file once. </li> <li> A builder sub-agent can run ordinary shell writes again. Write claims outlive the agents that register them, so a workspace accumulated one per builder that ever ran — six completed agents left four standing claims in testing — and the shared-checkout gate counted those long-finished children as live contenders. Every later builder was refused <code>Bash</code> writes with "cannot prove a bounded file target" and pushed toward worktree isolation, which puts the work in a checkout the operator never looks at. The gate now asks the question it meant to ask: is another running child writing in this shared checkout. Concurrent writers are still gated; a lone builder writes in the workspace you are actually watching. </li> <li> Ctrl-C during the first moments of startup no longer kills Codewhale outright. The terminating-signal handlers were registered inside the task that waits on them, and a spawned task does not run until the scheduler first polls it, so a SIGINT arriving in that window hit the default disposition — the process died with no exit code, no terminal restore, and no session record. The handlers are now installed synchronously, before the telemetry notice and before arming, so the window is closed. </li> <li> The documented tool list on the docs site named <code>update_plan</code> and <code>work_update</code> as coordination tools. Neither is callable by the model — <code>update_plan</code> replays older Plan artifacts and <code>work_update</code> is a hidden compatibility alias — so the page listed two tools a reader cannot use and omitted <code>todo_write</code>, the one they can. </li> </ul> <h3>Security</h3> <ul> <li>Bumped <code>nanoid</code> past <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">GHSA-2v37-7h3g-55p8</a> (a custom generator given size zero could loop indefinitely), restoring a zero-advisory <code>npm audit</code> for the website.</li> </ul> <h3>Removed</h3> <ul> <li>The default model-facing SlopLedger implementation, its storage-oriented transcript language, and the <code>/debt</code>, <code>/cleanup</code>, <code>/slop</code>, and <code>/canzha</code> command surface.</li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">Sh1Zuku</a> (<code>@SparkofSpike</code>) contributed LaTeX rendering in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#4981</a>, completed circled-digit/keycap width handling in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5001</a>, and delivered actionable File-edit recovery in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5008</a>; for this train he resumed interrupted sub-agents from checkpoints in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5242</a>, surfaced real shell wait elapsed time in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5240</a>, and kept alternate-scroll off while mouse capture is active in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5234</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">XhesicaFrost</a> (<code>@XhesicaFrost</code>) fixed long Windows user-PATH preservation in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5006</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">Paulo Aboim Pinto</a> (<code>@aboimpinto</code>) added the user-command dispatch acceptance contract in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#4992</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">DracheTek</a> (<code>@DracheTek</code>) provided the multilingual, CRLF-heavy File-edit failure report in issue <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5003</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">An Ziwu</a> (<code>@MuRongMoQing</code>) reported the Windows PATH-overwrite defect in issue <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#4685</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">shenjackyuanjie</a> (<code>@shenjackyuanjie</code>) fixed the Windows OpenHarmony linker re-quoting for spaced SDK paths in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5095</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">bistack</a> (<code>@bistack</code>) contributed MCP Registry discovery with Registry-first tool selection in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5238</a>.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">vFONGv</a> (<code>@vFONGv</code>) wrote the zh-CN Windows beginner guide with screenshots in PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5229</a>, harvested after its base branch was accidentally deleted during maintainer cleanup.</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">mky</a> (<code>@mky</code>) fixed the FreeBSD build (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5254</a>, <code>rquickjs</code> <code>bindgen</code> on FreeBSD).</li> <li><a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">cacdcaecawae</a> (<code>@cacdcaecawae</code>) contributed embedder-owned sub-agent state roots (PR <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">#5252</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880046/3935569/github-release-hmbowncodewhale-v094-08082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.5 (08.08.2026)</h1> Wed, 02 Sep 2026 11:48:50 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.508.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.5</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.5</h2> Codewhale v0.9.5 consolidates the terminal application into one compiled runtime while preserving the familiar <code>codewhale</code> and <code>codew</code> commands. It also expands the managed Runtime API, makes session and Fleet work easier to inspect and resume, and removes the hidden local continuation backstop that could end productive work without a final assistant response. <h3>Added</h3> <ul> <li><code>model = "auto"</code> for prompt-based tier selection: When set, the dispatcher analyses the user's prompt before delegating to the TUI and selects <code>deepseek-v4-pro</code> for complex tasks or <code>deepseek-v4-flash</code> for simple tasks (PR <a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">#5257</a>).</li> <li>Runtime API controls for persistent goals, bounded memory inspection, MCP server and skill lifecycle management, and durable Fleet receipt evidence.</li> <li>Append-only session-tree history with <code>/tree</code>, <code>/branch</code>, <code>/fork</code>, and <code>/resume</code>, plus <code>/rc</code> remote control and managed login.</li> <li>A unified Fleet roster for built-in dispatch postures and a pinned indicator that keeps active background work visible above the composer.</li> <li>Incremental MCP registry refreshes that return the local snapshot immediately and update it in the background.</li> <li>Scout and Reviewer agents can use a bounded direct-command evidence shell for read-only workspace, Git, and GitHub inspection, and can keep private working notes in their own To-do while the durable transcript retains their evidence.</li> </ul> <h3>Changed</h3> <ul> <li><code>codewhale-cli</code> now contains the terminal runtime directly. Release installers expose byte-identical <code>codewhale</code> and <code>codew</code> commands without a separate TUI executable. The v0.9.5 asset set alone retains deprecated <code>codewhale-tui-*</code> filenames as byte-identical compatibility copies so installed v0.9.4 clients can discover and complete this upgrade.</li> <li>Startup release checks cache successful lookups for one hour. The updater downloads and verifies the primary runtime once, then refreshes any existing <code>codew</code> or legacy <code>codewhale-tui</code> command paths from the same bytes.</li> <li>Headless <code>codewhale exec</code> runs and verifier benchmark rollouts no longer impose a 100-step default. <code>--max-turns</code> remains available as an explicit opt-in ceiling; Fleet workers retain their separately configured budget.</li> <li>Goal token and time budgets are telemetry rather than default stop conditions, and automatic goal continuation is unlimited unless the user explicitly configures a continuation ceiling.</li> <li>Command-palette and slash-completion shadowing now share one alias-aware discovery contract.</li> <li>The website install guidance, localized product copy, navigation controls, social metadata, and Cloudflare build pipeline now describe and deploy the same one-runtime release contract.</li> </ul> <h3>Fixed</h3> <ul> <li>The hidden 20-step no-user-input backstop no longer ends productive turns. Tool results, queued steering, child completions, REPL feedback, and goal continuations can all reach the next provider step and a final assistant response; explicit user-configured limits and genuine stuck-loop guards remain.</li> <li>Complete error details are directly inspectable after a failure instead of leaving the terminal with a clipped, unrecoverable error fragment.</li> <li>A newly minted OAuth credential is adopted in the same provider-selection flow instead of requiring a second picker trip.</li> <li>Fresh session titles can replace a stale cached <code>New Session</code> placeholder, unknown model context limits fail loudly, and release/source-install fallbacks no longer request binaries removed by the single-runtime conversion.</li> </ul> <h2>Contributors</h2> <ul> <li><a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">Sh1Zuku</a> (<code>@SparkofSpike</code>) fixed stale cached session titles that could pin the <code>New Session</code> placeholder.</li> <li><a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">Paulo Aboim Pinto</a> (<code>@aboimpinto</code>) built the shared alias-aware command discovery contract and acceptance coverage.</li> <li><a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">Sun Zhenyuan</a> (<code>@bistack</code>) contributed the background incremental MCP Registry refresh.</li> <li><a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">SKY ZHAO</a> (<code>@skyzhao1223</code>) contributed prompt-based <code>model = "auto"</code> routing in PR <a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">#5257</a>.</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880045/3935568/github-release-hmbowncodewhale-v095-08082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.6 (12.08.2026)</h1> Wed, 02 Sep 2026 11:48:49 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.612.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.6</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.6</h2> Codewhale v0.9.6 is a subtractive release: fewer runtime guards, one stable prompt, truthful provider endings, and a smaller compaction path that preserves the provider cache. The changes were grounded by matched Terminal-Bench 2.1 runs against Pi 0.8.41 and by dogfooding repeated manual compaction. <h3>Added</h3> <ul> <li><code>web_search</code> defaults to Firecrawl Cloud without an API key; keyless requests are headerless and quota-bounded, while an optional user key raises limits.</li> <li>Green web builds on <code>main</code> now emit an actionable manual-deploy reminder, so site changes cannot quietly appear shipped while Cloudflare still serves an older revision.</li> <li>Mistral AI is a first-class provider route, including Codestral models, first-party reasoning support, authentication, picker entries, and aliases.</li> <li>Headless <code>Bash</code> can transfer explicitly requested persistent Unix services out of an exec run, with ownership and cleanup receipts.</li> <li><code>/remote-env</code> opens hosted Work from the current GitHub or CNB branch tip and states exactly which unpushed, dirty, ignored, secret, and session state stays local.</li> <li>Linux ARM64 release and nightly assets are static musl builds with native launch checks.</li> <li>Maintainers can report observed daily active installs from the same anonymous, aggregate telemetry dataset; no additional client data is collected.</li> <li>Fleet-dispatched members under a read-only evidence (no-network) ceiling now keep the <code>Web</code> tool's read-only <code>search</code> and <code>fetch</code> actions — parity with an ordinary scout — while every reaching surface (<code>web.run</code>, <code>fetch_url</code>, <code>github</code>, MCP) stays denied and the sentinel-backed capability envelope remains the fail-closed backstop.</li> <li><code>/fleet setup</code> can show an optional, deterministic, unratified role-to-model advisory built only from configured ready routes. Accept, edit, and reject all remain inside the existing human-reviewed profile save boundary; the advisory never launches a Fleet or writes a second configuration.</li> <li><code>/update</code> checks for a newer Codewhale release and installs it from inside the TUI, while <code>tui_help</code> gives agents the same command and key map users see.</li> <li>Markdown file paths render as OSC 8 links where the terminal supports them, and every agent row can open that agent's transcript directly.</li> <li>ACP editor sessions can execute multi-round file, search, Git, patch, and explicitly enabled shell tool calls through the shared Runtime registry. Shell access requires both the client's terminal capability and Codewhale's headless shell opt-in, and cancellation stops an in-flight tool before the turn returns (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5225</a> by <a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@rafaelcavalheri</a>).</li> <li>Lowercase <code>read</code> returns bounded typed PNG, JPEG, GIF, and WebP results to image-capable Chat, Responses, Anthropic, and ACP routes. Text-only routes receive an explicit omission receipt; image bytes never spill into ordinary transcript, export, compaction, or relay text.</li> </ul> <h3>Changed</h3> <ul> <li>Anonymous usage counting is on by default for fresh installs and disclosed in a native first-run Codewhale modal with an immediate opt-out. Prior declines remain off. Codewhale does not collect conversations, code, prompts, files, repo or branch names, credentials, model content, or per-turn activity timelines.</li> <li>Wide terminals use a responsive, full-screen ocean canvas with modest gutters: prose keeps a readable measure while tools, diffs, work surfaces, the composer, and status chrome can use the available width. Turn and major activity seams breathe without padding every call inside a tool group.</li> <li>Root CLI help describes product actions directly instead of exposing internal TUI/runtime layers.</li> <li><code>Bash action="wait"</code> now blocks by default when a wait is requested; callers can still ask for a nonblocking snapshot, and persistent service ownership remains explicit.</li> <li>Compaction is one cache-stable summary request followed by one committed replacement summary and a bounded recent-message tail. Older saved sessions still restore.</li> <li>Ask, Work, Auto-Review, and Full Access share one stable base prompt. Modes continue to differ through permissions and the live tool catalog; the former Act label is now Work throughout the product and shipped locales.</li> <li>Full Access now auto-approves non-bypassable tools consistently, and the default choice shown on ordinary approval cards is configurable.</li> <li>Model, context-window, dispatch-name, and nested-agent spawn receipts report the route and limits actually used rather than silently substituting a guessed identity.</li> <li>Child-agent launches mint one immutable route receipt before admission and preserve it through status, interruption, completion, resume, Work Graph, and ledger projections, so provider/model attribution cannot drift (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5305</a>).</li> <li>Goal runs no longer stop because of internal continuation, repeated-gap, or unanswered-question guards. Explicit user limits and terminal goal states remain authoritative.</li> <li>Account-owned <code>/rc</code> remote control now keeps exclusive ownership and a crash-recoverable delivery journal until the server acknowledges terminal, approval, failure, and snapshot state.</li> <li><code>todo_write</code> is an optional progress surface rather than required model ceremony.</li> <li>New turns use one small, stable toolbox: <code>read</code>, <code>write</code>, <code>edit</code>, <code>bash</code>, <code>agent</code>, <code>todo_write</code>, and <code>tool_search</code>. The optional progress tool stays visible as familiar working memory; specialized native, Web, MCP, plugin, memory, task, and verification tools are policy-filtered and searchable; activated schemas stay in a bounded per-conversation cache. Every sub-agent keeps its own search and cache, including policy-allowed Web research, while forked context and parent activations remain warm starts rather than allowlists.</li> <li>The direct file and shell schemas follow Pi's deliberately small contract: bounded complete-line reads, hash-free writes, unambiguous multi-edit with BOM/CRLF preservation and conservative fuzzy matching, and one foreground <code>bash</code> command with a bounded chronological output tail. Modes change execution authority, not those primitive names.</li> <li>Codewhale no longer re-states the To-do list to the model. The model learns what is on the list from the tool result its own <code>todo_write</code> call returned, which is ordinary conversation history — the same way Pi's To-do works. The transient <code><codewhale:work_state></code> block that used to ride the tail of every parent turn-loop and sub-agent step request is gone, along with the stable system prefix being disturbed by list changes. A snapshot is still shown once, where a person asked for it: the <code><codewhale:fork_state></code> block a newly forked sub-agent is handed, <code>/relay</code> handoff instructions, and the agent card. The complete To-do stays visible in the UI. A structural test asserts real outbound provider request bodies do not carry the list.</li> <li>Scout and Reviewer name the read-only investigator roles. Both expose exactly one shell entry point — canonical lowercase <code>bash</code>, bounded by the strict read-only classifier — and the legacy <code>Bash</code> alias stays denied in the catalog and at dispatch. Previously a case-insensitive name match let a call spelled <code>Bash</code> execute through that carve-out, returning raw shell to a read-only role.</li> </ul> <h3>Fixed</h3> <ul> <li> Sending more context while a lowercase <code>bash</code> command is running now moves the command to <code>/jobs</code> and returns a successful running receipt instead of falsely reporting <code>Command exited with code -1</code>; the process keeps running and its completion still arrives through the normal runtime event. </li> <li> First-run usage disclosure now opens as a native Codewhale modal instead of a shell questionnaire before application startup. Telemetry remains unarmed until the native choice is made, and an in-memory Disable choice governs the current session even when its preference cannot be saved. </li> <li> <code>/compact</code> completion, failure, queued, duplicate, and mailbox outcomes are durable transcript receipts instead of short-lived toasts. A stray terminal event can no longer leave every later compaction stuck as already running. </li> <li> Compaction now follows Codex's simple transcript shape: recent user context followed by one ordinary history checkpoint. It never appends the summary, the To-do list, or volatile shell/worker state to the standing system prompt; reloads migrate the persisted carrier back into exactly one history item. </li> <li> Automatic compaction uses a percentage of the real context window, clamped to the route's spendable ceiling. Pressure comes from the current parent-route prompt, not cumulative billing or child-model usage. </li> <li> Compaction, review, verify, routing, setup, Fleet, MCP, RLM, vision, translation, and sub-agent calls inherit the resolved route's normal output, sampling, and reasoning policy. Small internal-task token caps no longer truncate thinking routes or special-case individual providers. </li> <li> Incomplete provider responses fail truthfully across ordinary turns and every internal model consumer. Partial text stays interrupted, pending tool calls do not execute, and billed usage is retained. </li> <li> Transport-only <code>(reasoning omitted)</code> placeholders no longer enter new transcripts and are filtered from restored sessions. Reasoning expand/collapse actions stay attached to the exact rendered cell, including after replacement, restore, filtering, and resize (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5291</a>). </li> <li> Step-budget exhaustion is a typed failure and cannot release a pending persistent service. Cancellation after terminal usage still charges the turn. </li> <li> Deferred tools now preserve a completed result when a provider reuses its tool-call ID on the retry turn, preventing successful plugin calls from entering a repeated execution loop. </li> <li> Website setup, provider, diagnostics, Fleet, and single-runtime claims now match the source candidate. </li> <li> Opening the sub-agent register no longer hides the to-do list: the Agents panel shows the full register and the durable checklist together, and the register header is a two-way door that returns to Tasks on a second click. </li> <li> The ⌥V / Alt+V details chord opens the selected work-surface row's own inspector instead of the transcript's nearest tool cell, so a selected to-do row shows its own content rather than the latest reasoning. </li> <li> The first-run usage disclosure now asks a clear question — "Help improve Codewhale?" — with unambiguous "Yes, keep anonymous counts" / "No, turn off tracking" choices in every shipped locale, and states the persistent opt-out command. Consent semantics are unchanged: telemetry stays unarmed until a choice is made. </li> <li> macOS screencapture screenshots referenced in a message are copied to a stable attachments directory the moment the message is received, and the reference is rewritten to the stable path, so the image still exists when the agent reads it. Only files under a screencapture "Temporary Items" directory are touched; copies are idempotent and a failed copy keeps the original reference. </li> <li> Manual <code>/compact</code> during an active turn now queues even when the engine's bounded op mailbox is saturated. The request defers client-side, retries as mailbox slots free, and cannot latch as already running after it settles. </li> <li> Interactive <code>/load</code>, startup <code>--resume</code>, and <code>/resume</code> picker paths preserve the persisted provider, endpoint, and model identity; picker resume also leaves a durable transcript receipt. </li> <li> Relative <code>mcp_config_path</code> values no longer depend on the launch directory or silently load an empty server pool: Codewhale warns and falls back to the user-global MCP configuration. Explicit absolute paths remain authoritative. </li> <li> Alibaba Model Studio <code>qwen3.8-max</code> and <code>qwen3.8-max-preview</code> still stream their current reasoning, but no longer replay historical <code>reasoning_content</code> that those routes do not accept. Historical reasoning replay is now gated by the exact provider/API/model contract, so unknown <code>*-thinking</code> lookalikes fail closed while documented Qwen, Kimi, DeepSeek, Mistral, Anthropic, and Responses continuity rules remain intact. </li> <li> Compatibility File/patch calls retain optional content-hash guards when a caller supplies them. The new direct <code>write</code> and <code>edit</code> schemas do not expose hash or prior-read ceremony. </li> <li> Shell previews hold back incomplete UTF-8 sequences instead of emitting replacement characters, and compaction receipts report token deltas. </li> <li> Nested agents may narrow but can never widen their inherited depth budget (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5317</a> by <a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@ousamabenyounes</a>). </li> <li> Container publication now assembles AMD64 and ARM64 images in parallel on native runners from the already-verified static release binaries, then publishes and checks one multi-architecture manifest. It no longer rebuilds both targets through the single long-running QEMU job that lost its runner. </li> </ul> <h3>Removed</h3> <ul> <li>The no-progress guard, repeated-read guard, and injected tool-error strategy coaching. Productive polling, repeated inspection, and model-owned recovery are no longer interrupted by runtime heuristics.</li> <li>Never-wired decision-card, keybinding, hover, shell-execution, engine-op, and release-script paths were deleted so the supported runtime has one route for each behavior.</li> </ul> <h2>Contributors</h2> <ul> <li>Xavier Pestel (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@xavierpestel-ai</a>) — Mistral AI provider route (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5295</a>).</li> <li>Ben Younes (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@ousamabenyounes</a>) — inherited nested-agent depth cap (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5317</a>).</li> <li>Rafael Cavalheri (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">@rafaelcavalheri</a>) — ACP agentic tool turns (<a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">#5225</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880044/3935567/github-release-hmbowncodewhale-v096-12082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.7 (13.08.2026)</h1> Wed, 02 Sep 2026 11:48:46 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.713.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.7</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.7</h2> Codewhale v0.9.7 keeps the catalog ordinary. Grok 4.6 lands as a normal catalog row instead of a provider-shaped pile of special cases, OrcaRouter joins as a named provider, and a panic-safety advisory in <code>lru</code> is cleared by lifting the pin that caused it rather than living around it. <h3>Added</h3> <ul> <li>Grok 4.6 is the direct xAI default, with the <code>grok</code> alias moving onto it and <code>grok-4.5</code> still explicitly selectable. Its 500K context, text/image input, tool and structured-output support, <code>low</code>/<code>medium</code>/<code>high</code>/<code>xhigh</code> reasoning efforts (default <code>high</code>), and server-side web search all come from the Models.dev-shaped catalog rather than model-specific code. <code>reasoning_effort</code> reaches the wire only on the exact first-party <code>https://api.x.ai/v1</code> route, and the usage-aware 200K-token pricing boundary is scoped to direct xAI so aggregator routes reusing the model slug cannot inherit xAI billing.</li> <li>OrcaRouter is a first-class named provider: <code>ORCAROUTER_API_KEY</code>, default base URL <code>https://api.orcarouter.ai/v1</code>, <code>deepseek/deepseek-v4-pro</code> default, <code>orcarouter/auto</code> routing, CLI <code>--provider</code> selector, and TUI picker entries (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5321</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Reasoning-effort normalization and the model picker read a model's published <code>reasoning_options</code> list from the catalog instead of collapsing every route to the historic Low/Medium ladder. Any catalog row that publishes an effort list keeps its own vocabulary.</li> <li>Docs record DeepSeek's live <code>DeepSeek-V4-Pro-0813</code> backend label while the callable API ID stays <code>deepseek-v4-pro</code>. No aliases are remapped and no <code>deepseek-v4-pro[1m]</code> selector is sent.</li> </ul> <h3>Fixed</h3> <ul> <li>Copying a user or assistant message takes its canonical content instead of reserialized transcript lines, keeping role glyphs, continuation rails, and visual wrapping out of the clipboard while preserving authored Unicode, Markdown, and hard line breaks. Tool and Thinking cells stay on the existing full-transcript path (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5319</a>).</li> <li><code>load_session</code> no longer runs crash recovery on every read. Snapshot reads go through a side-effect-free <code>load_session_snapshot</code> and recovery is explicit via <code>recover_session_for_resume</code>, so an embedding host inspecting a durable session while a tool is still running no longer gets a spurious crash repair (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5320</a>).</li> </ul> <h3>Security</h3> <ul> <li><code>lru</code> moves to 0.18 to clear RUSTSEC-2026-0253, where <code>LruCache::pop()</code> was not panic-safe and could leave dangling list pointers. The <code>ratatui-core</code> <code>=0.1.0</code> pin that transitively forced <code>lru</code> ^0.16 is lifted, so <code>ColorCompatBackend</code> now answers <code>get_cursor_position()</code> from tracked cursor state — the upstream-recommended workaround for the startup CPR race (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">ratatui/ratatui#2483</a>, <a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">ratatui/ratatui#2640</a>) that the pin originally worked around. <code>ratatui</code> itself stays pinned at <code>=0.30.0</code>, so the API surface is unchanged.</li> </ul> <h3>Known issues</h3> <ul> <li>The integration test <code>exec_persistent_service::failed_exec_kills_pending_service_and_exits_nonzero</code> is a confirmed flake under parallel load ("service pid file never appeared"). It passes in isolation and is unrelated to any v0.9.7 change.</li> </ul> <h2>Contributors</h2> <ul> <li>XhesicaFrost (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@XhesicaFrost</a>) — canonical message copy (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5319</a>).</li> <li>h3c-hexin (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>) — session snapshot and crash-recovery split (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5320</a>).</li> <li>XiaoHuo888-hue (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">@XiaoHuo888-hue</a>) — OrcaRouter provider registration (<a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">#5321</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880043/3935566/github-release-hmbowncodewhale-v097-13082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.9 (18.08.2026)</h1> Wed, 02 Sep 2026 11:48:45 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.918.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.9</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.9</h2> Codewhale v0.9.9 is a truth-and-resilience release: the shell tool can no longer wedge a session when the host runs out of disk or descriptors, unverified context windows and output ceilings are labeled honestly at every surface, DeepSeek V4 is priced on the published peak/off-peak tiers, SSE UTF-8 fails closed in every dialect, Fleet shadowing is visible, bwrap gets container essentials and extra roots, the <code>dsh</code> skin rides the bundle profile, the <code>agent</code> tool schema is down to 12 fields, and README/website locales grow to 18 and 8. <h3>Fixed</h3> <ul> <li>The lowercase <code>bash</code> tool no longer wedges when its complete-output spill file cannot be created: a full temp volume or exhausted descriptor table used to fail every call — <code>echo ok</code> included — with the harness-internal "Failed to create streaming shell output" and never recover until the host was cleaned up. The spill is now best-effort (the bounded tail is still returned and the truncation notice says why the full-output path is missing), and any remaining spawn/stream failure names the exhausted resource — disk, file descriptors, memory — and says the next call is safe to retry (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5465</a>; the wedge that took out the owner's own 0.9.9 session).</li> <li>A concrete route/offering output limit now outranks the conservative 8,192-token compatibility guess for an uncatalogued model. Routes that publish no output limit remain fail-closed, documented model ceilings stay authoritative, and a route limit can never raise the requested cap (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5460</a>).</li> <li>Context-window honesty at every surface (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5239</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5441</a>): the <code>model-name hint</code> and <code>fallback</code> rungs of the context-window ladder are guesses, and every surface that renders one now says so — the status line, <code>/status</code>, <code>/config</code>, the context-pressure message, the model picker chips, and the auto-router inventory. Unverified windows still drive real budgets (compaction trigger, context meter, output reservation); they just stop reading as capabilities anyone checked. A window parsed from an <code>_Nk</code> model-name suffix (<code>qwen3-32b-256k</code> → 256K) is now its own <code>model-name hint</code> rung below <code>catalog</code>, because it is optimistic rather than conservative — a catalog or provider-reported value beats it. The <code>[providers.<name>] context_window</code> override remains the hard fix and renders as <code>configured</code> with no marker.</li> <li>Output-ceiling honesty (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5440</a>): an Anthropic-family model the catalog does not describe keeps the 64K Messages floor as its clamp and the ChatGPT/ Codex OAuth route keeps its 4K policy, but <code>OutputCeilingSource</code> gained an <code>unverified</code> rung for both, so exec-stream receipts and the model picker label them <code>unverified</code>/"assumed floor" instead of <code>documented</code>. Clamp values are unchanged.</li> <li>Telemetry default-on is visible (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5441</a>): <code>codewhale doctor</code>'s runtime-posture section gained a <code>telemetry=on (default)</code>-style row with the source that decided it (cli | env | config | default), and <code>codewhale config get telemetry</code> reports the resolved consent with its source instead of <code>key not found</code> on a machine whose batches ship. Truth change only; resolution and behavior are untouched.</li> <li>Fleet: a scout's read-only shell carve-out (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5428</a>) is now honored by both the posture gate and the execution envelope, so <code>git log</code>, <code>find | head</code>, <code>npm view</code> and the other bounded read-only commands run in-place instead of being refused as "Executes" (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>). Delegation still never widens authority: the role-isolation test and docs/SUBAGENTS.md pin that a child cannot exceed its parent's posture (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5435</a>).</li> <li><code>/rename</code> and <code>/title</code> now apply mid-first-turn: the session file does not exist until the first autosave, so the rename fell through with NotFound; the shared path now prefers the per-session checkpoint and rebuilds from App state, with a PTY regression test through the live event loop (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5430</a>).</li> <li><code>integrations dsh plan</code> no longer refuses DeepSeek's default Responses-dialect route (<code>deepseek-v4-flash</code>); Responses and Anthropic-Messages routes are carried through pi-ai <code>openai-responses</code> / <code>anthropic-messages</code> instead of being approximated or refused; only credentialed base URLs are still refused, with an error that names provider and model (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5434</a>).</li> <li>Session cost no longer sits at <code>unverified_live_pricing</code> when live pricing cannot be verified (control-plane 503, Models.dev capabilities-only overlays): provider-docs bundled fallback rates for the DeepSeek V4 family on Fireworks / OpenCode Zen restore a usable figure, live per-provider rows still win, and <code>kimi-k3</code> stays unpriced until a published rate exists (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a>; harvested from <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5402</a>).</li> <li>Release assets: <code>release.yml</code> asset-freshness checks compare against the release job's own <code>started_at</code>, so job-level reruns of the npm step are no longer poisoned by earlier uploads (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5429</a>).</li> <li>macOS CI: the <code>agent_focus_pty</code> auto-review receipt test waited on a worker that had already completed and raced the rail's focus; it now holds the child's wrap-up and waits for a settled live row (refs <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5403</a>).</li> <li>DeepSeek V4 pricing follows the published peak/off-peak tiers (peak 01:00–04:00 and 06:00–10:00 UTC; off-peak is half of peak) for <code>deepseek-v4-flash</code> and <code>deepseek-v4-pro</code> in USD and CNY, resolved from each turn's recorded time; the stale single-tier rows understated cost up to ~4×. Because every direct DeepSeek first-party rate is now time-windowed, the scorecard fails closed (<code>missing_recorded_time</code>) on an undated DeepSeek turn instead of guessing a tier (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5470</a>; <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a> follow-up, verified against api-docs.deepseek.com on 2026-08-17).</li> <li>SSE UTF-8 split across HTTP/2 DATA frames now fails closed in every streaming dialect: a shared strict decoder, tail flush, and <code>decode_failed</code> propagation (<code>InvalidSseUtf8</code>) replace the per-dialect approximations, with byte-chunk decoder tests (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5374</a>; supersedes draft <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5404</a>).</li> <li>CI: <code>release_four_read_only_fleet_roles_launch_with_canonical_prompts</code> answered Fleet children with SSE while they call the blocking JSON path; the parse failure was retried and double-counted the worker on slow macOS runners (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5471</a>; refs <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> <li>Context: every web tool surface (<code>Web</code>, <code>web_search</code>, <code>web.run</code>, <code>fetch_url</code>) now uses the noisy-result soft limit, so large fetches are compacted like shell output instead of consuming the ordinary hard limit (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5474</a>, thanks <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>).</li> <li>Routing: a lowercase saved selector such as <code>glm-5.2</code> resolves against the owning Z.ai / DeepSeek catalog row (case-fold fallback, only when exactly one provider-owned wire id matches) instead of being classified as another provider's bare model (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>, thanks <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>; diagnosis by <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@asto18089</a> in <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">Pinvou#14</a>).</li> <li>Model catalog brought current as of 2026-08-17 against the official pricing pages: gpt-5.6-terra / gpt-5.6-luna rates, <code>claude-sonnet-5</code> keeps $2/$10 (the announced September increase was withdrawn), <code>claude-opus-5</code> added, <code>kimi-k3</code> and <code>kimi-k2.7-code-highspeed</code>, <code>MiniMax-M2.7-highspeed</code>, Mistral first-party rows, xAI <code>grok-4.5</code> / <code>grok-4.3</code> with long-context tiers, Gemini and Qwen limits, and RedNote's <code>dots3-note</code> preview as an OpenRouter row (no first-party API exists yet) — every number carries its source and a pinned test (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5485</a>).</li> <li>Website: copy on codewhale.net rewritten in plain declarative sentences — one idea per sentence, numbers from the generated facts, no self-narration — with a voice sheet at docs/design/WEB_VOICE.md (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5483</a>).</li> <li>CI: the release workflows no longer restore npm/cargo caches after checking out a caller-supplied SHA — the CodeQL cache-poisoning Highs <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#88</a>–<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#107</a> are closed with a contract test over the workflow files (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5463</a>).</li> <li>Compact TUI rows below 60 columns no longer reserve a hidden session-metrics strip, so narrow terminals reclaim the row instead of clipping the transcript (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5486</a>).</li> <li>Ghostty's truecolor underwater field now uses a dedicated synchronized 60 FPS lane instead of the legacy 30 FPS compatibility cap, with continuous caustic fades replacing visibly stepped color changes.</li> <li>Live reasoning's advertised <code>Space:expand</code> action now runs before the composer's first-character paste-burst hold, while spaces in an active paste remain payload. The newest reasoning preview also spends only genuinely free viewport rows before truncating instead of stopping at the fixed 10/12-row fallback on roomy terminals.</li> <li>Strict <code>cargo doc</code> builds no longer fail on bare URLs in rustdoc comments; the remaining links are explicit Markdown targets (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5489</a>).</li> </ul> <h3>Changed</h3> <ul> <li>The model-facing <code>agent</code> tool advertises exactly 12 fields — <code>action</code>, <code>prompt</code>, <code>type</code>, <code>profile</code>, <code>name</code>, <code>agent_id</code>, <code>message</code>, <code>until</code>, <code>detached</code>, <code>worktree</code>, <code>write_roots</code>, <code>resume_from</code> — down from 33 (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5324</a>, refs <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5123</a>). Budgets (<code>max_steps</code>, <code>wall_time_secs</code>, <code>max_depth</code>), routing overrides (<code>model</code>, <code>model_strength</code>, <code>thinking</code>), worktree-path knobs, the deliberate/spawn-contract fields and the wait/status/interrupt extras moved off the advertised schema. Every removed field stays parse-accepted and honored unchanged (same contract as <code>token_budget</code>), so saved transcripts, ACP/MCP clients and Fleet configs replay as-is; the <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5426</a>/<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5435</a> containment clamps are untouched. Child budgets now resolve from role defaults (60/120 turns, 1800 s wall time, unchanged clamps) and new <code>[subagents]</code> keys <code>default_max_steps</code> / <code>default_wall_time_secs</code>. Because the tool catalog is part of the session-pinned prompt prefix (docs/CACHE.md), upgrading re-fills the KV prefix once per session.</li> <li>TUI prose — user messages, assistant answers, and reasoning/thinking — now wraps at the full content width on wide terminals, matching tool/status cells, instead of stopping at a 105-column rail that left a dead right margin on ultrawide displays (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5436</a>).</li> <li>Configured skill prompts are stable across session roots and operating systems: only custom configured roots hide their physical path, ordinary workspace/global skills keep a discoverable privacy-safe path, warning replacements are boundary-aware (including non-UTF-8 Unix paths), and Windows separators render as <code>/</code>. The skills prompt is also 50 bytes leaner without raising a runtime-contract ceiling (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5492</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5473</a>).</li> <li>Auto-router classifier requests accept <code>[auto.router] timeout_secs</code>, while preserving the existing default when the key is absent (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5494</a>).</li> <li>Every <code>ci.yml</code> job now has an explicit 10–90 minute timeout appropriate to its workload, bounding stale assigned runners instead of inheriting GitHub's six-hour default (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5495</a>).</li> <li>The docs shell and shared web components now route localized copy through the typed dictionary spine; these are two incremental phases of <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5337</a>, not completion of the full epic (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5488</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5490</a>).</li> <li>Dependency: rusqlite 0.40.2 (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5391</a>).</li> <li>Documentation: stale A/B/C-tier references, provider defaults, module descriptions, and line anchors now match the current code (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5481</a>).</li> </ul> <h3>Added</h3> <ul> <li><code>[transcript] prose_measure</code> (positive integer, optional): caps prose wrap at N columns for owners who want a bounded reading measure on ultrawide terminals. <code>0</code> or absent keeps the full width; negative or non-integer values are rejected with a clear config error. Tool, diff, and status cells never inherit the cap (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5436</a>).</li> <li>Localization: README translations for Français, Deutsch, 繁體中文, हिन्दी, Türkçe, Italiano, Polski, العربية and Català join the existing nine (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5451</a>); codewhale.net routes fr, de, ca, hi, tr, it, pl and ar (with <code>dir="rtl"</code> plumbing) as partial locales (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5453</a>).</li> <li>Docs: README Integrations section (incl. the DeepSeek Harness <code>dsh</code> plugin path, docs/INTEGRATIONS_DSH.md) localized across all READMEs; RFC keeping the deterministic-first auto-review hybrid (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5427</a>); Claude Code parity reference for agents/workflows/plugins/skills (docs/design/CLAUDE_CODE_PARITY.md); config.example.toml / SUBAGENTS.md / TOOL_LIFECYCLE.md brought back in line with the code (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5447</a>).</li> <li><code>dsh</code> integration: the Codewhale palette is applied through the bundle profile via dsh's documented <code>overrideTokens</code> (on by default; <code>codewhale integrations dsh update --skin false</code> turns it off), replacing the 0.9.8 exported-CSS skin that dsh's inline body variables overrode (docs/design/DSH_BUNDLE_SKIN.md, docs/INTEGRATIONS_DSH.md) (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5469</a>).</li> <li><code>dsh</code> integration: an ambient ocean scene behind the DSH web UI — slow whale silhouettes, a school of <code>><></code> glyph fish, bubbles — drawn on a canvas under a translucent veil of the Codewhale palette, plus an explicit responsive <code>WHALE BROTHERS / CODEWHALE × DEEPSEEK HARNESS</code> lockup; light and dark, ~30 fps capped, paused when hidden, a static frame under <code>prefers-reduced-motion</code>; on by default with the skin, <code>codewhale integrations dsh update --ocean false</code> turns it off (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5484</a>).</li> <li>Fleet: agent shadowing is visible — a roster-row badge, a Layers block in agent detail, and a <code>doctor</code> "Fleet roster layers" section (JSON <code>operate_fleet.roster.multi_layer</code>), in all 15 TUI locales. Layer collapse and <code>[fleet.profiles]</code> migration stay for 0.9.10 (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5098</a>).</li> <li>Sandbox: bwrap containers get the <code>--dev/--proc/--tmpfs</code> essentials plus configurable extra roots (<code>bwrap_ro_roots</code> / <code>bwrap_dev_roots</code>) so toolchains that live outside the workspace stay reachable read-only (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5410</a>).</li> <li>Tests: <code>crates/tui/tests/README.md</code> states the keyless assembled-journey rule and maps the Auto-Review guardian acceptance items to the engine journeys that exercise them (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5361</a>).</li> <li>OrcaRouter's default endpoint is classified as an aggregator billing surface, so pricing and session-cost reporting use the correct billing posture instead of treating it as a first-party provider (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5493</a>).</li> <li>Dependencies: ratatui 0.30.2, thiserror 2.0.20.</li> </ul> <h3>Removed</h3> <ul> <li><code>dsh</code> integration: the exported-CSS skin file and its "skin export" status line (superseded by the bundle-applied <code>overrideTokens</code> skin, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5469</a>).</li> </ul> <h2>Contributors</h2> <ul> <li>hexin (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@h3c-hexin</a>) — a concrete route/offering output limit outranks the 8,192-token compatibility guess for an uncatalogued model (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5461</a>, closes <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5460</a>); web tool results use the noisy soft limit (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5474</a>); owned direct model casing resolves safely (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>); and configured-skill prompts stay stable across ephemeral roots and operating systems (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5492</a>, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5473</a>).</li> <li>Gabriel-Degret (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@Gabriel-Degret</a>) — configurable auto-router classifier timeout (<a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5494</a>; first contribution).</li> <li><a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@asto18089</a> — diagnosed the Z.ai <code>glm-5.2</code> casing collision and wrote the first provider-scoped fix in <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">Pinvou#14</a> (carried upstream in <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5475</a>).</li> <li>Reports and reproductions that shaped this release: <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@hardy922</a> (context- window honesty, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5239</a>), <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@redstar</a> (bwrap extra roots, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5410</a>), <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@all-lopezg</a> (SSE UTF-8 garbling on DeepSeek Flash, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5374</a>), <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@alitvak69</a> (unverified live pricing, <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5241</a>), and <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a> (the macOS filtered-suite hang investigation on <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880042/3935565/github-release-hmbowncodewhale-v099-18082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> <article> <h1>GitHub Release: Hmbown/Codewhale v0.9.8 (20.08.2026)</h1> Wed, 02 Sep 2026 11:48:43 +0200 <div class="github-feed-entry"><div class="github-feed-badges"><a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">Hmbown/Codewhale</a>v0.9.820.08.2026@github-actions[bot]</div><div class="github-feed-changelog"><blockquote> Codewhale is the public product from Shannon Labs. The <code>codewhale</code> command, npm package, and release-asset names remain lowercase technical identifiers. The legacy npm package <code>deepseek-tui</code> is deprecated and receives no further releases. Users coming from v0.8.x legacy <code>deepseek</code> / <code>deepseek-tui</code> names should migrate with <code>docs/REBRAND.md</code>. </blockquote> <h2>Install</h2> <h3>Recommended — npm (one command, both entrypoints)</h3> <pre>npm install -g codewhale</pre> The wrapper downloads the matched <code>codewhale</code> and <code>codew</code> command assets from this Release. Both contain the same compiled runtime. <h3>Docker / GHCR</h3> <pre>docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.8</pre> The image exposes the same runtime as both <code>codewhale</code> and <code>codew</code>. The <code>latest</code> tag is also updated on release. <h3>Cargo (Linux / macOS)</h3> <pre>cargo install codewhale-cli --locked</pre> The Cargo package installs <code>codewhale</code>. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a <code>codew</code> symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. <h3>Manual download — platform archives (recommended)</h3> Each archive below contains the same runtime under the <code>codewhale</code> and <code>codew</code> command names, plus an install script: <table> <thead> <tr> <th>Platform</th> <th>Archive</th> <th>Install script</th> </tr> </thead> <tbody> <tr> <td>Linux x64</td> <td><code>codewhale-linux-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Linux ARM64</td> <td><code>codewhale-linux-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Android ARM64 (Termux)</td> <td><code>codewhale-android-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS x64</td> <td><code>codewhale-macos-x64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>macOS ARM</td> <td><code>codewhale-macos-arm64.tar.gz</code></td> <td><code>install.sh</code></td> </tr> <tr> <td>Windows x64 (installer)</td> <td><code>CodeWhaleSetup.exe</code></td> <td>NSIS setup</td> </tr> <tr> <td>Windows x64</td> <td><code>codewhale-windows-x64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows x64 (portable)</td> <td><code>codewhale-windows-x64-portable.zip</code></td> <td>—</td> </tr> <tr> <td>Windows ARM64</td> <td><code>codewhale-windows-arm64.zip</code></td> <td><code>install.bat</code></td> </tr> <tr> <td>Windows ARM64 (portable)</td> <td><code>codewhale-windows-arm64-portable.zip</code></td> <td>—</td> </tr> </tbody> </table> Unix (Linux / macOS): <pre>tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh</pre> Windows: <ul> <li>For the installer path, run <code>CodeWhaleSetup.exe</code>; it installs <code>codewhale.exe</code> and <code>codew.exe</code> under <code>%LOCALAPPDATA%\Programs\CodeWhale\bin</code> and adds that directory to the current-user PATH.</li> <li>Extract the archive for your machine: <code>codewhale-windows-x64.zip</code> or <code>codewhale-windows-arm64.zip</code></li> <li>Run <code>install.bat</code> (copies to <code>%USERPROFILE%\bin</code>)</li> <li>Add <code>%USERPROFILE%\bin</code> to your PATH</li> </ul> The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has bare, unarchived <code>codewhale-<platform></code> and <code>codew-<platform></code> assets. The seven <code>codewhale-tui-<platform></code> filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package <code>deepseek-tui</code> is deprecated and is not republished. For migration from v0.8.x legacy binary names, see <code>docs/REBRAND.md</code>. <h3>Verify (recommended)</h3> Download the checksum manifests from this Release and verify: <pre># Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing</pre> <h2>What's in v0.9.8</h2> Codewhale v0.9.8 ships the remaining assigned finish. Remaining web settings polish moves to v0.9.9. Prefab third-party templates that have a published OpenAI-compatible host ship here (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5350</a>). <h3>Fixed</h3> <ul> <li> <code>sudo</code> (and <code>su</code>/setuid helpers) work again for wheel-group administrators who want Codewhale to be able to escalate: the Linux startup hardening's irreversible <code>PR_SET_NO_NEW_PRIVS</code> flag — inherited by every child process — is now skippable with <code>CODEWHALE_NO_NEW_PRIVS=0</code> (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5413</a>). The flag stays on by default; the no-ptrace and no-core-dump measures are never skipped. </li> <li> Abort-class process deaths no longer poison the terminal (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5424</a>). A stack overflow, allocation failure, or double panic skips the panic hook and every cleanup guard, which is how a v0.9.7 user's mid-turn exit left mouse capture leaking SGR sequences into their shell. An async-signal-safe handler now restores the terminal modes and appends a one-line cause marker to <code>~/.codewhale/crashes/last-fatal-signal.log</code> before re-raising, keeping the honest 128+signal wait status. A SIGKILL (OOM killer) remains uninterceptable by design. </li> </ul> <h3>Changed</h3> <ul> <li> Prompt-cache prefix is pinned for the session. The tool loop no longer recomposes the system prompt from disk on every model step, so an agent writing a file no longer busts the provider KV prefix cache mid-turn. The system prompt and tool catalog are re-composed only on a declared header change (<code>/model</code>, mode, goal, session resume), which re-pins under a logged reason; an undeclared change is reported as drift and the original pin is kept instead of silently becoming the new baseline. Workspace, AGENTS.md, skills, memory, and goal drift now reaches the model as one bounded <code><context_update></code> user message at the next user turn — a history append, not a header rewrite. <code>/cache stats</code> shows the pin reason, the last-miss reason, the undeclared-drift count, and the context-update count. See <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">docs/CACHE.md</a>. </li> <li> Plugin compatibility is now per-component. A reviewed, trusted, enabled bundle that mixes Skills or MCP with unsupported commands, agents, hooks, LSP, native, filesystem-roots, or lifecycle-mutation declarations keeps the supported adapters active and reports the rest as inactive (<code>full</code> / <code>partial</code> / <code>unsupported</code>). All-unsupported bundles still cannot be enabled. The capability hash is now v2 and binds this build's activation policy, so older v1 receipts and any later adapter-enablement change fail closed as needs-review. Skills and each MCP transport re-request their own capability at the consumption boundary. </li> </ul> <h3>Added</h3> <ul> <li> Composer multiline mode is available in <code>/settings</code>. When enabled, Enter inserts a new line and Shift+Enter sends the message (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5345</a>, reported and tracked by <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@AiurArtanis</a>). </li> <li> <code>/plugin marketplace add|list|show|remove|install</code> completes the federated marketplace journey (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5311</a>). <code>add</code> reads one LOCAL catalog document in the real published schemas (Kimi, Claude, Codex, or Codewhale native) — no network, regular files only — and persists it beside the plugin state with the same hardened, fail-closed store. <code>list</code>/<code>show</code> render every candidate with per-entry diagnostics, display-only tiers, and honest install plans that say when Codewhale cannot fetch a source; <code>install</code> routes through the existing reviewed installer, so installed bundles still enter disabled and untrusted. Foreign auto-install policy (Codex <code>INSTALLED_BY_DEFAULT</code>) is visibly ignored; nothing is auto-installed, auto-trusted, or granted vendor trust. </li> <li> <code>/rc</code> attach now includes an observed <code>owner/name</code> git remote when the folder has a GitHub, CNB, or Gitee origin, so CWC can label the paired session. Paths stay off the wire. Reconnect after both this client and CWC <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#202</a> land to backfill existing empty rows. </li> <li> The local Runtime web client keeps the thread rail clipped so New thread cannot paint over the session fact chips. Chips wrap instead of sliding under the rail. </li> <li> Z.ai <code>GLM-5.3</code> is live on the Coding Plan and is now the default direct Z.ai model: <code>DEFAULT_ZAI_MODEL</code> resolves to <code>GLM-5.3</code> in both <code>codewhale-tui</code> and <code>codewhale-config</code>, and it is the first <code>/model</code> row after <code>/provider zai</code>. Explicit <code>GLM-5.2</code> selections (<code>model = "GLM-5.2"</code> and its <code>glm-5.2</code> aliases) keep their own id — only the default moved. Limits and reasoning options still inherit from <code>GLM-5.2</code> until Z.ai publishes distinct 5.3 numbers. No USD price is claimed. A live call can still 429 with entitlement code 1311 on accounts that are not provisioned for 5.3. </li> <li> The TUI transcript renders Markdown blockquotes (<code>></code> lines) with a quote rail — nested quotes, inline bold/code/links, wrapped continuation rows, and selection copy that keeps the quote text and skips the rail chrome. </li> <li> Sub-agent details show the resolved model, fleet role, and type. Labels use the session/role name instead of a generic Agent N (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5371</a>, <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5287</a>). </li> <li> Documented catalogue output ceilings (DeepSeek V4 384K) are honored on the request. A clean output-limit stop continues the turn instead of killing it (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5373</a>). </li> <li> Ollama Cloud is a first-class hosted provider (<code>/provider ollama-cloud</code>) on the official OpenAI-compatible <code>https://ollama.com/v1</code> route. Local Ollama stays keyless. The exact released <code>ollama</code> + Cloud URL tuple keeps a bounded compatibility path across saved sessions, Fleet, and nested subagents; neighboring remotes stay custom and fail closed against inherited official credentials. </li> <li> Homebrew ships a <code>codewhale</code> formula. <code>brew tap Hmbown/deepseek-tui && brew install codewhale</code> is the install path; <code>brew upgrade codewhale</code> updates it. The legacy <code>deepseek-tui</code> formula remains a deprecated alias for one overlap release. </li> <li> Terminal tab/window titles now carry the existing saved session name before the live state (<code>Codewhale</code>, <code>reasoning…</code>, <code>using tool…</code>, <code>done</code>), so parallel sessions are identifiable at a glance without a second title setting. <code>/title <name></code> is a discoverable alias for <code>/rename</code>; both update the one session name shown in the picker, composer, and terminal tab. Control, bidi, and zero-width format characters are stripped from the saved name itself, so <code>/title</code>, <code>/rename</code>, the picker, the Runtime API, <code>codewhale sessions</code>, and the OSC 0 tab title all carry the same escape-free text (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5419</a>, Sh1Zuku). </li> <li> Eden AI is a named OpenAI-compatible Chat Completions provider (<code>edenai</code>, aliases <code>eden-ai</code> / <code>eden_ai</code>) with <code>EDENAI_API_KEY</code>, global and EU base-URL overrides, a live provider-scoped model catalog, and <code>deepseek/deepseek-v4-pro</code> as the verified default. Generic reasoning fields stay omitted because Eden AI routes multiple upstream model families (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5422</a>, Kai Nacke). </li> <li> Children (sub-agents and Fleet workers) inherit the session's permission posture faithfully: Auto-Review's deterministic floor and model guardian decide a worker's held calls (fail closed when unavailable, never a prompt); under Ask a held call is raised in the parent's approval UI and the worker waits visibly; Full Access still fails closed on the safety floor. Each prompt-less decision is a one-line note in that worker's transcript (focus mode) and an audit-log record. </li> <li> Worker role defaults keep what the role does not intend to withhold: every built-in role keeps network reads; <code>planner</code> may run read-only shell probes; <code>custom</code> inherits the parent's write/network/shell posture and is narrowed only by its explicit tool list or the spawning call. Read-only roles (<code>scout</code>, <code>reviewer</code>, <code>planner</code>, <code>verifier</code>, <code>consultant</code>) still never write the workspace. The focused worker's header states its effective posture from the runtime snapshot. </li> <li> <code>/workflow status</code>, <code>/workflow cancel [run_id]</code>, <code>/workflow settings</code>, and <code>/workflow help</code> are answered by Codewhale itself from the run journal and live run state — no model turn — and <code>/workflow run <path></code> launches a checked-in workflow as-is. <code>/config workflow</code> and <code>/config goal</code> explain the effective tables. The workflow tool now honors the session <code>[workflow]</code> table (<code>automatic</code>, <code>auto_start_read_only</code>, <code>require_approval_for_writes</code>, limits) instead of product defaults. </li> <li> Goal mode enters as readily as DeepSeek Harness: the agent may create the session goal when a direct request describes a verifiable multi-turn end state, and Codewhale shows a one-line <code>Goal set</code> receipt with how to pause or clear it. Bare <code>/goal</code> shows plain progress (and how to continue when no turn is running), prints usage on an empty session instead of asking the model, and <code>/goal help|status</code> are reserved words. </li> <li> Whale Teams in the terminal: the six Signal Cut whale identities (Scout, Patch, Harbor, Echo, Keel, Lantern) appear as species badges on <code>/fleet</code> roster rows and worker rows, with an identity portrait in the roster detail pane and a six-state word (Resting, Thinking, Working, Waiting for you, Blocked, Offline) derived only from the child's real runtime status. Colors come from the theme tokens, every glyph has an ASCII fallback, and the working wake animates only under full motion. See <code>docs/design/WHALE_TEAMS_TUI.md</code>. </li> <li> A session metrics strip on the phase row (<code>4 turns · 108 steps │ LLM 11m46s · Tool call 1m52s │ TTFT avg 1.5s · 120 tok/s │ Cache hit 99% │ Input 9.3M</code>), on by default as the <code>session_metrics</code> footer item (<code>/statusline</code>, <code>[tui].status_items</code>). Every value comes from engine receipts — turn starts, per-model-call usage with stream time, time-to-first-token and whole-call time, tool start/complete edges, and provider-reported cache and input tokens. Cells without evidence are omitted, never estimated. <code>/status</code> prints the untrimmed line; the phase row sheds its lowest-value groups to fit the columns it actually has. </li> <li> Auto-Review decisions nobody was prompted for are now visible in the transcript as one-line notes: model-guardian allow/deny verdicts with their risk tier and stated reason, guardian failures (denied, fail closed), deterministic policy blocks, and holds Auto-Review denied without pausing. The audit log keeps the full record. <code>/permissions</code> ends with the active posture, what it decides on its own versus never, and the audit-log path. The footer's <code>Esc to interrupt</code> hint is localized. See <code>docs/design/AUTO_MODE_PARITY.md</code> for the Claude Code / Kimi Code parity ledger and follow-ups. </li> <li> <code>codewhale integrations dsh status|plan|connect|update|launch|disable|enable|remove</code> connects an existing official DeepSeek Harness (<code>dsh</code> 0.1.0-rc.6, verified) through Codewhale using only its documented seams: a <code>--patch</code> overlay that pins the exact Codewhale provider/model/endpoint identity (native <code>deepseek-official</code> route, or a hand-declared <code>openai-completions</code> route named <code>codewhale-<provider></code> for OpenAI-compatible providers), the Codewhale permission posture exported as <code>DSH_PERMISSION_MODE</code>, and an append-only receipt. Codewhale writes only under <code>$CODEWHALE_HOME/integrations/dsh/</code>, never copies API keys or edits DSH files, never broadens permissions (<code>--allow-full-access</code> only mirrors an existing Codewhale full-access posture), and reports not-installed / offline / incompatible / detected / connected / stale-config / stale-version / disabled honestly. Anthropic Messages and OpenAI Responses routes are refused as not carriable. The documented DSH plugin path is an explicit opt-in: <code>install-bundle</code> materializes a Codewhale bundle package (<code>codewhale-dsh-bundle</code>, MIT notice retained) and installs it with <code>dsh plugin --profile codewhale add <path></code> into a dedicated <code>codewhale</code> profile (pnpm required, reported truthfully when missing; <code>web</code>/<code>headless</code> untouched), so <code>dsh --profile codewhale</code> alone carries the identity; <code>update</code> regenerates the bundle patch and <code>remove-bundle</code> reverses it, leaving the DSH-owned profile directory in place. <code>/setup tools</code> and <code>codewhale doctor</code> show the read-only detection state; <code>doctor</code> also lists the DSH read-only credential consent alongside Codex and Grok. The optional <code>--skin</code> export writes a Codewhale token stylesheet generated from the TUI palette (Blue Stage dark/light, ombre water column, mode/permission/state colors, reduced-motion fallbacks); DSH exposes no custom-theme API, so the sheet is labeled an unsupported overlay and is never injected. See <code>docs/INTEGRATIONS_DSH.md</code>. </li> </ul> <h3>Fixed</h3> <ul> <li> Selecting the <code>google</code> provider kind resolved to the <code>antigravity</code> TUI identity (and vice versa): the agy provider entry was inserted at different positions in the config-level enum and the TUI's discriminant-indexed lookup table. The table now matches the enum, so provider pickers, sorted display, and kind round-trips are correct. </li> <li> The provider picker's key-entry stage accepted typed input and pastes for OAuth-only providers after <code>antigravity</code> declared OAuth acquisition; those gates now key off the OAuth acquisition class instead of a hard-coded provider identity. </li> <li> The webhook hook sink no longer panics when its HTTP client fails to build; it falls back to a default client (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5381</a>, EvanProgramming). </li> <li> Session-index JSONL writes are serialized behind a process-wide mutex so concurrent state stores cannot drop an append during compaction (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5382</a>, EvanProgramming; complements the cross-process file lock). </li> <li> A billed <code>max_tokens</code> stop followed by a transport error fails the turn instead of continuing into a second request. A clean output-limit stop still continues. Mid-size context windows keep the ordinary 65K internal reservation so compaction does not collapse to the 1K headroom floor when the catalogue documents a matching output ceiling. </li> <li> Thinking cycle, <code>/effort</code>, and Settings now walk each model's real ladder instead of the DeepSeek off/high/max shortcut. Grok 4.6 is auto/low/medium/high/xhigh (cannot disable); Grok 4.5 is auto/low/medium/high; first-party DeepSeek keeps a documented <code>low</code> tier. <code>/effort</code> persists and receipts through the same path as Ctrl+T. </li> <li> Google Gemini is its own backend (<code>/provider google</code>) on the official OpenAI-compatible route with thought-signature capture/replay and fail-closed replay for thinking models. Antigravity (<code>agy</code> 1.1.13) is a separate provider: consent-gated read-only import of the official CLI's login, then a text-only cloud-code stream (<code>/v1internal:streamGenerateContent</code>). Tools, images, and unknown SSE shapes fail closed. Gemini 3.7 Flash is not advertised until a live turn succeeds on this wire. The website 44-count still excludes Antigravity. </li> <li> DeepSeek Flash SSE on macOS no longer turns mid-character HTTP/2 flushes into U+FFFD replacement characters (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5374</a>). Invalid UTF-8 fails the line instead of using lossy decode. </li> <li> <code>[workshop] read_result_max_bytes</code> and <code>tool_result_max_bytes</code> raise the model-visible read/tool-result floor; they never lower the compile-time defaults and cap at 2MiB (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5367</a>). </li> <li> Fireworks and OpenCode Zen DeepSeek V4 Flash/Pro keep a bundled family rate when the live control plane is down, so session cost is not stuck on <code>unverified_live_pricing</code> (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5241</a>). <code>kimi-k3</code> stays unpriced until a published rate exists. </li> <li> Provider setup ships a SenseNova OpenAI-compatible preset (<code>S</code>) on the published <code>https://token.sensenova.cn/v1</code> host (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5350</a>). OpenCode Zen/Go stay first-class rows. Agnes has no published URL, so it has no preset. </li> <li> Privileged release workflows no longer restore rust-cache, sccache, or npm caches after checking out a caller-supplied SHA (CodeQL cache-poisoning <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#88</a>–<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#106</a>). Catalog drift no longer prints raw bundled/upstream blobs (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#107</a>). </li> <li> Cancelling a turn now cancels its foreground child agents with it. </li> <li> Empty compaction no longer wipes conversation history. </li> <li> Wide terminals and tmux panes fill the full available width again for the transcript and composer (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5322</a>). The brief v0.9 session-shell side gutter is gone so expanding a pane rematerializes layout the same way shrinking does. </li> <li> The agent tool schema rejects empty calls. </li> <li> The local web client keeps recovered stream gaps closed, user questions answerable, manual bootstrap access intact, and streamed prose quiet for assistive tech. </li> <li> Website zh-Hans copy now says 宪章, matching the TUI pack (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5397</a>, Lstarsky0). </li> <li> Public website provider facts include Google Gemini and Ollama Cloud (44 runnable routes). Antigravity stays credential-plane-only. Harvested from <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5398</a> (Lstarsky0) with that correction. </li> <li> The website models page carries a truthful read-only settings preview built from repository facts; it never implies the site can change local configuration (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5370</a>, <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5411</a>, mvanhorn). </li> <li> The canonical <code>ultra</code> reasoning effort now maps to each provider's maximum tier alongside the legacy <code>ultracode</code> alias, instead of being silently dropped (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5303</a>, <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5409</a>, buiducnhat). </li> <li> Session titles truncate by character count, not byte offset, so multi-byte titles (CJK, emoji) cut at the intended width and word boundary instead of past the limit (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5415</a>). </li> <li> Wide terminals and tmux panes fill the full available width again for the transcript and composer (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5322</a>). The brief v0.9 session-shell side gutter is gone so expanding a pane rematerializes layout the same way shrinking does. </li> <li> The background verifier test drives the current libtest executable instead of the rustup <code>rustc</code> shim, so the TUI suite no longer depends on <code>$HOME</code> or holds the process-wide test environment lock across an async wait (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5056</a>, <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5423</a>, Isabel Wu). </li> </ul> <h3>Removed</h3> <ul> <li>The source-structure budget ratchet (CI step, checker, baseline JSON). It measured line counts, not quality: every legitimate feature required a hand-edited ceiling and the accompanying "review" was self-review, so it bought ceremony, not protection. Behavior-measuring gates (dead-code, runtime-contract, persistence-backlog) stay enforced.</li> <li>DeepSeek can reuse a key already stored by official DeepSeek Harness (<code>dsh</code>) after <code>codewhale auth external-consent --provider deepseek --mode read-only</code>. Codewhale reads only <code>DEEPSEEK_API_KEY</code> from the exact granted <code>$DSH_HOME/.credentials.yaml</code> and never writes or refreshes that file.</li> <li>The TUI markdown parser now honors CommonMark fence-length rules: a ```` opener is not closed by a shorter ``` line, so <code>></code> content inside a longer fence stays literal code instead of escaping into a quote.</li> <li>Sub-agents finalize when the parent session id changes, so a closed session cannot block new children as a live owner (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5372</a>).</li> <li>Child spawn-route receipts stay live and usage is deduped by response (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5366</a>).</li> <li>Doctor keeps persisted setup readiness across first-run / update checkpoints (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5340</a>).</li> <li>Approval default selection is applied and explained; agents are told when approvals are disabled (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5293</a>).</li> <li>A <code>/models</code> 2xx probe is a connection check, not model readiness.</li> <li>Site layout uses one container, the ticker no longer implies false provider readiness, and install links stay in the active locale.</li> </ul> <h2>Contributors</h2> <ul> <li>EvanProgramming (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@EvanProgramming</a>) — webhook client panic fallback (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5381</a>); session-index JSONL mutex (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5382</a>).</li> <li>Lstarsky0 (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@Lstarsky0</a>) — session peek hides internal runtime events (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5376</a>); thinking-ladder test re-pin (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5378</a>); provider-count follow-ups (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5383</a>/<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5384</a>); macOS agy fixture canonicalization (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5392</a>); zh-Hans 宪章 terminology (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5397</a>); regenerated website facts harvested and corrected from <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5398</a>.</li> <li>Matt Van Horn (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@mvanhorn</a>) — read-only models settings preview on the website (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5411</a>, fixes <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5370</a>).</li> <li>Nhat Bui (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@buiducnhat</a>) — canonical <code>ultra</code> reasoning effort mapped across provider effort tables (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5409</a>); session titles truncated by character count, not byte offset (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5415</a>).</li> <li>Sh1Zuku (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@SparkofSpike</a>) — <code>/title</code> and the session name in the terminal tab/window title, plus the mid-turn title deadlock fix (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5419</a>).</li> <li>Kai Nacke (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@redstar</a>) — Eden AI provider registration, aliases, <code>EDENAI_API_KEY</code>, and the global/EU endpoints (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5422</a>).</li> <li>Isabel Wu (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">@wuisabel-gif</a>) — background verifier test isolated from rustup and <code>$HOME</code> (<a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5423</a>, slice of <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">#5056</a>).</li> </ul> See <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">CHANGELOG.md</a> for full notes and <a href="https://tsecurity.de/weiterlesen/3880041/3935564/github-release-hmbowncodewhale-v098-20082026/" target="_blank" rel="noopener noreferrer">docs/CHANGELOG_ARCHIVE.md</a> for older releases.</div></div> </article> </main></body></html>