CHANGELOG.md - CodeWhale

CHANGELOG.md

1	# Changelog
2
3	All notable changes to this project will be documented in this file.
4
5	The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6	and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
8	## [Unreleased]
9
10	## [0.9.4] - 2026-08-05
11	Codewhale v0.9.4 ships the release-train harness work: the familiar Fleet
12	roster/setup face with a clear operator-leader and user/folder scope, a
13	work strip that keeps actionable agents instead of a permanent archive,
14	waiting policy that forbids polling without freezing independent work,
15	calmer tool output and session recovery, account/Workflow-search/
16	automation/handoff surfaces, a shorter translation-ready website, and
17	release-blocker fixes across permissions, DeepSeek Responses, SQLite,
18	File edits, terminal width, and Windows installation.
19
20	### Added
21
22	- Sub-agent checkpoint resume: `agents/followup` resumes an
23	`interrupted_continuable` child from its checkpoint into a fresh agent loop —
24	new agent id, original prompt plus the prior conversation tail — when a
25	runtime is attached, and otherwise keeps queue-only semantics with the
26	`continuation_handle` returned; a second followup on the same interrupted id
27	returns the existing resumed target instead of spawning a duplicate (PR #5242).
28	- MCP Registry discovery with Registry-first tool selection: `registry_sync`
29	surfaces the eligible local stdio catalog as a complete model-side candidate
30	set, connect-failure messages classify early-exit and usage-help output and
31	point recovery at the next Registry candidate, and a bundled `mcp-discovery`
32	skill documents the flow (PR #5238).
33	- Progressive fresh-context disclosure: fresh sessions ship a minimal
34	constitutional kernel — ground truth, user intent and scope, truthful
35	completion, guarantees in mechanism, and precedence — with procedural
36	playbooks disclosed on demand, an opt-in project context pack
37	(`project_context_pack_enabled`) counted in context reports, and `load_skill`
38	catalogue discovery via `name="list"`; the measured fresh-context budget
39	drops by roughly 40% (PR #5077).
40	- Named Fleet store v2: one self-contained TOML Fleet per configuration
41	(`schema = "fleet"`), with scope-explicit selection (user-global default vs
42	folder override), migration receipts from legacy role profiles, and atomic
43	saves that refuse to clobber a different Fleet on the same slug.
44	- Scout replaces the user-facing "faster" control: catalog-verified fast
45	siblings only, never a guessed model name; pinned Scout survives operator
46	changes.
47	- Truthful model-picker rows: vision/tools/limits chips only when the catalog
48	knows, with provider → family → exact model grouping.
49
50	- Opt-in product telemetry, off by default. A first-run notice asks once, on
51	a terminal, with declining pre-selected — Enter declines. Nothing is collected
52	unless both `telemetry = true` and a recorded "Enable" answer are present, so
53	a `telemetry = true` written before this release stays inert: the key has been
54	settable and inert for a long time, and setting it was never consent.
55
56	An enabled session sends its batches to the first-party ingest endpoint,
57	`https://telemetry.codewhale.net/v1/telemetry`, which is the shipped default
58	for `telemetry_endpoint`. That is a Cloudflare Worker whose complete source is
59	in this repository under `telemetry-ingest/`; it writes to Workers Analytics
60	Engine, whose row is exactly `_sample_interval`, `blob1`–`blob20`, `dataset`,
61	`double1`–`double20`, `index1`, and `timestamp` — **there is no IP, country,
62	or geo column**, so storing one is structurally impossible rather than merely
63	disabled. The handler reads two request headers, never touches the request's
64	geo properties, logs nothing, and validates against a closed field set that
65	rejects an entire batch carrying any unpublished key. Cloudflare's retention
66	for that data is a fixed three months. Setting `telemetry_endpoint = ""`
67	instead writes each batch to `$CODEWHALE_HOME/telemetry/dryrun.jsonl` and
68	constructs no HTTP client at all, so you can read exactly what would have been
69	sent.
70
71	Turning it off is an answer, not a flag: it deletes the random install id,
72	truncates every buffered event, and leaves a permanent tombstone that a
73	session already running re-checks before it appends and before it sends. A
74	failed wipe fails closed. `CODEWHALE_TELEMETRY=0` is a hard floor that beats
75	`--telemetry true` and the config key, and a value the parser cannot read
76	also resolves to off. Fleet workers are hard-off. A repo-local
77	`.codewhale/config.toml` can set neither key.
78
79	Never collected: prompts, completions, tool arguments, diffs, file contents,
80	filenames, paths, git remotes, repo or branch names, memory entries, chat
81	history, credentials (not even a boolean asserting one exists), model ids,
82	custom provider table names, MCP server names, error or panic message bodies,
83	per-event timestamps, keystrokes, clipboard, screenshots, or location. The
84	full schema is [`docs/TELEMETRY.md`](docs/TELEMETRY.md), and a test parses the
85	field names out of that file and asserts set equality with the structs the
86	serializer uses.
87
88	This supersedes the roadmap's previous "no Codewhale product telemetry" entry,
89	which moves from "Ruled out" to an opt-in framing. What stays ruled out:
90	always-on or silent telemetry, per-keystroke or per-tool-call phone-home, and
91	any third-party ad or analytics SDK in the runtime binary.
92	- Registered `GLM-5.3` (direct Z.ai) and `z-ai/glm-5.3` (OpenRouter) as
93	selectable GLM routes, with their aliases (`glm-5.3`, `glm-5-3`,
94	`zai-glm-5.3`, `zai-glm-5-3`). Z.ai had **not released GLM-5.3 as of
95	2026-08-03** — the ids are registered so they resolve to the Z.ai/OpenRouter
96	routes instead of being rewritten to another vendor's model, and they will
97	fail upstream until Z.ai ships the model. Metadata (context, output,
98	reasoning controls) is inherited wholesale from `GLM-5.2` pending official
99	Z.ai release metadata; pricing is intentionally absent, and `GLM-5.2` remains
100	the default Z.ai model. No third-party gateway roster gained the model:
101	OpenCode Zen, OpenCode Go, Alibaba Model Studio, and TelecomJS publish no
102	glm-5.3 entry, so Codewhale advertises none.
103
104	- Managed Codewhale account commands (`account login`, `status`, `logout`, and
105	`keys`) with browser device flow, profile- and origin-scoped secure sessions,
106	refresh/revocation, redacted BYOK-vault management, and a token-free Runtime
107	account receipt. Provider authentication remains separate, and `cloud`
108	remains a compatibility alias.
109	- `/automation` operator controls to list, inspect, pause, resume, delete, and
110	run durable automations. Creation remains on the approval-gated
111	model-visible `automation` tool.
112	- A provider-neutral `WorkflowSearchSpec` authoring and freeze boundary, plus
113	structured 2–16-candidate experimental search in the best-of-N Workflow
114	starter. It freezes baseline, route, evidence, evaluator, gate, score, budget,
115	and review policy before admission; it validates gate/scoring commands but
116	does not execute or certify them itself.
117	- The bundled generation-9 `handoff` skill for compact, decision-ready
118	continuation across sessions.
119	- Expanded terminal LaTeX rendering for aligned and matrix environments,
120	cases, arrays, text/font/accent commands, brackets, symbols, and
121	command-aware scripts (PR #4981).
122	- Exact 40-character build provenance and secure account-session capability
123	receipts on `/v1/runtime/info`; unknown source provenance continues to fail
124	closed.
125	- Acceptance-level Gherkin coverage locking the existing user-command
126	precedence, alias shadowing, fallback, and invalid-command error contract
127	(PR #4992).
128
129	### Changed
130
131	- `/fleet` is the familiar roster/setup face again. The operator row is the
132	Fleet leader (session model); the header names the selected saved Fleet and
133	whether it is user-global or folder-scoped. Named-Fleet switching lives under
134	`/fleet fleets` (Enter selects in the row's own scope). Session route changes
135	stay temporary until `/fleet save`, `/fleet save-as`, or `/model save-default`.
136	- Waiting-for-subagents directions forbid peek/status polling and sleep-as-wait,
137	but allow independent work that does not depend on a child's result — the
138	parent no longer freezes mid-turn with useful non-conflicting work available.
139	- `workflow run` no longer requires `--fleet`; a saved Fleet is an optional pin
140	layer over roles + the session route.
141	- Homepage and getting-started copy is shorter and scannable across locales,
142	with dictionary key and `{brand}` token parity preserved.
143
144	- Tool results now render as ordinary bounded previews with real expansion;
145	storage, retention-ledger, and internal evidence language no longer leak into
146	normal transcripts.
147	- Prose wrapping, goal state, modal questions, composer-tail behavior, and
148	ambient motion now follow one deterministic interface contract across narrow
149	terminals and fast streams.
150	- Scout and reviewer Fleet roles gain network access and the bounded
151	verification surface for real reconnaissance while retaining the no-write,
152	no-raw-shell security floor.
153	- Workflow runs may describe up to 1,000 tasks while admitting at most 16 live
154	tasks at once through the host concurrency gate. Tournament ordering now
155	supports explicit score-first selection while retaining its cost-first
156	default.
157	- Runtime permission compatibility inputs resolve to one live
158	`permission_posture`. Auto-Review can proceed without approval or structured
159	question modals, unresolved holds fail closed, and a call planned under stale
160	authority is retried after a posture change (PR #5025).
161	- Duplicate and drifting per-turn metadata has been removed in favor of
162	runtime-owned authority, and large inline account and skill tests now live in
163	owned test seams.
164	- Pinned Ratatui to 0.30.0 and ratatui-core to 0.1.0. ratatui-core 0.1.1+
165	makes `Terminal::clear()` issue a blocking cursor-position report that
166	raced the TUI input loop and could kill first launch; both pins are
167	load-bearing, because 0.30.0 declares `ratatui-core ^0.1` and would
168	otherwise resolve forward on its own (PR #5192 by @bistack; upstream
169	ratatui/ratatui#2640).
170	- Updated globset to 0.4.19, clap-complete to 4.6.8,
171	futures-util to 0.3.33, libc to 0.2.189, actions/stale to 11.0.0, and
172	docker/login-action to 4.5.2. The locked graph also includes the
173	event-listener 5.4.2 fix for RUSTSEC-2026-0221.
174
175	### Fixed
176
177	- An explicit `type=builder` (or its `implementer` alias) plus
178	`write_authority=read_only` now fails closed at spawn instead of launching a
179	labeled write role that silently had only recon tools and then self-BLOCKED
180	after burning a turn (#5123). The check is deliberately narrow, because two
181	neighbouring combinations are legitimate and stay legal:
182	- `type=worker` + `read_only` — worker is the unnamed default (it renders as
183	`general`) and takes its capability from authority, not from its name, so a
184	read-only worker is an ordinary general-purpose child. Worker, scout,
185	reviewer, and verifier remain the four canonical read-only Fleet roles.
186	- any `role` + `read_only` — `role` is an identity for roster resolution, not
187	a capability claim, so an acceptance Workflow can still resolve
188	`implementer` to its saved profile while scoping that child to verification.
189
190	Callers that spelled a read-only narrowing as `type: "implementer"` should
191	move it to `role: "implementer"`.
192	- User-global credentials survive an explicit workspace `CODEWHALE_CONFIG_PATH`
193	that selects a route with no local key — readiness probes the user-global
194	provider table before concluding a key is missing.
195	- Sub-agent token figures on the work bar accumulate input+output (the same
196	total the worker budget uses) instead of completion tokens alone; elapsed
197	time still freezes when the child settles.
198	- Live work-bar rows for sub-agents show how many to-dos they still have
199	left (`N left`) when the child's own ledger has unsettled items — never a
200	fabricated zero when no list exists.
201
202	- Surfaces no longer claim an OS sandbox on platforms that cannot enforce one.
203	The policy resolver takes no platform input, so on default Linux (bubblewrap
204	is opt-in) and on all Windows the header chip read `files: workspace` and
205	`/status` read `sandbox workspace-write` while nothing was restricted. Both
206	now resolve the real backend and say `(unenforced)`.
207	- `tool_category` hook conditions matched only retired tool names, so a
208	`category = "shell"` deny hook — the security control `docs/HOOKS.md`
209	documents — silently never fired. Categories now use the registered names,
210	and multi-action tools classify by action.
211	- A `Retry-After` header of `-5`, `nan`, or `1e300` crashed the request task
212	(`Duration::from_secs_f64` panics on a negative). Parsing is now guarded and
213	bounded to one hour.
214	- Bearer tokens no longer leak into operator-visible receipts. `Authorization:
215	Bearer <jwt>` split into two tokens and the JWT matched no redaction rule;
216	prefix matching was also case-sensitive, so `SK-live-…` survived.
217	- `prune_older_than` destroyed the NEWEST rollback snapshots and kept the old
218	ones — on every boot, for any workspace with snapshots spanning the retention
219	window. Both prune paths now share one orphan-chain rebuild and preserve each
220	survivor's real timestamp.
221	- An absolute or relative command path no longer defeats every execpolicy deny
222	rule (`/bin/rm -rf /` did not match a `rm -rf /` rule), and a typed `Allow`
223	rule no longer auto-approves a chained suffix such as `git log ; curl … \| sh`.
224	- Wrong types on `File` read range params and `Bash` stdin/cwd/task_id are now
225	errors instead of silent defaults — a `start_line:"1200"` string used to
226	return the head of the file, and a non-string `stdin` ran the command with no
227	stdin and reported success.
228	- Multibyte tool ids no longer panic the context inspector, wide (CJK) text no
229	longer overflows the decision card, and a hostname like `127.evil.example.com`
230	is no longer treated as loopback.
231	- Refusals name calls the model can actually make (`rlm action='open'` rather
232	than a retired `rlm_open`; `Bash` rather than `exec_shell`).
233
234	- Sub-agent dispatch no longer aborts the process. The Tokio runtime was built
235	by `#[tokio::main]`, leaving every worker thread on the 2 MiB default while
236	only the owner thread received the explicit 16 MiB stack — and the engine runs
237	on a worker. A debug-build `agent` dispatch exceeded that stack and raised
238	SIGABRT, which is not a panic and so could not be caught; the process died
239	mid-spawn with no child request ever issued. Release builds were unaffected.
240	- Fleet profiles that pin a provider no longer leak a bare model id onto the
241	session route. `model_overrides` exported each role's model while dropping its
242	provider, so a scout pinned to another provider's model was dispatched against
243	the active client and denied at the wire — visible as an instant auth failure
244	on the first sub-agent of a fan-out.
245	- The rail's Pinned panel no longer spends four rows saying "No active work".
246	An empty panel now collapses like the Tasks panel always has, and the settings
247	migration no longer folds the default `sidebar_focus = "auto"` into a pinned
248	always-on strip, which had silently handed that panel to every user who had a
249	settings file at all. (An empty panel collapses; a panel holding settled
250	to-dos or finished workers is not empty — see the standing-register entry
251	below.)
252	- The work bar keeps settled to-dos and an honest Subagents header, while
253	completed/cancelled workers collapse out of the Top strip so fan-outs do not
254	permanently eat the transcript. Failed or interrupted workers stay visible
255	(they still need attention). Settled agents remain reachable through the
256	Agents panel and catalog. To-do rows say their state in words (pending /
257	in progress / completed / cancelled), and sub-agent rows carry type,
258	objective, elapsed, and input+output tokens. Every work row is a door in
259	every rail panel and placement: click and Enter open the row's world
260	(work inspector / agent details — finished agents included) instead of
261	doing nothing. A click after the detail pager closed itself reopens the
262	detail rather than being swallowed by a stale toggle.
263	- The rail strip yields its rows to the transcript when the terminal cannot
264	seat both, so the idle ocean survives at 24 rows instead of being evicted.
265	- `code_execution` and `js_execution` no longer describe themselves to the model
266	as sandboxed. Both are ordinary local subprocesses with no seccomp, jail, or
267	container (PR #5221 by @h3c-hexin and @asto18089).
268	- Model Studio reasoning controls now fail closed on the host rather than on the
269	provider enum, so a custom `base_url` no longer receives Alibaba-specific
270	`enable_thinking` fields, and `qwen3.8-max` is no longer sent a thinking
271	switch it does not accept (PR #5233 by @Inference1, closing #5203).
272	- `config.example.toml` no longer claims Shift+Tab cycles the reasoning tier.
273	Shift+Tab cycles the permission posture; Ctrl+T cycles reasoning
274	(found by @vFONGv, PR #5229).
275
276	- Alibaba Model Studio reasoning controls are now route- and model-scoped
277	instead of provider-wide (#5203, harvested from #5233 by
278	[@Inference1](https://github.com/Inference1)). Codewhale sends
279	`enable_thinking` / `preserve_thinking` / `reasoning_effort` only when the
280	configured `base_url` is a verified Alibaba Chat Completions host, so
281	pointing a `modelstudio-*` provider ID at a custom gateway no longer injects
282	DashScope's dialect into it. `qwen3.8-max` and `qwen3.8-max-preview` are
283	thinking-only and no longer receive an `enable_thinking: false` they cannot
284	honor; `preserve_thinking` is sent for the models documented to accept it, so
285	their reasoning trace survives into the next turn; and `deepseek-v4*` /
286	`glm-5.x` map the reasoning tier onto the documented `high` / `max` ladder.
287
288	- xAI device login now recovers from a config that points at a missing
289	Codewhale-owned credential generation instead of failing every attempt
290	with a generic activation error, and finalize failures report the full
291	error chain (#5032).
292	- API keys saved to the secret store no longer read as unconfigured for
293	providers that are not currently active; a configured Kimi/Moonshot key
294	survives provider switches and restarts without re-entry (#5033).
295	- Switching to the Codex provider with no saved model now lands on the live
296	roster's flagship model instead of a stale static default (#5034).
297	- Worktree-isolated Fleet builders no longer contend on the per-workspace
298	delegated-coordination lock, and a failed lock acquisition is retried on
299	use instead of being memoized for the life of the process (#5036).
300	- Fleet dispatch now rebinds the child client when the resolved profile
301	model requires a different wire protocol (DeepSeek flash on Responses),
302	instead of failing deterministically on the worker's first request
303	(#5042).
304	- DeepSeek Responses now sends `reasoning.effort: "none"` for the Off tier,
305	shows a truthful notice instead of silently discarding server-side
306	`web_search_call` items, and parses cache-hit, cache-miss, cache-write, and
307	pricing telemetry while retaining the OpenAI-style nested fallback.
308	- File edits now explain no-op and missing-search failures, reject newly
309	unbalanced C/C++ preprocessor replacements, handle the reported
310	CRLF/non-ASCII cases, and safely relocate stale unified-diff hunks only when
311	whole-file context is unique (PRs #5008 and #5030).
312	- Circled digits, enclosed alphanumerics, and keycap graphemes use consistent
313	two-column measurement in Codewhale, Ratatui, and CJK terminals, preventing
314	missing-character and phantom-space corruption (PR #5001).
315	- SQLite connections install their busy timeout before locking setup and avoid
316	rewriting persistent WAL mode on every open, removing the concurrent-open
317	release-gate failure.
318	- The Windows installer preserves long current-user `PATH` values, their
319	registry type, and unrelated entries across install and uninstall (PR #5006).
320	- Provider configuration no longer contains user-reachable panic paths when
321	metadata or prior credential state is missing.
322	- Resuming a session restores composer text only from a same-session persisted
323	draft; submitted prompts and internal background-runtime envelopes remain in
324	history instead of appearing in the composer (PR #5029).
325	- Shared CI now handles bot-authored issue-link checks, provisions cargo-deny's
326	toolchain, and fetches the locked test graph before offline runtime-budget
327	validation.
328	- Re-quote each linker argument in the Windows OpenHarmony clang launcher so a
329	spaced SDK path (e.g. the default `D:\DevEco Studio\...` install) keeps its
330	`--sysroot` intact through the final Rust link, and extend the no-SDK release
331	guard to keep the re-quoting contract (PR #5095).
332
333	- The shell tool reports the real elapsed wait time in its result content
334	instead of echoing the requested timeout (PR #5240).
335	- Transcript wheel scrolling under iTerm2: xterm alternate-scroll (DECSET
336	1007) now stays off while mouse capture is active, so wheel events arrive as
337	mouse events instead of being converted into arrow keys (#5223, PR #5234).
338
339	### Removed
340
341	- The default model-facing SlopLedger implementation, its storage-oriented
342	transcript language, and the `/debt`, `/cleanup`, `/slop`, and `/canzha`
343	command surface.
344
345	### Contributors
346
347	- [Sh1Zuku](https://github.com/SparkofSpike) (`@SparkofSpike`) contributed
348	LaTeX rendering in PR #4981, completed circled-digit/keycap width handling in
349	PR #5001, and delivered actionable File-edit recovery in PR #5008; for this
350	train he resumed interrupted sub-agents from checkpoints in PR #5242,
351	surfaced real shell wait elapsed time in PR #5240, and kept alternate-scroll
352	off while mouse capture is active in PR #5234.
353	- [XhesicaFrost](https://github.com/XhesicaFrost) (`@XhesicaFrost`) fixed long
354	Windows user-PATH preservation in PR #5006.
355	- [Paulo Aboim Pinto](https://github.com/aboimpinto) (`@aboimpinto`) added the
356	user-command dispatch acceptance contract in PR #4992.
357	- [DracheTek](https://github.com/DracheTek) (`@DracheTek`) provided the
358	multilingual, CRLF-heavy File-edit failure report in issue #5003.
359	- [An Ziwu](https://github.com/MuRongMoQing) (`@MuRongMoQing`) reported the
360	Windows PATH-overwrite defect in issue #4685.
361	- [shenjackyuanjie](https://github.com/shenjackyuanjie) (`@shenjackyuanjie`)
362	fixed the Windows OpenHarmony linker re-quoting for spaced SDK paths in
363	PR #5095.
364	- [bistack](https://github.com/bistack) (`@bistack`) contributed MCP Registry
365	discovery with Registry-first tool selection in PR #5238.
366	- [vFONGv](https://github.com/vFONGv) (`@vFONGv`) wrote the zh-CN Windows
367	beginner guide with screenshots in PR #5229, harvested after its base branch
368	was accidentally deleted during maintainer cleanup.
369
370	## [0.9.3] - 2026-07-31
371
372	This is the Codewhale v0.9.3 source candidate. It is not a published release
373	until the matching tag, packages, checksums, and release assets exist.
374
375	DeepSeek V4 Flash is now a first-class Codewhale route, and the agent-facing
376	tool surface has been reduced to the canonical action tools that current
377	models actually need. This release also hardens credential, authorization,
378	durability, compaction, and macOS File Provider boundaries while deleting
379	stale runtime and dependency surface.
380
381	### Added
382
383	- Native `deepseek-v4-flash` support over DeepSeek's Responses API, including
384	stateless reasoning-item replay, semantic SSE terminal events, structured
385	function calls and outputs, `apply_patch`, and model-aware wire-format
386	selection. Exact current Flash IDs use Responses; future direct
387	`deepseek-vN-*` model IDs inherit that route conservatively, while custom
388	DeepSeek-compatible endpoints retain Chat Completions unless configured
389	otherwise.
390	- A pipe-only `codewhale auth print-api-key` handoff for explicitly selected
391	providers. It shares Codewhale's home-scoped credential authority, refuses
392	terminal output, and prevents sentinel placeholders from becoming live
393	credentials.
394	- Per-turn `max_tool_calls` enforcement at the engine admission gate, plus a
395	named-file write scope with a separate read seam. The runtime now rejects
396	over-budget calls before execution and keeps the operator's write boundary
397	explicit (#4415).
398	- Runtime-contract, source-structure, and persistence-backlog ratchets that
399	name drift instead of allowing large ownership surfaces to grow silently
400	(#3921, #4785).
401
402	### Changed
403
404	- Model-visible built-ins now use the canonical `Bash`, `File`, and `Run`
405	action schemas. `apply_patch` remains available as the one direct custom
406	edit tool supported by DeepSeek Responses. The bundled stop-ship workflow,
407	Fleet fixtures, shell shortcut, and engine tests use the same canonical
408	vocabulary.
409	- Canonical `File { action: "write" }` requests now pass through the same
410	semantic repo-law checks as the former write path. Approval, Full Access,
411	and workflow execution cannot bypass the repository safety floor by choosing
412	the canonical schema.
413	- Codewhale home resolution is shared across the CLI, TUI, state, and secret
414	stores. `doctor` is offline by default, distinguishes credential source from
415	availability, and reports one consistent path snapshot.
416	- Durable runtime event writes are serialized across simultaneous processes,
417	blocking history waits move off async workers, and provider quota exhaustion
418	remains typed and retryable through compaction (#4522).
419	- Skill discovery caches the merged catalog behind watched-mtime validation;
420	large skill, engine, subagent, UI, and ambient-ocean test blocks now live in
421	owned test seams.
422	- Reasoning summaries stay in the user's language, complete jellyfish
423	silhouettes relocate around transcript text, and cached ocean frames include
424	their palette identity (#4807).
425	- The authorization-order contract now documents and tests how modes, hooks,
426	permission rules, safety floors, repo law, approvals, and sandboxing compose
427	(PR #4980).
428
429	### Fixed
430
431	- macOS sandbox extensions cover CloudStorage/File Provider workspaces without
432	broadening unrelated paths; thanks @Watcher24 for the #4085 report and
433	reproduction.
434	- Foreground shell state detaches before steering, so an interrupted command
435	cannot keep owning the composer (PR #4979).
436	- MCP application-level failures and malformed error envelopes fail closed
437	instead of looking like successful tool output.
438	- Optional PDF failures are truthful and PDF classification no longer misses
439	supported inputs.
440	- Bracketed-paste contents are redacted from traces, and credential diagnostics
441	never treat placeholder sentinels as usable keys.
442
443	### Removed
444
445	- The legacy callable aliases `exec_shell`, `run_shell_command`, `read_file`,
446	`write_file`, `list_dir`, `grep_files`, `file_search`, and the duplicate
447	Work/RLM registrations. Historical transcript and policy semantics remain
448	readable, but new model turns receive only the canonical action surface.
449	- The bundled PDF parser dependency chain, replacing it with the smaller
450	optional extraction boundary tracked by #4382.
451
452	### Contributors
453
454	- [Turisla](https://github.com/greyfreedom) (`@greyfreedom`) documented and
455	locked the authorization-order contract in PR #4980.
456	- [Nightt](https://github.com/nightt5879) (`@nightt5879`) fixed foreground
457	shell detachment before steering in PR #4979.
458	- [Watcher24](https://github.com/Watcher24) (`@Watcher24`) provided the macOS
459	File Provider report and reproduction for #4085.
460	- [Fred Leitz](https://github.com/fleitz) (`@fleitz`) retains required
461	source-candidate credit for the canonical `Bash` workspace fix from PR #4673
462	and issue #4674.
463
464	## [0.9.2] - 2026-07-29
465
466	This is the Codewhale v0.9.2 source candidate. It is not a published release
467	until the matching tag, packages, checksums, and release assets exist.
468
469	### Changed — behavior
470
471	- Legacy `model = auto` no longer elects a network classifier on its own.
472	Holding a DeepSeek API key used to silently select `deepseek-v4-flash` as the
473	classifier for every Auto turn — a per-turn cost on a route nobody asked for,
474	and one provider privileged over the rest. Auto now stays local and free
475	unless an explicit `[auto.router]` block names a provider and model.
476
477	If you relied on the implicit default, restore it explicitly:
478
479	```toml
480	[auto.router]
481	provider = "deepseek"
482	model = "deepseek-v4-flash"
483	```
484
485	`[auto.router]` remains legacy `model = auto` configuration. It is unrelated
486	to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by
487	name from a Fleet file and decides only how hard an already-frozen route
488	thinks.
489
490	Landed since v0.9.1, not yet released. A cluster of defects found by a
491	read-through audit of the policy engine, the MCP proxy, the session index,
492	and the app-server bridge — several of them cases where the wrong outcome
493	was reached silently, behind a response or a log line that looked fine. The
494	release also adds opt-in session, reasoning, localization, and inspectability
495	surfaces; existing defaults remain stable unless an entry below explicitly
496	says otherwise.
497
498	### Added
499
500	- `/permissions` now lists the active user permission-rule source, each rule's
501	effective matcher and global/repository scope, and whether that scope applies
502	in the current workspace. `/permissions remove <number>` previews deletion
503	and requires a snapshot-bound confirmation token, so a concurrent edit
504	cannot move a different rule under the confirmed index. Appends and removals
505	share one adjacent lock, preserve unrelated TOML formatting and comments,
506	atomically replace `permissions.toml`, and reload the live user ruleset
507	without clearing session-only approvals. `/config ask-rules` remains a
508	compatibility entry; rule creation, glob/directory rules, and deny
509	persistence remain out of scope (#1186, PR #4960 by @greyfreedom).
510
511	- `/preview-request` (aliases `/dryrun` and `/preview_request`) is a human-only,
512	provider-free inspection of the next primary turn. Production dispatch and
513	preview share one prepared-request seam across Chat Completions, Anthropic
514	Messages, and OpenAI Responses, so the manifest reads the final wire model,
515	reasoning controls, tool choice, tool schemas, and body hash from the same
516	value production sends. Route, tool, or body facts that require Auto's
517	provider classifier, an MCP connection, mutable hooks, compaction, or queued
518	runtime injections remain typed unavailable. The manifest reports exact
519	primary role/lane identity, upstream route-source provenance, requested and
520	effective reasoning, canonical JSON sizes, conservative offline estimates,
521	and provider-reported usage as unavailable because no request ran. It never
522	adds a model-visible tool, sends a provider call, or prints prompt, message,
523	credential, endpoint-path, or workspace-path content. The explicit
524	`/preview-request base-prompt` mode prints only the exact effective base
525	prompt; effective system text remains protected behind its final hash. The
526	exact body includes the same authoritative transient Work/To-do tail used by
527	production, including graph-backed state newer than the legacy projection.
528	Preflight preserves production's separately framed base-plus-Work estimate,
529	and fails closed when the authoritative projection is unavailable. An
530	exhausted active goal token budget also produces a typed unavailable result
531	before any outbound request is built.
532	(#1004, #3928; dry-run concept harvested from PR #1099 by @GTC2080 / TaoMu.)
533
534	- Slash commands, hotbar actions, and CLI entrypoints for the same Lane/Fleet
535	lifecycle operation now share one typed control-plane contract
536	(`codewhale-lane::control`): a stable `<domain>.<verb>` id, read-vs-write
537	authority, persistence scope, exact-identity target selection, retryability,
538	lifecycle outcome, and one bounded, sanitized receipt. `docs/COMMAND_CONTROL_PLANE.md`
539	documents it (#1888).
540
541	- `/lane [list\|status\|interrupt\|restart\|resume]` — durable Lane control from the
542	composer, backed by the same executor `codewhale lane …` calls. `codewhale
543	lane interrupt\|restart\|resume` are the matching CLI verbs; `lane stop` stays as
544	a compatibility spelling of `lane interrupt`. Appending `@<lifecycle-seq>` to a
545	lane id fences a write to the exact durable generation you observed, so a
546	concurrent transition is rejected as a conflict rather than acted on (#1888).
547
548	- `codewhale fleet list` and `/fleet [list\|status\|interrupt\|resume]` — durable
549	Fleet run inspection and control from either surface, through shared DTOs that
550	carry the exact provider, provider-table id, model, effective reasoning tier,
551	and route source when the ledger records them, and a typed `not_recorded` /
552	`not_applicable` / `redacted` reason when it does not. Requested-vs-effective
553	reasoning is never back-filled: the ledger persists the effective tier only, so
554	the requested tier reports `not_recorded` (#4022).
555
556	- The bundled skill pack now ships a `help` skill (catalog generation 7). It is
557	`invocation: explicit-only`, so it never enters the model's ambient catalogue
558	and costs no prompt budget. Its body is a routing card that points at the
559	surfaces this build actually exposes — `/help` and `/help <command>`,
560	`/skills` and `/skills inspect`, `/config`, `doctor`, and the `docs/` tree
561	when the workspace is a Codewhale checkout — and explicitly forbids pasting a
562	command list or settings table into context (#4698).
563
564	- `crates/tui/assets/skills-catalog-matrix.json`: an authored, provider-free
565	expectation matrix covering every bundled skill (tier, invocation, aliases,
566	ambient-catalogue eligibility, shadowed aliases). Contract tests in
567	`crates/tui/src/skills/catalog_matrix.rs` assert a bijection between the
568	fixture and the shipped bundle, so the starter pack cannot change without an
569	explicit fixture update. The matrix covers positive eligibility and explicit
570	load, non-activation negatives, alias resolution, explicit-only exclusion,
571	alias-vs-canonical collision precedence, and prompt-budget invariants (no
572	duplicate catalogue entries, no aliases as extra entries, and the shipped
573	pack fitting inside the 12 000-char budget with no omitted-skills line). These
574	are deterministic registry/catalog/resolver assertions and make no claim about
575	semantic model routing (#4698).
576
577	- Locale-routing coverage for the complete bundled catalog across every shipped
578	locale (`en`, `ja`, `zh-Hans`, `zh-Hant`, `pt-BR`, `es-419`, `vi`, `ko`). No
579	bundled skill ships a localized routing description and none was invented;
580	the tested contract is deterministic fallback to the canonical English
581	description, with the rendered catalogue byte-identical across locales.
582	Exact-tag match, primary-subtag fallback, and English fallback are covered
583	against a synthetic authored fixture, and the parity test fails if a bundled
584	skill ever gains localized metadata without source-backed coverage (#4698).
585
586	- `docs/LIVE_SMOKE.md`: copy-pasteable, opt-in live-smoke instructions for Kimi
587	K3 and a second provider/model (DeepSeek). The runs are manual only — nothing
588	in CI, tests, or skills invokes them. They use `env -i` plus a throwaway
589	`CODEWHALE_HOME`; `HOME` is left unset rather than repurposed, and ambient
590	provider variables are not forwarded. The operator names the credential
591	variable explicitly, and the isolated child reads its value with echo off,
592	restores the prior terminal state on exit or interruption, and never persists
593	the value or puts it in a command argument. The page states the expected
594	route/model/reasoning/tool receipt fields while treating provider errors as
595	unclassified until provider configuration, authentication/entitlement, and
596	harness behavior have been corroborated independently (#4698).
597
598	- Approval cards can now remember eligible safe shell and file-write approvals
599	as exact `allow` rules scoped to the current repository. Remembered shell
600	commands use complete-command matching, validated file and patch paths remain
601	workspace-relative, and dangerous, critical, or repo-law-held requests stay
602	ineligible and continue to require review.
603
604	- `tui.header_items` (array of strings, optional, default `[]`): an opt-in
605	header chip showing cumulative session token usage as input / cache-hit /
606	output. Set `header_items = ["tokens"]` under `[tui]` to enable it. The
607	chip is the only elidable element of the header — the git label, context
608	meter, and version stamp keep their space, and narrow terminals drop the
609	chip rather than the baseline chrome. Unknown entries are warned about and
610	skipped so configs written by newer builds stay loadable by older ones
611	(#4520 requested by @eugenicum; PR #4610 by @XhesicaFrost, harvested with
612	co-authorship).
613
614	- `thinking_default_expanded` lets reasoning blocks start open while keeping
615	Space as the per-block toggle. The setting is persisted, available through
616	native and runtime configuration, and documented for SSH/tmux accessibility
617	(issue #4925 and PR #4928 by @M-Maciej).
618
619	- The transcript renders a conservative subset of LaTeX math as readable
620	Unicode without rewriting fenced/inline code, ordinary currency, escaped
621	dollars, or unknown commands. The contribution from PR #4973 by
622	@SparkofSpike was hardened and landed through PR #4974; reported by
623	@antarikshraya in #4957.
624
625	- Session control now includes a sessions rail, shared archive projection,
626	picker archive controls, and opt-in interactive auto-resume with explicit
627	handoff behavior. The work closes the remaining session-browsing direction
628	from #2934; thanks @cy2311 for the original report.
629
630	- The bundled contributor-onboarding skill can sync contribution context,
631	select the appropriate gate, and prepare a digest without inflating the
632	ambient skill catalog. It follows the contributor-navigation request in
633	#4227 by @JayBeest.
634
635	- Bahasa Indonesia now has a complete repository documentation suite and a
636	registered website dictionary alongside the shipped TUI locale (PRs #4962
637	and #4972 by @atmosuwiryo, closing #4789).
638
639	- Reasoning content can keep its rail, italics, cursor, and expansion controls
640	while disabling only the warm background highlight. The independent setting
641	is persisted and localized (#4089; reported by @elijahchan2019).
642
643	- StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the
644	two endpoint/billing routes distinct, and localizes the choice across the
645	complete packs (#4526; reported by @whp233).
646
647	- OpenCode Zen is a separate model-aware API-key provider. Its curated catalog
648	selects Responses, Anthropic Messages, or Chat Completions per model;
649	unsupported Gemini and unknown models fail closed, and missing Zen
650	credentials never fall through to ChatGPT/Codex OAuth guidance. The
651	implementation from closed PR #4467 by @snail-vs (snailoniu) is preserved in
652	the candidate.
653
654	- Markdown exports correlate prompts with stable workspace restore-point ids
655	and say when correlation is unavailable or ambiguous, completing the
656	remaining restoration/export direction from #2494 by @wywsoor.
657
658	### Fixed
659
660	- Permission setup now consistently presents the product postures Ask,
661	Auto-Review, and Full Access instead of leaking the internal `never` token.
662	The same resolved sandbox policy now drives execution and UI receipts: Plan
663	stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access
664	is actually unsandboxed unless a stricter effective configuration wins.
665
666	- Fleet setup no longer stalls when a user explicitly selects a configured
667	Codex or Grok external-consent route. The selected route is activated and
668	validated before saving, roster roles open directly on their Model step,
669	Review saves on the first Enter, and new profiles default to the personal
670	profile directory that the roster loads on the next session.
671
672	- Provider credential dialogs now share one wrapping, secret-safe API-key
673	surface across every non-OAuth provider. A key already present in durable
674	storage is reported as configured without rendering it, typing or pasting is
675	clearly framed as replacement, narrow help text remains visible, and Codex
676	and Grok OAuth flows remain token-free in this modal.
677
678	- Ctrl+O again opens the complete recorded reasoning detail for the selected,
679	active, or latest reasoning block. The whole-turn Turn Inspector moved to
680	Ctrl+Alt+O and `/turn inspect`, removing the shortcut collision while keeping
681	raw leaf detail and post-flush reasoning discoverable.
682
683	- Failed child agents now deliver a distinct high-priority failure receipt to
684	their owning parent with a sanitized failure class, elapsed work, and a full
685	transcript handle. Parent-to-child message, follow-up, and interrupt tools
686	now use one hierarchy-checked mailbox path, and persisted nested completion
687	envelopes remain safely restorable across instruction-text revisions.
688
689	- Background-shell completion events now carry only bounded tails plus a
690	retrievable exact-evidence handle. Terminal foreground Bash results are
691	acknowledged at the direct tool-result boundary and are no longer emitted a
692	second time as background completion artifacts.
693
694	- Providerless Fleet and child-agent fixed-model routes now reject only
695	high-confidence foreign-provider model ids before creating a worktree, while
696	explicit provider/model pairs, custom and local endpoints, unknown ids, and
697	aggregator wire-id resolution retain their intended behavior.
698
699	- Manual compaction now preserves and reports the supplied provider failure
700	class instead of replacing it with an opaque generic error. This does not
701	infer quota exhaustion when the recorded failure does not prove it.
702
703	- The ambient jellyfish keep complete, readable silhouettes while animating,
704	and the website favicon now uses the Signal Current desktop tile instead of
705	the legacy whale mark.
706
707	- ACP JSON-RPC responses preserve numeric request ids for avante.nvim while
708	retaining the negotiated string-id exception for Zed (PR #4929 by
709	@atmosuwiryo).
710
711	- Restored shell cells whose job no longer exists stop displaying live
712	spinners and settle into a truthful stale/no-output state across transcript,
713	phase strip, and sidebar (PR #4937 by @LI-Jialu, closing #4547).
714
715	- Interrupted checkpoints and timed recovery snapshots remain checkpoints
716	instead of being promoted into orphan session files, preventing duplicate
717	`/resume` entries (PR #4963 by @SparkofSpike).
718
719	- Every shipped locale is admitted by the typed settings schema and native
720	chooser, with complete/partial status kept independent and tested (PR #4856
721	by @nightt5879, closing #4786). Context-menu hover hit-testing also accounts
722	for its title row (PR #4897 by @XhesicaFrost; reported by @SparkofSpike in
723	#4803).
724
725	- OSC 52 and SSH/tmux clipboard transport run on one bounded background worker
726	rather than blocking input and rendering on the TUI loop; late transport
727	failures still surface through the status path (PR #4896 by @nightt5879,
728	closing #4159).
729
730	- Non-streaming model calls receive a generation-length response budget rather
731	than the SSE header-open timeout, while actual SSE opens share the bounded
732	cross-provider transport seam. The equivalent fix direction came from
733	closed PR #4743 by @vibecoding-skills.
734
735	- Resumed sessions diagnose a deleted inherited workspace before shell launch
736	instead of failing as an opaque Windows process error (report #4100 by
737	@redjade75723). DeepSeek native tool-call wrapper tokens are also scrubbed
738	from visible streaming and completed output as a grounded fail-soft follow-up
739	to report #3880 by @hardy922; that report's exact emitted marker remained
740	unconfirmed.
741
742	- Auto model routing now preserves the user's requested reasoning effort
743	through startup, provider/model changes, session restore, the picker,
744	Ctrl+T, and Hotbar actions. The tier is normalized only after the concrete
745	provider route is known instead of being silently replaced by Auto
746	(#4941, PR #4961 by @nightt5879).
747
748	- Auto-compaction now defaults on for every known model context window,
749	including Kimi K3's 1,048,576-token routes. Persisting only an
750	`auto_compact_threshold` or `auto_compact_threshold_percent` now counts as
751	opt-in intent, while an explicit `auto_compact = false` remains authoritative.
752	`/config` reports the effective state, percentage, and computed token trigger.
753
754	- Per-provider `context_window` overrides are now documented and visible in
755	`/config`, provider setup help, diagnostics, and the example configuration.
756	The effective override consistently drives preflight budgeting, the context
757	meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their
758	Coding Plan tier has the smaller window.
759
760	- Agent Details now projects status, model, elapsed time, and step counts from
761	the same row snapshot as the primary agents list, eliminating contradictory
762	worker state between the two surfaces.
763
764	- Composer submission and its hints now share one state machine. Portable
765	terminals use Enter to queue during a running turn and Enter again to steer;
766	Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is
767	no longer advertised as universally available.
768
769	- `edit_file` now matches LF-only model search text against CRLF files,
770	preserves the file's line-ending style for replacement text, and still
771	rejects newline-normalized duplicate matches as non-unique (#4764).
772	Implemented in PR #4942 by @nightt5879; reported and root-caused by
773	@LmeSzinc.
774
775	- `/fleet status` read the current TUI session's sub-agents while `codewhale
776	fleet status` read the durable `.codewhale/fleet.jsonl` ledger — two different
777	things wearing one name, so a run started by `codewhale fleet run` never
778	appeared in the TUI. `/fleet status` now reads the durable ledger through the
779	same code path as the CLI; the session view keeps its own name as
780	`/fleet workers` (`/subagents` and `n` still work). When a workspace has no
781	ledger, both surfaces report a typed `no_fleet_ledger` reason instead of an
782	empty-looking "all clear", and neither creates the ledger as a side effect of
783	reading it (#4022).
784
785	- `codewhale fleet status` (and `list`/`interrupt`/`resume`) created
786	`.codewhale/fleet.jsonl` as a side effect of opening the manager, then
787	reported `no_fleet_ledger` for the file it had just made — so the second
788	invocation showed an empty Fleet where none existed. The CLI now refuses
789	those verbs before the manager is constructed, matching `/fleet` (#4022).
790
791	- `fleet resume <run-id>` accepted any string. An id absent from the ledger
792	reconciled nothing but still wrote a run-status record keyed by whatever was
793	typed, and reported `no_change`. Unknown ids are now refused as `not_found`
794	before any durable write (#4022).
795
796	- `lane interrupt` reported `transitioned` even when it changed nothing —
797	another process's stop looked like our own. The Runtime backend now reports
798	whether this call performed the transition, and a no-op is `no_change`.
799	The `@<lifecycle-seq>` fence is also evaluated inside the registry's per-Lane
800	lock rather than before it, so a stale fence refuses without running Runtime
801	teardown instead of racing between the check and the stop (#1888).
802
803	- `/lane` no longer runs Runtime teardown on the TUI composer thread. Reads on
804	the slash surface skip reconciliation (which probes tmux and takes a lock)
805	and say so on the receipt instead of implying freshness; `lane interrupt` is
806	CLI-only until that work runs off-thread, and reports
807	`surface_not_supported` naming `codewhale lane interrupt` (#4022).
808
809	- The hotbar is no longer modelled as a third control surface. A slot binds a
810	slash command and fires it with no argument, so it runs as the slash
811	surface; the contract now declares which verb a bare press actually reaches
812	(`hotbar_bare_dispatch`, true only for `lane.list`) instead of advertising
813	target-taking verbs as hotbar-reachable (#1888).
814
815	- `codewhale lane list --json` and `lane status --json` keep emitting the
816	`LaneRecord` shape they always have — the receipt did not replace it. The
817	human `lane status` output also regained `branch`, `session`, `socket`,
818	`attach`, and `log`, which the first cut of the shared DTO had dropped
819	(#1888).
820
821	- No surface advertises a backend it does not have. `lane restart` and
822	`lane resume` have no implementation — a Lane is re-created by
823	`codewhale lane start`, and a stopped Lane's Runtime session is gone — so all
824	three surfaces refuse them with `backend_not_implemented` and say why.
825	`fleet restart` drives the manager loop to completion, which only the CLI
826	runs, so `/fleet restart` reports `surface_not_supported` and names the CLI
827	command rather than quietly doing a smaller thing (#1888).
828
829	- Deny rules in `permissions.toml` no longer miss a command because of an
830	intervening flag: deny matching is token-based with flag-skipping and
831	backtracking, so a `git push` rule still catches
832	`git -c foo=bar push`. Path matching folds case only on platforms whose
833	filesystems are case-insensitive, and the default approval branch no
834	longer proposes the working directory as a network host.
835
836	- MCP tool calls run once. A failed call is no longer retried as if it
837	were a failed lookup, qualified-name resolution collects every match and
838	reports an ambiguity instead of taking whichever the hash map yielded
839	first, and registering a server whose name collides with an existing one
840	after sanitization is now an error rather than a silent overwrite.
841	The equivalent call-once fix direction came from closed PR #4756 by
842	@adity982.
843
844	- The session index survives a torn line: an unparseable entry is skipped
845	rather than aborting the whole read, appends carry their data through to
846	disk, and appends and compaction share a lock so a compaction can no
847	longer race an append into a lost record.
848
849	- `Edit` counts as a write tool for workflow elevation, and the TUI's
850	write/shell classification now delegates to one shared allowlist rather
851	than keeping a second copy that could drift.
852
853	- A rejected `app/config/set` stays a no-op. Previously an invalid value
854	still tore down the cached runtime bridge, killing the child runtime and
855	orphaning every other in-flight stdio thread behind a response that
856	correctly reported failure.
857
858	- A malformed project `config.toml` is no longer indistinguishable from
859	having no project config. Because a project config may only tighten
860	approval and sandbox policy, silently discarding a broken one dropped a
861	repository's restrictions back to the looser user defaults; the setup
862	wizard now says so, naming the file but never quoting its contents.
863
864	- An expired lane worktree no longer leaves its branch behind, which made
865	reusing the same lane name fail with "branch already exists". A branch
866	still carrying unmerged commits is kept — a TTL lapsing is not consent
867	to delete someone's work.
868
869	- An in-flight `thread/message` turn can be stopped. The stdio loop keeps
870	reading while a turn streams, so the new `thread/interrupt` request (and
871	`shutdown`) can reach a runaway turn instead of waiting on the very turn
872	they were meant to stop.
873
874	- Precedence is stated only in the constitution's "Whose word wins" section.
875	Memory hygiene no longer ships an inverted Tier list that put the
876	constitution above the user's current request; approval, compaction, and
877	personality overlays describe behavior without rank vocabulary; and the
878	authority recap points at the single source rather than restating a second
879	ladder.
880
881	- `<turn_meta>` carries facts (mode, posture, model, workspace), not mode
882	doctrine or permission-question essays re-asserted every user message.
883
884	- The project context pack (pretty-printed workspace tree) is off by default
885	and opt-in via `[context] project_pack = true`. Language law is compressed
886	while keeping the English-constitution / user-language-reply contract.
887
888	- Modal lists and config pickers wrap selection at both ends (Down past the
889	last row returns to the top). Home-directory resolution prefers
890	`HOME`/`USERPROFILE` via `effective_home_dir` across remaining call sites so
891	Windows tests that fake the home env vars match production paths. The
892	equivalent home-directory sweep came from closed PR #4760 by
893	@EvanProgramming.
894
895	### Changed
896
897	- Prefix-cache tool catalog entries store only the SHA-256 digest, not the
898	joined catalog string. Unused plan-transition validation helpers are removed.
899
900	- Settings sections now hold only what they claim (#4751). Fleet keeps
901	Fleet/member concerns; `/goal` moved to a Session section and Workflow
902	orchestration to its own Workflow section. The inert DeepSeek-only
903	`default_model` fallback moved out of Model settings into an explicit
904	Legacy section — exact-Fleet users switch Fleets, not fallback models;
905	the config field is retained because the runtime still reads it. This is
906	presentation only: the persisted keys (`goal_command`, `workflow`,
907	`default_model`), their values, scopes, and runtime behavior are unchanged.
908
909	- Auto model routing is scoped to the active provider. The classifier
910	inventory no longer discloses other providers' runnable routes (or the fact
911	that their credentials exist), a classifier reply naming another provider is
912	refused, the local heuristic no longer falls back to a different provider
913	when the active one is unusable, and the implicit DeepSeek-flash classifier
914	is skipped for non-DeepSeek sessions. Auto receipts and the model picker
915	hint report the active-provider-only scope instead of "runnable providers".
916	Cross-provider Auto is available only through the persisted `[auto]
917	cross_provider = true` opt-in (an explicit `[auto.router]` route remains its
918	own opt-in for the classifier call). Same-provider strong/fast selection and
919	`[auto] cost_saving` are unchanged.
920
921	- The QA pseudo-terminal acceptance harness now parses frames with `rio-vt`
922	behind its existing neutral frame/color surface, retaining the assertions
923	while removing the `vt100` dependency (PR #4931 by @raphamorim).
924
925	- Anthropic Messages and OpenAI Responses stream opening now share the
926	`client/stream_entry.rs` seam already used by Chat Completions: one bounded
927	response-header wait, shared dual/HTTP-1.1 policy selection, at most one
928	HTTP/1.1 fallback on a classified HTTP/2 header stall, and common idle-timeout
929	diagnostics. Wire-specific authentication, headers, endpoints, decoding, and
930	rate-limit behavior remain at each adapter edge. The timeout-placement
931	diagnosis and fix direction came from closed PR #4743 by
932	@vibecoding-skills.
933
934	### Security
935
936	- Release containers now publish an SBOM attestation and pin maximum-mode
937	provenance explicitly so supply-chain metadata cannot silently weaken with a
938	builder-default change (PR #4958 by @kobihikri).
939
940	### Contributors
941
942	Thank you to the contributors whose code, reports, and reviews shaped v0.9.2:
943
944	- [@greyfreedom](https://github.com/greyfreedom) — exact repository-scoped
945	allow grants and cross-platform path semantics (PR #4761), plus safe
946	permission-rule listing and snapshot-bound removal (PR #4960).
947	- [@nightt5879](https://github.com/nightt5879) — off-event-loop clipboard
948	writes (PR #4896), complete locale exposure in settings (PR #4856), CRLF-safe
949	edits (PR #4942), and reasoning-effort preservation across automatic model
950	routing (PR #4961).
951	- [@XhesicaFrost](https://github.com/XhesicaFrost) — the configurable
952	session-token header (PR #4610) and context-menu hover alignment (PR #4897).
953	- [@cyq1017](https://github.com/cyq1017) — the hooks configuration/executor
954	split from PR #4087.
955	- [@snail-vs](https://github.com/snail-vs) (snailoniu) — OpenCode Zen's
956	model-aware routes, authentication, documentation, and test isolation from
957	closed PR #4467, whose contributor commits are preserved in the candidate.
958	- [@SparkofSpike](https://github.com/SparkofSpike) — the zh-Hans translation
959	quality review harvested from PR #4908, duplicate-session fix in PR #4963,
960	LaTeX implementation from PR #4973 landed through #4974, and the context-menu
961	reproduction in #4803.
962	- [@GTC2080](https://github.com/GTC2080) — the request-preview concept from
963	PR #1099.
964	- [@h3c-hexin](https://github.com/h3c-hexin) — non-UTF-8 `fetch_url`
965	decoding direction from PR #4909.
966	- [@fleitz](https://github.com/fleitz) — required source-candidate credit for
967	the canonical `Bash` no-`cwd` workspace fix and regression in PR #4673
968	(issue #4674).
969	- [@LmeSzinc](https://github.com/LmeSzinc) — the Windows CRLF `edit_file`
970	reproduction, root-cause analysis, and affected-code anchors in issue #4764.
971	- [@atmosuwiryo](https://github.com/atmosuwiryo) — ACP numeric-id compatibility
972	(PR #4929) and the Indonesian documentation and website locale (PRs #4962
973	and #4972).
974	- [@M-Maciej](https://github.com/M-Maciej) — the expanded-by-default reasoning
975	setting and its original report (PR #4928, issue #4925).
976	- [@raphamorim](https://github.com/raphamorim) — migration of the QA PTY frame
977	parser to `rio-vt` (PR #4931).
978	- [@LI-Jialu](https://github.com/LI-Jialu) — truthful finalization of restored
979	stale shell cells (PR #4937).
980	- [@kobihikri](https://github.com/kobihikri) — release-container SBOM and
981	explicit provenance mode (PR #4958).
982	- [@EvanProgramming](https://github.com/EvanProgramming),
983	[@adity982](https://github.com/adity982), and
984	[@vibecoding-skills](https://github.com/vibecoding-skills) — equivalent fix
985	direction for the effective-home sweep (#4760), MCP call-once behavior
986	(#4756), and streaming/non-streaming timeout split (#4743).
987	- [@antarikshraya](https://github.com/antarikshraya) — the LaTeX transcript
988	rendering report in #4957.
989	- [@eugenicum](https://github.com/eugenicum) — the token-header request and
990	output-presentation measurements in #4520 and #4468.
991	- [@whp233](https://github.com/whp233) — the StepFun/OpenCode subscription-route
992	request in #4526.
993	- [@redjade75723](https://github.com/redjade75723),
994	[@hardy922](https://github.com/hardy922),
995	[@JayBeest](https://github.com/JayBeest),
996	[@elijahchan2019](https://github.com/elijahchan2019),
997	[@cy2311](https://github.com/cy2311), and
998	[@wywsoor](https://github.com/wywsoor) — reports and product direction behind
999	the stale-workspace diagnosis (#4100), native-tool-token filtering (#3880),
1000	contributor onboarding (#4227), optional reasoning highlight (#4089),
1001	session control (#2934), and export/restore correlation (#2494).
1002
1003	## [0.9.1] - 2026-07-24
1004
1005	### Dogfood follow-ups (2026-07-24)
1006
1007	### Added
1008
1009	- `/compact [focus]`: the manual compaction command now accepts an
1010	optional focus argument that is injected into the summary prompt, and
1011	the compaction summary itself becomes a structured nine-section
1012	successor briefing (primary intent, key concepts, files and code,
1013	errors and fixes, problem solving, user messages, pending tasks,
1014	current work, next step) that carries earlier compaction summaries
1015	forward and explicitly forbids tool use — replacing the free-form
1016	"under N words" instruction. Codewhale's pin/working-set and
1017	V4 prefix-cache-aligned machinery are unchanged.
1018
1019	- Saved workflows become slash commands: `*.workflow.js` files under
1020	`<workspace>/.codewhale/workflows/` and `~/.codewhale/workflows/` are
1021	discovered as `/name` commands that accept custom arguments (forwarded
1022	to the run's `args`), launch through the `workflow` tool in the
1023	background, and report their run id. Hand-written `.md` commands with
1024	the same name always win. The workflow tool's `source_path` now also
1025	accepts the user-global `~/.codewhale/workflows/` store, and every
1026	settled run leaves a durable synthesized report under
1027	`.codewhale/reports/<run_id>.md` (status, goal, gates, progress,
1028	result, verification).
1029
1030	### Fixed
1031
1032	- Disambiguate the two Kimi K3 model-picker rows, which read as an
1033	unexplained duplicate: bare `k3` is now labeled "Kimi Code plan route"
1034	with its default 262K window annotated as the plan-tier floor (raisable
1035	via the provider `context_window` setting for plans that include 1M),
1036	and `kimi-k3` is labeled "Moonshot direct route" with its 1M window.
1037	Both remain distinct, valid routes for the same underlying model.
1038	- Close the model-facing `agent` tool role schema: the `type` property now
1039	publishes the canonical JSON Schema enum `["worker", "scout", "planner",
1040	"reviewer", "builder", "verifier", "custom"]` instead of describing the
1041	accepted values in prose. Legacy aliases are no longer advertised to
1042	models; they remain accepted only at replay/deserialization boundaries.
1043	Provider schema sanitizers (Chat Completions, strict mode, Anthropic
1044	Messages / OpenAI Responses, Moonshot/Kimi) are pinned by test to
1045	preserve the closed enum.
1046
1047	### Changed
1048
1049	- Rework the ambient idle ocean: the water now holds exactly one loose
1050	wedge school of fish, jellyfish, bubbles, and the rare whale cameo —
1051	seaweed and bio-dust are removed. Fish swim on a wrap-around path and
1052	always face the way they move (direction can only change while the
1053	school is off-screen); the lead fish carries an eye (`><o>`).
1054	Jellyfish become a pulsing bell with a lagging swaying tentacle. All
1055	ambient marks now glow via background→ink color lerp: a travelling
1056	sin² wave through the school, a floor-bounded pulse for jellyfish,
1057	and occasional raised-cosine glints on bubbles, with deliberately
1058	non-matching periods so nothing strobes in sync.
1059
1060	- Rename the internal delegated-worker role type from `SubAgentType` to
1061	`FleetRole` with canonical variants (`Worker`, `Scout`, `Planner`,
1062	`Reviewer`, `Builder`, `Verifier`, `Custom`) matching the public Fleet
1063	vocabulary one-to-one. Wire behavior is unchanged: serialization emits
1064	canonical Fleet values only, and persisted `agent_type` fields plus
1065	documented legacy spellings (`general`, `explore`, `plan`, `review`,
1066	`implementer`, …) continue to load at deserialization/parse boundaries;
1067	unknown role tokens still fail closed with the canonical vocabulary in
1068	the error.
1069
1070
1071	The Codewhale v0.9.1 source candidate includes a first-class local web client over the Runtime API,
1072	first-class OpenCode Go and TelecomJS TokenHub providers and restored xAI device login,
1073	calendar-correct hourly automations, a buildable OpenHarmony workflow-js
1074	target, and hardening for Auto routing, remote-terminal clipboard transport,
1075	restart recovery, and a coherent TUI, Work, evidence, and public release
1076	surface.
1077
1078	### Added
1079
1080	- Add `codewhale web [--port 7878]`, a first-class loopback-only browser
1081	client over the canonical Runtime API. The dependency-free embedded shell
1082	supports thread lifecycle, snapshot-then-SSE transcripts, turn start/steer/
1083	interrupt, approvals, and user questions, including pending-request recovery
1084	across tab reloads, while leaving unsupported managed,
1085	files, PTY, model-selection, and Fleet controls absent. Browser auth uses a
1086	short-lived one-time loopback capability exchanged for an opaque, bounded,
1087	process-local HttpOnly, SameSite=Strict session cookie with a same-origin
1088	mutation guard; Runtime tokens never enter URLs, HTML, browser storage, logs,
1089	or browser-launch arguments (#4423).
1090	- Add OpenCode Go as a first-class, subscription-backed Chat Completions
1091	provider with `[providers.opencode_go]`, `OPENCODE_GO_API_KEY`, and the eight
1092	models currently documented on its `/v1/chat/completions` endpoint. Models
1093	served only through OpenCode Go's Anthropic `/messages` endpoint remain out
1094	of this narrow route until Codewhale supports per-model wire selection
1095	(#1481 by @seanthefuturegorilla; implementation harvested from PR #773 by
1096	@zhangweiii and PR #1050 by @sternelee).
1097	- Add TelecomJS TokenHub as a first-class Chat Completions provider with
1098	`[providers.telecomjs]`, `TELECOMJS_API_KEY`, and a key-scoped live
1099	`/v1/models` refresh. Models.dev and provider-specific catalogs remain in
1100	separate source partitions so either refresh order preserves both; refreshes
1101	do not delete the other source's rows, matching model ids from unrelated
1102	providers do not fabricate metadata, and chat requests omit unsupported
1103	reasoning fields (PR #4370 by @baendlorel; harvested with co-authorship).
1104	- Prepare native Windows ARM64 `codewhale`, `codew`, and `codewhale-tui`
1105	binaries, npm selection, updater support, and standard/portable release
1106	archives. Build and smoke them on GitHub's native Windows 11 ARM runner,
1107	and move Linux ARM64 release builds to the native Ubuntu ARM runner to
1108	remove the slower multi-arch cross-link setup (#4267 by @w1w218).
1109	- `load_skill` tool now supports listing: omit `name` or pass `"list"` to
1110	see all available skills without loading one (#4651).
1111	- Add a unified `/skills` manager with one precedence-aware root catalog,
1112	bounded duplicate/shadow/conflict auditing, package provenance, and
1113	validated install, update, remove, and trust mutations (PR #4679 by
1114	@SamhandsomeLee).
1115	- Add a safe Agent Details view and bounded, structured `current_activity` to
1116	the single Work projection, sourced from worker events instead of renderer
1117	string inference. Rows stay compact, exact evidence is opt-in, and raw child
1118	output never enters the parent transcript (#2889 and #4636; design direction
1119	by @aboimpinto, preserved from #2694).
1120	- Make exact results and delegated coordination durable: non-inline tool output
1121	becomes immutable session-owned evidence behind bounded receipts; File
1122	mutations add configurable success-only diffs; and decisions and write
1123	contention survive restart with typed neutral-fan-in records (#4619, #4636,
1124	#4647).
1125	- Runtime API provider registry and atomic provider-switch endpoints
1126	(`GET /v1/providers`, `GET /v1/providers/{id}/models`,
1127	`POST /v1/providers/{id}/switch`) so the web GUI renders a dynamic
1128	provider/model picker without the setConfig+reload clobber (#4658).
1129	- Typed filter (`/`) in the Fleet setup wizard's Model step: substring
1130	match over provider id, display label, and model id keeps
1131	OpenRouter-scale catalogs navigable (#4639).
1132	- `[auto.router]` config: explicit provider/model/thinking for the Auto
1133	mode classifier route; unset keeps the DeepSeek flash default, and
1134	missing credentials fall back to the local heuristic.
1135
1136	### Changed
1137
1138	- Keep the top activity bar literal and actionable: active To-dos appear first,
1139	followed by Sub-agents, while generic operations and coordination stay in
1140	the detail surface. Completed-only bars auto-hide, and top/side layouts can
1141	be resized by dragging their divider and retain the chosen size (#4700,
1142	#4702).
1143	- Use each theme's semantic colors for composer mode and permission rails, and
1144	show a larger inline reasoning preview with clearer local/full expansion
1145	affordances (#4699, #4701).
1146	- Simplify the model-facing runtime around stable action tools (`File`, `Git`,
1147	`Run`, deferred `Web`, and durable task and automation families), with legacy
1148	spellings hidden for replay. Fresh sessions no longer reserve a Work surface
1149	before real work exists (PR #4675).
1150	- Give the terminal shell one deliberate visual language: cool Plan → Act →
1151	Operate and warm Ask → Auto-Review → Full Access ramps match between header
1152	and split composer edges; transcript rhythm groups related activity; a
1153	refined whale keeps the empty state calm; and one-cell live motion with
1154	truthful labels distinguishes reasoning, reading, tool use, and verification
1155	without exposing private reasoning text. Reduced-motion and animation-off
1156	settings freeze it, while ASCII-safe terminals retain the signal (#4676,
1157	#4677).
1158	- Unified shell tool: the model now sees a single `Bash` tool with an `action`
1159	parameter (run/wait/interact/cancel). Legacy `exec_shell*` names remain as
1160	hidden compat aliases for transcript replay, and the tool-search catalog
1161	keeps `Bash` active by default (#4625).
1162	- Tool output inline preview increased from 6 to 12 lines (4 head + 4 tail)
1163	before the fold indicator; full pager (`v` key) unchanged (#4603).
1164	- Mode changes (`/mode agent\|plan\|operate`) now persist to `settings.toml`
1165	and restore across sessions (#4628).
1166	- Billing provenance: every outgoing API request carries an
1167	`x-codewhale-provenance` header with client version and provider (#4324).
1168	- The `/model` picker's typed search now ranks results: provider-name
1169	matches first (drill-down), then exact id, then id-prefix, then the
1170	active provider's rows (#4639).
1171	- System prompt text consolidated into a single `prompts/text.rs`
1172	module (byte-exact constants replacing 17 layered files);
1173	composition order, constitution-first binding, and locale/personality
1174	variants unchanged.
1175	- Ask, Auto-Review, Full Access, and Never resolve through one permission
1176	contract: `resolve_tool_permission` in the engine and
1177	`resolve_approval_request_disposition` in the UI share one truth table for
1178	session grants/denials, non-bypassable policy holds, and modal prompts
1179	(#4412).
1180	- Collapsed multi-struct tool families into single action-dispatched tools
1181	(`AutomationTool`, `TasksTool`, `GithubTool`, `RlmTool`) while keeping
1182	legacy tool names as hidden compatibility aliases for transcript replay.
1183	- Operate-mode children default to leaf depth (`max_depth=0`) unless the
1184	caller explicitly grants a deeper budget (#4598).
1185
1186	### Fixed
1187
1188	- Restore `uwu` theme config round-tripping and keep header permission colors
1189	and authored idle-whale geometry aligned with the selected theme (#4696).
1190	- Default canonical `Bash` runs with no explicit `cwd` to the active
1191	`ToolContext.workspace`, including an isolated sub-agent worktree, instead of
1192	falling through to the shared shell manager's parent workspace. The regression
1193	test detects the selected workspace through marker files so it remains
1194	meaningful across PowerShell path spellings (#4674, PR #4673 by @fleitz).
1195	- Generate QuickJS bindings for `aarch64-unknown-linux-ohos` with the native
1196	SDK's libclang and sysroot, carry the OHOS target and sysroot through final
1197	linking, and keep unsupported persistent PTY dependencies out of the target
1198	while retaining non-PTY `exec_shell` support (#4470 by @shenjackyuanjie;
1199	original bindgen approach in #4384 by @shenyongqing).
1200	- Honor `[auto] cost_saving = true` in provider-aware heuristic and classifier
1201	routing, using only validated same-provider fast siblings and deriving
1202	fallback candidates from their actual provider so Auto cannot invent a
1203	cross-provider model. Providers without a known fast sibling stay on the
1204	active model (#4486; partial #4405).
1205	- Make terminal-client clipboard behavior truthful over SSH: use OSC 52
1206	outside tmux, stock `tmux load-buffer -w` inside tmux, and bracketed paste
1207	for client-to-remote text. Graphical text and image access now requires
1208	credible forwarding or an explicit override, transport failures no longer
1209	claim success, and help distinguishes terminal text paste from graphical
1210	image attachment (#4484).
1211	- Keep a fresh TUI Work surface from rendering prior-session worker snapshots
1212	or durable-task terminal receipts whose creation or completion predates the
1213	current app start. Active durable tasks remain visible, and shared history
1214	stays available through `/tasks` and archived agent views (#4488; partial
1215	#4416).
1216	- Make doctor and setup output distinguish static configuration, command
1217	availability, MCP protocol readiness, and backend health instead of
1218	presenting configured routes as live-healthy. Ordinary doctor runs no
1219	longer wake loopback/self-hosted providers unless `--probe-local` is
1220	explicitly requested (#4485; partial #4406).
1221	- Serialize test-only configuration-path readers with temporary environment
1222	redirects so the Windows provider-persistence matrix cannot observe another
1223	test's transient `CODEWHALE_HOME` or config path (#4483, closing #4463).
1224	- Restore direct Moonshot `kimi-k3` to its documented 1,048,576-token
1225	context window and 131,072-token output limit instead of treating the live
1226	model as an unknown legacy 128K route. The existing Kimi Code tiered `k3`
1227	route and credential reuse remain unchanged (#4481).
1228	- Keep read-before-edit snapshots in the engine session so a file read remains
1229	valid across turns and context compaction, while a new session still starts
1230	with an empty tracker (#4475 by @Angel-Hair).
1231	- Make `apply_patch` expose the canonical `replace` operation while continuing
1232	to accept deprecated `changes` payloads through one validation path. Mixed
1233	patch, replace, and compatibility modes now fail before any write (#4476 by
1234	@Angel-Hair).
1235	- Show the prompt-cache hit rate in the phase strip when the Cache status item
1236	is enabled, using overflow-safe rounded integer math and leaving compact or
1237	disabled status layouts unchanged (#4474 by @dmitri-0).
1238	- Preserve Solarized Light's canonical Base3 (`#fdf6e3`) shell background
1239	instead of tinting it green-grey through the default underwater Ombre
1240	treatment, while retaining foreground ambient life (#4457 by
1241	@AiurArtanis; PR #4471 by @nightt5879).
1242	- Register `/slop` and `/canzha` as compatibility aliases of `/debt`, while
1243	keeping user-command ownership truthful across dispatch, help, slash
1244	completion, alias copy, and typo suggestions (PR #4680 by @nightt5879).
1245	- Fail closed on legacy Kimi CLI credential imports: remove Codewhale's
1246	hard-coded first-party-client impersonation and refresh request, never
1247	auto-enable or rewrite imported credentials, and label the compatibility
1248	route as a read-only imported token. An explicitly configured, still-valid
1249	access token remains usable until expiry; missing, malformed, and expired
1250	imports recover through the supported Kimi Code API-key route while
1251	first-class OAuth awaits Codewhale's own vendor registration (#4417,
1252	partially addressed).
1253	- Restore xAI/Grok device-code OAuth login against the live xAI OIDC
1254	contract: discovery with issuer/endpoint validation and documented
1255	fallbacks, user-principal scope set, RFC 8628 `slow_down` backoff capped at
1256	code expiry, bounded, sanitized error reporting for denial, expiry, and
1257	malformed responses, and a shared blocking-worker boundary for both CLI and
1258	TUI login so reqwest's blocking client never creates or drops its private
1259	runtime inside Codewhale's Tokio runtime (#4410).
1260	- Anchor `FREQ=HOURLY` automations with `BYHOUR`/`BYMINUTE` to persisted
1261	local-calendar slots so intervals keep their wall-clock phase across DST,
1262	restart, resume, RRULE updates, duplicate-slot recovery, and post-run
1263	advancement. Nonexistent clock slots are skipped and ambiguous slots run at
1264	their first occurrence (#4381 by @h3c-hexin).
1265	- Give content-watch drafts canonical identities: the link and semantic-drift
1266	watchers now write and dedup through one canonical draft-storage key with
1267	deterministic hash-suffixed IDs, validate and bound model drift output
1268	before any KV writes, and show truthful admin draft labels, so unchanged
1269	findings dedup and changed findings re-draft instead of colliding (#4453).
1270	- Make model-policy JSON repair consider object and array payloads in source
1271	order, matching nested delimiters across quoted strings and escapes and
1272	returning the earliest balanced candidate that parses, instead of letting
1273	an unmatched opening delimiter or object-first preference corrupt array
1274	payloads (#4430).
1275	- Convert persisted sub-agent completion and still-running control events into
1276	concise, non-authoritative resume checkpoints, keeping their raw runtime
1277	envelopes, sentinels, and retry instructions out of restored model and TUI
1278	conversation state (#4409).
1279	- Deliver failed, stopped, and stale sub-agent outcomes exactly once to the
1280	awaiting parent, lifecycle mailbox, and TUI before closing their runtime
1281	state. Restart now reconciles orphaned queued/model/tool-wait worker records
1282	to interrupted while preserving checkpoints, and cancelled workers no
1283	longer read as completed in the TUI (#4408).
1284	- Give host applications a cancellation boundary for MCP OAuth login so a
1285	stalled or abandoned provider login no longer hangs the calling session
1286	(#4380).
1287	- Avoid blocked reader joins after Windows process kills so terminated shell
1288	sessions cannot hang their readers (#4383).
1289	- Give stdin-less observer hooks immediate EOF and contain timed-out hook
1290	process trees so descendants and pipe readers cannot leak after the parent
1291	shell exits (#4489 by @luismateusvargas).
1292	- Preserve the full unsigned Windows PTY process status instead of collapsing
1293	every high-bit exception or NTSTATUS to `2147483647`, including decimal and
1294	hexadecimal diagnostic metadata for device retests (#4100 by
1295	@redjade75723).
1296	- Keep the Hotbar Setup action list synchronized with keyboard focus when the
1297	selection moves beyond the visible rows, including Down past `/export`
1298	(#4418).
1299	- Route Windows OpenHarmony Cargo links through the repository's target-aware
1300	clang launcher so the final Rust link keeps its target, sysroot, and MUSL
1301	flags, and extend the no-SDK release guard to protect that contract. This
1302	completes [@shenjackyuanjie](https://github.com/shenjackyuanjie)'s PR #4470
1303	setup alongside [@shenyongqing](https://github.com/shenyongqing)'s original
1304	bindgen approach in PR #4384.
1305	- Reconcile the website roadmap with reality: the retired share-link
1306	direction is now an explicit non-goal, Workrooms is the considered
1307	direction, and the local web client appears as underway, in English and
1308	Chinese (#3418).
1309	- System-prompt skills block and skill-load warnings no longer embed absolute
1310	home/workspace paths; entries render workspace-relative or `~/…` so the
1311	byte-stable prompt prefix never leaks private paths. A new invariant test
1312	guards absolute paths, API keys, and workspace paths in the prefix (#4632).
1313	- Mode/permission baseline unit tests no longer read the developer's live
1314	`settings.toml`; they isolate config I/O to a temp directory (#4628).
1315	- Enter no longer freezes the composer on send: dispatch splits into a
1316	sync prepare phase (instant history + spinner) and a spawned async
1317	phase (auto-route, preflight, engine send), with submits gated while
1318	a dispatch is in flight (#4605).
1319	- Self-hosted routes keep explicit per-model output limits for unknown
1320	wire aliases instead of the generic 4K fallback (#4655 by @h3c-hexin;
1321	PR #4656).
1322	- Chat Completions idle-timeout errors now include received-byte and
1323	timing telemetry, distinguishing prefill stalls from mid-stream
1324	stalls with truncated tool-call arguments (#4657 by @h3c-hexin).
1325	- `set_config` provider writes now keep the in-memory route in step,
1326	so a following model write lands in the new provider's table instead
1327	of clobbering the previous provider's root default_text_model (#4658
1328	by @gaord, with a follow-up route-sync fix).
1329
1330	### Security
1331
1332	- Restrict cross-origin Runtime API browser preflights to the documented
1333	authentication and content headers, explicitly allowing `Authorization`
1334	instead of relying on a wildcard (#4454).
1335
1336	### Contributors
1337
1338	Thank you to the contributors whose code, reports, and reviews shaped v0.9.1:
1339
1340	- [@h3c-hexin](https://github.com/h3c-hexin) — calendar-anchored hourly
1341	automation recurrence (PR #4381), the MCP OAuth cancellation report
1342	(#4380), explicit limits for unknown local models (PR #4656 / #4655),
1343	and idle-timeout progress telemetry (PR #4657).
1344	- [@gaord](https://github.com/gaord) — Runtime API provider registry and
1345	atomic provider-switch endpoints (PR #4658).
1346	- [@SamhandsomeLee](https://github.com/SamhandsomeLee) — the unified `/skills`
1347	root catalog, audit/provenance model, validated mutations, manager UI, and
1348	acceptance coverage (PR #4679), plus Enter-send lag diagnosis and fix
1349	direction for #4605 (PR #4654; landed via the release-lane async-dispatch
1350	split).
1351	- [@aboimpinto](https://github.com/aboimpinto) — the Layer 5.1 user-command
1352	registry boundary from PR #3278; the exact authored evidence commit from PR
1353	#4046, preserved intact in the integration graph; and the #2870 follow-up
1354	audit whose metadata and malformed-sibling gaps shaped the final corrections.
1355	Paulo also provided the structured, redacted Agent Details and
1356	`current_activity` direction preserved from #2694/#2889 and the real-PTY
1357	lifecycle acceptance direction from #2886.
1358	- [@baendlorel](https://github.com/baendlorel) — TelecomJS TokenHub provider
1359	support and key-scoped live-catalog direction from PR #4370, harvested into
1360	the current provider architecture with co-authorship preserved.
1361	- [@zhangweiii](https://github.com/zhangweiii) and
1362	[@sternelee](https://github.com/sternelee) — the original first-class
1363	OpenCode Go implementations (PRs #773 and #1050), harvested into the
1364	current provider architecture.
1365	- [@seanthefuturegorilla](https://github.com/seanthefuturegorilla) — the
1366	canonical OpenCode Go/Zen provider request and acceptance direction
1367	(#1481).
1368	- [@nightt5879](https://github.com/nightt5879) — `/debt` compatibility aliases
1369	with dispatch-consistent user-command shadowing across discovery surfaces
1370	(PR #4680), plus the Solarized Light background preservation fix (PR #4471).
1371	- [@AiurArtanis](https://github.com/AiurArtanis) — the Solarized Light
1372	regression report and reproduction (#4457).
1373	- [@shenjackyuanjie](https://github.com/shenjackyuanjie) — the HarmonyOS
1374	workflow-js bindgen, portable-pty gating, and SDK environment work
1375	(PR #4470).
1376	- [@shenyongqing](https://github.com/shenyongqing) — the original HarmonyOS
1377	bindgen approach (PR #4384), carried into the landed implementation.
1378	- [@luismateusvargas](https://github.com/luismateusvargas) — the Windows hook
1379	process-leak reproduction, process-tree analysis, and EOF fix direction
1380	(#4489).
1381	- [@redjade75723](https://github.com/redjade75723) — the persistent Windows PTY
1382	report that exposed lossy high-bit process-status handling (#4100).
1383	- [@w1w218](https://github.com/w1w218) — the Windows ARM64 release request and
1384	real-device motivation (#4267).
1385	- [@Angel-Hair](https://github.com/Angel-Hair) — session-owned read-before-edit
1386	tracking and the explicit, backwards-compatible `apply_patch` replacement
1387	contract (PRs #4475 and #4476).
1388	- [@dmitri-0](https://github.com/dmitri-0) — configurable cache-hit visibility
1389	in the phase strip (PR #4474).
1390	- [@fleitz](https://github.com/fleitz) — the canonical `Bash` no-`cwd`
1391	workspace fix and regression test that keep isolated sub-agent commands in
1392	their own worktree (PR #4673, closing #4674).
1393	- [@SparkofSpike](https://github.com/SparkofSpike) — the Windows Ctrl+O
1394	reproduction that exposed pre-pager result truncation and conflicting composer
1395	shortcut routing (#4482), and the exact Vim-space regression reproduction
1396	verifying the v0.9.1 input path already contains the needed global binding
1397	(PR #4477).
1398
1399	### Security
1400
1401	- Harden the public community-site boundary: scheduled review drafts now use
1402	one canonical freshness namespace, admin discard is restricted to validated
1403	draft objects, public feed requests cannot spend the server-held GitHub
1404	token, and maintainer login bodies are type- and size-bounded before parsing.
1405
1406	## [0.9.0] - 2026-07-16
1407
1408	Codewhale v0.9.0 replaces the default terminal shell with the underwater
1409	interaction system, makes Operate message-first, and hardens the Fleet,
1410	Workflow, routing, accounting, and release surfaces that support day-to-day
1411	agent work. The release also expands localization and gives the public site a
1412	quieter, docs-first community foundation. Its provider work replaces the old
1413	hand-maintained picker boundary with live ProviderLake discovery and adds the
1414	largest curated model-and-pricing expansion in the project so far.
1415
1416	### Fixed — final integration
1417
1418	- Redact configured, environment, file-backed, and bare active credentials
1419	from every tool result before it crosses any model-provider wire protocol;
1420	retrieved spillover content is sanitized again at that boundary. The
1421	`read_file` tool also refuses CodeWhale configuration, backup, and
1422	credential-store paths, preventing routine tool use from exposing those
1423	local files.
1424	- Keep immediate TUI submit failures inside the shell: custom-provider route
1425	preflight and closed-mailbox errors now restore the exact composer draft and
1426	selected skill for retry, with a sticky visible error instead of exiting.
1427	- Anchor automatic compaction thresholds to the route's spendable input
1428	budget after output reservation and safety headroom, so large-output and
1429	tight self-hosted routes compact before provider context rejection. The TUI
1430	pre-send gate and warning copy now use the same token threshold as the
1431	engine. Preserve the 262K Kimi route's usable input budget and use the
1432	documented 32K default generation budget instead of mirroring the context
1433	window as output (#4293 by @SamhandsomeLee, #4368 by @bruce6135, and #4378
1434	by @mvanhorn).
1435	- Fail closed instead of reporting base-rate dollar estimates for direct OpenAI
1436	GPT-5.4/5.4 Pro, GPT-5.5 (including dated snapshots), and GPT-5.6
1437	Sol/Terra/Luna requests above 272K input tokens. Exact tiered accounting
1438	remains deferred to the generalized pricing schema; smaller 5.4 variants,
1439	GPT-5.5 Pro, Codex subscription, and foreign-provider routes are unchanged
1440	(#4317).
1441	- Retire `deepseek-chat` and `deepseek-reasoner` before they reach DeepSeek's
1442	first-party OpenAI or Anthropic wire APIs, migrating both to the documented
1443	`deepseek-v4-flash` replacement while preserving legacy non-thinking /
1444	thinking intent when no explicit reasoning tier is set. Aggregator, Wanjie
1445	Ark, self-hosted, and custom endpoint model ids remain provider-owned (#4320).
1446	- Make Operate a message-first multitask surface: ordinary prompts work without
1447	a Workflow, direct parent tools follow the same approval, sandbox, shell,
1448	ask-rule, and repository protections as Act, and follow-ups can queue while
1449	work is active. Bounded background workers remain preferred for independent,
1450	parallel, isolated, or long-running work; child handoffs cannot inherit
1451	standing Full Access, and each dispatch produces one durable completion
1452	receipt.
1453	- Let personal Fleet profiles in `CODEWHALE_HOME/agents` travel across
1454	repositories while project profiles in `.codewhale/agents` override them.
1455	Saving refreshes the live roster, and the UI now says explicitly that profile
1456	availability does not expand workspace, trust, or filesystem authority.
1457	- Move file-mention discovery onto one bounded, generation-safe background
1458	worker so a slow filesystem read cannot freeze composer input. Exact paths
1459	resolve on send; fuzzy matches stay in the completion popup instead of
1460	silently attaching an arbitrary same-name file (#4365 by @WavesMan, with the
1461	initial bounded-walk approach from #4367 by @LeoLin990405).
1462	- Keep the opt-in `remember` tool in the model-visible first-turn catalog so
1463	durable preference capture works without requiring a model to discover a
1464	tool it cannot yet know exists (#4373 by @Angel-Hair and #4377 by
1465	@mvanhorn).
1466	- Make `review` handle a staged snapshot relative to a base ref by comparing
1467	the branch merge-base tree with the index. This preserves committed and
1468	staged branch work, excludes unstaged edits, and avoids the invalid
1469	`git diff --cached <base>...HEAD` form.
1470	- Honor each MCP server's advertised discovery capabilities before calling
1471	optional tools, resources, templates, or prompts; keep optional probes
1472	independently bounded and fail-soft (#4308 by @nsfoxer).
1473	- Make offline `scorecard` pricing provider-aware: `turn_end` records carry the
1474	effective route and a non-secret billing surface, runtime exports and
1475	supported aliases ingest cleanly, legacy/unknown routes remain explicitly
1476	unpriced, and route-scoped cache and recorded-time pricing replace model-only
1477	guesses. Historical runtime aggregates use each turn's recorded time;
1478	costless catalog routes fail closed while exact provider-owned hand-price
1479	rows remain available. StepFun PAYG and Step Plan usage now stay distinct
1480	without persisting raw endpoint URLs, so subscription quota is never reported
1481	as token spend (#4335). Completion-only shell, manual-compaction, and purge
1482	events remain visible to `turn_end` observers as explicitly non-model
1483	lifecycle records. This builds on the scorecard introduced by @findshan in
1484	#3388.
1485	- Preserve named custom-provider identity across TUI sessions, `exec --resume`,
1486	runtime threads, exports, cache and Workflow receipts. Restores resolve the
1487	saved provider against live configuration before creating a client, never
1488	infer a provider from the model ID, and fail closed when the named route was
1489	removed, invalid, or ambiguous (#4334).
1490	- Bind credentials to the endpoint that owns them. Environment-selected custom
1491	hosts can no longer inherit saved provider keys, keyring entries, OAuth, or
1492	ambient provider variables; only an explicitly source-marked CLI key may
1493	follow an explicit CLI endpoint override. `auth_mode = "none"` also strips
1494	credential-shaped custom headers consistently in the TUI and app server,
1495	while keyless loopback routes remain usable as local runtimes.
1496	- Make hosted runtime threads deterministic and provider-exact: serialize
1497	thread, turn, and event mutation; keep cancellation ownership with the host;
1498	preserve the selected provider through every durable turn; terminalize
1499	exceptional streams once; and prevent the runtime manager from silently
1500	dispatching unclaimed goal continuations or child turns.
1501	- Treat required user confirmation as a real goal blocker instead of a failed
1502	goal, and explain how to recover when a previously cached approval is denied.
1503	Cached-denial recovery is also committed as a settled transcript receipt, so
1504	tool completion or a later status update cannot erase it from scrollback or
1505	accessibility output. The notice now describes matching, process-scoped
1506	denials truthfully across all shipped locales; approval audits honor
1507	`CODEWHALE_HOME`, and expired status toasts cannot remain trapped behind a
1508	persistent entry. Both states remain visible and actionable instead of
1509	looking like unexplained model or tool failure (#4374 and #4375 by
1510	@Angel-Hair, with the final hardening in #4385 by @nightt5879).
1511	- Make Fleet launch and teardown deterministic: route flags are placed before
1512	`exec`, workers are contained in owned Unix sessions or Windows Job Objects,
1513	and cancellation reaps surviving descendants with bounded escalation before
1514	manager state settles. Fence progress, terminal status, verification
1515	receipts, and evidence by durable attempt generation so a stale process can
1516	never complete or overwrite a restarted attempt; terminal state and receipt
1517	now commit atomically, stale-heartbeat decisions use a full lease CAS,
1518	exhausted-retry alerts are exactly once, and crash-truncated ledger tails are
1519	quarantined before the next append. Standalone CLI and Runtime API restart
1520	controls now drive the replacement attempt through a real executor to its
1521	terminal receipt, while per-run manager ownership prevents concurrent
1522	controllers from launching the same attempt twice.
1523	- Keep the stopship Workflow fixture bounded to measured 24k-per-turn role
1524	budgets and a 360k aggregate. Authored child step and wall-time limits now
1525	reach the live runtime, including launch-queue wait; promoted evidence stays
1526	intact between roles, tool-free handoff consumers omit tool fields on the
1527	provider wire, and a terminal `BLOCK` fails the Workflow instead of producing
1528	a successful Lane receipt. Free-form descriptions no longer fabricate write,
1529	shell, or network risk; unknown structured risk remains fail-closed.
1530	- Keep repository trust affirmative and explicit: only `1`/`Y` are advertised
1531	as acceptance keys, while Enter remains non-affirmative and explains the
1532	required choice.
1533	- Replace literal legal and doctrinal metaphors in Simplified Chinese setup and
1534	`/constitution` copy with direct collaboration terminology reviewed by a
1535	native speaker (#4369 by @hmr-BH).
1536	- Keep the transcript reviewable while an inline approval card is active:
1537	Page Up/Down, modified arrows, Home/End, and the mouse wheel now move through
1538	the visible evidence without changing or dismissing the pending decision
1539	(#4371 by @amuthantamil).
1540	- Match generated worker names to the active UI language while preserving
1541	explicit user names, and tighten the 89x50 shell rhythm across Fleet rows,
1542	choice dialogs, transcript boundaries, and the idle composer.
1543	- Put docs content and search before the full index on small screens, reduce
1544	mobile dead space, and keep the public community copy focused on issues,
1545	pull requests, and international contributors.
1546
1547	### Changed — the underwater shell
1548
1549	- Replace the default TUI shell with the underwater interaction system: one
1550	renderer owns the header, top work strip, transcript ledger, composer, and
1551	footer, with explicit compact/normal/wide tiers and no legacy sidebar or
1552	dashboard in the default path. The legacy composition survives only behind
1553	the internal `classic` treatment.
1554	- Add a distinct pre-session launch screen — new session, new worktree (with
1555	inline naming and real lane provisioning), scoped resume count, changelog,
1556	quit — with reliable non-colliding keys and row/keyboard parity.
1557	- Render turns as a ledger: user message, short narration, settled tool
1558	receipts, and exactly one live row. Fast tool bursts land directly as
1559	batch receipts (no spinner churn), completed receipts stay inspectable,
1560	failures hold a coral receipt with stderr one `v` away, and one shared
1561	tool rail replaces nested card borders.
1562	- Make completion a one-shot exhale: `working -> finishing -> done` in the
1563	footer only, with no transcript repaint, no lingering loop, and no stale
1564	cancel action in the completed state.
1565	- Rebuild the secondary rooms on one hairline grammar — config, setup,
1566	sessions, help, context, theme, model/route, Fleet, file attach — each
1567	with a title hairline, row objects with focus/selection/mouse parity,
1568	one panel-owned scroll rail, and wrapped action footers.
1569	- Make `/model` a model-first atomic route picker across configured
1570	providers: provider and model switch together on apply, and every row
1571	prints the resolved model. `/theme` gains a live preview with truthful
1572	Esc revert across all 12 shipped themes.
1573	- Add a live context inspector (Alt+C) backed by the current route: exact
1574	system/messages/free token buckets, a proportional map, drill-down into
1575	the detail pager, and no frozen session while it is open.
1576	- Project Workflow runs as an in-stream run map: a collapsed one-line card
1577	that unfolds into per-lane rows with role, resolved model, worktree,
1578	elapsed track, and per-member running/waiting/failed/cancelled/done
1579	states, plus gates and a debrief built only from real run data. Child
1580	transcripts never flood the parent shell.
1581	- Unify Fleet into roster/setup/workers rooms: the operator is pinned first
1582	with the live session route, members show resolved route truth (inherit /
1583	fast lane / pinned), and the workers tab is a control surface with
1584	row-local open/stop and real lifecycle counts.
1585	- Distinguish repository-law approvals from ordinary approvals: the
1586	constitution prompt names its authority, source, matched rule, and target,
1587	and Full Access never bypasses it. Ordinary approvals render as a still
1588	coral band above the visible transcript.
1589	- Keep streaming honest and cheap: provider-unit deltas replace per-grapheme
1590	queueing, the transcript is top-anchored so appended lines stop shifting
1591	settled rows, ambient animation stops during real work, and ordinary
1592	completion no longer triggers full-screen clears (verified by render-diff
1593	logs: suffix updates of tens of cells while streaming, zero periodic
1594	full repaints).
1595	- Give every underwater treatment ambient life: ombre breathes its water
1596	column while flat and Terminal-owned keep the idle fish and bubble
1597	(foreground-only for Terminal), a typed treatment setting replaces string
1598	comparisons, reduced motion freezes life legibly, `fancy_animations =
1599	false` stills the chrome, and typing scatters the fish immediately. Fish
1600	keep a one-cell gap from occupied text; the whale remains the single brand
1601	mark and returns to stillness between caustic sweeps.
1602	- Bring the whale mark to life with a soft diagonal caustic sweep, then let it
1603	genuinely rest. Active markers now share a smoother 8 Hz clock after the
1604	existing earned-motion delay, while reduced motion, hidden/off-screen views,
1605	modal ownership, and compact-terminal redraw budgets remain authoritative.
1606	The motion is adapted from the Apache-2.0 Grok Build interaction language,
1607	not copied as a global pulse or high-frequency receipt cascade.
1608	- Keep compact terminals operable: `/config` and `/resume` collapse
1609	secondary chrome before sacrificing their selectable rows at 40x12 and
1610	60x16, bodies budget for the footer's real wrapped height, and the
1611	selection stays visible through resizes.
1612	- Route footer notices through the classified toast system so informational
1613	acknowledgements (for example "Auto-compaction enabled") expire instead of
1614	becoming permanent idle chrome, while warnings and errors hold as sticky
1615	notices until their window passes.
1616	- Complete the `CODEWHALE_ASCII_SAFE=1` decorative tier: the whale mark,
1617	context meter, braille state markers (mapped by dot density so the working
1618	bubble still reads as a rising fill), bubbles, rails, and role/lane glyphs
1619	all narrow to semantic ASCII while user, model, and CJK text passes
1620	through untouched. Verified by whole-surface rendered-buffer sweeps.
1621	- Repair the Help catalog to match handler truth (`Alt+G`, `Alt+Shift+G`,
1622	`Alt+[`, `Alt+]`, `Alt+L`, `Alt+?`), and give theme, Help, model, and
1623	config rows direct mouse paths with the same activation as Enter.
1624
1625	### Changed — integrated runtime and TUI
1626
1627	- Make worker delegation route-aware and identity-safe: workers receive a
1628	small role-scoped system prompt instead of stale parent/model boilerplate,
1629	faster routes resolve through the configured provider, and opening a worker
1630	shows its complete available transcript. Remove `token_budget` from the
1631	ordinary model-facing Agent schema so agents do not micromanage ad-hoc
1632	launches; explicit legacy calls remain readable for compatibility.
1633	- Mature `/config` interaction for enumerated and boolean settings with
1634	pickers/toggles, mouse-wheel scrolling, stable focus, and configured-provider
1635	selection. Startup mode is now only Agent or Plan; legacy `operate`/`yolo`
1636	settings migrate to Agent with permission posture represented separately.
1637	- Show where effective permission policy comes from and keep profile,
1638	environment, project, managed, and requirements-controlled posture read-only
1639	in the in-session editor. Runtime presets edit only proven user-owned root
1640	settings and no longer persist temporary environment overlays.
1641	- Restore the original four-line whale mark and make ambient ocean motion
1642	coherent across the full scroll surface: one continuous ombre, eased fish
1643	that face their direction of travel, fish in otherwise blank scrollback, and
1644	explicit reduced-motion and animation controls.
1645	- Keep model reasoning in the transcript rather than the Tasks strip, retain
1646	the live header status indicator, separate worker and success colors, and use
1647	the same rail grammar for both work-strip and transcript scrollbars.
1648	- Present the default Z.AI Coding Plan route, including child routes, as
1649	subscription quota instead of estimated per-token dollars. No undocumented
1650	account endpoint is called by this change.
1651
1652	### Added
1653
1654	- Thinking Machines Lab's Inkling through Together using the exact wire model
1655	`thinkingmachines/inkling`, with `inkling` and `together-inkling` aliases and
1656	exact `none` / `minimal` / `low` / `medium` / `high` / `max` reasoning
1657	values. Codewhale does not invent a context window, price, or offline picker
1658	claim while the provider's public catalog metadata remains inconsistent.
1659	- Expand the verified offline catalog with Claude Sonnet 5, Claude Fable 5,
1660	GPT-5.3 Codex, and Qwen3.7 Plus, including time-aware Sonnet 5 introductory
1661	pricing and explicit cache rates. Refresh stale GLM-5.1, Kimi K2.6, Trinity,
1662	Qwen3.6, Nemotron, Anthropic, GLM-5.2, Kimi K2.7 Code, GLM-5 Turbo, and
1663	GPT-5 Codex price or limit rows; keep Xiaomi MiMo explicitly unpriced where
1664	the provider's token plan and pay-as-you-go surfaces cannot be distinguished.
1665	- MiniMax Messages provider support for MiniMax-M3 and MiniMax-M2.7, with
1666	OpenAI-compatible and Messages routes, regional endpoint guidance, request
1667	coverage, catalog limits, and tier-aware pricing (PR #4354 by @octo-patch).
1668	- Dynamic MCP server infrastructure and an approval-gated tool that lets the
1669	model start a configured MCP server from chat context. Harvested from
1670	#3869 and #3866 by @bistack with authorship preserved.
1671	- Parent `--disallowed-tools` restrictions now flow into sub-agents and Fleet
1672	workers by default, including deny-wins, wildcard, catalog-filtering, and
1673	multi-generation inheritance coverage. Harvested from #4096 by @JayBeest
1674	(#4042).
1675	- Korean (ko) UI locale with full key parity and onboarding/setup wiring
1676	(PR #4347 by @moduvoice).
1677	- Localize the entire underwater layer: 104 new UI strings — launch menu,
1678	phase words, mode/permission chips, footer hints, session picker, context
1679	inspector, route and theme pickers, Fleet roster, workflow status, sidebar
1680	work strip, repository-law approval copy, and file-attach titles — wired
1681	through MessageIds and translated into ja, zh-Hans, es-419, pt-BR, vi,
1682	and ko. Every complete pack now holds exact raw key parity with English
1683	(856 keys), enforced by new tests that the old English-fallback gate could
1684	not perform. The permission chip maps from typed state, so localization
1685	can never silently collapse it. Machine-authored translations follow each
1686	pack's existing terminology and are flagged for native review.
1687	- Anthropic adapter: sanitize top-level `oneOf`/`anyOf`/`allOf` in tool
1688	input schemas so affected tools no longer fail the whole request with
1689	HTTP 400 (PR #4346 by @qinlinwang).
1690	- Anthropic pricing: bill cache-write tokens at published rates
1691	(PR #4348 by @knqiufan, #4318).
1692	- NetBSD: generate QuickJS bindings at build time so `codewhale-workflow-js`
1693	compiles (PR #4349 by @ci4ic4).
1694	- Real-PTY release gates for six-worker fan-out liveness with Esc cancel,
1695	multi-terminal route isolation, queued steering via terminal-safe Ctrl+G
1696	(with Ctrl+S retained where the terminal forwards it), the one-shot
1697	completion footer, and per-theme ANSI output for every shipped palette.
1698
1699	### Fixed
1700
1701	- Make release publication complete and source-anchored: every build checks out
1702	the resolved tag commit, tag movement is rejected before GHCR, GitHub
1703	Release, Homebrew, Cargo, or npm writes, and registry helpers require a clean
1704	checkout exactly matching the remote tag. Manual recovery runs are
1705	exact-tag-only and execute the same parity gate as automatic tag pushes.
1706	- Publish a coherent distribution set: both checksum manifests now contain
1707	usable public basenames and cover the full 29-asset matrix; GHCR, Homebrew,
1708	GitHub archives, and the Linux x64 CNB mirror carry `codewhale`, `codew`, and
1709	`codewhale-tui`. The CNB shortcut now fails clearly outside Linux/OpenHarmony
1710	x64 instead of promising assets that the mirror does not build.
1711	- Preserve task text when a skill is invoked through dollar, unified-slash, or
1712	explicit skill syntax, while keeping bare skill invocations and management
1713	subcommands intact (PR #4372 by @nightt5879, co-authored by @CCChisato;
1714	#3915).
1715	- Honor MCP server discovery capabilities: require advertised or legacy
1716	`tools/list`, keep optional resource/template/prompt probes independently
1717	bounded and fail-soft, and format descriptions Unicode-safely (#4308,
1718	harvested with co-authorship from @nsfoxer).
1719	- Age-evict terminal sub-agent worker records from the state ledger so
1720	long-lived, high-fan-out sessions do not keep rewriting multi-megabyte
1721	terminal history (#4217; root-cause and fix direction from @yekern).
1722	- Resolve the sub-agent completion/cancellation race with one terminal-state
1723	claim: cancellation suppresses late mailbox/parent/UI delivery, while a
1724	completed result remains publicly running until its notification is safely
1725	delivered.
1726	- Keep Workflow panel controls from stealing ordinary composer letters. Enter,
1727	Delete, Up/Down, and Esc own panel actions; typed characters return focus to
1728	the composer and start the message normally.
1729	- Preserve the composer prompt gutter from the first typed character through
1730	wrapping, scrolling, cursor placement, and mouse hit-testing so the `>` does
1731	not disappear or make input appear to jump.
1732	- Emit terminal-native OSC 8 metadata for rendered URLs without placing escape
1733	payload bytes in the measured text, keeping long links visible, selectable,
1734	and clickable in supporting terminals.
1735
1736	- Keep headless structured output terminal-clean: `codewhale exec` engines
1737	no longer emit interactive terminal-title/taskbar OSC sequences, so
1738	`--output-format stream-json` stdout stays parseable, escape-free JSONL.
1739	Interactive TUI sessions keep their terminal chrome.
1740	- Localization honesty: the parity gate was blinded by its own English
1741	fallback — two keybinding rows (`KbCyclePermissions`, `KbCycleThinking`)
1742	were missing from all five "complete" packs and now ship translated; the
1743	Operate-mode copy that drifted in English was retranslated in every pack
1744	(including zh-Hant's slice); three MessageIds absent from
1745	ALL_MESSAGE_IDS are visible to tests again; and the `/config`
1746	theme/locale hints and the invalid-locale error derive from the shipped
1747	registries instead of stale hand lists that advertised 4 of 12 themes
1748	and 4 of 8 locales.
1749	- The setup wizard's constitution step no longer claims a "55-line core"
1750	in any language (the bundled core is larger today); the guided draft says
1751	"the bundled core stays active" instead.
1752	- In-app selection copy is rail-clean and now regression-tested: copied
1753	transcript text excludes the `▎ ╎ │ ●` decorations via cache metadata
1754	(#4208 — thanks @eugenicum for the report and code-aware fix direction;
1755	terminal-native selection with mouse capture off remains a product
1756	decision on the proposed `rail_style` option).
1757
1758	### Docs
1759
1760	- Stamp every 0.9-era roadmap document with an explicit status (current,
1761	historical, superseded, principle-only, or future RFC), correct trackers
1762	that recorded unshipped work as done, and describe what remains after
1763	v0.9.0 in `docs/AGENT_RUNTIME.md`.
1764	- Add `docs/rfcs/UNIFIED_PROVIDER_LOGIN.md`: one `codewhale auth login`
1765	surface for Anthropic, OpenAI Codex, and xAI, with the Anthropic adapter
1766	gated on verifying flow permissions before any constants are adopted.
1767	- Refresh `docs/ACCESSIBILITY.md` for treatment-independent ambient life
1768	and the completed ASCII tier.
1769
1770	### Changed — runtime foundations
1771
1772	- Make the advertised Android/Termux release target buildable by generating
1773	QuickJS bindings against the Android NDK instead of expecting an upstream
1774	pre-generated `aarch64-linux-android` binding file, and give Android CLI/TUI
1775	HTTP clients a preconfigured rustls root store (Mozilla WebPKI roots) so
1776	standalone Termux processes stop panicking inside
1777	`rustls-platform-verifier`'s JVM expectations (#4236, #4242).
1778	- Rebalance the bundled Constitution after the v0.8.67 prompt ablation: keep
1779	the procedural policy tail in mode-specific layers, while restoring concise
1780	behavioral guidance for momentum, causal investigation, constraint-first
1781	decisions, mechanism-backed guarantees, and clean continuity.
1782	- Wire live catalog cache into provider/model pickers without dropping stale or
1783	prior rows after TTL expiry / refresh failure (#4139). Remove the dead
1784	`OFFERING_SEEDS` hand table so the bundled Models.dev catalog is the sole
1785	seed source; pickers show a compact `stale` / `cache failed` chrome chip when
1786	the Models.dev layer is past TTL or last refresh failed.
1787	- Make `work_update` the sole model-facing To-do / Work progress tool (#4132).
1788	`checklist_` and `todo_` remain registered as hidden compat aliases for
1789	transcript replay; `update_plan` stays Strategy metadata/context/route, not
1790	a second checklist. Mode/approval prompts nudge the single surface.
1791	- Demote the bundled Models.dev snapshot to an offline/stale fallback after
1792	live catalog refresh (#4188). ProviderLake precedence is live Models.dev >
1793	bundled seed > legacy hardcoded completion names; pickers, inventory, and
1794	subagent validation stay catalog-backed, and Codewhale-only providers keep
1795	defaults when Models.dev has no rows.
1796
1797	### Added
1798	- Wire xAI device-code OAuth into `codewhale auth xai-device`, the TUI
1799	`/auth xai-device` command, and guided provider setup, with comment-preserving
1800	auth-mode persistence and loopback exchange coverage (#4257).
1801	- Add GPT-5.6 Sol, Terra, and Luna to the OpenAI API route, including their
1802	1.05M context metadata, 128K output limits, pricing, and `max` reasoning
1803	effort. Add Meta Model API as a first-class OpenAI-compatible provider for
1804	Muse Spark 1.1 with 1M context, tool/reasoning metadata, provider aliases,
1805	and both `META_MODEL_API_KEY` and Meta's `MODEL_API_KEY` credential names.
1806	- Catalog automation: `scripts/catalog_models_dev.py` refreshes secret-free
1807	Models.dev / OpenRouter listings and validates the offline seed snapshot
1808	(`snapshot --check`) without ever persisting API keys (#4117).
1809	- `/model` picker cycles six catalog views with `A` (Configured → Catalog →
1810	Recent → Coding → Cheap → Long context) and richer row metadata from the
1811	live/bundled catalog (context, max output, tools, reasoning, price/M,
1812	freshness). Discoverability views do not auto-apply a surprising route
1813	(#4115).
1814
1815	- Workflow runs are now durable: every run appends to a
1816	`.codewhale/workflow-runs.jsonl` journal and hydrates on startup, so
1817	`workflow status` survives restarts; runs left `running` by a dead process
1818	are recovered as failed (#4011). The transcript renders workflow tool
1819	output as a run card (status, goal, children, progress, verification)
1820	instead of a generic one-liner (#4038), and `workflow` accepts a `verify`
1821	flag that runs post-completion verification gates and fails the run when
1822	gates fail (#4013).
1823	- Hotbar sources for MCP tools and skills: MCP tool slots prefill the
1824	composer (execution stays behind the normal tool-approval flow) and skill
1825	slots activate through the existing `$skill` alias (#2068, #2069).
1826	- Mode & permission surface: Tab cycles Plan → Act → Operate; Shift+Tab
1827	cycles the Agent permission posture (Ask / Auto-Review / Full Access) with
1828	a footer permission chip; Ctrl+T cycles reasoning effort and Ctrl+Shift+T
1829	opens the live transcript overlay. Operate is the orchestration mode
1830	(delegate, wait, inspect, dispatch) and raises sub-agent fan-out while
1831	focusing the Agents sidebar.
1832	- Provider lake facade: the provider/model pickers, hotbar, and model
1833	inventory now enumerate configured providers' models from the bundled
1834	catalog (with an `A` toggle to browse the full catalog), replacing the
1835	hardcoded per-provider model table (#3830 follow-up).
1836	- Added Cursor-integrated-terminal dogfood evidence for the published v0.8.67
1837	release, covering installed binary provenance, release/publication checks,
1838	headless runtime smoke, setup QA, and remaining manual visual TUI checks.
1839	- README and README.zh-CN now point users to the community-maintained
1840	CodeWhale for VS Code GUI frontend while clarifying that this repository's
1841	`extensions/vscode/` scaffold remains the read-only Phase 0 viewer (#4035).
1842
1843	### Fixed
1844
1845	- Sub-agent waiting no longer peek→sleep polls: `agent(action="wait")` joins
1846	children, unchanged peeks are throttled (~30s) with an anti-polling nudge,
1847	and mode prompts teach the join primitive (#4097). Harvested from PR #4098
1848	by [@Mr-Moon121](https://github.com/Mr-Moon121) (Jeffrey Luna).
1849	- `/provider` picker remembers catalog/configured view and highlighted row
1850	across reopen, matching `/model` picker memory.
1851	- Mode picker roster is exactly Act / Plan / Operate (no Multitask, no
1852	numeric `4`/`5` gaps). Legacy `yolo`/`4` remain invisible one-way
1853	permission shorthand for Act + Bypass.
1854
1855	- Fleet setup is a role/profile roster editor, not a provider-scoped model
1856	picker: the Model step lists routes from every configured provider (not
1857	only the active one), a picked route's provider is persisted explicitly in
1858	the saved profile TOML (`provider = "..."`, never inferred from the model
1859	id), and the loader/route resolver read that field back out verbatim. The
1860	draft-preview save keypress no longer competes with a separate pager's
1861	`g`/`G` scroll bindings — the exact TOML preview now renders inline on the
1862	same Review step that saves it (#4093).
1863	- `codewhale fleet run` and interactive in-process Fleet launches now honor a
1864	profile-pinned provider/model route instead of merely recording it on the
1865	receipt. Headless workers receive the non-secret `--provider` and `--model`
1866	pair; TUI workers resolve the same explicit route in process. Credentials
1867	still come from the worker's environment, provider is never inferred from a
1868	model id, and unpinned workers continue to inherit the run route (#4093,
1869	#4193).
1870	- The Fleet setup `m` model-assisted redraft no longer drops a picked
1871	cross-provider route: the provider/model the operator chose are re-pinned
1872	onto the drafted profile (a model draft is always `provider: None`), so
1873	saving it keeps the explicit route instead of persisting an ambiguous,
1874	provider-scoped profile (#4093).
1875	- Saving a Fleet profile now fails with a clear message when it pins a
1876	provider that has no configured credentials, using the same
1877	configured-provider check the model picker uses (#4093).
1878	- Workflow correctness: completion polling fails closed instead of
1879	fabricating success when a sub-agent reports no terminal status; cancel
1880	interrupts the JS VM (cancel handle + abort) and blocks further spawns;
1881	and `budget.spent()` reports real manager-scope usage instead of always 0.
1882	- Sub-agent spawns validate the model↔provider pair before dispatch:
1883	inherited/faster routes remap foreign models to the provider's catalog
1884	default, and explicit pins fail fast with a diagnostic instead of an
1885	upstream model-not-found error.
1886	- TUI stability: engine event drains break every 8–16 events / 8 ms to keep
1887	input live (#1830, #2317, #1198); the terminal input pump restarts after
1888	stall recovery on macOS/Linux too; the startup raw-mode probe no longer
1889	leaks raw mode on timeout; recovery snapshots persist every 45 s during
1890	long turns and the offline queue persists on every push (#1830);
1891	queue/steer paths surface toasts while streaming (#2317, #1338); and
1892	modal submit errors re-open the modal instead of being swallowed (#1198).
1893	- Core/state: paused jobs persist as paused across restarts; unarchive
1894	updates the in-memory cache; tool dispatch has a timeout; MCP
1895	notifications no longer receive responses; corrupted checkpoints surface
1896	errors instead of loading empty state; the session index compacts instead
1897	of growing unbounded; and recording thread-goal usage no longer
1898	self-deadlocks the state store.
1899	- Runtime compaction summaries are now persisted into `/v1` thread records so
1900	engine reloads and restarts preserve compacted context. Contributed by
1901	MXAntian (@MXAntian) (#4091).
1902	- The TUI leaves xterm alternate-scroll mode off when mouse capture is disabled,
1903	preserving native terminal text selection in light-theme/no-mouse-capture
1904	sessions. Contributed by Nightt (@nightt5879) (#4088, #4026).
1905	- The public `/api/github/feed` endpoint is now forced dynamic on Cloudflare so
1906	it returns live GitHub activity instead of a build-time empty feed.
1907
1908	### Security
1909
1910	- Require bearer authentication for `/v1/chat/completions`, compare tokens in
1911	constant time, return accurate 4xx/5xx statuses, bound request bodies and SSE
1912	frames, redact secrets from stdio `config get`, and reliably reap the runtime
1913	child during shutdown.
1914	- Keep trust precedence and secret persistence fail-closed: user ExecPolicy
1915	rules outrank agent-layer rules, chained commands cannot propose unsafe
1916	trusted-prefix amendments, and config and secret writes are atomic with
1917	filesystem synchronization on every supported platform.
1918
1919	### Changed
1920
1921	- Tool-hang watchdog trimmed from 15 minutes to 10 (#1862); approval modal
1922	footer hints use a higher-contrast tier (#3380); status/mode copy is
1923	disclosed once across header, footer, cards, and sidebar instead of
1924	repeated per layer.
1925	- Removed the unused `tui::whale_routes` taxonomy module and its tests.
1926	Contributed by Darrell Thomas (@DarrellThomas) (#4041, #3852).
1927
1928	### Deprecated
1929
1930	- YOLO mode: `--yolo`, `default_mode = "yolo"`, and the hotbar YOLO action
1931	now map to Act + Full Access permissions via a compatibility shim and
1932	show a one-shot deprecation notice. Removal is deferred beyond v0.9.0 so
1933	this release does not break existing scripts without a dedicated cutover.
1934
1935	### Removed
1936
1937	- Remove the deprecated `deepseek` and `deepseek-tui` binary shims in this
1938	breaking release. `codewhale`, `codew`, and `codewhale-tui` are the supported
1939	entry points; existing DeepSeek provider support and legacy config/session
1940	migration remain intact.
1941
1942	### Known issues
1943
1944	- Android/Termux arm64 remains a preview in v0.9.0. The target, asset wiring,
1945	updater selection, dependency graph, and source-build path have automated or
1946	static coverage, but shell/PTY/config/TUI startup and runtime behavior remain
1947	unverified on a real device (#4236, #4242). Do not use a GNU/Linux arm64
1948	archive in Termux.
1949
1950	### Contributors
1951
1952	Thank you to the international community whose code, reports, reviews, and
1953	reproductions shaped v0.9.0:
1954
1955	- [@amuthantamil](https://github.com/amuthantamil),
1956	[@bistack](https://github.com/bistack),
1957	[@bruce6135](https://github.com/bruce6135),
1958	[@CCChisato](https://github.com/CCChisato),
1959	[@ci4ic4](https://github.com/ci4ic4),
1960	[@cyq1017](https://github.com/cyq1017), and
1961	[@DarrellThomas](https://github.com/DarrellThomas).
1962	- [@eugenicum](https://github.com/eugenicum),
1963	[@findshan](https://github.com/findshan),
1964	[@gaord](https://github.com/gaord),
1965	[@hmr-BH](https://github.com/hmr-BH),
1966	[@hongqitai](https://github.com/hongqitai), and
1967	[@idling11](https://github.com/idling11).
1968	- [@JayBeest](https://github.com/JayBeest),
1969	[@knqiufan](https://github.com/knqiufan),
1970	[@LeoLin990405](https://github.com/LeoLin990405),
1971	[@moduvoice](https://github.com/moduvoice),
1972	[@mvanhorn](https://github.com/mvanhorn),
1973	[@Mr-Moon121](https://github.com/Mr-Moon121), and
1974	[@MXAntian](https://github.com/MXAntian).
1975	- [@Angel-Hair](https://github.com/Angel-Hair),
1976	[@nightt5879](https://github.com/nightt5879),
1977	[@nsfoxer](https://github.com/nsfoxer),
1978	[@octo-patch](https://github.com/octo-patch),
1979	[@qinlinwang](https://github.com/qinlinwang),
1980	[@SamhandsomeLee](https://github.com/SamhandsomeLee), and
1981	[@taixinguo](https://github.com/taixinguo).
1982	- [@WavesMan](https://github.com/WavesMan),
1983	[@wuisabel-gif](https://github.com/wuisabel-gif), and
1984	[@yekern](https://github.com/yekern).
1985
1986	## [0.8.68] - 2026-07-10
1987
1988	### Changed
1989
1990	- Make the advertised Android/Termux release target buildable by generating
1991	QuickJS bindings against the Android NDK instead of expecting an upstream
1992	pre-generated `aarch64-linux-android` binding file, and give Android CLI/TUI
1993	HTTP clients a preconfigured rustls root store (Mozilla WebPKI roots) so
1994	standalone Termux processes stop panicking inside
1995	`rustls-platform-verifier`'s JVM expectations (#4236, #4242).
1996	- Rebalance the bundled Constitution after the v0.8.67 prompt ablation: keep
1997	the procedural policy tail in mode-specific layers, while restoring concise
1998	behavioral guidance for momentum, causal investigation, constraint-first
1999	decisions, mechanism-backed guarantees, and clean continuity.
2000	- Wire live catalog cache into provider/model pickers without dropping stale or
2001	prior rows after TTL expiry / refresh failure (#4139). Remove the dead
2002	`OFFERING_SEEDS` hand table so the bundled Models.dev catalog is the sole
2003	seed source; pickers show a compact `stale` / `cache failed` chrome chip when
2004	the Models.dev layer is past TTL or last refresh failed.
2005	- Make `work_update` the sole model-facing To-do / Work progress tool (#4132).
2006	`checklist_` and `todo_` remain registered as hidden compat aliases for
2007	transcript replay; `update_plan` stays Strategy metadata/context/route, not
2008	a second checklist. Mode/approval prompts nudge the single surface.
2009	- Demote the bundled Models.dev snapshot to an offline/stale fallback after
2010	live catalog refresh (#4188). ProviderLake precedence is live Models.dev >
2011	bundled seed > legacy hardcoded completion names; pickers, inventory, and
2012	subagent validation stay catalog-backed, and CodeWhale-only providers keep
2013	defaults when Models.dev has no rows.
2014
2015	### Added
2016	- Wire xAI device-code OAuth into `codewhale auth xai-device`, the TUI
2017	`/auth xai-device` command, and guided provider setup, with comment-preserving
2018	auth-mode persistence and loopback exchange coverage (#4257).
2019	- Add GPT-5.6 Sol, Terra, and Luna to the OpenAI API route, including their
2020	1.05M context metadata, 128K output limits, pricing, and `max` reasoning
2021	effort. Add Meta Model API as a first-class OpenAI-compatible provider for
2022	Muse Spark 1.1 with 1M context, tool/reasoning metadata, provider aliases,
2023	and both `META_MODEL_API_KEY` and Meta's `MODEL_API_KEY` credential names.
2024	- Catalog automation: `scripts/catalog_models_dev.py` refreshes secret-free
2025	Models.dev / OpenRouter listings and validates the offline seed snapshot
2026	(`snapshot --check`) without ever persisting API keys (#4117).
2027	- `/model` picker cycles six catalog views with `A` (Configured → Catalog →
2028	Recent → Coding → Cheap → Long context) and richer row metadata from the
2029	live/bundled catalog (context, max output, tools, reasoning, price/M,
2030	freshness). Discoverability views do not auto-apply a surprising route
2031	(#4115).
2032
2033	- Workflow runs are now durable: every run appends to a
2034	`.codewhale/workflow-runs.jsonl` journal and hydrates on startup, so
2035	`workflow status` survives restarts; runs left `running` by a dead process
2036	are recovered as failed (#4011). The transcript renders workflow tool
2037	output as a run card (status, goal, children, progress, verification)
2038	instead of a generic one-liner (#4038), and `workflow` accepts a `verify`
2039	flag that runs post-completion verification gates and fails the run when
2040	gates fail (#4013).
2041	- Hotbar sources for MCP tools and skills: MCP tool slots prefill the
2042	composer (execution stays behind the normal tool-approval flow) and skill
2043	slots activate through the existing `$skill` alias (#2068, #2069).
2044	- Mode & permission surface: Tab cycles Plan → Act → Operate; Shift+Tab
2045	cycles the Agent permission posture (Ask / Auto-Review / Full Access) with
2046	a footer permission chip; Ctrl+T cycles reasoning effort and Ctrl+Shift+T
2047	opens the live transcript overlay. Operate is the orchestration mode
2048	(delegate, wait, inspect, dispatch) and raises sub-agent fan-out while
2049	focusing the Agents sidebar.
2050	- Provider lake facade: the provider/model pickers, hotbar, and model
2051	inventory now enumerate configured providers' models from the bundled
2052	catalog (with an `A` toggle to browse the full catalog), replacing the
2053	hardcoded per-provider model table (#3830 follow-up).
2054	- Added Cursor-integrated-terminal dogfood evidence for the published v0.8.67
2055	release, covering installed binary provenance, release/publication checks,
2056	headless runtime smoke, setup QA, and remaining manual visual TUI checks.
2057	- README and README.zh-CN now point users to the community-maintained
2058	CodeWhale for VS Code GUI frontend while clarifying that this repository's
2059	`extensions/vscode/` scaffold remains the read-only Phase 0 viewer (#4035).
2060
2061	### Fixed
2062
2063	- Sub-agent waiting no longer peek→sleep polls: `agent(action="wait")` joins
2064	children, unchanged peeks are throttled (~30s) with an anti-polling nudge,
2065	and mode prompts teach the join primitive (#4097). Harvested from PR #4098
2066	by [@Mr-Moon121](https://github.com/Mr-Moon121) (Jeffrey Luna).
2067	- `/provider` picker remembers catalog/configured view and highlighted row
2068	across reopen, matching `/model` picker memory.
2069	- Mode picker roster is exactly Act / Plan / Operate (no Multitask, no
2070	numeric `4`/`5` gaps). Legacy `yolo`/`4` remain invisible one-way
2071	permission shorthand for Act + Bypass.
2072
2073	- Fleet setup is a role/profile roster editor, not a provider-scoped model
2074	picker: the Model step lists routes from every configured provider (not
2075	only the active one), a picked route's provider is persisted explicitly in
2076	the saved profile TOML (`provider = "..."`, never inferred from the model
2077	id), and the loader/route resolver read that field back out verbatim. The
2078	draft-preview ratify keypress no longer competes with a separate pager's
2079	`g`/`G` scroll bindings — the exact TOML preview now renders inline on the
2080	same Review step that ratifies it (#4093).
2081	- The headless `codewhale fleet run` CLI now launches workers on their profile-pinned route, not just records it on the receipt: `codewhale exec` gains a non-secret `--provider` flag, and a worker whose profile pins provider B is dispatched with `--provider B --model <B's model>` even when the parent session is on provider A (credentials still resolve from the worker's own environment; provider is never inferred from the model id). Workers with no profile-bound provider are unchanged — no `--provider`, run-level model. The interactive TUI spawns roster members in-process and does not yet honor the pinned provider (it uses the session provider); that remainder is tracked in #4193 (#4093).
2082	- The Fleet setup `m` model-assisted redraft no longer drops a picked
2083	cross-provider route: the provider/model the operator chose are re-pinned
2084	onto the drafted profile (a model draft is always `provider: None`), so
2085	ratifying it keeps the explicit route instead of persisting an ambiguous,
2086	provider-scoped profile (#4093).
2087	- Ratifying a Fleet profile now fails with a clear message when it pins a
2088	provider that has no configured credentials, using the same
2089	configured-provider check the model picker uses (#4093).
2090	- Workflow correctness: completion polling fails closed instead of
2091	fabricating success when a sub-agent reports no terminal status; cancel
2092	interrupts the JS VM (cancel handle + abort) and blocks further spawns;
2093	and `budget.spent()` reports real manager-scope usage instead of always 0.
2094	- Sub-agent spawns validate the model↔provider pair before dispatch:
2095	inherited/faster routes remap foreign models to the provider's catalog
2096	default, and explicit pins fail fast with a diagnostic instead of an
2097	upstream model-not-found error.
2098	- TUI stability: engine event drains break every 8–16 events / 8 ms to keep
2099	input live (#1830, #2317, #1198); the terminal input pump restarts after
2100	stall recovery on macOS/Linux too; the startup raw-mode probe no longer
2101	leaks raw mode on timeout; recovery snapshots persist every 45 s during
2102	long turns and the offline queue persists on every push (#1830);
2103	queue/steer paths surface toasts while streaming (#2317, #1338); and
2104	modal submit errors re-open the modal instead of being swallowed (#1198).
2105	- app-server hardening: `/v1/chat/completions` requires the bearer token;
2106	errors return real 4xx/5xx statuses; request bodies and SSE frames are
2107	size-limited; stdio `config get` redacts secrets and stdio shutdown reaps
2108	the runtime child; graceful shutdown on SIGTERM/Ctrl+C; constant-time
2109	token comparison; dropping the runtime bridge no longer blocks the
2110	runtime.
2111	- Policy/config/secrets: user-layer ExecPolicy rules outrank agent-layer
2112	rules; chained commands no longer propose trusted-prefix amendments;
2113	config and secrets writes are atomic (with fsync) on all platforms; empty
2114	provider chains no longer panic.
2115	- Core/state: paused jobs persist as paused across restarts; unarchive
2116	updates the in-memory cache; tool dispatch has a timeout; MCP
2117	notifications no longer receive responses; corrupted checkpoints surface
2118	errors instead of loading empty state; the session index compacts instead
2119	of growing unbounded; and recording thread-goal usage no longer
2120	self-deadlocks the state store.
2121	- Runtime compaction summaries are now persisted into `/v1` thread records so
2122	engine reloads and restarts preserve compacted context. Contributed by
2123	MXAntian (@MXAntian) (#4091).
2124	- The TUI leaves xterm alternate-scroll mode off when mouse capture is disabled,
2125	preserving native terminal text selection in light-theme/no-mouse-capture
2126	sessions. Contributed by Nightt (@nightt5879) (#4088, #4026).
2127	- The public `/api/github/feed` endpoint is now forced dynamic on Cloudflare so
2128	it returns live GitHub activity instead of a build-time empty feed.
2129
2130	### Changed
2131
2132	- Tool-hang watchdog trimmed from 15 minutes to 10 (#1862); approval modal
2133	footer hints use a higher-contrast tier (#3380); status/mode copy is
2134	disclosed once across header, footer, cards, and sidebar instead of
2135	repeated per layer.
2136	- Removed the unused `tui::whale_routes` taxonomy module and its tests.
2137	Contributed by Darrell Thomas (@DarrellThomas) (#4041, #3852).
2138
2139	### Deprecated
2140
2141	- YOLO mode: `--yolo`, `default_mode = "yolo"`, and the hotbar YOLO action
2142	now map to Act + Full Access permissions via a compatibility shim and
2143	show a one-shot deprecation notice; removal is planned for 0.9.0.
2144
2145	## [0.8.67] - 2026-07-06
2146
2147	### Added
2148
2149	- The model you select in `/model` is now the operator: fleet workers whose
2150	task spec and roster profile pin no model inherit the active session route
2151	instead of a hardcoded `auto` sentinel, matching the pinned operator row in
2152	`/fleet roster`. Task-level and profile model overrides still win, and
2153	route receipts record which source applied (`task.model`,
2154	`agent_profile.model`, or `run.model`).
2155	- Added the `/workflow` command (aliases `/workflows`, `/wf`) as the user
2156	opt-in to workflow orchestration. Bare `/workflow` orchestrates the current
2157	work — the model synthesizes the objective from the conversation context;
2158	`/workflow <objective>` narrows the run; `/workflow status [run_id]` and
2159	`/workflow cancel <run_id>` relay typed run receipts without starting new
2160	runs.
2161	- Bare `/goal` with no active goal now declares a goal from the conversation
2162	context via `create_goal` instead of printing usage; with an active goal it
2163	remains the status readout, and explicit `/goal <objective>` is unchanged.
2164	- Added the constitution-first setup wizard: a unified `/setup` shell with
2165	resume, back navigation, and skip-retry state; provider/model readiness
2166	cards with a custom-provider form and provider-picker detail layout; a
2167	runtime posture card with preset application and project-override warnings;
2168	a setup verification report; and transactional setup persistence with
2169	secret redaction and rollback (#3402, #3403, #3404, #3405, #3406, #3410,
2170	#3411).
2171	- Added a structured user-global constitution with a deterministic renderer,
2172	prompt-block injection, guided principle authoring with preview and preset
2173	save, and a `/constitution` manager command as the primary constitution
2174	management surface, with file state shown in setup and actions surfaced in
2175	diagnostics (#3793, #3806, #3811).
2176	- Added model-assisted constitution and fleet-profile drafting behind an
2177	explicit ratify gate, with untrusted-draft provenance recorded so
2178	model-authored text is never applied silently. Updating users keep their
2179	existing constitution unchanged, and a localized constitution checkpoint is
2180	required after update (#3794).
2181	- Added the Hotbar route editor v1 with route-switch slot actions and support
2182	for custom model routes, plus a configured-provider route manager for
2183	`/provider` and `/model` with a missing-auth handoff into provider key
2184	entry (#2066, #3830, #3831).
2185	- Added auto-discovery of `.codewhale/rules/` and `.claude/rules/`
2186	directories as project context, with a total byte-budget cap on the
2187	assembled rules block. Contributed by maple (@yekern).
2188	- Exposed `context_input_budget_for_route` from the engine so external
2189	integrations can reuse route budget math. Contributed by hexin
2190	(@h3c-hexin).
2191	- Added GUI config persistence to the runtime API. Contributed by @gaord.
2192	- Added a website localization matrix with a locale registry and drift
2193	checks. Harvested from #3763 by @idling11 (#3090).
2194	- Added `doctor` detection of half-applied setup state, and startup milestone
2195	tracing for boot-performance diagnosis.
2196	- Added a v0.8.67 computer-use dogfood prompt that covers the Cursor-terminal
2197	QA flow, headless gates, setup, sub-agent completion, Fleet, Workflow, model
2198	pricing, and release evidence collection.
2199	- Fleet: local worker memory usage is now reported, including retained memory
2200	while a task is in Running status. Contributed by @cyq1017 (#3901).
2201	- Website: community hub, constitution thesis page and constitution-centered
2202	homepage, models page generated from the provider registry, docs dark mode
2203	and full SEO metadata/sitemap coverage, terminal player for real
2204	constitution traces, and a live star badge and version.
2205	- Added Meituan LongCat as a first-class OpenAI-compatible provider
2206	(`longcat`, with `long-cat`, `meituan-longcat`, and `meituan` aliases),
2207	`LONGCAT_API_KEY` discovery, the `LongCat-2.0` default model, provider
2208	picker wiring, model completions, provider docs, and web provider facts.
2209	- Fleet: added per-provider setup cards (Persistence, Constitution, Hotbar,
2210	Tools/MCP, Remote Runtime) with a unified setup catalog and provider-specific
2211	credential links. Provider setup progress is persisted transactionally with
2212	rollback guards, Codex OAuth is kept out of provider key storage, and a
2213	headless QA contract verifies setup readiness across providers.
2214	- Fleet: added Fleet starter profiles with role-aware loadouts (scout→Fast,
2215	manager→Inherit, etc.), `/fleet setup` profile-authoring wizard, Fleet
2216	effective-permission recording, and route intent-source tracking.
2217	- Fleet: added 'operator' as a built-in Fleet roster member — the preferred
2218	helm Fleet slot for workflow coordination. Operator plans, routes, reviews
2219	outputs, and calls other Fleet slots as needed. This is a roster role, not a
2220	separate app mode. The full Operation/Operate-mode architecture is deferred
2221	to 0.9.0.
2222	- Workflow: declarative workflows now run through the production driver, the
2223	workflow tool is wired to sub-agent dispatch, public Workflow surfaces are
2224	renamed, and typed workflow-run and status receipts are emitted for
2225	debugging and verification.
2226	- Added provider-agnostic Fleet rosters and loadouts: provider-specific
2227	subagent limits, launch concurrency, and admission caps are derived from
2228	config without hardcoding any single provider.
2229	- Added Workflow runtime foundations: the internal JS authoring/runtime crates
2230	compile and replay example workflows. 0.8.67 ships the `/workflow` opt-in,
2231	production-driver dispatch path, sub-agent task handoff, and typed run/status
2232	receipts; richer authoring UX and the full TUI run view remain tracked for
2233	v0.8.68 (#2974, #4038).
2234
2235	### Changed
2236
2237	- Clarified the Fleet coordination hierarchy and made roles carry real
2238	doctrine: the operator (the session's `/model` selection) runs the
2239	operation and assigns managers to workflows; a manager is the middle
2240	manager of exactly one workflow. The built-in reviewer is now explicitly
2241	adversarial (assume the change is broken, try to refute it), and the review
2242	sub-agent intro adopts the same framing. Built-in `manager`/`operator`/
2243	`reviewer` roster members now ship role `instructions` that flow into worker
2244	prompts on both the Fleet task-spec and agent/workflow `profile:` spawn
2245	paths; custom profiles override them via the same `instructions` field.
2246	- Removed the decorative Fleet vocabulary that never routed differently:
2247	the `tool-heavy` slot and the `strong`/`balanced`/`deep-reasoning`/`code`/
2248	`review`/`tool-heavy` loadout tiers. `inherit` (the operator's route) and
2249	`fast` (the provider's faster class) remain; retired names in existing
2250	configs keep parsing (as custom labels) with identical auto routing, and
2251	the `/fleet setup` model-class step now offers only the real choices.
2252	- Raised the default subagent concurrency for high-throughput fanout:
2253	`max_subagents` default 20 → 64 (config ceiling 128) and the queued+running
2254	admission cap 200 → 1024. Users on metered plans who want the old behavior
2255	can set `max_subagents = 20` in config.toml.
2256	- Renamed the internal `whaleflow` subsystem to `workflow` across the
2257	workspace: the `codewhale-whaleflow`/`codewhale-whaleflow-js` crates become
2258	`codewhale-workflow`/`codewhale-workflow-js`, Rust identifiers and JS bridge
2259	symbols are renamed, the `CODEWHALE_WHALEFLOW_JS_*` environment variables
2260	become `CODEWHALE_WORKFLOW_JS_*`, and the authoring/RFC docs move to
2261	`WORKFLOW_AUTHORING.md` and `WORKFLOW_EXTERNAL_MEMORY.md`. Historical
2262	changelog and retro-ledger entries keep the old name as a record.
2263	- Documented the Homebrew rollout strategy and added a distribution-channel
2264	check to the release checklist. Harvested from #3760 by @idling11 (#3489).
2265	- Paused Linux RISC-V prebuilt release and nightly artifacts because
2266	`rquickjs-sys` 0.12.0 does not ship `riscv64gc-unknown-linux-gnu` bindings;
2267	installers, docs, and update paths now treat RISC-V as unsupported until
2268	upstream bindings or a bindgen-enabled build lands.
2269	- Made the approval prompt calm, compact, and honest, and centered the
2270	first-run follow-up on the constitution; first-run onboarding now hands off
2271	into the setup wizard, and the language picker offers every shipped locale
2272	(#3929).
2273	- Startup performance: boot janitors and store scans no longer block the
2274	first frame, `@mention` completion no longer re-walks the workspace per
2275	keystroke, and idle offline-queue clones and duplicate tool-output hashing
2276	were eliminated.
2277	- Clarified the misleading "Ctrl+B backgrounds this command" shell wording
2278	(#3859) and the hotbar help shortcuts. Docs contribution by Chanhyo Jung
2279	(@roian6).
2280	- Documented the enforced repo-law invariants, the constitution flow, and the
2281	`/fleet setup` profile-authoring wizard; aligned `permissions.toml` action
2282	docs. Docs contribution by @greyfreedom.
2283	- Bumped web dependencies: wrangler 4.103.0 → 4.107.0, mermaid 11.15.0 →
2284	11.16.0, vitest 4.1.8 → 4.1.9 (@dependabot).
2285	- Backfilled v0.8.67 regression coverage across sub-agent completion, budget
2286	exhaustion, delegate ordering, provider onboarding, setup scroll, model
2287	catalog pricing, Fleet routing, and Workflow gates (#4076).
2288	- Split the large TUI debug command group and palette/theme internals into
2289	smaller modules without changing user-visible behavior (#4078, #4081).
2290
2291	### Fixed
2292
2293	- Fixed the goal sidebar elapsed timer so completed and blocked goals freeze
2294	their "completed in {elapsed}" readout instead of ticking forever. Goal state
2295	now records a `finished_at` instant that both sidebar render paths and the
2296	engine snapshot clamp elapsed against; `/goal resume` clears the freeze and
2297	the timer ticks again.
2298	- Fixed paused goals silently un-freezing their sidebar timer: usage keeps
2299	accruing while paused, and the next goal snapshot used to clear the frozen
2300	instant. Paused goals now stay frozen until an explicit resume.
2301	- Fixed durable `/goal` progress accounting so usage and continuation updates
2302	release the shared SQLite connection before re-reading the updated goal,
2303	unblocking resumed goal loops and full workspace release tests.
2304	- Fixed a scheduled-automation race where deleting an automation while its
2305	run was being enqueued left the already-created task running untracked;
2306	the run record is now persisted unconditionally.
2307	- Removed `panic = "abort"` from the release profile: it disabled unwinding
2308	and broke the panic supervision that keeps one failing tool call from
2309	taking down the whole session. The `lto`/`strip`/`codegen-units` size and
2310	speed tuning is unchanged.
2311	- Fixed session save/load to persist and restore the active model provider
2312	across restarts. Previously sessions created under one provider (e.g.
2313	DeepSeek) would silently load under a different active provider. Provider,
2314	subagent limits, fallback chain, context window, and reasoning effort are now
2315	restored from saved session metadata, with `"deepseek"` as the default for
2316	legacy sessions.
2317	- Raised the streamed model-response idle timeout and matched the TUI stall
2318	watchdog to the configured stream budget so long reasoning pauses are not
2319	recovered as stalled turns (#2487, #3998).
2320	- Fixed Codex OAuth/sub-agent release diagnostics so `auth list` reports an
2321	active Codex OAuth file, Responses API child requests encode inherited tool
2322	names safely, rate-limited child requests checkpoint as resumable provider
2323	interruptions, and failure records surface the real Responses API error
2324	(#3884).
2325	- Fixed fresh launch/setup testing with an explicit `CODEWHALE_HOME` so
2326	config, settings, theme prefs, and doctor legacy-state diagnostics do not
2327	inherit unrelated ambient `~/.deepseek` files (#4001, #4002).
2328	- Sub-agent state now persists to `.codewhale/` instead of the lingering
2329	pre-rebrand `.deepseek/` path (#3864). Contributed by Stime (@yekern).
2330	- `/plugin enable\|disable` now persists across restarts (#3918), and the
2331	plugin command is hidden from the root slash menu and kept canonical after
2332	the scanner merge. Contributed by Nightt (@nightt5879).
2333	- `/config ask-rules` now shows ask rule actions with improved diagnostics,
2334	with file-rule action precedence under test. Contributed by @greyfreedom.
2335	- Fleet/sub-agents: enforced an absolute recursion-depth ceiling and widened
2336	task-id entropy, gave each atomic state write a unique temp path, kept
2337	sub-agent tool catalogs in parent parity (#3836), and made the Agents
2338	sidebar reconcile sub-agent completion and cancellation live (#3837).
2339	- Fixed apply_patch mangling newlines, defaulted fuzz to 3, and made writes
2340	atomic; fixed compaction to preserve pins on emergency compaction, harden
2341	the summary fallback, and count image tokens; corrected backtrack boundary,
2342	checkpoint clear ordering, prune guard, and durable rename.
2343	- Fixed the SSE client to flush the final frame, join multi-line data fields,
2344	and stop corrupting multibyte UTF-8 split across network reads.
2345	- Kept review-only turns read-only, aliased `auto` mode to the agent policy,
2346	showed the mode-derived safety policy in status (contributed by @cyq1017),
2347	and stopped the durable-review floor from holding routine YOLO work
2348	(#3883).
2349	- Fixed self-update to prefer exact binary release assets. Contributed by
2350	@LI-Jialu.
2351	- UI polish: stopped constitution and fleet-profile model drafts from
2352	freezing the event loop, scoped the context-menu backdrop to the popup
2353	rect, stacked model-picker panes on narrow modals, unified display-width
2354	helpers on one contract (#3924), removed misleading success toasts,
2355	issue-number leaks, and dead-end empty states, and repaired the onboarding
2356	trust and api-key keys.
2357	- Fixed the onboarding Trust step so plain Enter no longer silently grants
2358	workspace trust; users must choose the explicit trust or exit keys.
2359	- Fixed same-root skill-name collisions being silently shadowed; duplicate
2360	normalized skill names now warn while keeping discovery deterministic
2361	(#3919).
2362	- Normalized discovered skill names, removed unenforced trust copy, and
2363	surfaced the gated constitution override in prompts.
2364	- Fixed a parallel `subagent::` suite flake where one test's process-wide
2365	`Retry-After` pause could strand unrelated budget-capped workers for the
2366	full stale window; requests now re-poll the global pause in bounded slices
2367	and the rate-limit test clears the window on drop.
2368	- Sub-agent and Fleet reliability now fail empty, step-limited, and
2369	budget-exhausted children with explicit diagnostics instead of silent
2370	`Completed (no output)` success; budget exhaustion preserves partial output,
2371	`worktree: true` discovers one-level nested repos from harness directories,
2372	and completion-before-start delegate events recover into named rows instead
2373	of ellipsis-only identities (#4050, #4051, #4052, #4053).
2374	- Goal-mode writing and research tasks can complete with
2375	`verification.status = "not_applicable"` without triggering continuation
2376	loops (#4054).
2377	- First-run onboarding routes API keys through the selected provider, setup
2378	wizard bodies scroll with PageUp/PageDown, shipped locale packs are back to
2379	`en.json` parity with zh-Hant explicitly partial, stable feature flags stay
2380	out of Experimental, and model/provider rows include current LongCat and
2381	sourced-pricing hints (#4056, #4057, #4058, #4062, #4063).
2382	- Running tool rows animate while a lone foreground tool is active, and
2383	workflow receipts render run/status/failure cards instead of one-line or
2384	null-success output (#4059).
2385	- Model-facing turn metadata now includes a compact git workspace snapshot and
2386	escalates context pressure at the same thresholds as the TUI, helping agents
2387	narrow scope or compact before truncation (#4071, #4073).
2388	- Successful child sub-agent completions inline the child's `EVIDENCE` block
2389	before the completion sentinel, so parents can cite child findings without
2390	re-running tools (#4072).
2391	- Deferred tools hydrate and execute in the same batch when the original
2392	arguments are valid, and `[tools].always_load` now keeps configured MCP tools
2393	active instead of forcing the first-call retry. Thanks @SparkofSpike for the
2394	hot-path MCP report (#4074, #4027).
2395	- New commit-range co-author checks reject bot/tool trailers on newly pushed
2396	commits; historical release-range cleanup remains a separate maintenance
2397	concern (#4075).
2398	- Fixed fuzzy `edit_file` matching so matches that begin with multibyte UTF-8
2399	characters, including CJK text, advance on character boundaries instead of
2400	panicking. Contributed by Nightt (@nightt5879), reported by Taixin Guo
2401	(@taixinguo) (#3971, #4045).
2402	- Fixed Unix dispatcher/TUI output under early-closing pipes such as
2403	`codewhale doctor \| head` by restoring the default `SIGPIPE` handler before
2404	printing and propagating signal exits quietly. Contributed by @aznikline,
2405	reported by @BrathonBai (#4030, #4043).
2406	- Suppressed dead_code warnings in the unused plugin registry module and
2407	fixed formatting across the command-group files. Contributed by Paulo Aboim
2408	Pinto (@aboimpinto).
2409	- Pointed the website Community nav link at the community hub.
2410
2411	### Security
2412
2413	- MCP client hardening: closed an SSE-endpoint SSRF, bounded the HTTP
2414	response body via Content-Length instead of a streaming read, bounded stdio
2415	line reads to prevent OOM denial of service, fixed a dead timeout, and
2416	removed an unbounded buffer.
2417	- Made execpolicy deny/trust rules segment-aware, closing a command-chaining
2418	bypass.
2419	- Closed repo-law and safety-floor bypasses found by adversarial review:
2420	protected invariants are now enforced as mechanism, the destroyer gap in
2421	the safety floor is closed, a catalog-present tool with no execution path
2422	now fails closed, `web_run` open/click is classified as destructive, and
2423	the allow-list gained wildcard and case handling.
2424	- Refused symlinked rules directories to prevent workspace escape via
2425	discovered rules. Contributed by maple (@yekern).
2426	- Bounded Fleet sub-agent worker output so fanout cannot exhaust TUI memory
2427	(#3882), and preserved event headroom for progress. Contributed in part by
2428	@cyq1017.
2429	- Added an untrusted constitution-draft gate with authoring provenance so
2430	model-drafted constitutions require explicit human ratification.
2431
2432	### Removed
2433
2434	- Removed unused model-registry helpers. Harvested from #3872 by @cyq1017.
2435	- Removed unused request-tuning metadata. Harvested from #3871 by @cyq1017.
2436	- Removed dead fleet task helpers (#3894 by @cyq1017), the unused
2437	approval-cache container (#3845) and localization QA metadata (both by
2438	@nightt5879), the dormant tab collaboration subsystem (#3838), the legacy
2439	flash auto-router (#3839), the stale project_doc loader (#3840), ignored
2440	mock LLM placeholders (#3841), dead model-catalog helpers (#3842), the
2441	unused execpolicy amend module, and dead MCP/client retry helpers.
2442	- Retired the deprecated `WHALE.md` context fallback (#3798).
2443
2444	## [0.8.66] - 2026-06-29
2445
2446	### Added
2447
2448	- Added `codewhale doctor` / `codewhale doctor --json` legacy-state
2449	diagnostics that compare known `~/.deepseek` state paths with their
2450	`~/.codewhale` counterparts and flag unmigrated or dual-root data (#3727).
2451	- Added Sakana AI Fugu as a first-class OpenAI-compatible provider with
2452	`sakana`/`fugu` aliases, `FUGU_API_KEY` / `SAKANA_API_KEY` discovery,
2453	provider-picker wiring, model completions, and provider docs. Harvested from
2454	#3748 by @lerugray.
2455	- Added WhaleFlow-to-Fleet launch-shape validation: the default Fleet workflow
2456	contract allows up to 100 total agents and 5 recursive rings, requires
2457	bounded loops/expands before launch, and preserves per-slot model selection.
2458	- Added a read-only `/config ask-rules` view for the resolved
2459	`permissions.toml` path, file status, rule count, and configured
2460	tool/command/path ask rules. Merged from #3569 by @greyfreedom.
2461	- Added provider-level `context_window` overrides so OpenAI-compatible
2462	gateways and self-hosted providers can budget against their real model
2463	context window (#3545).
2464	- Added the native `codew` shim to release archives, Windows installer inputs,
2465	local release-asset preparation, and checksum verification so manual installs
2466	receive the same short command that Cargo installs build.
2467	- Added OpenModel as a first-class Anthropic Messages provider, with config,
2468	CLI, provider picker, docs, and registry coverage. Harvested from #3585 by
2469	@noaft.
2470	- Added WeCom Bridge deployment and security documentation, with shipped
2471	runtime/bridge commands and approval-timeout environment guidance. Harvested
2472	from #3640 by @pkeging.
2473	- Added a token/cache/cost `scorecard` command for offline release gating,
2474	baseline regression checks, and per-turn cost visibility (#3388). Stream-JSON
2475	exec metadata now also reports conservative `input_analysis` and
2476	`visible_final_answer_chars`, so benchmark harnesses can measure transcript
2477	growth and final-answer bloat without guessing (#2956, #2957).
2478	- Added a release evidence ledger for v0.8.66 and opened the external ACP
2479	registry submission for CodeWhale after validating the published
2480	`codewhale@0.8.65` ACP auth handshake against the upstream registry checker
2481	(#3192).
2482	- Added a typed `[verifier]` config table for the verifier-preview lane, with
2483	`enabled` and the shipped `verdict_policy = "hunt"` mapping documented and
2484	validated (#2093).
2485	- Added Hotbar `Alt+1`–`Alt+8` quick-slot switching with decision-card key
2486	disambiguation, plus an introductory card that explains and can dismiss the
2487	Hotbar (#3796, #3788).
2488	- Release/docs hygiene: guarded public install/version snippets and the npm
2489	`codewhaleBinaryVersion` pointer against drift, made `check-docs`/`check-facts`
2490	fail on stale snippets or unmapped providers, and stopped `sync-changelog`
2491	from dropping a release when only `[Unreleased]` exists (#3767, #3768, #3769,
2492	#3770, #3771, #3772).
2493
2494	### Changed
2495
2496	- Deferred Auto mode from the user-facing mode picker, cycle, hotbar, `/mode`
2497	command, and runtime-thread mode overrides until it has a distinct prompt and
2498	auto-review behavior; existing `auto` mode text now folds back to Agent
2499	instead of selecting a hollow mode, and approval modal copy no longer implies
2500	the current mode is YOLO (#3730, #3733).
2501	- Clarified the Fleet setup surface and docs so Fleet is treated as the durable
2502	sub-agent configuration layer while WhaleFlow is the agent-authored
2503	orchestration plan that selects and monitors Fleet slots.
2504	- Slimmed the default Constitution prompt while keeping its required structural
2505	anchors under regression coverage, reducing the static prompt footprint for
2506	cache-sensitive turns (#2953).
2507	- Made the approval prompt inline and bottom-anchored instead of a full-screen
2508	takeover, so context and controls stay visible while a tool awaits a decision
2509	(#3799).
2510	- The Hotbar is now hidden by default until explicit setup opt-in (#3807); the
2511	interactive Agent shell also defaults to approval-gated on with a shared
2512	baseline (#3756).
2513	- Mode authority now resolves approval prompts through a single authority
2514	source instead of per-surface checks (#3795).
2515
2516	### Fixed
2517
2518	- Surfaced legacy state relocation with a user-visible migration notice whenever
2519	`~/.deepseek/<state>` is moved or copied into `~/.codewhale/<state>`, so
2520	upgraded users know their data was preserved and where the canonical state
2521	now lives (#3726).
2522	- Restored legacy `.deepseek/sessions` visibility for upgraded installs where
2523	an empty `~/.codewhale/sessions` directory already existed, by copying
2524	missing legacy session entries into the primary CodeWhale session store
2525	without overwriting newer data (#3724).
2526	- Calmed approval risk classification for read-only shell commands such as
2527	`codewhale --version`, `codewhale --help`, and `git status --porcelain` so
2528	the modal no longer labels proven read-only shell as destructive (#3730).
2529	- Added provider/model route columns to `/cache` turn telemetry so DeepSeek
2530	cache-hit regressions can be correlated with Auto route changes (#3738).
2531	- Fixed runtime API approval handling so workspace trust no longer auto-resolves
2532	ordinary tool approvals; trust now only participates in full-access retry
2533	decisions while YOLO/auto-approve remains the approval bypass (#3736).
2534	- Fixed modal surfaces so the shared view stack paints an opaque backdrop before
2535	any overlay, while Plan/request-input popup interiors stay opaque and the Plan
2536	confirmation footer keeps action choices visible on narrow terminals (#3732).
2537	- Added a turn-loop Plan-mode guard for file-writing tools and write-capable MCP
2538	tools so Plan's "no writes" promise is enforced before approval or execution,
2539	not only by the sandbox/catalog layer (#3734).
2540	- Preserved the durable review safety floor for publish-like shell actions in
2541	YOLO mode, so `cargo publish`, `npm publish`, and tag/release pushes force
2542	approval instead of silently auto-approving (#3735).
2543	- Fixed Ctrl+O external-editor freezes where CodeWhale's terminal input pump
2544	could keep reading keys while Vim/editor owned the terminal, especially in
2545	Windows mintty/cygwin shells. Thanks @buko for the precise repro (#3657).
2546	- Hardened the OHOS dependency drift check against transient Cargo registry EOFs
2547	by retrying the dependency graph probe before failing CI.
2548	- Updated the `/links` provider fallback to the current CodeWhale docs URL and
2549	added a Baidu Qianfan docs link. Harvested from #3621 by @noaft.
2550	- Hardened `CODEWHALE_TOOL_SURFACE=shell-only` for benchmark/exec runs: the
2551	shell-only surface hides native tools from the model-visible catalog, and
2552	unknown `CODEWHALE_TOOL_SURFACE` values now warn instead of silently falling
2553	back to the full tool surface (#2954).
2554	- Sub-agent fanout and lock hot paths: preserved event-channel headroom for
2555	progress events (#3783, thanks @cyq1017), let independent sub-agent starts
2556	join a single parallel dispatch batch instead of serializing (#3801), rendered
2557	the sub-agent sidebar/ListSubAgents from a read-only snapshot with bounded
2558	cleanup (#3803), used nonblocking best-effort sends for ListSubAgents refresh
2559	while still awaiting critical events (#3802), moved sub-agent state
2560	persistence disk I/O off the manager write lock (#3805), and used `try_lock`
2561	for shell-manager refresh in async UI paths (#3804).
2562	- Provenance: runtime continuations and `SubAgentHandoff` now inherit standing
2563	YOLO authority, while `MemoryRecall`, `ImportedTranscript`, and
2564	`AssistantGenerated` inputs remain guarded (#3817).
2565	- Approval honesty: labeled session-scoped approvals accurately instead of
2566	"always", and surfaced approval decisions in tool results (#3766).
2567
2568	## [0.8.65] - 2026-06-24
2569
2570	### Added
2571
2572	- Provider/model/route resolution (EPIC #2608). Canonical provider, model,
2573	offering, and route types with a single `RouteResolver` that produces a
2574	resolved `ReadyRouteCandidate` (endpoint, wire protocol, model id, context
2575	limit, price) for every switch (#3458, #3084, #3384). The executing client is
2576	now constructed from the resolved candidate rather than re-derived from config
2577	(#3384). A committed, network-free Models.dev-shaped catalog gives models real
2578	context windows and pricing, with a secret-free live cache (#3497, #3498,
2579	#3385). Offering pricing with provenance is projected onto candidates (#3501,
2580	#3085), and route limits feed a route-aware context-budget service (#3508,
2581	#3523, #3086).
2582	- Fleet execution substrate (EPIC #3154). Fleet profile types and config
2583	(#3469), durable manager resume, workspace agent-profile loading resolved into
2584	the worker runtime (#3367), loadout intent carried in task specs (#3512), and
2585	receipts that persist the resolved route for inspection (#3154, #3166). Worker
2586	status is folded into the unified `/fleet` surface and exposed through the
2587	Runtime API.
2588	- Provider surfaces. A `/provider` readiness dashboard with reasoning
2589	readiness, an experimental/supported maturity marker, and an "open models for
2590	this provider" action (#3083, #2984, #3485); cross-provider `/model` search
2591	with scroll and provider type-ahead (#3484, #3075); inline `<think>`
2592	reasoning-stream routing with per-provider overrides (#3222); usage telemetry
2593	normalized into canonical token classes including Responses cache-miss and
2594	reasoning tokens (#2961, #3509); and remote MCP OAuth login with bearer/header
2595	auth precedence (#3527).
2596	- More providers and routes. User-defined OpenAI-compatible custom providers
2597	via `[providers.<name>]` (#1519); a DeepSeek Anthropic-compatible route (#2963,
2598	#3449); a Qianfan route (#3425); Zhipu folded into Z.ai with equal-treatment
2599	model normalization (#3539); DashScope/Together fixtures.
2600	- Localized mode picker and composer indicators. The `/mode` picker prompt,
2601	mode names, and hints, plus the composer's Vim mode indicator, now render in
2602	all seven shipped locales (model-facing mode labels stay English). Harvested
2603	from #2239 by @gordonlu.
2604	- Website and automation. A runtime/integrations page, provenance and
2605	mirror-trust copy, a fact-drift CI gate, a published install script, and a
2606	weekly community digest archive on codewhale.net (#3419, #3421, #3415, #3482,
2607	#3420); per-automation mode/shell/trust/approval settings (#3467).
2608	- Model reference browser. A read-only `/modeldb` command (aliases
2609	`model-reference`, `modelref`) opens a pager over the bundled catalog — every
2610	model's factual context window, max output, modality, and price, grouped by
2611	provider/kind. Labels only: it never selects, routes, or tiers a model
2612	(#3205, #2300).
2613	- Transcript presets. A `/config preset <name> [--save]` mechanism with a
2614	first `calm` preset — calm mode, calm tool collapse, comfortable spacing, and
2615	low motion — presentation-only and evidence-preserving (#3478).
2616	- Model capability profiles. A typed `model_profile` module separates
2617	intrinsic model facts from resolved provider-route capability, so compact
2618	routes defer heavier nonessential tools while standard/full routes keep the
2619	eager tool surface (#3451, #3365).
2620	- Live provider catalog refresh. A secret-free `/models` live-fetch layer
2621	(401/403/404/429 mapped to typed outcomes) feeds the catalog cache; the API
2622	key authorizes the request but is never persisted into the delta or cache
2623	(#3385).
2624
2625	### Changed
2626
2627	- Config modularization (#3311). `ProviderKind` (#3505), harness posture
2628	(#3507), and provider default seeds (#3503) moved into dedicated modules, and
2629	the `config.rs` monolith split into clean leaf modules (paths, search,
2630	model/base-URL constants, sub-agent limits) behind a `pub use` facade.
2631	`AppMode` helpers were centralized (#3510), and mode-vs-permission policy is
2632	now derived through a single `base_policy_for_mode` resolver instead of
2633	scattered mutation (#3386, advisory review-intent behavior preserved).
2634	- Leaner tool surface. Dropped `task_shell_*` from the active set and folded
2635	`tool_search_*` (#3463); ablated the in-turn loop_guard and encoded reasoning
2636	dispositions (#3462); added the Orchestration disposition to the constitution.
2637	- Routing. Provider/model switches and the capability-aware fallback chain
2638	resolve through `RouteResolver`; reasoning effort is normalized for the
2639	resolved provider; the fallback chain now skips providers that lack auth
2640	(#2574); and context window and memory-pressure come from the resolved route
2641	(#3086).
2642	- UX. Approval modal gained a group divider and selected-row caret (#3515);
2643	picker scroll/type-ahead and selection contrast hardened (#3500); the README
2644	was rewritten as an architecture end-cap (#3087); and repo agent guidance was
2645	de-hardcoded to live truth.
2646	- Fleet identity and defaults. Fleet workers now enter with an explicit
2647	"summoned Fleet member" operating contract, setup/profile prompts keep the
2648	default model behavior as same-route inheritance, and generated worker
2649	instructions avoid leaking recursive topology that only the orchestrator
2650	needs.
2651	- Legacy swarm cleanup. Removed the obsolete `/swarm` core command/menu
2652	registration so `/fleet` is the product surface, while `/subagents` remains a
2653	compatibility shortcut to worker status.
2654	- Running-state animation. Tool cards and background-task rows now share one
2655	faster braille spinner cadence, so Bash/background work reads consistently
2656	alive across the transcript and sidebar.
2657	- Restored contributor credit. Threaded machine-readable credit
2658	(`docs/CONTRIBUTORS.md` + `.github/AUTHOR_MAP`) for earlier merged work that
2659	shipped without it, including the `/jobs cancel-all` action and the npm
2660	retry-timeout hint (#1538) by @jieshu666, and the community ACP adapter
2661	reference by @rockeverm3m.
2662
2663	### Fixed
2664
2665	- Release hygiene. The strict `cargo clippy --workspace --all-targets --locked
2666	-- -D warnings` gate passes; `npm run build` no longer dirties the generated
2667	web facts; the site sets `metadataBase`; the community digest page parses each
2668	record independently and localizes its chrome; and `cargo audit` is clean with
2669	the starlark-transitive unmaintained advisories documented.
2670	- Routing and mode correctness. Ordinary prompt text is no longer
2671	interpreted as a mode switch (#3387, #3491); model candidates are scoped to the
2672	active provider; Together-owned DeepSeek routes are accepted (#3426); insecure
2673	`http://` custom endpoints raise an advisory warning (#1519); and the Fleet
2674	setup planner's role/model selection now drives the generated profile.
2675	- Runtime stability. MCP connection drops are explicit (#3524), HTTP API
2676	calls reuse a shared MCP pool (#3532), and per-agent sub-agent mailbox
2677	telemetry is throttled to cut UI lag (#3454).
2678	- YOLO background-shell approvals. A background shell command no longer pops
2679	an approval modal in YOLO mode. `classify_risk` marks all shell commands
2680	destructive, so the auto-review safety floor held every background shell for
2681	review, and the `ForcePrompt` site never checked `auto_approve` — only
2682	background commands surfaced it, since foreground shells take the
2683	`Interactive` origin and skip that branch.
2684	- Bash approval modal fit. The shell approval modal now labels Bash
2685	commands directly, avoids repeating command/workdir in the impact summary,
2686	wraps long commands, and switches to compact controls on short terminals so
2687	the decision keys stay visible.
2688	- Custom-provider picker rows. Concrete `[providers.<name>]` entries now
2689	appear in the provider picker (id, endpoint, auth readiness, wire protocol,
2690	current model) instead of only the generic placeholder; auth readiness honors
2691	per-entry key/env/metadata/no-auth/loopback.
2692	- Passive MCP tool discovery. Runtime API-owned stdio MCP processes are no
2693	longer spawned from passive `/v1/apps/mcp/tools` requests; live discovery
2694	remains available through `?connect=true`. `doctor` now warns on relative-path
2695	stdio MCP commands without `cwd`.
2696
2697	## [0.8.64] - 2026-06-22
2698
2699	### Added
2700
2701	- Seamless auto-compaction defaults. Known large-context routes now keep
2702	automatic compaction on by default while carrying summaries forward through
2703	the stable prompt path, reducing surprise context loss without changing
2704	explicit opt-out behavior.
2705	- Runtime web automation readiness. Local app automation gains a
2706	loopback-only dev-server readiness primitive so agents can wait for TCP and
2707	optional HTTP health checks before browser verification. Harvested from
2708	#3376 by @cyq1017.
2709	- Model and integration polish. `/model pro` and `/model flash` shortcuts
2710	now resolve to the current DeepSeek V4 routes while preserving existing model
2711	IDs. Harvested from #3350 by @KUK4. The WeCom bridge landed with
2712	maintainer follow-up hardening for state permissions and chat-facing error
2713	reporting, from #3370 by @pkeging.
2714
2715	### Fixed
2716
2717	- Security and trust-boundary hardening. Project-local config can no longer
2718	loosen user-owned shell or instruction-file policy, file edits now require a
2719	fresh read of the target file, git history inputs reject option-shaped or
2720	control-character revisions, interactive execution surfaces require approval,
2721	and local tool paths are narrowed through workspace/root validation.
2722	- Runtime and diagnostics redaction. Generated runtime/app-server tokens,
2723	raw session lineage identifiers, provider registry drift values, review
2724	receipt internals, and webhook URLs are no longer echoed into human-facing
2725	logs or diagnostics.
2726	- Network and alert safety. Provider TLS verification bypass requests now
2727	fail closed, fleet alert webhooks require HTTPS, fetch URL hostnames are
2728	resolved before requests, and runtime mobile auth no longer relies on
2729	token-bearing URLs.
2730	- Path-state hardening. Config sibling files, project MCP cwd values,
2731	runtime thread store files, sub-agent state, project-local state roots, and
2732	app-server sidecar config paths now resolve through checked roots before
2733	reads/writes.
2734	- Release CI repair. Nightly cross-target builds install Rust targets
2735	explicitly and retry transient cargo failures; auto-tag runs are serialized
2736	and treat an already-created remote tag as a no-op. Safe slices harvested
2737	from #3374 by @donglovejava.
2738	- Provider wait and sidebar regressions. Provider-wait footers suppress
2739	noisy countdowns until useful while keeping timeout warnings visible,
2740	harvested from #3375 by @idling11. The pinned sidebar can render at a
2741	narrower 64-column boundary, harvested from #3371 by @donglovejava.
2742	- Delegated server cleanup. Delegated `serve` / `app-server` children gain
2743	OS-level parent-death cleanup on supported platforms, completing the #3259
2744	follow-up from #3378 and #3317 by @wuisabel-gif.
2745	- ACP and sandbox correctness. ACP sessions preserve multi-turn
2746	conversation history across prompt turns, harvested from #3372 by @xulongzhe.
2747	Worktree Git metadata writes are allowed through sandbox policy without
2748	broad trust-mode escalation, from #3356 by @cyq1017 and the #3355 report by
2749	@linletian.
2750
2751	### Changed
2752
2753	- Community and dependency harvests. The release train carries focused
2754	community-credit slices from #3379 by @greyfreedom, #3348 by @nightt5879,
2755	#3346 by @hongqitai, #3345/#3333 by @cyq1017, and Dependabot updates for
2756	`windows`, `toml`, `tokio`, `lru`, `similar`, and web tooling security locks.
2757	- Public release surface cleanup. Benchmark-specific materials were kept
2758	out of the public release repo; benchmark source fragments belong in the
2759	separate `codewhale-bench` lane.
2760
2761	## [0.8.63] - 2026-06-19
2762
2763	### Added
2764
2765	- Sub-agent fanout safeguards (#3318, #3319). High-fanout Workflow runs can
2766	now queue and drain more agents than the instantaneous concurrency cap by
2767	default, with `[subagents] max_admitted` available to tune that bounded
2768	admission population. Distinct `agent` calls are no longer capped by the
2769	per-turn loop guard before runtime launch concurrency and provider
2770	rate-limit backoff can apply. `[subagents] token_budget` applies a shared
2771	aggregate token ceiling to a root `agent` run and its descendants.
2772	- Per-worker sub-agent token enforcement (#3321). A `token_budget` /
2773	`max_tokens` set on an individual `agent` call now bounds that single worker
2774	mid-run: once its accumulated model tokens exceed the cap it stops cleanly
2775	with a `budget_exhausted` status instead of running to `max_steps`. This
2776	complements the scope-level admission gate (#3319) — the per-worker cap stops
2777	one runaway worker, the scope cap bounds total fan-out — without
2778	double-counting. Harvested from #3321 by @donglovejava.
2779	- Provider-specific sub-agent fanout config. `[subagents.providers.<provider>]`
2780	profiles now override `enabled`, `max_concurrent`, `max_admitted`,
2781	`launch_concurrency`, `max_depth`, token budget, API timeout, and heartbeat
2782	timeout for the active provider. Use broad direct-API profiles such as
2783	`[subagents.providers.deepseek]` and tighter subscription profiles such as
2784	`[subagents.providers.glm]`; `/config subagents status` shows both global
2785	and active-provider resolved values.
2786	- Sub-agent control and isolation. The single `agent` tool now exposes
2787	status, peek, and cancel actions for running children, and accepts
2788	`worktree: true` to create an isolated git worktree/branch for parallel edit
2789	lanes instead of requiring callers to hand-roll a `cwd`.
2790
2791	### Fixed
2792
2793	- Mode and tool catalog correctness. Core action tools remain discoverable
2794	in the model-facing catalog/tool search, and a consistency self-check flags
2795	registered handlers that drift out of the advertised catalog. Review-looking
2796	prompts in explicit Agent/YOLO mode now keep the requested mode and tools,
2797	with only an advisory review hint.
2798	- Sub-agent orchestration recovery. Child agents now retry transient
2799	provider header/SSE timeouts before failing, and parent runs synthesize missed
2800	child completions from terminal child state so orchestration cannot hang on a
2801	lost completion event.
2802	- DeepSeek thinking tool calls. DeepSeek chat-completions requests now omit
2803	explicit `tool_choice` whenever reasoning/thinking is enabled, avoiding
2804	provider rejections while leaving no-thinking routes unchanged.
2805	- Task sidebar shortcuts and attribution. Ctrl-K stays palette/emacs-kill,
2806	while Ctrl-X is scoped to Tasks-sidebar background shell cancellation. Shell
2807	jobs launched by sub-agents now render with their child-agent owner in the
2808	Tasks sidebar and transcript.
2809	- Long-turn recovery and context economy. Repeated read-only search
2810	loop blocks now return guidance instead of fatal tool failures, Python build
2811	failures that are missing `setuptools` include an install/retry hint, long
2812	foreground shell timeouts steer models toward background execution, and noisy
2813	shell/test/web outputs are compacted earlier for large-context routes.
2814	- Config display redaction. `codew config get/list` now recursively masks
2815	token-, secret-, password-, credential-, and authorization-like keys inside
2816	unknown `extras` tables and redacts sensitive HTTP header values before
2817	printing config output.
2818	- Queued follow-up hints and force-steer keys. The pending-input preview now
2819	advertises `Ctrl+S send now` whenever queued follow-ups exist, and
2820	Ctrl/Cmd+Enter force-steering also accepts the common Ctrl+J terminal
2821	encoding while a turn is running.
2822	- Sidebar default visibility restored (#3328). New and upgraded sessions
2823	now use a pinned composed sidebar by default when the terminal is wide
2824	enough, so live Agents and Tasks surface without opting back into idle
2825	auto-collapse. Older settings files that captured the v0.8.62 auto-collapse
2826	default now migrate to `pinned` unless `/sidebar auto --save` records an
2827	explicit opt-in. `/sidebar` now reports when width or auto-collapse
2828	suppresses rendering instead of saying the sidebar is visible. Reported by
2829	@dxfq.
2830	- JavaScript execution proxy env handling (#3273, #3331). `js_execution`
2831	now enables Node's environment-proxy mode when proxy variables are present,
2832	mirrors lowercase proxy variables for the child process, and backfills
2833	`HTTP_PROXY` / `HTTPS_PROXY` from `ALL_PROXY`. Reported by @lordwedggie and
2834	harvested from #3331 by @cyq1017.
2835	- Legacy app-server non-loopback auth hardening (#3258). Bare
2836	`codewhale app-server --host 0.0.0.0` now fails fast unless an explicit
2837	`--auth-token` or `CODEWHALE_APP_SERVER_TOKEN` is supplied, keeping generated
2838	one-time `cwapp_*` tokens loopback-only.
2839	- Legacy `.deepseek` state write-path migration (#3240). State subdirectories
2840	(`sessions`, `slop_ledger`, `trophies`, `catalog`) are now always written under
2841	`~/.codewhale/`, and the first write of a subdir relocates any pre-existing
2842	`~/.deepseek/<sub>` contents into the primary location so the legacy tree stops
2843	growing while old data is preserved. The read resolver still finds legacy data
2844	for backfill until each subdir migrates. Reported by @Final527; onboarding
2845	marker slice from #3302 by @nightt5879.
2846	- State subdir validation on Windows (#3240). State path hardening now
2847	rejects rooted/prefixed subdir strings such as `/etc` before resolving or
2848	migrating state directories, keeping the `.codewhale` write resolver inside
2849	its state root across platforms.
2850
2851	## [0.8.62] - 2026-06-17
2852
2853	### Changed
2854
2855	- GLM-5.2 is now the default direct Z.AI model. `DEFAULT_ZAI_MODEL` resolves
2856	to `GLM-5.2` in both `codewhale-tui` and `codewhale-config`; the `glm-5.1`
2857	alias still resolves to `GLM-5.1` (the defaulting was decoupled from the alias
2858	arm so it no longer tracks the default). Docs and `config.example.toml` no
2859	longer describe GLM-5.2 as an opt-in preview.
2860	- GLM-5-Turbo registered as a real model and wired as the faster/explore
2861	sub-agent sibling for the GLM family: a `GLM-5.2` parent routes
2862	faster/explore children to `GLM-5-Turbo` (direct Z.ai) and `z-ai/glm-5-turbo`
2863	(OpenRouter), instead of down to GLM-5.1. GLM-5.1 and GLM-5-Turbo themselves
2864	have no cheaper tier and keep children on the parent.
2865	- `type: "explore"` sub-agents default to `model_strength: "faster"`. Bounded
2866	read-only lookup/search/status work now uses the cheaper same-family sibling
2867	automatically, unless an explicit `model` or `model_strength: "same"` is
2868	supplied. Non-explore roles keep the conservative `same` default.
2869	- GPT-5.5 / OpenAI Codex faster route stays on GPT-5.5 with reasoning
2870	resolved to `low` (the Codex Responses API has no true `off`, so the resolved
2871	effort is now honest `low` rather than `off` silently rewritten). No
2872	DeepSeek/GLM fallback is fabricated when no cheaper same-provider sibling
2873	exists. DeepSeek Pro→Flash routing and its no-thinking faster lane are
2874	unchanged.
2875	- Base prompt / delegate skill guidance updated to encourage parallel
2876	read-only exploration (2-4 `type: "explore"` sub-agents) for broad repo,
2877	version, branch, release, and API-surface investigations, while keeping
2878	architecture, integration, and final verification in the parent. The
2879	delegate skill examples now use provider-neutral `model_strength` instead of
2880	hardcoded DeepSeek model ids.
2881	- Agent synthesis guardrails. The base constitution now frames tools around
2882	sufficient evidence rather than open-ended persistence: extra reads, searches,
2883	and delegation must target a missing fact, and agents should answer with
2884	limits instead of broadening searches indefinitely. The runtime loop guard
2885	now blocks duplicate read-only/delegated calls earlier and caps repeated
2886	broad lookup/delegation loops in a single turn with a synthesis-forcing tool
2887	error. Guard metadata distinguishes exact duplicates
2888	(`identical_tool_call`) from no-progress loops (`no_progress_tool_loop`).
2889	- Sub-agent handoff and visibility. Direct sub-agent completions are drained
2890	before the next parent model request, so finished children can wake the main
2891	model promptly instead of waiting for an empty-tool-use branch or idle engine
2892	path. Nested sub-agents now report completions to their immediate parent
2893	inbox; the main model still receives only direct-child completions, avoiding
2894	grandchild floods while preserving nested evidence flow. Sub-agent output
2895	guidance now requires child-agent provenance when a sub-agent relies on a
2896	child report: cite the child `agent_id` and the child's EVIDENCE line(s), and
2897	do not present child findings as directly verified facts. The sidebar orders
2898	sub-agents as a parent/child tree and annotates nested rows with parent and
2899	depth information in hover text.
2900	- Sub-agent summary provenance (#2652). A sub-agent's free-text result is now
2901	explicitly treated as an unverified self-report rather than confirmed
2902	evidence. The completion sentinel carries `summary_kind: complete \| truncated`
2903	so the parent model can branch on whether it saw the full report or a clipped
2904	excerpt. Short summaries (≤ 12,000 chars) get a soft "re-verify material
2905	claims" suffix; longer ones are head+tail truncated with an honest marker
2906	stating the elided middle is not retrievable via `retrieve_tool_result`.
2907	Every summary therefore carries exactly one boundary marker, never both.
2908	- Provider metadata centralization. Provider env vars, config keys, aliases,
2909	and auth hints are now resolved through the shared `ProviderMetadata` registry
2910	across `codewhale-config`, `codewhale-tui`, and `codewhale-cli`, reducing drift
2911	between the provider picker, `codewhale auth`, `doctor --json`, and setup
2912	hints.
2913
2914	### Added
2915
2916	- Agent clarification questions (#3102). Agents now have a first-class
2917	`request_user_input` tool to ask the user structured clarifying questions
2918	through a modal UI surface instead of only emitting a chat message and hoping
2919	the user notices. Mirrors the approval/secret-request flow the harness
2920	already used for permissions. The tool accepts 1-3 questions, each with a
2921	header, an id, 2-4 selectable options (label + description), and
2922	`allow_free_text` / `multi_select` flags (both default to `false` for
2923	back-compat). Input is validated up front with actionable errors. Wired
2924	across all layers: the `request_user_input` tool, engine handling
2925	(`turn_loop` → `approval`), an interactive TUI modal (`UserInputView`) with
2926	full keyboard navigation, and the runtime protocol
2927	(`EventFrame::UserInputRequest` + `AppRequest::SubmitUserInput`) so headless
2928	/ app-server clients can answer programmatically. Parity tests cover the
2929	wire round-trip and the omitted-flags default.
2930	- Transcript hyperlinks — out-of-band OSC 8 (#3029). Clickable file /
2931	file:line / URL links now reach the terminal through a column-drift-safe
2932	path. Link payloads are embedded in-band by the markdown renderer, then
2933	extracted out of the ratatui buffer cells and re-emitted out-of-band by
2934	`ColorCompatBackend` — so the `ESC` bytes never occupy display columns or
2935	corrupt selection. Supporting terminals get live hyperlinks; others see the
2936	label text unchanged. Clipboard/selection extraction strips residual codes as
2937	defense-in-depth.
2938	- CodeWhale-only skill discovery gate (#3296). New
2939	`[skills].scan_codewhale_only = true` limits session-time skill discovery to
2940	CodeWhale-owned roots (`<workspace>/.codewhale/skills`, `~/.codewhale/skills`,
2941	and any explicit `skills_dir`) while ignoring cross-tool directories such as
2942	`.claude/skills`, `.opencode/skills`, `.cursor/skills`, and `~/.agents/skills`.
2943	The default remains the broad compatibility scan.
2944	- Permission/ask runtime rules (#3295). Sibling `permissions.toml` ask-only
2945	rules are now loaded by the TUI engine and applied to `exec_shell` before
2946	Auto/session approval shortcuts. Matching ask rules force an approval prompt
2947	in otherwise auto-approved flows and are rejected under
2948	`approval_mode = "never"`.
2949	- Runtime API no-auth documentation. `docs/RUNTIME_API.md` now documents
2950	`codewhale app-server --insecure-no-auth` for loopback-only testing and warns
2951	against combining it with `--mobile` on `0.0.0.0`.
2952
2953	### Fixed
2954
2955	- TUI polish. The empty-startup welcome block is centered by the actual
2956	rendered text width, fixing the off-center layout left over from the old
2957	sidebar-oriented welcome composition. Streaming HTTP body read errors now
2958	explain whether CodeWhale can retry before output, or is surfacing a warning
2959	after partial output to avoid replaying and duplicating streamed text.
2960	- Config comment preservation. Rewriting `config.toml`, `settings.toml`, or
2961	`tui.toml` now merges user comments and formatting back into the serialized
2962	document; if comment merge fails, the write falls back to plain serialized
2963	output rather than failing.
2964	- Snapshot gate respected for per-tool snapshots (#3292). Per-tool snapshots
2965	now check `[snapshots].enabled` before writing, matching the existing
2966	session-level gate.
2967	- Poppler `pdftotext` detection (#1667). The dependency resolver now probes
2968	`pdftotext -v` instead of `--version`, because Poppler treats `--version` as
2969	an input filename. Fixes detection on systems where only Poppler is installed.
2970	- Plan confirmation checklist visibility. The Plan-mode confirmation modal
2971	now shows the active checklist under the plan details, so users can review the
2972	concrete `checklist_write` work breakdown before accepting or revising a plan.
2973
2974	### Retroactive credits
2975
2976	A credit-reconciliation pass found shipped community fixes that were never
2977	recorded in this changelog. Crediting them now, with the version they shipped in:
2978
2979	- Global `~/.deepseek/AGENTS.md` fallback loading — thanks @manaskarra (fix) and @xfy6238 (report) (#1157, v0.8.27)
2980	- CRLF SSE event parsing for MCP — thanks @reidliu41 (fix) and @djairjr (report) (#1309, v0.8.29)
2981	- Reduce-motion default on VTE/flicker terminals — thanks @Geallier (report) (#1470, v0.8.34)
2982	- `portable-pty` 0.9 upgrade for LoongArch64 — thanks @quentin-lian (fix) and @k0tran (report) (#1531, #1992, v0.8.46)
2983	- `DEEPSEEK_ALLOW_INSECURE_HTTP` guard for LAN vLLM — thanks @F1LT3R (report) (#1656, v0.8.47)
2984	- Hidden `reasoning_content` kept in English regardless of locale — thanks @cmyyy (report) (#1842, v0.8.47)
2985	- `ExternalTool` abstraction layer — thanks @aboimpinto (#1794, #2294, v0.8.48)
2986	- Ephemeral generated project context — thanks @Final527 (report) (#3058, v0.8.59)
2987
2988	## [0.8.61] - 2026-06-15
2989
2990	This release lands the runtime control plane for multi-agent work: the TUI stays
2991	responsive while sub-agents run, sub-agents converge toward fleet-style durable workers
2992	with per-role model routing, and provider/model routes are isolated per session. It also
2993	folds in several community contributions.
2994
2995	### Added
2996
2997	- WhaleFlow runtime foundations — worker runtime profiles (role / permissions / shell /
2998	tools / model-route, with non-escalating child derivation), a cross-provider model registry
2999	with offline catalog hydration, and provider-readiness / context-budget / provider-adapter /
3000	resource-telemetry services. (#3217, #3071, #3072, #3073)
3001	- Per-role, heterogeneous-model sub-agent routing — sub-agents can be assigned a model and
3002	provider per role (e.g. scout vs. synthesis; verifiers route to a fast model). (#2027, #1768)
3003	- Durable goal mode — cross-turn goal progress with token/time accounting and a
3004	verifier-as-judge gate before a goal may complete. (#3215, #891, #1976, #2058, #2029)
3005	- Parent-visible worker interaction contract — a recommended action per worker. (#3226)
3006	- Maintainer GitHub workflow skills; ACP registry submission prepared. (#3192)
3007	- OpenAI-compatible `/v1/chat/completions` endpoint on the legacy app-server HTTP transport,
3008	provider-neutral, with model registry resolution and configured-credential forwarding.
3009
3010	### Changed
3011
3012	- Sub-agents converge toward fleet-style durable workers — real worker lifecycle states are
3013	projected to the sidebar instead of a hardcoded "running", and a sub-agent returns a structured
3014	needs-input checkpoint instead of parking. (#3226, #3096, #3154)
3015	- The per-turn runtime tag exposes capability posture instead of human-facing mode labels. (#3213)
3016	- Independent shell and verifier work defaults to background jobs with nonblocking waits and a
3017	completion notification; blocking now requires an explicit wait. (#3212)
3018	- Sub-agent launches now expose explicit `model_strength` and `thinking` controls to the model
3019	instead of hidden child-model auto-routing; `explore` work is documented as a good fit for
3020	faster models and `thinking: "off"`.
3021	- Plan mode is strictly read-only (no shell tools), consistent with its runtime posture.
3022	- `/swarm` is gated behind the durable worker substrate. (#3218)
3023	- Legacy `deepseek` install/update path resolves to `codewhale`. (#2960, #2924, #2917)
3024
3025	### Fixed
3026
3027	- TUI freeze when multiple sub-agents spawn (launch blocker) — the terminal input pump runs
3028	off the render thread, AgentProgress events are coalesced, and sub-agents no longer park on
3029	input with no orchestrator to answer; a six-worker stress test guards input/render/cancel
3030	liveness. (#3216, #3096)
3031	- Idle sub-agent completion notifications now resume the parent turn instead of waiting for a
3032	later user message; thanks @giovanni-paolilla for the deadlock report (#3266).
3033	- Provider/model route isolation — provider and model state is session-local, and a
3034	mismatched provider+model tuple is rejected at the route boundary. (#3227)
3035	- Route-effective context-window metadata, over-limit preflight, and bounded recovery from
3036	`context_length_exceeded` instead of re-looping. (#3204)
3037	- Synchronous tools (`file_search`, `grep_files`, `list_dir`) are cancellable and no longer hold
3038	a turn open against cancellation. (#1791)
3039	- MCP stdio proxy startup prompts no longer strand YOLO / non-interactive runs. (#2475)
3040	- Stalled / failed background-shell recovery; configurable sub-agent API timeout. (#1737, #1786, #1806)
3041	- Composer: reliable queued steering + Ctrl+S send (#3203, #3224); footer busy/idle indicator
3042	(#2982); CJK word-wrap (#963); clickable sidebar stop targets (#3028); live token throughput
3043	(#3190); auto-expiring terminal sub-agent cards (#3078).
3044	- Linux glibc preflight in the installer/update path with a clear error. (#3207, #1067)
3045	- Self-update retries transient GitHub metadata/asset failures and falls back from the GitHub
3046	REST API to the public `releases/latest` redirect before constructing release asset URLs. (#3232)
3047	- Provider picker lists providers in neutral alphabetical order instead of hard-coding DeepSeek first; the active provider stays pre-selected. (#3076)
3048	- Work sidebar no longer shows stale `phase now:` / `phase next:` strategy rows once the checklist
3049	is 100% complete.
3050	- Plan mode no longer shortcuts investigation for requests that name a repository, URL, version,
3051	release, build state, bug, PR, issue, API surface, or local code path.
3052	- Oversized pasted text stays editable in the composer, with a file backup appended at submit
3053	time for model access; thanks @idling11 (#3267, closes #3263).
3054	- Bare digit keys `1`-`8` now insert text instead of firing hotbar slots; use `Alt+digit` for
3055	hotbar actions. Thanks @wjq2026 for the report and @DieMoe233 for the paste-path note (#3243).
3056	- Kimi/Moonshot tool schemas normalize empty function parameters to a root object schema; thanks
3057	@jghwwnq for the provider repro (#3265).
3058	- Novita defaults to its OpenAI-compatible `/openai/v1` endpoint so chat completions no longer
3059	404 out of the box; thanks @buko for the report and endpoint verification (#3255).
3060	- Dependency security: `ws` pinned to 8.21.0 across npm packages to close remote memory-exhaustion
3061	DoS (dependabot).
3062
3063	### Community contributions
3064
3065	- Non-DeepSeek model pricing — thanks @mvanhorn (#3201)
3066	- Telegram polling transport — thanks @cyq1017 (#3195)
3067	- Mobile event history — thanks @RobertEmprechtinger (#3220)
3068	- Runtime-API session save — thanks @gaord (#3199)
3069	- Whale-accent rename — thanks @nightt5879 (#3197)
3070	- `DEEPSEEK_BASE_URL` / `MODEL` honored in `exec` — thanks @hongchen1993 (#3221)
3071	- VS Code read-only API documentation — thanks @cyq1017 (#3013)
3072	- Atomic ask-only permission rule persistence — thanks @greyfreedom (#3233)
3073	- DeepInfra provider support and release-surface follow-through — thanks @idling11 (#3235, closes #3231) and @nightt5879 (#3236)
3074	- Editable oversized paste composer flow — thanks @idling11 (#3267, closes #3263)
3075	- WeChat bridge (`integrations/weixin-bridge` via Feishu + Tencent OpenClaw) — thanks @VincentCorleone (#3206)
3076	- Config robustness: atomic permission-rule save, one-time config `.bak` backup before the first changed write, `CODEWHALE_HOME` as primary config home, and accepting the dispatcher-written config shape (camelCase aliases + `[features.enabled]` table) so legacy/dual-written configs parse cleanly
3077	- Dependency/CI bumps: docker login/qemu actions, softprops gh-release, download-artifact, vitest, @opennextjs/cloudflare, form-data, js-yaml, dompurify, ws
3078
3079	## [0.8.60] - 2026-06-13
3080
3081	### Added
3082
3083	- Agent Fleet real-run cutover (#3154/#3096). `codewhale fleet run` now
3084	launches durable workers through the headless `codewhale exec --output-format
3085	stream-json` path instead of the local simulation interpreter, with terminal
3086	worker events freeing leases so queued fleet tasks continue running.
3087	- Read-only shell parallelism (#2983). The engine can now run conservative
3088	read-only shell calls in parallel, including strict `bash`/`sh`/`zsh -c`
3089	wrappers for whitelisted commands, while writes, stdin, background TTY work,
3090	redirects, pipes, command substitution, and follow-mode tails stay serial.
3091	- Declarative JS/TS WhaleFlow authoring (#3097). WhaleFlow now accepts a
3092	compile-only `workflow({...})` JavaScript/TypeScript authoring form that
3093	lowers into the existing `WorkflowSpec` validator without executing user
3094	JavaScript.
3095	- Slash-menu Ctrl+P/Ctrl+N navigation (#3196). The slash command menu now
3096	supports Ctrl+P/Ctrl+N movement without letting the global file picker steal
3097	focus while the menu is open. Thanks @1Git2Clone for the PR.
3098	- New models and first-party provider routes. This release adds
3099	GLM-5.2 (selectable on the Z.ai Coding Plan and over OpenRouter as
3100	`z-ai/glm-5.2`, alongside the existing GLM-5.1 default), a first-party
3101	Z.ai provider route, a first-party StepFun / StepFlash route
3102	(`step-3.7-flash`), and a first-party MiniMax route defaulting to
3103	`MiniMax-M3` with the M2.7/M2.5/M2.1 family selectable (#3187/#3191).
3104
3105	### Changed
3106
3107	- README and contributor credits. The README now has a shorter public
3108	overview and moves the full contributor ledger to `docs/CONTRIBUTORS.md`,
3109	preserving public thanks for [DeepSeek](https://github.com/deepseek-ai),
3110	[DataWhale](https://github.com/datawhalechina),
3111	[OpenWarp](https://github.com/zerx-lab/warp), and
3112	[Open Design](https://github.com/nexu-io/open-design).
3113	- Fleet-backed sub-agent direction. Runtime docs now state the intended
3114	cutover clearly: "sub-agent" is role/UX vocabulary, while durable detached
3115	work should converge on the fleet-backed worker lifecycle with retries,
3116	receipts, and ledgered inspection.
3117
3118	### Fixed
3119
3120	- Sub-agent eval no longer blocks by default. `agent_eval` now returns the
3121	current projection immediately and delivers follow-up input without waiting
3122	for a running child to finish its provider call. Pass `block:true` for an
3123	intentional terminal wait.
3124	- Z.ai GLM thinking traces. Direct Z.ai requests now use the documented
3125	`thinking` shape, preserve and replay `reasoning_content`, classify GLM
3126	reasoning streams as thinking output, and accept `ultracode` as a max-effort
3127	alias.
3128	- Claude skill archive compatibility (#2743). `/skill install` keeps
3129	portable Claude-style skill folders supported while rejecting multi-skill
3130	Claude plugin archives clearly instead of silently installing only one skill
3131	and dropping plugin semantics. Thanks @AiurArtanis for the ecosystem request.
3132
3133	## [0.8.59] - 2026-06-12
3134
3135	### Added
3136
3137	- Moonshot Kimi K2.7 Code model. The Moonshot/Kimi provider now defaults to
3138	`kimi-k2.7-code`, recognizes `kimi`/`kimi-k2` aliases for that model, keeps
3139	explicit `kimi-k2.6` selectable, and adds the OpenRouter
3140	`moonshotai/kimi-k2.7-code` registry row.
3141	- Concise verbosity mode (#3052). CLI noninteractive launches now default
3142	to concise prompt/output discipline unless overridden by config, env, or
3143	`--verbosity`, while interactive TUI launches remain normal by default.
3144	Thanks @cyq1017 for the PR.
3145	- Ephemeral generated project context (#3058). Opening CodeWhale in a
3146	directory with no instruction files now keeps the bounded generated project
3147	overview in memory instead of creating `.codewhale/instructions.md`.
3148	- ACP registry auth metadata (#1447). The ACP stdio adapter now advertises
3149	terminal authentication setup in `initialize.authMethods`, matching the
3150	registry's validation requirement.
3151	- Sidebar context menus (#3065). Right-clicking the sidebar no longer shows
3152	`Paste`; clickable sidebar rows now offer their row command as the first
3153	context action.
3154	- Sidebar hover popovers (#3088). Streaming turns now keep sidebar hover
3155	popovers responsive while continuing to throttle transcript/body mouse
3156	motion.
3157	- Dark-theme selection contrast (#3074, thanks @drpars). Session, config,
3158	help, context-menu, and approval selections now use the muted selection
3159	background instead of the bright accent color.
3160	- Cursor-style activity metadata rows (#3146). Dense successful tool-run
3161	summaries now render as a single muted `Explored ...` / `Updated metadata`
3162	row, include short command-family labels for successful generic verifier
3163	groups, and keep keyboard/mouse expansion and detail inspection intact.
3164	- Provider-wait observability (#3095). Footer stall reasons now name the
3165	active provider/model route, idle seconds vs stream budget, and whether a
3166	fanout plan is still at `0 running` or dispatch is pending. Structured
3167	provider-wait incidents log once per turn from the main tick loop (not on
3168	every footer redraw).
3169	- Interactive fanout launch gate (#3095). Direct sub-agent children queue
3170	behind a configurable semaphore (`[subagents] interactive_max_launch`,
3171	default 4) with a visible `queued: waiting for an interactive fanout slot`
3172	reason before their first model step.
3173	- Goal lifecycle controls. `/goal` is now the primary command surface for
3174	session goals, with `pause`, `resume`, `complete`, `blocked`, and `clear`
3175	controls while `/hunt` remains a compatibility alias.
3176	- Persistent thread-goal API. App-server clients can now set, get, and clear
3177	durable thread goals through `thread/goal/set`, `thread/goal/get`, and
3178	`thread/goal/clear`, backed by the state store with Codex-style status and
3179	token/time accounting fields.
3180	- Command-boundary ownership layers (#2888/#3055). Built-in slash command
3181	metadata now lives in `commands/registry.rs`, slash parsing in
3182	`commands/parse.rs`, and handlers under group-owned command areas, preserving
3183	the existing dispatch surface while reducing future `commands/mod.rs` churn.
3184	- Approval-rule source metadata (#1186/#2971). Runtime API
3185	`approval.required` events now include optional `matched_rule` metadata when
3186	an execution-policy rule caused the prompt. Thanks @greyfreedom for the PR
3187	and @Ram9199 for the audit-semantics discussion.
3188	- Localized tool-family labels (#2901). Tool activity labels for read,
3189	patch, run, find, delegate, fanout, RLM, verify, think, and generic tool
3190	work now route through the shipped locale tables. Thanks @gordonlu for the
3191	PR.
3192	- Localized config section labels (#2918). The interactive config view now
3193	localizes section and session/saved scope labels while preserving English
3194	search terms. Thanks @gordonlu for the PR.
3195	- Localized config editor labels (#2919). The config editor modal now
3196	localizes edit labels, default/unavailable placeholders, and effective
3197	currency hints. Thanks @gordonlu for the PR.
3198	- Hotbar number-key dispatch (#3056). Bare `1`-`8` now trigger bound
3199	hotbar slots only when the composer is empty, while `Alt+1`-`Alt+8` trigger
3200	slots regardless of composer text and overlays keep key ownership. Thanks
3201	@reidliu41 for the PR.
3202	- Voice dictation commands (#3051). `/voice`, `/voice-send`, and
3203	`/voice-control` now record through `sox`/`rec`/`arecord`, transcribe via the
3204	active provider's chat-completions API, and insert transcripts at the
3205	composer cursor. The `voice.toggle` hotbar action dispatches the real voice
3206	command, with help and status text localized across all seven shipped
3207	locales. Thanks @huqiantao for the PR.
3208	- Thread rewind and snapshot restore API (#2808). GUI clients can now call
3209	`POST /v1/threads/{id}/undo`, `/patch-undo`, and `/retry` to fork, roll back,
3210	or rerun recent thread turns, plus `POST /v1/snapshots/{id}/restore` to
3211	restore a workspace snapshot by id. Thanks @bengao168 for the PR.
3212	- Active provider fallback chain (#2773). Configured `fallback_providers`
3213	now build an ordered primary-plus-fallback route that the TUI can report,
3214	advance through, and reset with `/provider fallback reset`, including footer
3215	visibility for fallback state. Thanks @idling11 for the PR.
3216	- Provider metadata registry (#3005). Built-in provider ids, display names,
3217	defaults, env vars, config keys, aliases, and wire formats now live in a
3218	shared metadata registry, with the provider drift check covering the registry
3219	contract. Thanks @sximelon for the PR.
3220	- Hugging Face provider route (#2879). Hugging Face Inference Providers now
3221	have first-class config, env, docs, and registry coverage for the
3222	OpenAI-compatible router, including `huggingface`/`hugging-face`/
3223	`hugging_face`/`hf` aliases and `HUGGINGFACE_`/`HF_` env fallbacks. Thanks
3224	@mvanhorn for the PR.
3225
3226	### Fixed
3227
3228	- SSE data lines without spaces (#3152). Chat Completions, Responses, and
3229	Anthropic stream readers now accept both `data: {...}` and `data:{...}` SSE
3230	frames, matching the spec and preventing providers that omit the optional
3231	space from streaming empty output. Thanks @wgeeker for the PR.
3232	- Runtime thread detail N+1 reads (#3141). `get_thread_detail` now scans
3233	persisted turn items once and groups them by turn instead of reading the
3234	items directory once per turn, preserving item order while keeping large
3235	thread detail loads responsive.
3236	- Project-local hook trust boundary (#3140). `.codewhale/hooks.toml` is now
3237	loaded only after the workspace is trusted in user-owned config, matching the
3238	project-local MCP trust model while preserving the documented shell-command
3239	hook contract.
3240	- Skill registry sync latency (#3139). `/skills sync` now syncs registry
3241	entries with bounded ordered concurrency, so network latency no longer stacks
3242	one skill at a time while output order stays deterministic.
3243	- SiliconFlow China provider config (#2893/#2895). `siliconflow-CN`
3244	now reads its own `[providers.siliconflow_cn]` / `[providers.siliconflow-CN]`
3245	table and falls back to `[providers.siliconflow]` only for unset
3246	`api_key`/`base_url`/`model` fields. Thanks @Artenx for the report and
3247	@idling11 for the PR.
3248	- Self-update download timeout (#3006). `codewhale update` now applies a
3249	five-minute HTTP client timeout so blocked or very slow GitHub release
3250	downloads fail instead of hanging indefinitely. Thanks @New2Niu for the PR.
3251	- Legacy `deepseek` update migration (#2960/#3013/#3053). Running
3252	`deepseek update` or `deepseek-tui update` from a pre-rebrand install now
3253	returns copy-pasteable npm, Cargo, Homebrew, and manual-binary migration
3254	steps instead of trying to spawn a missing `codewhale` binary. README and
3255	rebrand docs now cover the same upgrade path. Thanks @jazzi and
3256	@tiangangQiu for the reports, @cyq1017 for the update-path PR, and
3257	@angus-guo for the README PR.
3258	- Short `codew` shim delegation. The `codew` convenience binary now
3259	prefers the sibling `codewhale` dispatcher installed next to it before
3260	falling back to `PATH`, preventing fresh local builds or installs from
3261	accidentally invoking an older global dispatcher.
3262	- Constitution trust wording (#2950/#3008). The base prompt now explains
3263	that "begins with an A" means a baseline of trust, not a literal output
3264	formatting rule. Thanks @cyq1017 for the PR.
3265	- TUI provider-source recovery (#3007/#3011). Unsupported interactive
3266	providers now report whether the value came from `--provider`, environment,
3267	or config. Config-sourced unsupported providers fall back to DeepSeek without
3268	forwarding stale keyring secrets. Thanks @cyq1017 for the PR.
3269	- Exec auto-model handoff (#3148). `codewhale exec --model auto` now
3270	survives the CLI/TUI boundary by honoring the CodeWhale model env alias and
3271	legacy DeepSeek model handoff before falling back to provider defaults.
3272	Thanks @hongchen1993 for the PR.
3273	- macOS shortcut modifiers (#2938/#2943). Ctrl-like shortcuts that are
3274	reported as `SUPER` by macOS terminals now work for backgrounding tasks and
3275	sidebar-focus chords without rewriting clipboard shortcuts. Thanks @idling11
3276	for the PR.
3277	- TUI mouse-report leak (#3063/#3067). Strip raw SGR mouse coordinate
3278	tails from the composer even when `use_mouse_capture` is false, covering
3279	orphaned terminal reporting state after crashes or focus races.
3280	- Interrupted sub-agent lifecycle (#3080). API-timeout interruptions now
3281	emit `MailboxMessage::Interrupted`, render terminal interrupted cards, and
3282	reconcile stale running fanout counts from manager snapshots.
3283	- OpenAI Codex stream diagnostics and active tool collapse (#3146). The
3284	Responses bridge now reports nested `response.failed` /
3285	`response.incomplete` errors instead of `unknown`, and dense successful
3286	in-flight tool bursts collapse into the same calm activity metadata row as
3287	committed history.
3288	- OpenAI Codex reasoning tiers. Switching from DeepSeek to `openai-codex`
3289	now normalizes stale reasoning state into Responses-compatible
3290	`low`/`medium`/`high`/`xhigh` tiers. Startup, `/config`, and the model
3291	picker now display Codex labels instead of leaking DeepSeek
3292	`off`/`max` names, while Codex still reports as a Responses payload
3293	provider. The Responses request builder also clamps legacy `minimal` input
3294	to `low` and has regression coverage that Codex requests use
3295	`reasoning.effort`, not DeepSeek `thinking` fields.
3296	- OpenAI Codex context metadata (#3070). The `gpt-5.5` default and
3297	CodeWhale aliases now use OpenAI's documented 1,050,000-token context window
3298	and 128,000 max-output metadata for context pressure, prompts, and doctor
3299	capability output.
3300	- OpenAI Codex effective context budgeting. The public OpenAI API metadata
3301	for `gpt-5.5` remains 1,050,000 tokens, but the `openai-codex` OAuth route now
3302	budgets prompts against the 400K Codex-family effective window so preflight
3303	compaction runs before the backend returns `context_length_exceeded`.
3304	- OpenRouter Nemotron 3 Ultra preset. The OpenRouter preset and model
3305	registry now emit `nvidia/nemotron-3-ultra-550b-a55b` while keeping the old
3306	Ultra aliases compatible.
3307	- OpenRouter auth after MiMo switches (#3064). Switching from Xiaomi MiMo
3308	to OpenRouter now has regression coverage for preflight key failures and
3309	Bearer auth header isolation before any request can be dispatched.
3310	- Responses strict-tool schema compatibility (#3062/#3017/#1883). Responses
3311	function tools now preserve per-tool strict-mode compatibility, keep optional
3312	strict-schema fields nullable, and append deterministic constraint notes when
3313	root composition groups must be flattened for Responses.
3314	- Runtime prompt autonomous loop guard (#3061). Runtime policy reference
3315	now explicitly forbids initiating new work when `<runtime_prompt>` is the
3316	only new turn content and no tool/sub-agent handoff is pending.
3317	- Goal runtime status sync. Goal token budgets and active/paused/complete
3318	status now sync into the engine alongside the objective, and model-visible
3319	`update_goal` can only mark goals complete or blocked.
3320
3321	### Contributors
3322
3323	- Devin session work on #3080/#3095 (PRs #3103, #3104, #3106) — Hunter Bown
3324	(maintainer integration/cherry-pick on `codex/v0.8.59-release-ready`).
3325	- Nightt (@nightt5879) for the Responses strict-tool schema hardening in PR
3326	#3062.
3327	- yekern (@yekern) for the #3061 runtime-prompt loop safety report and repro
3328	that shaped the dispatch guard.
3329	- Paulo Aboim Pinto (@aboimpinto) for the staged command-boundary design and
3330	Layer 3 registry/parser extraction in PR #2888, plus the #2851/#2791/#2870
3331	architecture stream that guided the grouped command areas in #3055.
3332
3333	## [0.8.58] - 2026-06-11
3334
3335	### Added
3336
3337	- Native Anthropic provider. A dedicated Messages API adapter
3338	(`/v1/messages` with `x-api-key` auth) replaces OpenAI-dialect shims for
3339	Claude models: adaptive thinking with `output_config.effort` shaping,
3340	prompt-cache breakpoints (capped at 4, earliest dropped), signed-thinking
3341	replay via `signature_delta`, normalized cache-hit/miss usage telemetry,
3342	and SSE error envelopes. `claude-opus-4-8`, `claude-sonnet-4-6`, and
3343	`claude-haiku-4-5` join the model registry; configure with
3344	`ANTHROPIC_API_KEY` (#3014).
3345	- Hooks v2. `tool_call_before` hooks can now return a JSON decision —
3346	`{"decision": "allow"\|"deny"\|"ask", "reason", "updatedInput",
3347	"additionalContext"}` — with deny > ask > allow precedence across multiple
3348	hooks, last-writer-wins input rewriting, and concatenated context. Exit
3349	code 2 remains a legacy hard deny. Hooks support glob matchers and
3350	project-local `.codewhale/hooks.toml` (#3026).
3351	- Clickable sidebar. Background-job rows show/cancel on click, the
3352	Ctrl+K hint row runs `/jobs cancel-all`, and agent rows open `/subagents`;
3353	row actions are built in the same pass as the rendered lines so a click
3354	can never target the wrong job (#3028).
3355	- OSC 8 out-of-band hyperlink infrastructure with per-region open/close
3356	sequences that survive partial redraws (#3029).
3357	- `codewhale exec` gains `--allowed-tools`, `--disallowed-tools` (deny wins),
3358	`--max-turns`, and `--append-system-prompt` (#3027).
3359	- Constitution prompt source: YAML source-of-truth plus Python renderer for
3360	the system prompt, with the active prompt now served from
3361	`constitution.md` (#3015, renderer reconciliation still tracked).
3362	- Agent-task issue template, labels, and runner protocol (#3021); remote
3363	smoke-test droplet loop hardening — gh CLI, swapfile, agent sessions
3364	(#3022).
3365
3366	### Changed
3367
3368	- Sub-agent routing is provider-aware. DeepSeek ids are no longer
3369	hardcoded into model validation; routing works from per-provider
3370	big/cheap candidates, the network router is skipped when a provider has
3371	no cheap tier, and spawn-time model requests are validated against the
3372	active provider (#3018).
3373	- Model-specific facts in the system prompt (context window, sub-agent
3374	pricing, thinking notes, architecture characteristics) are now templated
3375	per-model instead of hardcoded DeepSeek V4 claims, in both `base.md` and
3376	`constitution.md` (#3025).
3377	- Provider capability lookups for Moonshot/OpenAI/Atlascloud resolve from
3378	per-model registry rows (bare and vendor-prefixed ids) instead of
3379	hardcoded 64K-era floors (#3023).
3380	- Reasoning-effort now reaches Atlascloud (DeepSeek dialect), Moonshot
3381	(`thinking` enable/disable), and Ollama (`think` param) (#3024); Moonshot/
3382	Kimi models joined the reasoning-content provider and model gates (#3016).
3383	- Transcript polish: compact tool-call cells without boilerplate (#3031),
3384	internal turn/agent ids hidden behind stable labels (#3030), and Ctrl+B
3385	now backgrounds the running foreground shell directly instead of opening
3386	a menu (#3032).
3387	- The Tasks sidebar separates "Model reasoning" from "Background commands",
3388	and `auth list` reports the same active-credential source as
3389	`auth status` for openai-codex.
3390
3391	### Fixed
3392
3393	- TUI freeze under sub-agent load. Rapid `AgentProgress` events
3394	saturated the render loop and starved terminal input; progress-driven
3395	repaints are now throttled to one per 100ms (#3033).
3396	- Hooks on Windows. Hook commands were passed to `cmd /C` through
3397	CRT-style argument quoting, which injected literal `\"` sequences that
3398	cmd.exe never unescapes — JSON decisions could not parse. Commands now
3399	reach cmd.exe verbatim via `raw_arg`.
3400	- Codex Responses: assistant tool results are converted to
3401	`function_call_output` items (multi-turn tool calling previously broke),
3402	tool schemas are sanitized for the Responses API, and `maximum` effort
3403	maps to `xhigh` (#3019, #3017 — both partially; retry/backoff and
3404	per-tool strict mode remain open).
3405	- Better tool-denial and provider error messages harvested from PR #2933
3406	(#3020).
3407
3408
3409	## [0.8.57] - 2026-06-10
3410
3411	### Added
3412
3413	- Turns now survive system sleep. When the host suspends mid-stream, the
3414	connection used to die on wake with `Stream read error: error decoding
3415	response body` and the turn was lost (#2990). The engine now stamps stream
3416	progress with both monotonic and wall-clock time; a large divergence on a
3417	stream error identifies a sleep/wake cycle, and the request is silently
3418	re-issued (up to the existing 3-retry budget) instead of failing the turn.
3419	- One-command release prep. `./scripts/release/prepare-release.sh X.Y.Z`
3420	bumps the workspace version, every internal crate dependency pin, the npm
3421	wrapper, and the README install-tag examples, refreshes `Cargo.lock`,
3422	regenerates the embedded TUI changelog slice and web facts, and runs
3423	`check-versions.sh` — the v0.8.56 release needed nine follow-up commits for
3424	exactly these sync points.
3425	- `.github/CODEOWNERS` and `.github/dependabot.yml` (weekly cargo +
3426	github-actions updates, monthly npm for `web/`).
3427
3428	### Changed
3429
3430	- The changelog went on a diet. Root `CHANGELOG.md` now carries recent
3431	releases (v0.8.40+); older entries moved to `docs/CHANGELOG_ARCHIVE.md`.
3432	`crates/tui/CHANGELOG.md` — embedded into every binary for `/change` — is a
3433	generated 15-release slice (`scripts/sync-changelog.sh`), no longer a
3434	357 KB manual byte-for-byte copy (~300 KB smaller binaries).
3435	- GitHub Release bodies are generated from the tagged version's changelog
3436	section (`scripts/release/generate-release-body.sh`) instead of a
3437	hardcoded workflow blob with a hand-pasted contributor list.
3438	- `check-versions.sh` now also gates `web/lib/facts.generated.ts` and the
3439	README install-tag examples; the CNB mirror pipeline validates the pushed
3440	tag against `Cargo.toml` before generating release notes.
3441	- Docs reorganized: internal design notes moved under `docs/rfcs/`; stale
3442	internal docs (old audits, handoffs, region-specific VM notes) removed.
3443	- Agent-facing polish: the system prompt environment block reports
3444	`codewhale_version` (was `deepseek_version`), the legacy
3445	`.deepseek/instructions.md` path is no longer advertised in the prompt
3446	(still honored for back-compat), and oversized instruction files are
3447	truncated with an explicit `[…truncated: N bytes omitted]` marker instead
3448	of a bare ellipsis.
3449
3450	### Fixed
3451
3452	- Docker images build again. The release `docker` job failed for v0.8.56
3453	because the Dockerfile still copied the pre-rebrand `deepseek` /
3454	`deepseek-tui` binaries; they are now symlinks to the codewhale binaries
3455	inside the image, so legacy container entrypoints keep working.
3456	- `.devcontainer/devcontainer.json` used the pre-rebrand container name,
3457	mount path, and `deepseek` remote user.
3458	- Stale `--bin deepseek` examples, `DeepSeek-TUI` strings in `/change`
3459	output, and pre-rebrand doc comments.
3460
3461	### Removed
3462
3463	- Unused dependencies: `tracing-appender` and `zeroize` (TUI crate),
3464	`rustls` (release crate); the orphaned `vendor/schemaui-0.12.0` lockfile
3465	leftover and a machine-specific one-off `scripts/verify_task.sh`.
3466
3467	## [0.8.56] - 2026-06-09
3468
3469	### Added
3470
3471	- Status picker localization. The status picker surface (7 MessageIds) is
3472	now localized across all supported locales (#2896, @gordonlu).
3473	- Approval dialog localization. The approval dialog surface is now
3474	localized across 7 locales: English, Simplified Chinese, Japanese,
3475	Vietnamese, Portuguese, Spanish, and French (#2891, @gordonlu).
3476	- Volcengine provider in TUI dispatcher. The `codewhale` / `codewhale-tui`
3477	CLI dispatcher now allows the Volcengine provider, so users can launch
3478	directly into a Volcengine-backed session (#2923, @hongchen1993).
3479	- Dispatcher API-key preference. When a provider-specific API key is
3480	supplied via the CLI dispatcher, it is now preferred over the saved root
3481	key, fixing a regression where saved keys masked explicit CLI keys (#2928,
3482	@hongchen1993).
3483	- Qwen 3.6 Plus model support. Added complete Qwen 3.6 Plus model
3484	resolution with dedicated version-bump tests (#2930, @idling11).
3485	- Oversized paste spill. Pastes larger than ~10 KB are now written to
3486	`.codewhale/pastes/` instead of being truncated or dropped, preserving the
3487	full content for the session (#2920, @sximelon).
3488	- Cross-session prompt cache. Added a disk-backed cross-session prompt
3489	base-section cache so post-mode-flip and post-restart turns reuse the
3490	byte-stable prefix without rebuilding it from scratch.
3491
3492	### Fixed
3493
3494	- Background shell routing. Shell commands expected to take >5 seconds are
3495	now automatically guided to background tasks instead of blocking the agent
3496	loop, with the task panel syncing immediately on cancel (#2947, #2941,
3497	@cyq1017, @idling11).
3498	- `allow_shell` error naming. Shell-tool refusal errors now explicitly name
3499	`allow_shell = false` as the reason and suggest `/config allow_shell true` as
3500	the escape hatch (#2905, @cyq1017).
3501	- Prefix-cache stability across mode flips. `allow_shell` is now decoupled
3502	from the static system-prompt prefix, so mode changes (Plan ↔ Agent ↔ YOLO)
3503	no longer rebuild the byte-stable message[0] and invalidate the DeepSeek
3504	prefix cache (#2949, @LeoAlex0).
3505	- `visibility="internal"` explained. The Runtime Policy Reference section
3506	of the system prompt now explains the `visibility="internal"` attribute so
3507	models stop narrating their current mode between steps (#2951, @LeoAlex0).
3508	- Bocha web search response handling. Updated response parsing for the
3509	Bocha search backend after an upstream API change (#2946, @h3c-hexin).
3510	- PDF read hang. Full-PDF reads now use `extract_text_by_pages` to avoid
3511	a hang on large or complex PDFs (#2898, @idling11).
3512	- 9 critical bugs. Fixed bugs across tools, client, and commands: stale
3513	`ContentBlockStop` cleanup, missing `#[test]` attribute, trailing-space
3514	restoration on English `ApprovalField` labels, and several
3515	correctness/stability issues (#2880, @HUQIANTAO).
3516
3517	### Changed
3518
3519	- CNB shim cleanup. Removed deprecated `deepseek` shim references from the
3520	CNB mirror path.
3521	- Style. Applied `cargo fmt` to `crates/tools/src/file.rs`.
3522
3523	## [0.8.55] - 2026-06-08
3524
3525	### Added
3526
3527	- Together AI provider. Added Together AI as a first-class provider
3528	(`[providers.together]`, `TOGETHER_API_KEY`/`TOGETHER_BASE_URL`/`TOGETHER_MODEL`)
3529	with default models `deepseek-ai/DeepSeek-V4-Pro` and
3530	`deepseek-ai/DeepSeek-V4-Flash`, TUI provider-picker/auth/capability support,
3531	and CLI `auth list`/`auth status` coverage.
3532	- Model catalog updates. Added Qwen 3.7 Max (`qwen/qwen3.7-max`), MiniMax 2.7
3533	(`minimax/minimax-m2.7`), and NVIDIA Nemotron 3 Ultra (`nvidia/nemotron-3-ultra`)
3534	on OpenRouter.
3535	- OpenAI Codex (ChatGPT) provider — experimental. Added an `openai-codex`
3536	provider that reuses an existing ChatGPT/Codex CLI OAuth login. The access
3537	token is read and refreshed from `~/.codex/auth.json` (no API key is stored),
3538	and requests use the OpenAI Responses API at `/codex/responses` with the
3539	`chatgpt-account-id` header and `responses=experimental` beta opt-in. Env
3540	overrides: `OPENAI_CODEX_ACCESS_TOKEN`/`CODEX_ACCESS_TOKEN`,
3541	`OPENAI_CODEX_BASE_URL`/`CODEX_BASE_URL`, `OPENAI_CODEX_MODEL`/`CODEX_MODEL`,
3542	`OPENAI_CODEX_ACCOUNT_ID`/`CODEX_ACCOUNT_ID`, `OPENAI_CODEX_AUTH_FILE`,
3543	`CODEX_HOME`. Default model `gpt-5.5`. The live Responses round-trip has not
3544	been exercised against the production backend in CI; treat as preview.
3545
3546	## [0.8.54] - 2026-06-08
3547
3548	### Added
3549
3550	- Added `/restore list [N]` so users can inspect more side-git rollback
3551	snapshots with UTC timestamps before choosing a restore point. Plain
3552	`/restore` now shows the 20 most recent snapshots, numeric restore targets can
3553	reach beyond that default listing up to a bounded index, and list requests
3554	above the visible cap fail explicitly instead of silently truncating.
3555	- Added HarmonyOS/OpenHarmony support scaffolding: environment-driven
3556	`OHOS_NATIVE_SDK` setup scripts and compiler wrappers, platform docs,
3557	explicit Rustls ring-provider installation for the no-provider TLS build, and
3558	OHOS fallbacks for unsupported keyring, clipboard, sandbox, browser-open, TTY,
3559	execpolicy Starlark parsing, and self-update surfaces.
3560	- Added `scripts/release/check-ohos-deps.sh` and wired it into CI/release
3561	preflight so the OpenHarmony target graph fails if unsupported `nix`,
3562	`portable-pty`, `starlark`, `arboard`, or `keyring` dependencies re-enter.
3563	- Added `.github/AUTHOR_MAP` and a CI co-author credit check so harvested
3564	commits use GitHub-mappable numeric noreply identities instead of `.local`,
3565	placeholder, bot/tool, or raw third-party emails.
3566	- Added a `turn_end` observer hook that fires after post-turn TUI state and
3567	token totals are updated. Hooks receive structured JSON with status, usage,
3568	totals, duration, tool count, and queued-message count on stdin; stdout is
3569	ignored and failures are warn-only (#1364, #2578).
3570	- Added provider-scoped `insecure_skip_tls_verify` for private
3571	OpenAI-compatible gateways that cannot use a trusted CA bundle. The setting is
3572	disabled by default, applies only to the active LLM provider HTTP client, and
3573	is surfaced by `codewhale doctor`; `SSL_CERT_FILE` remains the preferred path
3574	for corporate or private CA roots. Thanks @wavezhang for the original #1893
3575	direction.
3576	- Added a default-disabled hard-compaction planner that can identify the
3577	summarizable middle of a long conversation while preserving the recent tail,
3578	existing tool-call/result pair guarantees, and working-set pinning. This
3579	harvests the safe planning layer from #2522 without enabling hard compaction
3580	or adding a message-rewrite execution path yet. Thanks @HUQIANTAO for the
3581	proposal.
3582	- Added rich PlanArtifact support to `update_plan`: Plan mode can now carry
3583	grounded objectives, context, sources, critical files, constraints,
3584	verification, risks, and handoff notes through the transcript card, Plan
3585	confirmation prompt, `/relay`, fork-state, and saved-session replay.
3586	- Added the first `codewhale-whaleflow` foundation crate with typed workflow
3587	config/IR validation and deterministic phase ordering tests. This preserves
3588	the WhaleFlow direction from #2482/#2486 without exposing a runtime
3589	`workflow_run` tool until cancellation, replay, and worktree semantics are
3590	release-safe. The foundation now includes explicit `WorkflowSpec`,
3591	`WorkflowNode`, branch/leaf/policy metadata structs, plus serializable branch,
3592	leaf, and control-node result records toward the #2668 TraceStore contract.
3593	It also adds a crate-local mock executor skeleton for Sequence, BranchSet,
3594	Leaf, Reduce, LoopUntil, Cond, Expand, BranchTournament, and ParetoFrontier
3595	control flow so #2669 can progress without spawning agents, applying
3596	worktrees, or exposing a `workflow_run` runtime tool yet. A first Starlark
3597	authoring layer now compiles fail-closed model-authored workflow files into
3598	that typed IR, with `rlm_cache_change.star` and `issue_fix_tournament.star`
3599	examples plus a one-pass repair for common `ctx.*` authoring aliases (#2670).
3600	Leaf, branch, and workflow execution results now carry deterministic token
3601	and cost telemetry fields that the mock executor can aggregate without live
3602	provider calls or runtime sub-agent fanout (#2486). The mock executor now
3603	carries crate-local cancellation and budget-exhaustion status markers so the
3604	branch/leaf runtime contract can be tested before live workflow execution is
3605	exposed (#2669). A crate-only replay executor now evaluates workflows from
3606	recorded leaf/control records, computes
3607	stable SHA-256 leaf input hashes, and marks missing records as
3608	`replay_diverged` instead of calling models again (#2673); the runtime replay
3609	command and live-provider replay fallback remain deferred. The crate also now
3610	has a model-agnostic role/capability registry with mock provider plumbing and
3611	fail-closed JSON repair parsing, so WhaleFlow can choose capable models for
3612	roles without hardcoding provider-specific runtime paths (#2672). The
3613	`rlm_cache_change.star` dogfood workflow now exercises candidate branches,
3614	LoopUntil verification, tournament selection, teacher review, and mock
3615	execution in CI-oriented crate tests (#2679). Leaf, branch, and workflow
3616	results now also carry separate ARMH/shared-memo and provider prompt-cache
3617	telemetry counters, with mock aggregation tests, so #2671 can progress
3618	without wiring live RLM calls or billing-affecting provider behavior yet. The
3619	Starlark and typed-IR gates now also reject unknown leaf dependencies,
3620	reducer inputs, and teacher-review candidates before mock execution or replay,
3621	keeping generated workflows fail-closed while runtime/worktree semantics stay
3622	deferred. TeacherReview now has serializable GEPA-style candidate artifacts
3623	for notes, workflow recipes, skills, regression tests, cache policy, branch
3624	heuristics, and Starlark authoring prompt patches, plus an offline helper
3625	that proposes candidates from recorded execution traces without promoting
3626	them or training model weights (#2674). StudentReplay results can now be
3627	stored on teacher candidates, and a deterministic PromotionGate compares
3628	baseline-vs-candidate replay deltas, required tests, policy violations,
3629	staleness, and cost constraints before marking a candidate promotable (#2675).
3630	The external-memory cutline now documents that Aleph-style memory stays
3631	optional, explicit, visible, and clear/export-capable for v0.9.0 rather than
3632	becoming a hidden default context substrate (#2677).
3633	A dedicated v0.9.0 release acceptance matrix now tracks provider, runtime,
3634	UI, WhaleFlow, Model Lab, remote-workbench, docs, rollback, and credit gates
3635	that must be checked or explicitly deferred before tagging (#2729).
3636	HarnessProfile docs now pin the v0.9.0 order: posture/schema/resolver/seed
3637	profiles/status display must precede evidence stores, promotion gates, or any
3638	automatic Harness Creator, with DeepSeek, MiMo, Arcee, and generic/HF/local
3639	posture expectations called out separately (#2728).
3640	Hugging Face / Model Lab and `codebase_search` release gates now explicitly
3641	ship only the provider/MCP/docs/design foundation in v0.9; native Hub search,
3642	model passports, Spaces/Jobs workflows, eval/export surfaces, and runtime
3643	`codebase_search` registration remain deferred (#2705, #2680, #2727).
3644	Remote workbench acceptance is also marked docs/setup-only for v0.9 so release
3645	notes do not imply a shipped VM or Telegram bridge runtime (#2724).
3646	Release-facing HarnessProfile docs now match the current implementation:
3647	v0.9 ships the typed schema/config foundation and defers runtime resolver,
3648	telemetry, seed-profile selection, and status-display behavior until later
3649	verified slices. `config.example.toml` includes a commented dormant
3650	harness-profile example, and README links point at the real acceptance matrix
3651	and HarnessProfile cutline docs.
3652	The release acceptance matrix now records evidence for already-landed gates:
3653	provider-registry drift checks, provider-scoped TLS skip verify, read-only
3654	GUI runtime/restore-point surfaces, VS Code Agent View branch visibility,
3655	WhaleFlow mock/runtime foundations, explicit external-memory boundaries, and
3656	docs alignment. Live workflow execution, provider calls, TraceStore writes,
3657	and mutation-oriented GUI endpoints remain deferred until their atomicity and
3658	replay contracts are tested. The `rlm_cache_change.star` dogfood workflow can
3659	now be replayed from recorded mock leaf/control records, and missing dogfood
3660	records produce `ReplayDiverged` instead of falling back to live execution
3661	(#2679). The UI/workflow UX rows now also distinguish shipped transcript
3662	tool-run collapse, sidebar detail popovers, and PlanArtifact review/handoff
3663	evidence from the deferred first-look/home redesign, and record focused
3664	slash-picker readability smoke coverage for visibility, selection, skill
3665	insertion, Esc priority, and stable composer height (#2692, #2694, #2691,
3666	#2713).
3667	Thanks @AdityaVG13 for the WhaleFlow draft and cost-tracking direction.
3668	- Added a state-store v2 schema migration for WhaleFlow trace tables covering
3669	workflow, branch, leaf, control-node, and teacher-candidate runs. The
3670	migration creates persistence shape only; workflow execution and replay
3671	remain deferred until the runtime semantics are safe (#2668).
3672	- Added an official VS Code extension Phase 0 scaffold with terminal launch,
3673	local runtime attach checks, status bar state, and a read-only Agent View
3674	preview backed by recent runtime thread summaries, plus a read-only
3675	`GET /v1/snapshots` endpoint for GUI clients to inspect side-git restore
3676	points. The extension now renders those restore points read-only in its Agent
3677	View, and thread summaries include read-only workspace, branch, current Git
3678	head, and dirty-state metadata so the VS Code Agent View can show when a
3679	thread or agent lane is on another branch or has changed worktree state. Agent
3680	View and restore-point data now auto-refresh on a configurable
3681	read-only interval so branch/workspace/status changes become visible without a
3682	manual refresh. Agent View refreshes keep thread branch/workspace rows
3683	independent from restore-point loading, so a snapshot-listing failure no
3684	longer clears already-available thread metadata. This answers the VS Code GUI
3685	lane without exposing chat webviews, inline edits, or retry/undo/restore
3686	runtime mutation endpoints yet
3687	(#461, #462, #480, #1217, #2341, #1584, #2327, #2580, #2808). Thanks @AiurArtanis
3688	for the Agent View prompt, @lbcheng888 for the earlier scaffold, @gaord for
3689	the GUI runtime API direction, @douglarek, @caeserchen, and @nightt5879 for
3690	the branch visibility trail, and @BigBenLabs, @lzx1545642258, @yangdaowan,
3691	@mangdehuang, @VerrPower, @hejia-v, @nasus9527, and @ygzhang-cn for the
3692	GUI/VS Code demand and validation trail.
3693	- Added inline live-output refresh for background shell Exec cards keyed by the
3694	exact shell task id, so long-running commands can show bounded stdout/stderr
3695	tails without consuming deltas or matching by command text. Thanks
3696	@donglovejava for the live shell-output direction in #2048.
3697	- Added a static prompt composer override for embedders that need to replace
3698	the byte-stable base/personality prompt segment while leaving mode metadata,
3699	approval policy, tool taxonomy, Context Management, and the Compaction Relay
3700	under CodeWhale's runtime prompt assembly. This refines the embedder prompt
3701	customization path from #2786 without weakening prompt-continuity safeguards.
3702	Thanks @h3c-hexin.
3703	- Added `POST /v1/sessions` for runtime clients to save a completed thread as a
3704	managed session. The endpoint preserves thread title/model/mode/workspace
3705	metadata, maps missing threads to 404, and returns 409 instead of snapshotting
3706	queued or active turns.
3707	- Added cost-estimate pricing for the Xiaomi MiMo primary chat models, which
3708	were previously unpriced: `mimo-v2.5-pro` / `xiaomi/mimo-v2.5-pro` reuse the
3709	DeepSeek V4-Pro rate table and `mimo-v2.5` / `xiaomi/mimo-v2.5` reuse the
3710	DeepSeek V4-Flash rates. Existing DeepSeek pricing is unchanged (#2731, #2750).
3711	- Added a metadata-only `codewhale-config` provider registry with canonical
3712	lookup, alias-aware resolution, provider defaults, config-table keys, and
3713	API-key env candidates. Runtime routing remains unchanged and fallback
3714	providers stay dormant; this harvests the safe provider-trait foundation from
3715	#2479 toward #2075. Thanks @sximelon.
3716	- Added optional `[search].base_url` / `CODEWHALE_SEARCH_BASE_URL` support for
3717	DuckDuckGo-compatible private search endpoints, while keeping
3718	`DEEPSEEK_SEARCH_BASE_URL` as a legacy alias. Custom endpoints are gated by
3719	their configured host, do not fall back to public Bing, and report the custom
3720	host as the result source for diagnostics (#2436, #2510).
3721	- Added `completion_sound = "file"` with `[notifications].sound_file` so
3722	Windows users can play a custom WAV file for turn-completion sounds without
3723	changing the global Windows sound scheme (#2484, #2512).
3724	- Added `[tui].stream_chunk_timeout_secs` and `/config stream_chunk_timeout_secs`
3725	so slow local or OpenAI-compatible model servers can extend the SSE idle
3726	timeout without mutating process environment. The legacy
3727	`DEEPSEEK_STREAM_IDLE_TIMEOUT_SECS` env var remains a fallback (#2365, #2507).
3728	- Added dormant `fallback_providers = [...]` config parsing plus a provider-chain
3729	helper for future fallback routing. This preserves the requested contract
3730	without enabling silent runtime provider switches yet (#2574, #2777). Thanks
3731	@hsdbeebou for the request and @idling11 for the data-model draft.
3732	- Added `/hf` with `/huggingface` alias for Hugging Face MCP status/setup
3733	helpers and `/hf concepts` provider/MCP/Hub guidance. The helper points users
3734	to Hugging Face's settings-generated MCP configuration and intentionally does
3735	not include Hub search, direct Hugging Face HTTP requests, or upload behavior
3736	(#2709, #2782). Thanks @idling11 for the original Hugging Face MCP draft.
3737	- Added an in-process response cache for deterministic non-streaming,
3738	tool-free chat requests. The cache is keyed by provider, base URL, path
3739	suffix, API-key fingerprint, and final wire body, and zeroes usage on hits so
3740	local spend counters are not double-counted (#2501). Thanks @HUQIANTAO for
3741	the response-cache proposal and canonical-body key update.
3742	- Added `/sidebar` so users can toggle, show, hide, and optionally persist the
3743	TUI sidebar from the command line instead of relying on copy-hostile sidebar
3744	state during long transcript work (#2766, #2788). Thanks @mo-vic for the
3745	detailed report and @aboimpinto for the fix.
3746	- Added a pausable custom slash-command MVP: commands with `pausable: true`
3747	can pause before further tool execution, preserve the paused command while
3748	separate messages are handled, and resume only on explicit continue/resume
3749	wording. Harvested from #2732 with thanks to @aboimpinto.
3750	- Added Sofya (`provider = "sofya"`) as a search-tool backend with
3751	`SOFYA_API_KEY` fallback, while keeping Sofya scoped to web search rather
3752	than model-provider routing (#2790). Thanks @yusufgurdogan for the
3753	implementation.
3754	- Added Xiaomi MiMo `mode` / `XIAOMI_MIMO_MODE` / `MIMO_MODE` selection for
3755	Token Plan region endpoints and pay-as-you-go routing, plus dedicated Token
3756	Plan env keys for `tp-*` subscriptions (#2621, #2627). Thanks @springeye for
3757	the request and @xyuai for the implementation.
3758	- Added the first TUI hotbar action registry foundation so future UI controls
3759	can dispatch typed app actions instead of growing another command match
3760	surface (#2866). Thanks @reidliu41 for the implementation.
3761	- Added the narrow multi-tab core and persistence foundation, including tab
3762	manager snapshots, delegation/group restore counters, mention parsing,
3763	cross-tab events, and corruption-tolerant persisted state, while leaving the
3764	broader collaboration UI wiring to follow-up work (#2864). Thanks
3765	@ljm3790865 for the tab-core implementation and #2753 direction.
3766	- The VS Code Agent View now renders the runtime thread summary's Git `head`
3767	and dirty-worktree flag alongside branch metadata, keeping branch switches
3768	visible without adding retry/undo/restore mutation endpoints yet (#2580,
3769	#2862). Thanks @AiurArtanis and @nasus9527 for the IDE/agent-view requests
3770	and @gaord for the runtime metadata direction.
3771
3772	### Changed
3773
3774	- Removed the deprecated `deepseek` and `deepseek-tui` binary shims from the
3775	v0.9.0 Cargo crates and GitHub release artifact matrix. The canonical
3776	`codewhale`, `codew`, and `codewhale-tui` entry points remain, the private
3777	deprecated `npm/deepseek-tui` notice package stays unpublished, and DeepSeek
3778	provider/model/env/config compatibility remains first-class.
3779	- Command-adjacent config persistence and auto model routing now live in
3780	neutral TUI modules instead of command-owned files, reducing command-boundary
3781	coupling while preserving current `/config`, `/model`, UI, runtime, and
3782	sub-agent behavior (#2871). Thanks @aboimpinto for landing this first staged
3783	command-boundary layer from the broader #2851/#2791 design direction.
3784	- `/config` now reports the canonical `~/.codewhale/settings.toml` path for TUI
3785	settings while still reading legacy DeepSeek-branded settings fallbacks and
3786	migrating them into the CodeWhale home on load.
3787	- Provider switches now roll back transactionally when the first request to a
3788	newly selected provider fails authentication: CodeWhale restores the previous
3789	provider/model, model-ID passthrough, onboarding/API-key state, runtime
3790	config, persisted provider selection, and engine handle so users can return
3791	to DeepSeek after a failed Moonshot/Kimi switch (#2754, #2755). Thanks
3792	@Dr3259 for the Windows repro and @cyq1017 for the draft fix.
3793	- `PATCH /v1/threads/{id}` can now update a thread's persisted workspace for
3794	GUI/runtime clients. Workspace changes reject active turns and evict idle
3795	cached engines so the next turn starts in the new workspace.
3796	- Split `web_run` session/page cache state so cached page reads use shared
3797	page handles and do not serialize through the mutation path. The harvest also
3798	adds panic-safe state write-back and serializes cache-mutating unit tests so
3799	the global web cache remains stable under normal Cargo test parallelism.
3800	- Appended volatile `<turn_meta>` blocks after user text in outgoing user
3801	message content arrays so provider prefix caches can keep matching the stable
3802	user-input prefix across date, route, and working-set changes.
3803	- Projected mode, approval, and tool-taxonomy prompt metadata per request
3804	instead of mutating stored system prompts, keeping provider prefix-cache
3805	inputs byte-stable while preserving mode-specific instructions (#2687).
3806	Thanks @LeoAlex0 for the implementation.
3807	- Softened contribution intake automation: external issues now receive a warm
3808	triage note and are never auto-closed by the contribution gate, while the PR
3809	gate copy makes clear that dry-run observations are about maintainer safety,
3810	not contributor quality.
3811	- Added a PR gate marker guard so reopened unapproved PRs do not get duplicate
3812	intake comments, and clarified that PR reopening should happen after
3813	allowlist approval is merged.
3814	- Ollama `/model` completions no longer show hosted DeepSeek API model IDs.
3815	The picker preserves the current or saved local Ollama tag, and users can
3816	still fetch installed model IDs through `/models` instead of relying on a
3817	stale static default (#2742). Thanks @reidliu41 for the focused report and
3818	draft fix.
3819	- MCP runtime API tool listings and approval summaries no longer split
3820	underscored MCP server names at the first `_`. Tool-call routing already used
3821	the longest registered server name; the list endpoint now reuses that parser,
3822	and approval cards show the full MCP target route instead of a guessed server
3823	segment (#2744). Thanks @lioryx, @cyq1017, and @puneetdixit200 for the report
3824	and matching fixes.
3825	- Documented the agent and sub-agent stewardship ethos so future automation
3826	preserves human issue intake, careful PR review, and contributor credit.
3827	- Moved the TUI Starlark execpolicy parser and PTY support behind non-OHOS
3828	target dependencies so published OpenHarmony builds no longer pull `nix` 0.28
3829	through `rustyline` or `portable-pty`.
3830	- Explicit `skills_dir` configuration is now unioned with workspace skill
3831	discovery instead of being shadowed by workspace-local skills, and configured
3832	skills take precedence over global defaults when prompt space is constrained.
3833	- Tool-agent sub-agent routing now inherits the parent session model, or an
3834	explicit tool-agent override, instead of hard-coding `deepseek-v4-flash`;
3835	the fast lane still disables thinking through provider-aware request shaping.
3836	- Dense successful read/search/list tool runs now collapse into a single
3837	expandable transcript row by default, while running, failed, shell, patch,
3838	review, diff, and other risky tool cells remain visible. The setting
3839	`tool_collapse = "compact" \| "expanded" \| "calm"` controls the behavior.
3840	- Pending-input preview rows now label delivery mode explicitly as steer
3841	pending, rejected steer, or queued follow-up, with wrapped continuation rows
3842	aligned under the label so busy-turn input state is easier to read (#2054).
3843	- Editing a queued follow-up is now an explicit pending-input state. Pressing
3844	`Esc` while editing a queued follow-up restores the original queued message
3845	instead of cancelling the active turn or silently dropping the queued work
3846	(#2054).
3847	- Approval prompts now render prominent command, directory, file, path, or
3848	target rows before falling back to raw JSON params. Shell approvals preserve
3849	long command tails, split common shell chains for review, and show compact
3850	`printf > file` previews while keeping intent summaries visible (#1991,
3851	#2269).
3852	- Sidebar hover details now use row-level metadata for truncated Work, Tasks,
3853	and Agents rows. Mouse hover opens a bordered, wrapping popover with the full
3854	underlying row text, long turn/agent ids, and current sub-agent progress
3855	instead of repeating the already-ellipsized sidebar label (#2694, #2734).
3856	- Sub-agents now preserve checkpoint metadata around long model calls. A
3857	per-step API timeout marks the child as interrupted with a continuable
3858	checkpoint instead of ending as a null failed result, and `agent_eval` can
3859	explicitly continue a live checkpointed interrupted child while normal
3860	completed/failed/cancelled follow-up behavior stays unchanged (#2029).
3861	- Durable task recovery no longer requeues tasks that were `running` when the
3862	previous CodeWhale process exited. On restart those records are marked failed
3863	with a recovery note, and any running tool-call summaries are marked failed
3864	too, so stale shell/task state cannot silently become live work again (#1786).
3865	- Auto-generated project instructions now reuse the bounded Project Context
3866	Pack data instead of running an unbounded summary/tree scan when no
3867	`.codewhale/instructions.md` file exists. The fallback keeps later
3868	top-level folders visible in noisy large workspaces while the dynamic
3869	`<project_context_pack>` marker remains controlled by its own setting
3870	(#697, #1827).
3871	- Project context loading now uses a bounded process-local content-signature
3872	cache for repeated hot-path loads. The cache covers workspace/parent
3873	instructions, global AGENTS/WHALE fallbacks, repo constitution files,
3874	generated-context targets, trust markers, and trust config paths, and it
3875	stores post-load signatures so auto-generated context deletion/regeneration
3876	stays correct (#2636).
3877	- Configuration docs now show the provider-local `path_suffix` escape hatch
3878	for OpenAI-compatible gateways that accept `/chat/completions` but reject
3879	`/v1/chat/completions`, while making clear that model listing and DeepSeek
3880	beta routes keep their built-in paths (#1874).
3881	- The config crate now carries the v0.9 HarnessPosture data model:
3882	`HarnessPosture`, `HarnessProfile`, and typed posture/compaction/tool/safety
3883	enums. The schema rejects misspelled posture names or unknown profile keys
3884	instead of silently falling back to `custom`; a pure resolver can match
3885	provider/model routes for tests and future status plumbing, while runtime
3886	provider/model posture selection remains a follow-up (#2693, #2741, #2728).
3887
3888	### Fixed
3889
3890	- MiMo default tests. Guarded Xiaomi MiMo default-model tests against ambient CI provider environment variables.
3891	- Stream/body decode failures such as `Stream read error: error decoding
3892	response body` are now classified as recoverable network interruptions
3893	instead of generic internal errors, keeping the transcript and triage metadata
3894	aligned with the existing stream retry path (#2847). Thanks
3895	@qamranmushtaq-collab for the Windows/npx DeepSeek report.
3896	- The TUI footer, `/status`, `/mcp` manager, and command-palette MCP entries
3897	now count trusted workspace-local `.codewhale/mcp.json` servers together with
3898	the global MCP config, matching `codewhale mcp list` for merged global +
3899	project setups (#2787). Thanks @yekern for the detailed reproduction.
3900	- AltGr key chords in the composer no longer get swallowed by sidebar shortcuts
3901	on AZERTY and other international layouts, so characters such as `@`, `#`,
3902	`$`, `!`, and `%` can be entered normally (#2863, #2867). Thanks
3903	@ousamabenyounes for the fix and report.
3904	- Sub-agent shell completions now refresh the workspace branch/status chip
3905	immediately, and `/subagents` plus the Agents sidebar show each sub-agent's
3906	current workspace branch when it is running in a child worktree.
3907	- Authentication failures now include redacted request context such as provider,
3908	base URL authority, model, key source, key type, and key fingerprint, making
3909	stale provider, endpoint, or API-key state diagnosable without exposing the
3910	secret (#2665, #2792). Thanks @mvanhorn for the implementation.
3911	- Browser-opening actions now compile on non-desktop targets by delegating the
3912	unsupported-platform error to the shared URL opener instead of hiding the TUI
3913	wrapper behind a narrower macOS/Linux/Windows cfg. Thanks @ci4ic4 for the
3914	NetBSD/pkgsrc packaging report and fix (#2789).
3915	- MCP tool routing now preserves server names that contain underscores.
3916	`parse_prefixed_name` matches the qualified `mcp_<server>_<tool>` name against
3917	the set of registered server names and prefers the longest match, so tools on
3918	a server like `my_db` are reachable and an overlapping `my` / `my_db` pair
3919	routes correctly. Falls back to the legacy first-underscore split when no
3920	registered server matches (#2744).
3921	- Schema-hydrated deferred tools no longer render as a completed run. The first
3922	use of a deferred tool returns a schema-hydration result instead of executing;
3923	the transcript and sidebar now show "tool loaded — retry required" via a
3924	dedicated hydrated status, so it is no longer indistinguishable from a real
3925	successful execution. A hydrated row also ranks with active work rather than
3926	completed successes (#2648).
3927	- `codewhale sessions` now shows `codewhale resume <session-id>` in the footer
3928	instead of the invalid dispatcher command `codewhale --resume <session-id>`
3929	(#2758, #2760).
3930	- TUI HTTP clients now install the Rustls ring crypto provider before building
3931	`reqwest` clients, covering engine, runtime API, tool, MCP, config, and skill
3932	download paths. This keeps the no-provider TLS build from panicking during
3933	tests or embedded startup paths that do not enter through the main binary.
3934	- Prompt byte-stability tests now pin their temporary home and skills
3935	environment under the shared test-env lock so global skill directories cannot
3936	perturb deterministic prompt bytes during parallel test runs.
3937
3938	### Community
3939
3940	Thanks to @sximelon for reporting and fixing the saved-session resume
3941	footer hint (#2758, #2760), @cyq1017 for the custom
3942	DuckDuckGo-compatible search endpoint, custom completion sound file support,
3943	restore-listing implementation, and pending-input delivery-mode label work
3944	(#2510, #2512, #2513, #2532, #2054),
3945	@Artenx for the private-search endpoint report (#2436),
3946	@LHqweasd for the Windows custom notification sound request (#2484),
3947	@wywsoor for the broader macOS/iTerm rollback UX report (#2494),
3948	@HUQIANTAO for the `web_run` lock-splitting work (#2502), turn-metadata
3949	prefix-cache stability work (#2517), and project-context cache direction
3950	(#2636), @xyuai for canonical CodeWhale
3951	settings-path migration work (#2730), @gaord for the runtime thread
3952	workspace update and completed-thread save APIs (#2640, #2639),
3953	@shenjackyuanjie for the
3954	HarmonyOS/OpenHarmony port and MatePad Edge validation trail (#2634),
3955	@ousamabenyounes for the AZERTY AltGr composer shortcut fix (#2863,
3956	#2867), @reidliu41 for the hotbar action-registry foundation (#2866), and
3957	@ljm3790865 for the multi-tab core/persistence foundation and broader
3958	collaboration direction (#2864, #2753),
3959	@aboimpinto for the direct command-support boundary cleanup in #2871 and
3960	the broader #2851/#2791 command-layer design direction,
3961	@idling11 for the PlanArtifact direction in Plan mode (#2733), the dense
3962	tool-call transcript collapse/sidebar detail direction (#2738, #2734, #2692,
3963	#2694), and the HarnessPosture config model for provider/model posture (#2741,
3964	#2693), and
3965	@h3c-hexin for the tool-agent model inheritance and configured
3966	`skills_dir` fixes (#2736, #2737), @AresNing for the turn-end observer hook
3967	work (#2578), and @tdccccc for the approval key-detail and shell-preview
3968	work (#1991, #2269). Thanks also to @qiyuanlicn for the
3969	checkpoint/resume report that shaped the sub-agent recovery slice (#2029),
3970	@bevis-wong for the long-running shell/task liveness report (#1786),
3971	@shuxiangxuebiancheng for the third-party OpenAI-compatible path report
3972	(#1874), @hongqitai and @cyq1017 for the follow-up path-suffix PR
3973	review trail (#2508, #2506), @NASLXTO and @wuxixing for the
3974	large-workspace startup reports (#697, #1827), and @linzhiqin2003 and
3975	@merchloubna70-dot for earlier context-cap and startup-diagnosis work that
3976	shaped this bounded fallback. Thanks also to @cyq1017 for the MCP
3977	underscore-server-name fix and Xiaomi MiMo pricing (#2747, #2744, #2750, #2731)
3978	and @puneetdixit200 for independently diagnosing and fixing the same MCP
3979	underscore issue (#2746, #2744), @mvanhorn for the hydrated deferred-tool
3980	render fix (#2757, #2648), and @xyuai for the Xiaomi MiMo Token Plan region
3981	documentation (#2756, #2735). Additional thanks to @Implementist for Plan
3982	prompt scrolling, wrapping, and display-width fixes, @jrcjrcc for the
3983	Windows sub-agent completion render-width fix, and @punkcanyang for the
3984	original `/init` implementation harvested through #2771/#2745.
3985
3986	## [0.8.53] - 2026-06-03
3987
3988	### Added
3989
3990	- Hugging Face Inference Providers. Added `huggingface` as a native
3991	provider route (`/provider huggingface`). Supports `HUGGINGFACE_API_KEY`
3992	or `HF_TOKEN` for auth, `HUGGINGFACE_BASE_URL` and `HUGGINGFACE_MODEL`
3993	for overrides, and `deepseek-ai/DeepSeek-V4-Pro` / `deepseek-ai/DeepSeek-V4-Flash`
3994	as default models. Org-prefixed model IDs pass through.
3995
3996	### Fixed
3997
3998	- Agent-mode shell error copy. The missing-tool error for shell tools
3999	now directs users to `allow_shell = true` instead of nudging toward YOLO
4000	mode. `/config` surfaces `allow_shell` in the Permissions section.
4001	- Provider description. `/provider` command description is now neutral
4002	instead of recommending specific providers.
4003
4004	### Community
4005
4006	Thanks to @xyuai for provider persistence, `/logout` scope clarification,
4007	provider picker key replacement, and MiMo auth cleanup work (#2714, #2715,
4008	#2717, #2718), and @RefuseOdd for configurable `path_suffix` support on
4009	OpenAI-compatible endpoints (#2558).
4010
4011	## [0.8.52] - 2026-06-03
4012
4013	### Added
4014
4015	- SiliconFlow China region provider. Added the `siliconflow-CN` provider
4016	variant for the China regional endpoint, sharing the existing
4017	`[providers.siliconflow]` credentials and `SILICONFLOW_API_KEY` slot
4018	instead of creating a second credential namespace; the provider picker and
4019	registry docs now expose the regional route explicitly (#2588, #2615).
4020	- Multimodal `/attach` image forwarding. Attached images are now sent as
4021	OpenAI-compatible `image_url` content blocks so multimodal providers can
4022	actually see image attachments (#2584, #2587, #2607).
4023	- Sub-agent lifecycle hooks and runtime metadata. Sub-agent spawn/complete
4024	hook events, mode-change runtime messages, mode metadata on turns, localized
4025	context-inspector strings, and drag-to-resize sidebar width are included in
4026	this release slice.
4027
4028	### Fixed
4029
4030	- Sub-agents now auto-cancel after stale heartbeats. Running sub-agents
4031	track manager-visible progress and are auto-cancelled after the configurable
4032	`[subagents] heartbeat_timeout_secs` window (default 300s), releasing their
4033	concurrency slot and unblocking parent turns that would otherwise wait
4034	forever (#2603, #2614, #2620).
4035	- Work panel state survives transient lock misses. The sidebar caches the
4036	last successful Work summary so checklist and strategy progress no longer
4037	disappear into "Work state updating..." while the engine briefly owns the
4038	shared todo/plan locks (#2606, #2616).
4039	- SiliconFlow-CN no longer breaks main. Filled the missing CLI provider
4040	exhaustiveness arms and removed the duplicate/unreachable TUI config arms
4041	left by the #2615 landing; direct auth now stores the China-region variant in
4042	the shared SiliconFlow provider table (#2616, #2618, #2619).
4043	- v0.8.51 image-attach closure corrected. The `/attach` multimodal fix
4044	landed after the v0.8.51 tag, so this release is the first version that
4045	actually contains it for users installing from the published release line
4046	(#2584, #2607).
4047	- Legacy SSE MCP reconnects are retryable again. Closed or reset
4048	`POST /messages` requests on stale legacy SSE sessions now trigger the same
4049	reconnect-and-retry path as closed SSE streams, removing a release-gate flake
4050	and matching the intended recovery behavior (#2597).
4051	- Cache-hit cost accounting uses one telemetry source. Mixed DeepSeek
4052	`prompt_cache_hit_tokens` and OpenAI-style `cached_tokens` usage payloads no
4053	longer infer cache misses from the wrong hit count, avoiding inflated TUI cost
4054	estimates on cached DeepSeek turns (#2567, #2609).
4055	- Cygwin/MSYS2 config paths honor exported `$HOME`. CodeWhale and legacy
4056	DeepSeek config roots now prefer a non-empty `$HOME` before falling back to the
4057	platform home resolver, while `CODEWHALE_HOME` remains the strongest explicit
4058	override (#2369, #2610).
4059
4060	### Community
4061
4062	Thanks to @xyuai (#2587), @IcedOranges (#2584), @BH8GCJ (#2588),
4063	@shenjackyuanjie (#2618, #2619), @idling11 (#2606, #2616),
4064	@AresNing (#2578), @caiyilian (#2567), @buko (#2369),
4065	@gordonlu, @encyc, and @simuusang (#2603, #2620) for reports,
4066	patches, retesting, and release-stabilization signals that shaped this pass.
4067
4068	## [0.8.51] - 2026-06-02
4069
4070	### Added
4071
4072	- Arcee AI as a direct provider. New `[providers.arcee]` config block and
4073	`ARCEE_API_KEY` / `ARCEE_BASE_URL` / `ARCEE_MODEL` environment variables,
4074	wired through CLI auth (`codewhale auth set --provider arcee`), the TUI
4075	provider picker, and the model registry. The default direct-API model is
4076	`trinity-large-thinking` (reasoning-capable, 262K context and 262K max
4077	output); `trinity-large-preview` (262K context, non-reasoning) and
4078	`trinity-mini` (128K context) are also selectable. OpenRouter's
4079	`arcee-ai/trinity-large-thinking` route remains separate.
4080	- Arcee Cloudflare-WAF compatibility. The opening turn to the Arcee gateway
4081	uses a benign read-only tool surface (`read_file`, `list_dir`, `file_search`,
4082	`grep_files`, `git_status`, `git_diff`, `checklist_write`, `update_plan`) and
4083	splits example payloads such as `python -c …` out of the system prompt, so the
4084	WAF does not reject the first request; the full tool catalog stays reachable
4085	through tool-search. `trinity-large-thinking`'s `reasoning_content` is
4086	recognized and replayed on tool-call turns.
4087	- Expanded model catalog. Added context-window, max-output, and
4088	reasoning-capability metadata for additional model IDs, including
4089	`qwen/qwen3.6-flash`, `qwen/qwen3.6-plus`, `qwen/qwen3.6-max-preview`, and
4090	Xiaomi MiMo v2.5 chat/ASR/TTS variants; `trinity-large-preview`'s context
4091	window was corrected to 262K.
4092	- Provider-aware model picker. The picker groups models by provider, shows
4093	per-model hints, and remembers a saved model per provider.
4094
4095	### Changed
4096
4097	- Auto-compaction is now percentage- and model-aware. The per-model
4098	threshold helper is `compaction_threshold_for_model_at_percent(model,
4099	percent)` (replacing the effort-based variant), and the default
4100	`auto_compact_threshold_percent` is 80%. Auto-compaction defaults on for
4101	models with a context window of 256K or smaller and stays opt-in for 1M-token
4102	models (e.g. DeepSeek V4) to protect prefix-cache economics, unless the user
4103	has explicitly set `auto_compact`.
4104	- Clearer provider/gateway errors. HTTP error bodies are sanitized before
4105	display — HTML interstitials and Cloudflare "Access Denied" pages collapse to
4106	a one-line reason (with the ray/error ID) instead of dumping raw markup into
4107	the transcript — and 403s are split into authentication vs. authorization
4108	(gateway/WAF block) categories.
4109	- The invalid-model error now names the active provider and lists Arcee among
4110	the options.
4111
4112	### Removed
4113
4114	- The session "cycle" / checkpoint-restart system. Removed the `/cycles`,
4115	`/cycle <n>`, and `/recall` commands, the `recall_archive` tool, the
4116	cycle-handoff briefing prompt, the sidebar "cycles" lines, and the
4117	`cycle_manager` engine plumbing (`EngineConfig.cycle`, `Event::CycleAdvanced`,
4118	seam-manager cycle thresholds and flash briefings). Long sessions no longer
4119	auto-reset their context at a fixed token boundary — reclaim budget with
4120	`/compact` or model-aware auto-compaction instead. Existing on-disk cycle
4121	archives are left untouched but are no longer read or written.
4122
4123	### Fixed
4124
4125	- Assistant turns no longer leave an orphaned role glyph (the stray "blue dot")
4126	when a turn streams only whitespace between reasoning and a tool call.
4127	- Scrolling the mouse wheel over the right-hand sidebar no longer leaks into the
4128	transcript scroll.
4129	- The sidebar hover tooltip now appears only for truncated lines, sits below the
4130	cursor, and uses a neutral surface color instead of the warning-orange
4131	highlight that overlapped neighbouring rows.
4132	- Corrected the README's description of the Constitution (Article VII is the
4133	hierarchy itself; Article II's truth duty overrides even a user request) to
4134	match `prompts/base.md`.
4135	- Repaired release-blocking unit and integration tests left failing by the
4136	cycle-removal and compaction-threshold refactors (relay instruction,
4137	model-reject message, compaction budget, mock-LLM threshold helper).
4138	- Fixed DEC private-mode CSI fragment leakage into composer text after
4139	terminal resets, restoring clean prompt editing (#2592).
4140	- The engine now recovers from turn-level panics instead of killing the
4141	main event loop, keeping the session alive through transient failures
4142	(#2583, #1269).
4143	- Deeply nested files are now discoverable via @-mention and Ctrl+P file
4144	picker; the default walk depth was relaxed to handle monorepo layouts (#2488).
4145	- Command-palette selection stays visible when scrolling through long lists
4146	instead of scrolling off-screen (#2590).
4147	- exec_shell child processes now inherit .NET/NuGet and Windows app-data
4148	environment variables, fixing toolchain resolution on Windows (#1857).
4149	- A warning is emitted when shell/sandbox config keys are nested under
4150	unknown top-level sections instead of being silently ignored (#2589).
4151	- Diff-render now preserves leading whitespace in patch content lines,
4152	fixing an extra-space regression in PR previews (#2591). Thanks @zlh124.
4153	- Model selection from the /model command now persists per-provider across
4154	restarts, with a warning when persistence fails.
4155
4156	### Community
4157
4158	Thanks to @zlh124 (#2591) and @reidliu41 (#2601) for the fixes
4159	harvested into this release. Thanks also to @idling11 (#2602),
4160	@gordonlu (#2585), @cyq1017 (#2593), @xyuai (#2587, #2584),
4161	and @IcedOranges (#2584) for reports, drafts, and investigations
4162	that shaped this release cycle.
4163
4164	## [0.8.50] - 2026-06-02
4165
4166	### Added
4167
4168	- Added a Windows NSIS installer release artifact and classroom/lab deployment
4169	checklist, harvested from #2045 for #1987. The release workflow now builds
4170	`CodeWhaleSetup.exe` from the canonical Windows binaries, and the installer
4171	adds/removes only the exact current-user PATH entry.
4172	- Added deterministic session timestamps in session listings, receipt-export
4173	boundary docs, and current-model turn metadata for routed/auto sessions.
4174	- Added exact AtlasCloud provider-hinted model ID pass-through for explicit
4175	`vendor/model-id` selections, harvested from #2569 without freezing a
4176	brittle provider catalog.
4177	- Added Xiaomi MiMo speech/TTS support with a `codewhale speech` CLI command,
4178	`tts` tool alias, and config wiring for voice-design and voice-clone models,
4179	harvested from #2560.
4180	- Added a three-zone immutable prefix diagnostic layer (FrozenPrefix Phase 2)
4181	that logs cache-prefix drift at debug level without blocking requests,
4182	harvested from #2514.
4183	- Added a Cache Guard CI integration test suite simulating prefix-cache
4184	behaviour across nine scenarios, gated behind `CODEWHALE_CACHE_GUARD=1`,
4185	harvested from #2503.
4186	- Added a plan-mode byte-stability invariant test verifying that the tool
4187	catalog head remains byte-identical across mode toggles, harvested from
4188	#2519.
4189	- Localized all 15 `/queue` command messages across 7 shipped locales,
4190	harvested from #2568.
4191	- Added localized `FanoutCounts` MessageId for i18n of the aggregate worker
4192	stats line in fanout cards, harvested from #2566.
4193	- Added contribution gate CI workflows (PR gate, issue gate, contributor
4194	approval) with a dry-run mode, harvested from #2565.
4195
4196	### Changed
4197
4198	- Hardened theme repainting and sidebar color use so theme switches do not
4199	leave stale Whale-dark panel colors behind.
4200	- Made legacy config migration visible when CodeWhale copies old DeepSeek-era
4201	config into the CodeWhale config path.
4202
4203	### Fixed
4204
4205	- Fixed `/context` to use the effective routed model for context-window
4206	budgeting, so DeepSeek V4 routes report the 1M-token window and legacy
4207	DeepSeek routes keep the 128K fallback.
4208	- Fixed npm wrapper version output so `--version` prefers the installed binary
4209	version instead of stale package metadata when both are available.
4210	- Fixed multiline composer arrow navigation so holding Up/Down at the first or
4211	last line no longer replaces the current draft with prompt history.
4212	- Fixed foreground `exec_shell` output collection so timeout and inherited-pipe
4213	cleanup cannot wedge later tool calls behind the global tool lock.
4214	- Clarified the English DeepSeek account-balance footer chip from `bal` to
4215	`balance` so it is less likely to be mistaken for session spend.
4216	- Fixed truncated subagent tool calls and repeated truncated subagent responses
4217	so they return model-visible errors instead of silently failing.
4218	- Moved Paste to the first position in the right-click context menu so users
4219	copying text from the output area can paste with a single left-click instead
4220	of navigating past cell-specific actions.
4221
4222	### Community
4223
4224	Thanks to @ZhulongNT (#2045), @cyq1017 (#2521, #2536, #2537, #2559,
4225	#2562, #2563, #2564), @HUQIANTAO (#2527, #2519, #2503), @lucaszhu-hue
4226	(#2569), @idling11 (#2573), @encyc (#2514), @xyuai (#2560),
4227	@gordonlu (#2568, #2566), and @nightt5879 (#2565) for the work
4228	harvested into this release pass. Thanks
4229	also to issue reporters and verification helpers including @New2Niu
4230	(#2561), @buko (#2533, #2369), @wywsoor (#2494), @ctxyao (#2556),
4231	@Dr3259 (#2380), @caiyilian (#2567), and @chinaqy110 (#2571) for
4232	reports and acceptance details that shaped these fixes, plus the WeChat/Chinese
4233	UX reports relayed during the final triage pass.
4234
4235	## [0.8.49] - 2026-06-01
4236
4237	### Added
4238
4239	- Added the missing `[providers.moonshot]` example block for Moonshot/Kimi,
4240	documented `completion_sound`, and refreshed the tool-surface docs for the
4241	current registry, including `finance`, `web.run`, git history tools, memory,
4242	OCR, and other registered tools.
4243
4244	### Changed
4245
4246	- Hardened prefix-cache fingerprints to hash API-visible tool schema details,
4247	not just tool names, so schema and description drift invalidates cached
4248	prefixes before it can confuse model calls (#2264).
4249	- Kept `finance` registered independently from web-search tools and prevented
4250	duplicate web/patch tool registration in agent and YOLO modes.
4251
4252	### Fixed
4253
4254	- Fixed the DeepSeek V4-Pro cost estimate after the 2026-05-31 pricing cutoff:
4255	the post-promotion official rate remains one quarter of the original price,
4256	so CodeWhale no longer shows roughly 4x too much after June 1 (#2489).
4257	- Fixed Kimi/Moonshot tool schema normalization by moving parent `type` fields
4258	into `anyOf`/`oneOf` items, with regression coverage for nested schema shapes
4259	that could otherwise still fail Kimi validation (#2438).
4260	- Fixed raw ANSI/SGR fragments leaking into footer, shell-label, and sidebar
4261	activity text during active tool execution (#2481).
4262	- Fixed `[tui]` config parsing when `status_items` is omitted, restoring the
4263	documented default footer order for older and hand-written configs (#2483).
4264	- Fixed a shell env-scrubbing test so it does not depend on the user's default
4265	shell understanding POSIX parameter expansion.
4266	- Removed stale `qwen/qwen3.7-max` references left in `config.example.toml`
4267	after the v0.8.48 preset removal.
4268
4269	### Community
4270
4271	Thanks to @idling11 (#2480, #2485), @reidliu41 (#2493),
4272	@hongqitai (#2495), and @encyc (#2477) for the fixes and reliability
4273	work harvested into this release.
4274
4275	Thanks also to reporters and verification helpers whose issues shaped the
4276	release: @A-Corner (#2438), @taiwan988 (#2483), @AiurArtanis
4277	(#2489), and @Hmbown (#2481).
4278
4279	## [0.8.48] - 2026-05-31
4280
4281	### Added
4282
4283	- Recent large OpenRouter model presets. Added completions, aliases,
4284	routing metadata, and docs for Arcee Trinity Large Thinking,
4285	MiniMax M3, Xiaomi MiMo v2.5, Qwen 3.6 open-weight models, Kimi K2.6,
4286	GLM 5.1, Tencent Hy3, Gemma 4, and Nemotron (#2461).
4287	- Provider and web-search expansion. Added Xiaomi MiMo provider support,
4288	SiliconFlow, AtlasCloud static models, Volcengine Ark search, Baidu AI
4289	Search, provider-picker coverage, and richer custom-provider docs
4290	(#2246, #1868, #2421, #2429, #2371, #2394, #2287).
4291	- Workflow and tool ergonomics. Added the external-tool abstraction,
4292	pluggable TUI tool registry, custom slash-command allowed-tools enforcement,
4293	opt-in Unix socket hook sink, message-submit transform hooks, tool-cache
4294	introspection, and cache warmup-key tracking (#2294, #2420, #2326, #2430,
4295	#2434, #2423, #2424).
4296	- TUI workflow features. Added `/purge`, `/hunt`, thinking fold/unfold,
4297	terminal-transparent/Solarized Light/Claude themes, footer branch display,
4298	macOS notifications, intent summaries before approval prompts, and the
4299	mobile runtime smoke/QR workflow (#2387, #2306, #2385, #2276, #2270, #2267,
4300	#2347, #2260, #2389, #2403).
4301	- Platform and localization coverage. Added RISC-V prebuilt-binary
4302	support, Vietnamese localization, Java/Vue language-server defaults, runtime
4303	event envelopes, task migration/env isolation fixes, and state-message
4304	parent IDs for future forks (#2383, #2358, #2367, #2252, #2272, #2308).
4305
4306	### Removed
4307
4308	- Qwen 3.7 Max OpenRouter preset. Removed from the model registry, docs,
4309	and examples. Qwen 3.7 Max is a hosted model, not open-source; the preset
4310	will return when an open-weight Qwen 3.7 release ships.
4311
4312	### Changed
4313
4314	- Release hardening. CI now runs clippy/docs checks, web frontend lint and
4315	type checks, provider-registry drift checks, broader crate docs, and a large
4316	unit-test pass across core, MCP, TUI core, app-server, and web helpers
4317	(#2443, #2444, #2274, #2446-#2460, #2440, #2441, #2450, #2448, #2454).
4318	- Prompt, context, and model routing behavior. Stabilized project-context
4319	pack ordering, exposed the auto route in turn metadata, allowed embedders to
4320	override or inline constitutional instructions, moved volatile environment
4321	context below the prompt boundary, and used the effective model for
4322	compaction budgeting (#2418, #2410, #2356, #2311, #2314, #2437).
4323	- Execution policy foundation. Added typed ask-rule groundwork and kept
4324	`task_shell_start` gated behind `allow_shell`, preparing the permission UI
4325	path without broadening default shell access (#2404, #2384).
4326
4327	### Fixed
4328
4329	- Windows and shell reliability. Suppressed alt-screen logging on Windows,
4330	added the Windows batch launcher path, kept task shell tools eagerly loaded,
4331	loaded exec-shell companion tools consistently, covered controlling-terminal
4332	behavior, and improved shell tool availability errors (#2259, #2295, #1861,
4333	#2271, #2331, #2414, #2412).
4334	- Session and transcript durability. Fixed hidden-worktree discovery
4335	saturation, stalled in-progress turn recovery, session persistence
4336	truncation, cached-transcript user-message highlighting, large tool-output
4337	receipting, session-detail block serialization, and deterministic composer
4338	history flushing (#2273, #2329, #2283, #2395, #2386, #2297, #2265, #2375).
4339	- Provider and UI polish. Accepted custom model IDs in `/model` for
4340	non-DeepSeek providers, fixed Feishu per-chat model switching, localized
4341	context-menu labels, updated terminal tab naming, kept picker selections
4342	visible, allowed slash-space composer messages, and improved PDF text
4343	cleanup (#2280, #2149, #2320, #2319, #2324, #2316, #2266).
4344	- Security and dependency hygiene. Bumped `tar` and `qs`, trusted fake-IP
4345	placeholder ranges only when explicitly configured, decoded Bing result URL
4346	entities, fixed legacy MCP SSE connections, and replaced manual tool error
4347	display code with `thiserror` derives (#2364, #2425, #2355, #2245, #2301,
4348	#2442).
4349
4350	### Community
4351
4352	Thanks to contributors whose PRs landed or were harvested in this release:
4353	@cy2311 (#1861),
4354	@LING71671 (#1902, #2287, #2292),
4355	@axobase001 (#1968, #2296, #2297, #2298),
4356	@dzyuan (#1993),
4357	@mvanhorn (#2107, #2236),
4358	@malsony (#2129),
4359	@gaord (#2133, #2265, #2285),
4360	@yuanchenglu (#2149),
4361	@idling11 (#2161, #2266, #2306),
4362	@h3c-hexin (#2245, #2311, #2313, #2314, #2354, #2355, #2356),
4363	@AdityaVG13 (#2246),
4364	@Sskift (#2248),
4365	@cyq1017 (#2252, #2332, #2375),
4366	@HUQIANTAO (#2257, #2267, #2283, #2384, #2385, #2389, #2403, #2440-#2458, #2460),
4367	@New2Niu (#2260),
4368	@AiurArtanis (#2270),
4369	@Lee-take (#2272),
4370	@nightt5879 (#2274, #2344, #2347, #2373),
4371	@AresNing (#2278, #2318/#2434),
4372	@AccMoment (#2281),
4373	@reidliu41 (#2291, #2316, #2324, #2357, #2366, #2386, #2431),
4374	@aboimpinto (#2290, #2294, #2295, #2326, #2433),
4375	@zhuangbiaowei (#2301),
4376	@donglovejava (#2302, #2329, #2330, #2331),
4377	@hongqitai (#2308, #2432),
4378	@zlh124 (#2319, #2320, #2325),
4379	@encyc (#2336, #2338),
4380	@Implementist (#2426/#2429, #2439),
4381	@lihuan215 (#2333/#2430),
4382	@LeoAlex0 (#2388, #2395),
4383	@jimmyzhuu (#2371),
4384	@rockyzhang (#2383),
4385	@mo-vic (#2387),
4386	@hufanexplore (#2367),
4387	@hoclaptrinh33 (#2358),
4388	and @BryonGo (#2437).
4389
4390	Thanks also to reporters and verification helpers whose issues, patches,
4391	screenshots, logs, or retest requests shaped this release: @buko (#2359,
4392	#2360, #2369, #2469), @yyyCode, @gaslebinh-glitch, @Dr3259,
4393	@lpeng1711694086-lang, @VerrPower, @yan-zay, @jretz,
4394	@Neo-millunnium, @caeserchen, @T-Phuong-Nguyen, @zhyuzhyu,
4395	@0gl20shk0sbt36, @hatakes, @goodvecn-dev, @bevis-wong,
4396	@PurplePulse, and @nbiish.
4397
4398	## [0.8.47] - 2026-05-26
4399
4400	### Added
4401
4402	- **Closed-loop verification gate, runtime goal tools, DuckDuckGo default
4403	web search, Xiaomi MiMo, global AGENTS.md fallback, `/new`, composer
4404	selection, transcript copy cleanup, CNB mirror support, and Docker toolbox
4405	docs** shipped in the published v0.8.47 release.
4406
4407	### Changed
4408
4409	- **DeepSeek-first release framing, project-context logging, state-root
4410	migration, CodeWhale README paths, and reasoning-locale behavior** were
4411	finalized for the v0.8.47 release.
4412
4413	### Fixed
4414
4415	- **Provider picker scrolling, auto model restore, cache-inspect hashing,
4416	insecure LAN provider guard, large tool-output compaction, queued-message
4417	ordering, shell/Yolo startup handling, Windows alt-screen logging, and
4418	tooltip contrast** were fixed in the v0.8.47 release.
4419
4420	### Community
4421
4422	Thanks to contributors credited in the v0.8.47 GitHub Release, including
4423	@Fire-dtx, @imkingjh999, @harvey2011888, @victorcheng2333,
4424	@IIzzaya, @PurplePulse, @cyq1017, @knqiufan,
4425	@Colorful-glassblock, @hongqitai, @EmiyaKiritsugu3,
4426	@aboimpinto, @HUQIANTAO, @mvanhorn, @LING71671, and
4427	@reidliu41.
4428
4429	## [0.8.46] - 2026-05-26
4430
4431	### Added
4432
4433	- *`CODEWHALE_` env aliases.** `CODEWHALE_PROVIDER`, `CODEWHALE_MODEL`,
4434	and `CODEWHALE_BASE_URL` are public product-scoped aliases that take
4435	precedence over the legacy `DEEPSEEK_` forms. The `DEEPSEEK_` names
4436	remain accepted for back-compat.
4437	- Platform archive bundles. Release artifacts now ship as per-platform
4438	archives (`tar.gz` for Linux/macOS, `.zip` for Windows) containing both
4439	`codewhale` and `codewhale-tui` binaries plus an install script. No more
4440	downloading two loose files and guessing which ones to pick (#2193).
4441	- Windows portable archive. `codewhale-windows-x64-portable.zip` ships
4442	the two binaries without an install script for USB-stick distribution
4443	(#2193).
4444	- Web install download tile. The website install page now shows a
4445	platform-aware download tile with arch detection, SHA256 checksum
4446	display, and China mirror links, instead of burying the download behind
4447	the Cargo instructions (#2192).
4448	- Whale dark palette refresh. Better contrast and layer separation
4449	across the TUI color scheme (#2197).
4450	- Auto-collapse finished sub-agents. Completed sub-agent sessions now
4451	collapse automatically in the sidebar, reducing noise during long
4452	sessions (#2195).
4453	- Shell-running status chip. A `⏳ shell running` chip appears in the
4454	TUI footer while background shell tasks are active (#2194).
4455	- Sandbox process hardening (Linux). `PR_SET_DUMPABLE=0`,
4456	`NO_NEW_PRIVS`, and `RLIMIT_CORE=0` are applied at shell startup to
4457	harden child processes against inspection and privilege escalation
4458	(#2183).
4459	- CONTRIBUTING.md cross-links. Issue and PR templates are now
4460	cross-linked from CONTRIBUTING.md to improve contributor onboarding
4461	(#2203).
4462
4463	### Changed
4464
4465	- DeepSeek-first focus. v0.8.46 refocuses on delivering the
4466	highest-quality experience on DeepSeek first. Additional first-class
4467	provider paths are planned for v0.9.0 after the core DeepSeek workflow
4468	is solid.
4469
4470	### Fixed
4471
4472	- Model name casing preserved. `normalize_model_name_for_provider` no
4473	longer lowercases user-set model names such as `DeepSeek-V4-Flash`,
4474	preventing API lookup failures on case-sensitive backends (#2109).
4475	- Esc in model picker applies selection. Dismissing the model picker
4476	with Esc now applies the last-highlighted choice instead of reverting
4477	(#2196).
4478	- Web install downloads both binaries. The `install-binary.tsx`
4479	snippet now fetches both `codewhale` and `codewhale-tui`, fixing the
4480	`MISSING_COMPANION_BINARY` trap on fresh npm installs (#2191).
4481	- `grep_files` skips large directories. The pure-Rust search tool
4482	now skips known-large directories (`.git`, `node_modules`, `target`)
4483	before walking, preventing hangs on deep or slow filesystems.
4484	- Version-update hint uses semver. The update notification in the
4485	footer now compares versions semantically instead of lexicographically,
4486	so `0.8.10 > 0.8.9` is recognized correctly.
4487	- CVE-2026-8723 in feishu-bridge. Bumped `qs` to `>=6.15.2` in the
4488	Feishu bridge integration (#2198).
4489
4490	### Community
4491
4492	Thanks to new contributors whose PRs landed in this release:
4493	@donglovejava (#2154, #2163, #2166, #2167, #2168),
4494	@encyc (#2152),
4495	@saieswar237 (#2178),
4496	@sximelon (#2174),
4497	@nanookclaw (#2135),
4498	@Sskift (#2119),
4499	@xin1104 (#2105),
4500	@mrluanma (#2059),
4501	@Lellansin (#2055),
4502	@zhuangbiaowei (#2145),
4503	@aboimpinto (#1872),
4504	and continuing contributors @reidliu41, @cyq1017, @idling11,
4505	@h3c-hexin, @wdw8276, @zlh124, and @jeoor.
4506
4507	## [0.8.45] - 2026-05-25
4508
4509	### Added
4510
4511	- RLM session objects. `rlm_open` can now load `session://` refs,
4512	exposing the active prompt, history, and session data as symbolic objects
4513	inside RLM REPLs (#2047).
4514	- Command palette voice input. The command palette can launch a configured
4515	speech-to-text helper and show footer status while transcription runs
4516	(#2047).
4517	- Moonshot/Kimi provider. Moonshot/Kimi is now a first-class provider,
4518	including API-key auth, model completion, CLI auth, secret-store
4519	integration, and optional Kimi CLI credential reuse.
4520	- Deterministic whale-species sub-agent names. Sub-agents now get stable,
4521	human-readable whale-species nicknames (e.g. "Beluga", "Orca") while
4522	preserving the raw agent ID in the popup (#2035, #2016).
4523	- `/balance` command scaffold. Registered the `/balance` slash command
4524	as a placeholder for future provider billing queries (#2035, #2019).
4525	- Readable `/restore` snapshot labels. Snapshot labels now include the
4526	originating user prompt so restore listings are easier to identify. Thanks
4527	@idling11 (#2111).
4528	- Sidebar hover tooltips. Truncated Work and Tasks sidebar lines now expose
4529	their full text on hover. Thanks @idling11 (#2110).
4530
4531	### Changed
4532
4533	- AGENTS.md is now maintainer-local. The project instructions file no
4534	longer ships as a tracked repo file; it lives in maintainer-local ignored
4535	state (#2047).
4536
4537	### Fixed
4538
4539	- Sub-agent completion handoff compatibility. Completion handoffs now use a
4540	chat-template-safe role and emit before terminal updates, fixing strict
4541	OpenAI-compatible/self-hosted backends and preserving transcript ordering.
4542	Thanks @h3c-hexin and @cyq1017 (#2057, #2120).
4543	- Self-hosted context budgeting. Sub-500K self-hosted model windows now keep
4544	a usable input budget instead of disabling preflight compaction after output
4545	reservation underflow. Thanks @h3c-hexin (#2060).
4546	- Goal prompts start actionable. Goal-start prompts now open in an
4547	actionable state instead of requiring an extra nudge. Thanks @cyq1017
4548	(#2097).
4549	- Composer session title display. The composer chrome shows the current
4550	session title again and avoids grayscale luma overflow in debug builds.
4551	Thanks @wdw8276 (#2108).
4552	- Approval prompts use a one-step confirmation flow. Enter now commits the
4553	selected approval option directly, destructive warnings remain visible, and
4554	abort cancels the active turn instead of only denying the current tool call.
4555	Thanks @reidliu41 (#2143).
4556	- Model picker selection survives Esc. Dismissing the model picker with Esc
4557	no longer loses the highlighted selection. Thanks @reidliu41 (#2056).
4558	- Moonshot/Kimi sessions launch from the dispatcher. The `codewhale`
4559	wrapper now includes Moonshot/Kimi in the TUI provider allowlist, so
4560	`codewhale --provider moonshot --model kimi-k2.6` reaches the TUI instead of
4561	stopping after config resolution.
4562	- Slash recovery no longer restores command tails in the composer.
4563	Resuming a session or recovering from a crash no longer leaves stale
4564	slash-command text (e.g. `/sessions`) in the composer input (#2047, #2032).
4565	- Remembered tool approvals now update the live active turn.
4566	When the "remember" checkbox is set on an approval dialog, the active
4567	turn's auto-approve flag flips immediately instead of waiting for the
4568	next turn. Thanks @gaord (#2047, #2041).
4569	- YAML block scalars in SKILL.md frontmatter. Multi-line descriptions
4570	using `>` or `\|` indicators are now parsed correctly — folded block
4571	scalars join non-empty lines with spaces, literal scalars preserve
4572	newlines, and all three chomping modes (strip/clip/keep) are supported.
4573	Thanks @zlh124 (#1908, #1907).
4574	- User messages highlighted in the transcript. User-authored messages
4575	now render with a full-row background in the live TUI transcript, making
4576	it easier to scan prior turns. Assistant and system messages are
4577	unaffected. Thanks @reidliu41 (#1995, #1672).
4578	- Cancellable `list_dir` and `file_search`. Long directory walks and
4579	file searches now respond to user cancel/stop requests with a 30-second
4580	fallback timeout, preventing the TUI from hanging on deep or slow
4581	filesystems (#2035).
4582
4583	### Community
4584
4585	- README contributor acknowledgements resynced. The Thanks list now
4586	includes the latest contributor rows for @donglovejava, @encyc,
4587	@saieswar237, @sximelon, @nanookclaw, @Sskift, @xin1104, @mrluanma,
4588	@Lellansin, and @zhuangbiaowei, while preserving the existing @jeoor
4589	acknowledgement in the consolidated list.
4590
4591	## [0.8.44] - 2026-05-24
4592
4593	### Added
4594
4595	- `codew` convenience alias. `codew` is a short-form command that silently
4596	forwards to `codewhale`. Six fewer keystrokes, same binary. Ships with the
4597	Rust `codewhale-cli` crate and the npm `codewhale` package (#2013).
4598	- Session picker inline rename. Press `r` in the session picker (Ctrl+R)
4599	to rename the selected session inline. Type the new title, Enter to confirm,
4600	Esc to cancel (#1600).
4601	- Plan detail display. The \"Plan Confirmation\" modal now shows the plan
4602	explanation and step list from `update_plan` so you can review what was
4603	proposed before accepting (#834).
4604	- Agent team UX. Delegate cards in the transcript now show human-readable
4605	roles (scout, builder, reviewer, verifier, executor) and the completion
4606	summary instead of raw `agent_xxx` IDs (#1981).
4607	- `--continue` / `-c` CLI flag. `codewhale --continue` resumes your most
4608	recent interactive session for the current workspace.
4609
4610	### Changed
4611
4612	- App state migrates to `~/.codewhale/`. New installs write product-owned
4613	state (config, sessions, tasks, skills, logs, etc.) under `~/.codewhale/`.
4614	`~/.deepseek/` continues to work as a compatibility fallback — no data loss,
4615	no forced migration. `CODEWHALE_HOME` and `CODEWHALE_CONFIG_PATH` env vars
4616	are now supported alongside existing `DEEPSEEK_*` vars (#2011).
4617	- Project config overlay prefers `.codewhale/config.toml` before
4618	`.deepseek/config.toml`. Both are read; the CodeWhale root takes precedence.
4619	- Doctor reports active state root and whether legacy `~/.deepseek/`
4620	state is also present.
4621	- README contributor acknowledgements are current for this release.
4622	Thanks @jeoor, @LING71671, and @ousamabenyounes for the fixes and reports
4623	now reflected in the public credits.
4624	- Harvested-contribution credit audit completed. The README Thanks list now
4625	includes previously missed community helpers whose code, reports, or review
4626	notes were already credited in older changelog entries but not in the public
4627	contributor surface: @mvanhorn, @krisclarkdev, @tdccccc, @LittleBlacky,
4628	@AnaheimEX, @THatch26, @alvin1, @knqiufan, @IIzzaya, @duanchao-lab,
4629	@imkingjh999, @eng2007, @chennest, @kunpeng-ai-lab, @asdfg314284230,
4630	@maker316, @lalala-233, @muyuliyan, @czf0718, @MeAiRobot, @tiger-dog,
4631	@MMMarcinho, @lucaszhu-hue, @sandofree, @zhuangbiaowei, @NorethSea,
4632	@Jianfengwu2024, @Fire-dtx, @oooyuy92, @qinxianyuzou, @tyouter,
4633	@xulongzhe, @YaYII, @47Cid, and @JafarAkhondali.
4634	- Harvest guidance now requires GitHub-visible attribution. Maintainer
4635	harvests should preserve the original commit author where possible or add
4636	`Co-authored-by` trailers from the original PR commits, in addition to the
4637	existing `Harvested from PR #N by @handle` trailer and changelog credit.
4638	- Enter now steers when busy-waiting. When the model is busy but not
4639	actively streaming (waiting on tool results, sub-agents, or shell
4640	commands), pressing Enter tries to steer your message into the current
4641	turn instead of silently queueing it. During active streaming, Enter
4642	still queues to avoid interrupting in-flight reasoning (#2009).
4643
4644	### Fixed
4645
4646	- *`/save` no longer creates repo-local `session_.json`.** Default saves
4647	now go to the managed sessions directory instead of the current workspace.
4648	Explicit `/save path/to/file.json` exports still work as before (#2010).
4649	- Boot-time session prune caps managed sessions at 50 on every startup,
4650	preventing unbounded growth of `~/.codewhale/sessions/`.
4651	- Checkpoint path resolution no longer hardcodes `~/.deepseek/` — uses
4652	the resolved session directory instead.
4653	- Plain startup no longer auto-opens the session picker. `codewhale` and
4654	`codew` start in a fresh composer again even when saved sessions exist.
4655	Use `/sessions`, Ctrl+R, `--resume`, or `--continue` when you want to resume.
4656	- Work sidebar now refreshes immediately after `checklist_write`,
4657	`checklist_update`, and `update_plan` tool calls, matching the existing
4658	`todo_write` behavior instead of relying on the 2.5s periodic poll (#1787).
4659
4660	## [0.8.43] - 2026-05-24
4661
4662	### Fixed
4663
4664	- `grep_files` now respects the cancellation token. Long-running file
4665	searches cancel promptly instead of running to completion after the user
4666	aborts (#1839). Thanks @LING71671.
4667	- npm installer stream-pause race condition fixed. The install script now
4668	pauses HTTP response streams immediately, preventing early data loss that
4669	caused "Invalid checksum manifest line" errors (#1860). Thanks @jeoor.
4670	- Ctrl+Z restores the last cleared composer draft. Pressing Ctrl+Z in an
4671	empty composer recovers the text that was last cleared with Ctrl+U or
4672	Ctrl+S, matching the muscle memory users expect from other editors (#1911).
4673	Thanks @LING71671.
4674	- Clipboard works on non-wlroots Wayland compositors. The Linux clipboard
4675	path now tries `wl-copy` before `arboard`, fixing silent copy failures on
4676	niri, River, cosmic-comp, and GNOME mutter (#1938). Thanks @ousamabenyounes.
4677
4678	### Added
4679
4680	- `/goal` remains the persistent objective surface. Use `/goal <objective>`
4681	to set a goal and `/goal done` to mark it complete. Goal status appears in
4682	the Work sidebar with elapsed time, but it does not change Plan / Agent /
4683	YOLO mode or approval behavior. A tabbed Ralph-style Goal loop is deferred to
4684	v0.8.44 (#2007).
4685	- Post-turn receipts cite evidence for every completed turn. When a turn
4686	finishes, a receipt line shows in the transcript tail with a summary of
4687	tool calls, file changes, and evidence that supports the agent's claims.
4688	Tool evidence is collected per-turn and flushed on new dispatch.
4689	- Stall reason classification. When a turn has been running for more than
4690	30 seconds, the footer now appends a classified reason: "waiting for model",
4691	"tools executing", "sub-agents working", "compacting context", or "waiting —
4692	no recent activity".
4693	- Decision card widget for structured user input. When Brother Whale needs
4694	a choice, it surfaces a bordered card with numbered options, keyboard
4695	navigation (1-9 / j/k / arrows), and Enter/Esc to confirm or cancel.
4696	- Tasks sidebar now shows fuller turn IDs and supports copy-to-clipboard.
4697	Turn ID prefixes are widened from 12 to 16 characters for disambiguation,
4698	background job status is presented as "X running, Y completed" instead of
4699	ambiguous "X active (Y running)", and `y` / `Y` yank affordances copy the
4700	current turn ID or full status line to the system clipboard (#1975).
4701
4702	### Changed
4703
4704	- Contributor count and acknowledgement surfaces refreshed. The website
4705	fallback contributor count now reflects 98 live GitHub contributors (up from
4706	the stale 91). All three README translations (English, 中文, 日本語) now
4707	include 30+ previously unlisted contributors whose PRs were merged since
4708	April 2026.
4709	- README and web surface rebrand refinements. Crate descriptions, npm
4710	package text, and website copy now consistently position CodeWhale as
4711	open-model-first and provider-spanning, with DeepSeek V4 as the first-class
4712	path.
4713	- New contributor names added to README acknowledgements. Thanks to
4714	@Apeiron0w0, @aqilaziz, @ChaceLyee2101, @ComeFromTheMars, @CrepuscularIRIS,
4715	@dst1213, @eltociear, @fuleinist, @greyfreedom, @h3c-hexin, @heloanc,
4716	@hxy91819, @J3y0r, @JiarenWang, @jinpengxuan, @KhalidAlnujaidi, @laoye2020,
4717	@lbcheng888, @linzhiqin2003, @Liu-Vince, @lixiasky-back, @pengyou200902,
4718	@punkcanyang, @Rene-Kuhm, @SamhandsomeLee, @sockerch, @sternelee,
4719	@Wenjunyun123, @whtis, and @wuwuzhijing for the translations, typo fixes,
4720	docs polish, and small UX improvements that landed across the 0.8.42 →
4721	0.8.43 cycle.
4722
4723	### Security
4724
4725	- Thinking blocks can be collapsed/expanded via keyboard. Space on an
4726	empty composer toggles the focused thinking cell between collapsed and
4727	expanded, complementing the existing mouse right-click context menu (#1972).
4728	- Sub-agent completion events no longer delayed to the next turn. The turn
4729	loop now drains late-arriving sub-agent completions at the final checkpoint
4730	before breaking, so child-agent sentinels surface immediately instead of
4731	appearing in the following turn (#1961).
4732	- `codewhale doctor` now referenced correctly in SSE timeout errors.
4733	The error message shown when SSE streams fail to connect now points users to
4734	`codewhale doctor` (not the legacy `deepseek doctor`).
4735
4736	## [0.8.42] - 2026-05-24
4737
4738	### Changed
4739
4740	- CodeWhale now ships with the Brother Whale agent identity prompt. The
4741	built-in system prompt frames the agent as trusted, calm, careful, and
4742	responsible, and adds the coordination principle that great intelligence
4743	creates spaces where future intelligences can work together.
4744	- **CodeWhale positioning is clarified as DeepSeek-first and open-model
4745	oriented.** README, rebrand notes, crate metadata, and npm package text now
4746	describe CodeWhale as an agentic terminal for open source and open-weight
4747	coding models while preserving the official DeepSeek provider as first-class.
4748	- Model auto-routing is documented separately from TUI modes. README and
4749	modes docs now reserve "mode" for Plan / Agent / YOLO, describe
4750	`--model auto` as model/thinking routing, and name the fast
4751	`deepseek-v4-flash` thinking-off seam as Fin.
4752	- Rebrand shim docs now match the v0.8.x transition window. The npm and
4753	migration notes no longer imply the legacy `deepseek-tui` package/shims
4754	expired immediately after v0.8.41.
4755
4756	### Fixed
4757
4758	- User-authored messages render as literal plain text. Leading whitespace,
4759	whitespace-only lines, repeated spaces, and Markdown-looking `#` / `-` text
4760	now survive in transcript history, while assistant messages still render
4761	Markdown normally.
4762	- English turns stay English after localized context. The Brother Whale
4763	identity and base language rules no longer inject native-script examples into
4764	the English prompt path, and the prompt now calls out localized READMEs, issue
4765	text, file contents, and tool results as data rather than language signals.
4766	- Stream decode failures no longer leave the turn visually stuck. The UI
4767	now marks an active turn failed and flushes live cells as soon as the engine
4768	emits a stream error, so the sidebar/footer recover without requiring
4769	Ctrl+C (#1960).
4770	- RLM contexts now expose `_ctx`. Persistent RLM REPLs bind `_ctx` as a
4771	compatibility alias for the loaded source alongside `_context` and
4772	`content`, and the prompt/docs call out the exact names (#1962).
4773	- `handle_read` is easier to recover from. The tool keeps accepting full
4774	`var_handle` objects directly, adds `introspect: true` for size/projection
4775	hints, and validation failures now include copy-pasteable examples (#1963).
4776	- The help picker keeps the selected row visible while scrolling. `/help`
4777	now budgets against the real modal body height, wraps Up/Down navigation,
4778	and uses a stronger selected-row highlight (#1964).
4779	- Unicode `git_status` paths stay readable. Chinese and other non-ASCII
4780	repository paths now survive status parsing and display cleanly (#1936,
4781	#1953).
4782	- Project-local and configured skills appear in the slash menu. Workspace
4783	skills and configured skill directories now feed the command picker instead
4784	of only the bundled set (#1955, #1956).
4785	- Repeated Tab mode switching no longer stacks composer-obscuring toasts.
4786	The mode-switch notification now deduplicates instead of accumulating rows
4787	over the composer (#1926, #1957).
4788	- Local tool UX surfaces are clearer. `github_close_pr` now has the same
4789	guarded closure workflow as issue close, `handle_read` redirects artifact
4790	refs to `retrieve_tool_result`, Plan handoffs use plainer wording, and shell
4791	rows/sidebar tasks show the actual running command instead of placeholder
4792	labels.
4793
4794	### Thanks
4795
4796	Thanks to cyq ([@cyq1017](https://github.com/cyq1017)) for the Unicode
4797	`git_status`, local/configured skill discovery, and mode-switch toast fixes in
4798	#1953, #1956, and #1957. Thanks to **Reid
4799	([@reidliu41](https://github.com/reidliu41))** for the help picker scrolling
4800	and selection fix in #1964.
4801
4802	## [0.8.41] - 2026-05-23
4803
4804	### Changed
4805
4806	- Project renamed to codewhale. The canonical CLI dispatcher is now
4807	`codewhale` (was `deepseek`) and the TUI runtime is `codewhale-tui`
4808	(was `deepseek-tui`). The 14 workspace crates are renamed from
4809	`deepseek-` / `deepseek-tui-` to `codewhale-` / `codewhale-tui-`.
4810	The npm wrapper package is now `codewhale` (was `deepseek-tui`). See
4811	[docs/REBRAND.md](docs/REBRAND.md) for migration notes.
4812	- DeepSeek provider integration is unchanged. `DEEPSEEK_*` env vars,
4813	model IDs (`deepseek-v4-pro`, `deepseek-v4-flash`, the legacy
4814	`deepseek-chat` / `deepseek-reasoner` aliases), the
4815	`https://api.deepseek.com` host, and the `~/.deepseek/` config
4816	directory are all preserved.
4817
4818	### Deprecated
4819
4820	- The `deepseek` and `deepseek-tui` binary names continue to ship as
4821	tiny shims that print a one-line warning and forward argv to the
4822	renamed binaries. They will be removed in v0.9.0.
4823	- The `deepseek-tui` npm package continues to publish for one release
4824	cycle as a no-`bin` deprecation shim whose postinstall directs users
4825	to `npm install -g codewhale`. It will be removed in v0.9.0.
4826
4827	### Fixed
4828
4829	- Windows CI spillover tests are isolated. Tool-result deduplication
4830	tests now use a temporary spillover root guarded by the existing global
4831	spillover mutex, removing the shared-state race that made Windows CI fail
4832	unrelated PRs (#1943).
4833	- Terminated sub-agents keep `agent_eval` recoverable. Evaluating a
4834	completed child session now returns the available transcript result instead
4835	of losing the final output (#1738, #1928).
4836	- Bare `@/` completions no longer freeze the TUI. File-mention
4837	completion skips bare separator and dot tokens so Windows/WSL2 workspaces
4838	do not trigger an eager 4096-entry filesystem walk on the UI thread
4839	(#1921, #1929).
4840	- Enter paths avoid synchronous UI-thread waits. Composer history writes,
4841	offline queue persistence, feedback URL launching, and clipboard fallback
4842	helpers now run off the hot Enter path where appropriate (#1927, #1931,
4843	#1940, #1941, #1944).
4844	- tmux and screen sessions stop idling as terminal activity. Terminal
4845	multiplexers now force low-motion behavior and pin the fallback footer label
4846	so passive animations do not trip activity monitors (#1925, #1942).
4847	- Composer sanitization catches OSC 8 and Kitty fragments. The input
4848	sanitizer now strips common hyperlink and keyboard-protocol fragments that
4849	leaked into drafts while preserving ordinary prose (#1915, #1933).
4850	- The Work sidebar hides stale completed tasks. Terminal task records older
4851	than the current session and outside the recent-completion window no longer
4852	crowd active Work sidebar rows (#1913, #1930).
4853	- V4 Pro pricing docs reflect permanent rates. The English, Simplified
4854	Chinese, and Japanese READMEs now describe the V4 Pro pricing change as
4855	permanent instead of temporary (#1923, #1932).
4856
4857	### Thanks
4858
4859	Thanks to OpenWarp ([@zerx-lab](https://github.com/zerx-lab)) for
4860	prioritizing codewhale support and collaborating on terminal-agent UX.
4861	Thanks to [@leo119](https://github.com/leo119) for the update-command
4862	documentation lineage now preserved through the rename.
4863
4864	## [0.8.40] - 2026-05-21
4865
4866	### Added
4867
4868	- Configurable sub-agent per-step API timeout. A new
4869	`[subagents] api_timeout_secs` setting in `~/.deepseek/config.toml`
4870	controls how long each sub-agent step will wait on a DeepSeek
4871	`create_message` response before falling back. The value is clamped to
4872	`1..=1800`; `0` or unset preserves the legacy 120-second default, so
4873	existing installs see no behavior change. Long-thinking children (e.g.
4874	heavy plan or review work behind `agent_open`) can extend the timeout
4875	without recompiling (#1806, #1808).
4876	- Delegated file-write permissions for write-capable sub-agent roles.
4877	`implementer` and `custom` sub-agents may now run `Suggest`-level write
4878	tools (`write_file`, `edit_file`, `apply_patch`) without the parent
4879	runtime being auto-approved. Read-only stances (`explore`, `plan`,
4880	`review`, `verifier`) and the default `general` role still bounce
4881	approval-gated tools so they can't quietly mutate the workspace, and
4882	`Required`-level tools (shell, etc.) still need parent auto-approve
4883	regardless of role. Pick `implementer` (or pass an explicit `custom`
4884	allowlist) when the delegated task needs to land file changes
4885	(#1828, #1833).
4886	- Experimental Fin fast-lane tool agents. `tool_agent` opens a durable
4887	child session on DeepSeek V4 Flash with thinking forced off for simple
4888	tool-bound work such as OCR, file/search lookups, fetches, and command
4889	probes. It uses the existing `agent_eval` / `agent_close` lifecycle and
4890	mailbox token-usage stream, so sub-agent cost accounting stays on the same
4891	path as normal `agent_open` sessions.
4892
4893	### Fixed
4894
4895	- WSL2 and headless Linux startup no longer blocks on clipboard init. The
4896	TUI now defers clipboard initialization so machines without an X server can
4897	reach the first frame instead of hanging on a blank screen (#1773, #1772).
4898	- Windows alt-screen output stays clean when `RUST_LOG` is set. Runtime
4899	tracing is routed away from the interactive buffer so logs no longer leak
4900	into the TUI display (#1774, #1776).
4901	- OpenAI-compatible custom model names are preserved. Non-DeepSeek
4902	providers now pass explicit model names through instead of rewriting them to
4903	a DeepSeek default (#1714, #1740).
4904	- Wanjie Ark is a first-class provider. `--provider wanjie-ark`, the TUI
4905	provider picker, `deepseek auth`, doctor, and config files now target
4906	Wanjie's OpenAI-compatible MaaS endpoint with pass-through model IDs and
4907	Wanjie-specific env vars.
4908	- DeepSeek reasoning replay works through OpenAI-compatible endpoints.
4909	DeepSeek models selected under the generic `openai` provider now replay
4910	prior `reasoning_content` consistently and classify streamed reasoning the
4911	same way the replay path does (#1694, #1739, #1743).
4912	- Thinking-only turns no longer disappear. If a clean turn ends with
4913	thinking but no final answer text, the UI now surfaces a clear status instead
4914	of silently ending the turn (#1727, #1742).
4915	- Windows `cmd /C` preserves quoted shell arguments. Commands such as
4916	`git commit -m "feat: complete sub-pages"` now round-trip through the Windows
4917	shell wrapper without losing the quoted message (#1691, #1744).
4918	- Home/End are line-local inside multiline composer drafts. The keys now
4919	jump to the current input line boundary before falling back to transcript
4920	navigation (#1748, #1749).
4921	- Ctrl+C restores the canceled prompt reliably. Canceling a streaming turn
4922	puts the submitted prompt back in the composer and suppresses late stream
4923	events from drawing stale output (#1757, #1764).
4924	- Compaction recovers from cache-aligned summary context overflow. When a
4925	cache-preserving summary request itself exceeds the provider context window,
4926	compaction retries with the bounded formatted summary path instead of failing
4927	with a 400 "compression command failed" style error.
4928	- Terminal sub-agent sessions expose full transcript handles. Completed
4929	and canceled child agents now store the full child message transcript behind
4930	`transcript_handle`, so the parent can inspect details with `handle_read`
4931	instead of relying only on a lossy summary (#1738).
4932	- Forked saved sessions now keep visible lineage. `deepseek fork` records
4933	the parent session id and fork-time message count in additive metadata, and
4934	session listings mark forked paths with their source id. This gives users a
4935	bounded branchable-conversation workflow while the larger visual tree browser
4936	stays scoped for a future release.
4937	- Repeated shell wait rows collapse in the Tasks sidebar. Multiple live
4938	`task_shell_wait` polls for the same background job now render as one row
4939	with an explicit collapsed-wait count, reducing the stuck-task appearance
4940	tracked for v0.8.40 (#1737).
4941	- Leaked mouse scroll reports no longer erase composer draft suffixes. If
4942	a terminal delivers raw SGR mouse bytes into the input stream, the sanitizer
4943	now strips only the mouse report and adjacent coordinate fragments instead
4944	of deleting legitimate draft text such as `commit -m` or numeric prompts
4945	(#1778).
4946	- TUI runtime logs are separated per process and pruned on startup. Each
4947	session now writes `~/.deepseek/logs/tui-YYYY-MM-DD-PID.log`, and startup
4948	removes stale TUI logs older than seven days by default. Set
4949	`DEEPSEEK_LOG_RETENTION_DAYS` to a positive day count to adjust retention
4950	(#1782, #1784).
4951	- The offline eval harness preserves quoted Windows shell payloads. Its
4952	`exec_shell` step now uses the same single-payload shape as the runtime shell
4953	path, with raw `cmd /C` arguments on Windows so quoted commands remain intact
4954	(#1779).
4955	- The Feishu/Lark bridge recovers better after restarts. It now reattaches
4956	to persisted active turns after the long-connection client starts, and text
4957	chunking no longer splits emoji or other multi-code-unit characters.
4958	- RLM survives non-UTF-8 stdout. `rlm_eval` now decodes REPL stdout
4959	lossily instead of treating a single invalid byte as a fatal crash, so
4960	binary-adjacent diagnostics can still return a bounded result (#1815,
4961	#1819).
4962	- Small UI/review reliability fixes landed with the stability branch.
4963	`/clear` now resets all displayed cost state, grayscale theme previews avoid
4964	luma overflow, `/theme` picker arrow navigation wraps at the list edges, and
4965	encoded JSON review output is parsed before display.
4966	- New-file writes execute on the first Agent-mode call. `write_file` now
4967	stays preloaded in Agent mode, so creating a file no longer stops at the
4968	deferred-tool schema hydration message before the normal approval/execution
4969	path (#1825, #1841).
4970	- Saved sessions keep the selected model mode. Changing from `auto` to a
4971	concrete model now updates existing session metadata, and resumed sessions
4972	recompute the `auto` flag from the saved model instead of falling back to the
4973	startup default.
4974	- The `/model` picker persists thinking effort across restarts. Selecting
4975	Pro/Flash plus `high`/`max`/`auto` now writes both `default_model` and
4976	`reasoning_effort` to `settings.toml`, and startup restores the saved effort
4977	before falling back to `config.toml`.
4978	- The footer water strip is visible by default again. `fancy_animations`
4979	now defaults to `true`, while `NO_ANIMATIONS`, SSH/Termius, VS Code, Ghostty,
4980	and legacy terminal overrides still disable the animated strip where it is
4981	known to flicker.
4982	- Screenshots are readable without extra setup on macOS. `image_ocr` now
4983	uses the native Vision framework on macOS when Tesseract is absent, and
4984	`read_file` routes screenshot/image reads through the same OCR path. Pasted
4985	clipboard screenshots saved under `~/.deepseek/clipboard-images` are trusted
4986	automatically for read-only tools.
4987	- Auto-routing context no longer leaks hidden thinking. The model/router
4988	context summary now excludes `ContentBlock::Thinking`, so prior internal
4989	reasoning is not reintroduced as if it were visible user or assistant text.
4990
4991	### Changed
4992
4993	- Slash-command autocomplete ranks exact alias matches first. Typing
4994	`/q` now surfaces `/exit` (whose alias `q` is an exact match) above
4995	`/clear` (which only matches by the longer pinyin alias `qingping`).
4996	Within each rank tier the menu still falls back to alphabetical name
4997	order for deterministic display (#1811).
4998	- CNB mirror preflight covers stability-release branches. The CNB sync
4999	path now recognizes the v0.8.40 stability branch shape before release tags
5000	exist, making the Tencent Lighthouse/Lark deployment path easier to verify
5001	before publishing.
5002
5003	### Thanks
5004
5005	Thanks to jayzhu ([@zlh124](https://github.com/zlh124)) for the WSL2
5006	startup report and clipboard-init fix in #1772/#1773. Thanks to **Paulo Aboim
5007	Pinto ([@aboimpinto](https://github.com/aboimpinto))** for the Windows
5008	alt-screen logging report and fix in #1774/#1776, and for the Home/End
5009	composer work in #1748/#1749, plus the per-process log filename follow-up in
5010	#1782/#1783. Thanks to **Zhongyue Lin
5011	([@LeoLin990405](https://github.com/LeoLin990405))** for the provider model
5012	passthrough, reasoning replay, thinking-only turn, and Windows quoting fixes
5013	in #1740, #1743, #1742, and #1744. Thanks to **Nightt
5014	([@nightt5879](https://github.com/nightt5879))** for the Ctrl+C prompt restore
5015	fix in #1764. Thanks to **Ling ([@LING71671](https://github.com/LING71671);
5016	commits as `www17 <ivonrust@gmail.com>`)** for the configurable sub-agent API
5017	timeout in #1808 and the Agent-mode `write_file` preload fix in #1841,
5018	harvested with `1..=1800` clamping and a fail-fast guard so a stray
5019	`api_timeout_secs = 0` keeps the legacy 120-second default.
5020	Thanks to [@knqiufan](https://github.com/knqiufan) for the sub-agent
5021	file-write delegation work in #1833, harvested with structured approval-
5022	gate semantics (`Implementer` and `Custom` only, never `Required`-level
5023	tools) so write-capable children can actually land code without bypassing
5024	the `Required` approval class. Thanks to [@IIzzaya](https://github.com/IIzzaya)
5025	for the exact-alias-first slash-completion ordering idea in #1811, landed
5026	with a focused regression test. Thanks to Bevis and the community reports
5027	that surfaced the compaction failure mode addressed in this release. Thanks to
5028	Reid ([@reidliu41](https://github.com/reidliu41)) for the grayscale theme
5029	overflow report and `/theme` picker edge-wrapping patch in #1814.
5030
5031	---
5032
5033	Older releases (v0.8.39 and earlier) are archived in [docs/CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md).
5034
5035	[Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.9.4...HEAD
5036	[0.9.4]: https://github.com/Hmbown/CodeWhale/compare/v0.9.3...v0.9.4
5037	[0.9.3]: https://github.com/Hmbown/CodeWhale/compare/v0.9.2...v0.9.3
5038	[0.9.2]: https://github.com/Hmbown/CodeWhale/compare/v0.9.1...v0.9.2
5039	[0.9.1]: https://github.com/Hmbown/CodeWhale/compare/v0.9.0...v0.9.1
5040	[0.8.68]: https://github.com/Hmbown/CodeWhale/compare/v0.8.67...v0.8.68
5041	[0.8.67]: https://github.com/Hmbown/CodeWhale/compare/v0.8.66...v0.8.67
5042	[0.8.66]: https://github.com/Hmbown/CodeWhale/compare/v0.8.65...v0.8.66
5043	[0.8.65]: https://github.com/Hmbown/CodeWhale/compare/v0.8.64...v0.8.65
5044	[0.8.64]: https://github.com/Hmbown/CodeWhale/compare/v0.8.63...v0.8.64
5045	[0.8.63]: https://github.com/Hmbown/CodeWhale/compare/v0.8.62...v0.8.63
5046	[0.8.62]: https://github.com/Hmbown/CodeWhale/compare/v0.8.61...v0.8.62
5047	[0.8.61]: https://github.com/Hmbown/CodeWhale/compare/v0.8.60...v0.8.61
5048	[0.8.60]: https://github.com/Hmbown/CodeWhale/compare/v0.8.59...v0.8.60
5049	[0.8.59]: https://github.com/Hmbown/CodeWhale/compare/v0.8.58...v0.8.59
5050	[0.8.58]: https://github.com/Hmbown/CodeWhale/compare/v0.8.57...v0.8.58
5051	[0.8.57]: https://github.com/Hmbown/CodeWhale/compare/v0.8.56...v0.8.57
5052	[0.8.56]: https://github.com/Hmbown/CodeWhale/compare/v0.8.55...v0.8.56
5053	[0.8.55]: https://github.com/Hmbown/CodeWhale/compare/v0.8.54...v0.8.55
5054	[0.8.54]: https://github.com/Hmbown/CodeWhale/compare/v0.8.53...v0.8.54
5055	[0.8.53]: https://github.com/Hmbown/CodeWhale/compare/v0.8.52...v0.8.53
5056	[0.8.52]: https://github.com/Hmbown/CodeWhale/compare/v0.8.51...v0.8.52
5057	[0.8.51]: https://github.com/Hmbown/CodeWhale/compare/v0.8.50...v0.8.51
5058	[0.8.50]: https://github.com/Hmbown/CodeWhale/compare/v0.8.49...v0.8.50
5059	[0.8.49]: https://github.com/Hmbown/CodeWhale/compare/v0.8.48...v0.8.49
5060	[0.8.48]: https://github.com/Hmbown/CodeWhale/compare/v0.8.47...v0.8.48
5061	[0.8.47]: https://github.com/Hmbown/CodeWhale/compare/v0.8.46...v0.8.47
5062	[0.8.46]: https://github.com/Hmbown/CodeWhale/compare/v0.8.45...v0.8.46
5063	[0.8.45]: https://github.com/Hmbown/CodeWhale/compare/v0.8.44...v0.8.45
5064	[0.8.44]: https://github.com/Hmbown/CodeWhale/compare/v0.8.43...v0.8.44
5065	[0.8.43]: https://github.com/Hmbown/CodeWhale/compare/v0.8.42...v0.8.43
5066	[0.8.42]: https://github.com/Hmbown/CodeWhale/compare/v0.8.41...v0.8.42
5067	[0.8.41]: https://github.com/Hmbown/CodeWhale/compare/v0.8.40...v0.8.41
5068	[0.8.40]: https://github.com/Hmbown/CodeWhale/compare/v0.8.39...v0.8.40
5069

5069 lines MARKDOWN