Skip to content

v0.8.63

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 06:41
v0.8.63
ff7d8dc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CodeWhale is the canonical project, command, npm package, and
release-asset name. The legacy npm package deepseek-tui is
deprecated and receives no further releases. Users coming from
v0.8.x legacy deepseek / deepseek-tui names should migrate
with docs/REBRAND.md.

Install

Recommended — npm (one command, both binaries)

npm install -g codewhale

The wrapper downloads both binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v ~/.deepseek:/home/codewhale/.deepseek \
  ghcr.io/hmbown/codewhale:v0.8.63

The image ships the codewhale dispatcher and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one binary will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains both the codewhale dispatcher and codewhale-tui runtime, plus an install script:

Platform Archive Install script
Linux x64 codewhale-linux-x64.tar.gz install.sh
Linux ARM64 codewhale-linux-arm64.tar.gz install.sh
Linux RISC-V codewhale-linux-riscv64.tar.gz install.sh
macOS x64 codewhale-macos-x64.tar.gz install.sh
macOS ARM codewhale-macos-arm64.tar.gz install.sh
Windows x64 (installer) CodeWhaleSetup.exe NSIS setup
Windows x64 codewhale-windows-x64.zip install.bat
Windows x64 (portable) codewhale-windows-x64-portable.zip —

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

  • For the installer path, run CodeWhaleSetup.exe; it installs both binaries under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.
  • Extract codewhale-windows-x64.zip
  • Run install.bat (copies to %USERPROFILE%\bin)
  • Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform> and codewhale-tui-<platform>) — these are what the npm wrapper and the in-app codewhale update download, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt
shasum -a 256 -c codewhale-artifacts-sha256.txt

What's in v0.8.63

Added

  • Sub-agent fanout safeguards (#3318, #3319). High-fanout Workflow runs can
    now queue and drain more agents than the instantaneous concurrency cap by
    default, with [subagents] max_admitted available to tune that bounded
    admission population. Distinct agent calls are no longer capped by the
    per-turn loop guard before runtime launch concurrency and provider
    rate-limit backoff can apply. [subagents] token_budget applies a shared
    aggregate token ceiling to a root agent run and its descendants.
  • Per-worker sub-agent token enforcement (#3321). A token_budget /
    max_tokens set on an individual agent call now bounds that single worker
    mid-run: once its accumulated model tokens exceed the cap it stops cleanly
    with a budget_exhausted status instead of running to max_steps. This
    complements the scope-level admission gate (#3319) — the per-worker cap stops
    one runaway worker, the scope cap bounds total fan-out — without
    double-counting. Harvested from #3321 by @donglovejava.
  • Provider-specific sub-agent fanout config. [subagents.providers.<provider>]
    profiles now override enabled, max_concurrent, max_admitted,
    launch_concurrency, max_depth, token budget, API timeout, and heartbeat
    timeout for the active provider. Use broad direct-API profiles such as
    [subagents.providers.deepseek] and tighter subscription profiles such as
    [subagents.providers.glm]; /config subagents status shows both global
    and active-provider resolved values.
  • Sub-agent control and isolation. The single agent tool now exposes
    status, peek, and cancel actions for running children, and accepts
    worktree: true to create an isolated git worktree/branch for parallel edit
    lanes instead of requiring callers to hand-roll a cwd.

Fixed

  • Mode and tool catalog correctness. Core action tools remain discoverable
    in the model-facing catalog/tool search, and a consistency self-check flags
    registered handlers that drift out of the advertised catalog. Review-looking
    prompts in explicit Agent/YOLO mode now keep the requested mode and tools,
    with only an advisory review hint.
  • Sub-agent orchestration recovery. Child agents now retry transient
    provider header/SSE timeouts before failing, and parent runs synthesize missed
    child completions from terminal child state so orchestration cannot hang on a
    lost completion event.
  • DeepSeek thinking tool calls. DeepSeek chat-completions requests now omit
    explicit tool_choice whenever reasoning/thinking is enabled, avoiding
    provider rejections while leaving no-thinking routes unchanged.
  • Task sidebar shortcuts and attribution. Ctrl-K stays palette/emacs-kill,
    while Ctrl-X is scoped to Tasks-sidebar background shell cancellation. Shell
    jobs launched by sub-agents now render with their child-agent owner in the
    Tasks sidebar and transcript.
  • Benchmark-turn recovery and context economy. Repeated read-only search
    loop blocks now return guidance instead of fatal tool failures, Python build
    failures that are missing setuptools include an install/retry hint, long
    foreground shell timeouts steer models toward background execution, and noisy
    shell/test/web outputs are compacted earlier for large-context routes.
  • Config display redaction. codew config get/list now recursively masks
    token-, secret-, password-, credential-, and authorization-like keys inside
    unknown extras tables and redacts sensitive HTTP header values before
    printing config output.
  • Queued follow-up hints and force-steer keys. The pending-input preview now
    advertises Ctrl+S send now whenever queued follow-ups exist, and
    Ctrl/Cmd+Enter force-steering also accepts the common Ctrl+J terminal
    encoding while a turn is running.
  • Sidebar default visibility restored (#3328). New and upgraded sessions
    now use a pinned composed sidebar by default when the terminal is wide
    enough, so live Agents and Tasks surface without opting back into idle
    auto-collapse. Older settings files that captured the v0.8.62 auto-collapse
    default now migrate to pinned unless /sidebar auto --save records an
    explicit opt-in. /sidebar now reports when width or auto-collapse
    suppresses rendering instead of saying the sidebar is visible. Reported by
    @dxfq.
  • JavaScript execution proxy env handling (#3273, #3331). js_execution
    now enables Node's environment-proxy mode when proxy variables are present,
    mirrors lowercase proxy variables for the child process, and backfills
    HTTP_PROXY / HTTPS_PROXY from ALL_PROXY. Reported by @lordwedggie and
    harvested from #3331 by @cyq1017.
  • Legacy app-server non-loopback auth hardening (#3258). Bare
    codewhale app-server --host 0.0.0.0 now fails fast unless an explicit
    --auth-token or CODEWHALE_APP_SERVER_TOKEN is supplied, keeping generated
    one-time cwapp_* tokens loopback-only.
  • Legacy .deepseek state write-path migration (#3240). State subdirectories
    (sessions, slop_ledger, trophies, catalog) are now always written under
    ~/.codewhale/, and the first write of a subdir relocates any pre-existing
    ~/.deepseek/<sub> contents into the primary location so the legacy tree stops
    growing while old data is preserved. The read resolver still finds legacy data
    for backfill until each subdir migrates. Reported by @Final527; onboarding
    marker slice from #3302 by @nightt5879.
  • State subdir validation on Windows (#3240). State path hardening now
    rejects rooted/prefixed subdir strings such as /etc before resolving or
    migrating state directories, keeping the .codewhale write resolver inside
    its state root across platforms.

Contributor credits for this release live in the changelog entry above —
thank you to everyone whose reports, PRs, reviews, and reproductions shaped it.

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.

Contributors

Final527, cyq1017, and 4 other contributors
Assets 24
Loading