v0.9.1

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui
binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.1

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Platform	Archive	Install script
Linux x64	codewhale-linux-x64.tar.gz	install.sh
Linux ARM64	codewhale-linux-arm64.tar.gz	install.sh
Android ARM64 (Termux)	codewhale-android-arm64.tar.gz	install.sh
macOS x64	codewhale-macos-x64.tar.gz	install.sh
macOS ARM	codewhale-macos-arm64.tar.gz	install.sh
Windows x64 (installer)	CodeWhaleSetup.exe	NSIS setup
Windows x64	codewhale-windows-x64.zip	install.bat
Windows x64 (portable)	codewhale-windows-x64-portable.zip	—
Windows ARM64	codewhale-windows-arm64.zip	install.bat
Windows ARM64 (portable)	codewhale-windows-arm64-portable.zip	—

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.
• Extract the archive for your machine: codewhale-windows-x64.zip or
  codewhale-windows-arm64.zip
• Run install.bat (copies to %USERPROFILE%\bin)
• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.1

Dogfood follow-ups (2026-07-24)

Added

• /compact [focus]: the manual compaction command now accepts an
  optional focus argument that is injected into the summary prompt, and
  the compaction summary itself becomes a structured nine-section
  successor briefing (primary intent, key concepts, files and code,
  errors and fixes, problem solving, user messages, pending tasks,
  current work, next step) that carries earlier compaction summaries
  forward and explicitly forbids tool use — replacing the free-form
  "under N words" instruction. Codewhale's pin/working-set and
  V4 prefix-cache-aligned machinery are unchanged.

• Saved workflows become slash commands: *.workflow.js files under
  <workspace>/.codewhale/workflows/ and ~/.codewhale/workflows/ are
  discovered as /name commands that accept custom arguments (forwarded
  to the run's args), launch through the workflow tool in the
  background, and report their run id. Hand-written .md commands with
  the same name always win. The workflow tool's source_path now also
  accepts the user-global ~/.codewhale/workflows/ store, and every
  settled run leaves a durable synthesized report under
  .codewhale/reports/<run_id>.md (status, goal, gates, progress,
  result, verification).

Fixed

• Disambiguate the two Kimi K3 model-picker rows, which read as an
  unexplained duplicate: bare k3 is now labeled "Kimi Code plan route"
  with its default 262K window annotated as the plan-tier floor (raisable
  via the provider context_window setting for plans that include 1M),
  and kimi-k3 is labeled "Moonshot direct route" with its 1M window.
  Both remain distinct, valid routes for the same underlying model.
• Close the model-facing agent tool role schema: the type property now
  publishes the canonical JSON Schema enum ["worker", "scout", "planner", "reviewer", "builder", "verifier", "custom"] instead of describing the
  accepted values in prose. Legacy aliases are no longer advertised to
  models; they remain accepted only at replay/deserialization boundaries.
  Provider schema sanitizers (Chat Completions, strict mode, Anthropic
  Messages / OpenAI Responses, Moonshot/Kimi) are pinned by test to
  preserve the closed enum.

Changed

• Rework the ambient idle ocean: the water now holds exactly one loose
  wedge school of fish, jellyfish, bubbles, and the rare whale cameo —
  seaweed and bio-dust are removed. Fish swim on a wrap-around path and
  always face the way they move (direction can only change while the
  school is off-screen); the lead fish carries an eye (><o>).
  Jellyfish become a pulsing bell with a lagging swaying tentacle. All
  ambient marks now glow via background→ink color lerp: a travelling
  sin² wave through the school, a floor-bounded pulse for jellyfish,
  and occasional raised-cosine glints on bubbles, with deliberately
  non-matching periods so nothing strobes in sync.

• Consolidate Anthropic Messages and OpenAI Responses stream opening
  through the shared client/stream_entry.rs transport seam already used
  by Chat Completions: one bounded response-header wait, shared
  dual/HTTP-1.1 client policy selection, at most one HTTP/1.1 fallback
  retry on a classified HTTP/2 header stall (never after a stream body
  has begun), and the shared idle-timeout diagnostics format. Both
  adapters gain the bounded open wait and CODEWHALE_FORCE_HTTP1
  H1 pinning; wire-specific headers, authentication, endpoints, and
  stream decoding stay at the adapter edge, and the Responses provider
  retry loop for rate limits / transient upstream errors is preserved.

• Rename the internal delegated-worker role type from SubAgentType to
  FleetRole with canonical variants (Worker, Scout, Planner,
  Reviewer, Builder, Verifier, Custom) matching the public Fleet
  vocabulary one-to-one. Wire behavior is unchanged: serialization emits
  canonical Fleet values only, and persisted agent_type fields plus
  documented legacy spellings (general, explore, plan, review,
  implementer, …) continue to load at deserialization/parse boundaries;
  unknown role tokens still fail closed with the canonical vocabulary in
  the error.

The Codewhale v0.9.1 source candidate includes a first-class local web client over the Runtime API,
first-class OpenCode Go and TelecomJS TokenHub providers and restored xAI device login,
calendar-correct hourly automations, a buildable OpenHarmony workflow-js
target, and hardening for Auto routing, remote-terminal clipboard transport,
restart recovery, and a coherent TUI, Work, evidence, and public release
surface.

Added

• Add codewhale web [--port 7878], a first-class loopback-only browser
  client over the canonical Runtime API. The dependency-free embedded shell
  supports thread lifecycle, snapshot-then-SSE transcripts, turn start/steer/
  interrupt, approvals, and user questions, including pending-request recovery
  across tab reloads, while leaving unsupported managed,
  files, PTY, model-selection, and Fleet controls absent. Browser auth uses a
  short-lived one-time loopback capability exchanged for an opaque, bounded,
  process-local HttpOnly, SameSite=Strict session cookie with a same-origin
  mutation guard; Runtime tokens never enter URLs, HTML, browser storage, logs,
  or browser-launch arguments (#4423).
• Add OpenCode Go as a first-class, subscription-backed Chat Completions
  provider with [providers.opencode_go], OPENCODE_GO_API_KEY, and the eight
  models currently documented on its /v1/chat/completions endpoint. Models
  served only through OpenCode Go's Anthropic /messages endpoint remain out
  of this narrow route until Codewhale supports per-model wire selection
  (#1481 by @seanthefuturegorilla; implementation harvested from PR #773 by
  @zhangweiii and PR #1050 by @sternelee).
• Add TelecomJS TokenHub as a first-class Chat Completions provider with
  [providers.telecomjs], TELECOMJS_API_KEY, and a key-scoped live
  /v1/models refresh. Models.dev and provider-specific catalogs remain in
  separate source partitions so either refresh order preserves both; refreshes
  do not delete the other source's rows, matching model ids from unrelated
  providers do not fabricate metadata, and chat requests omit unsupported
  reasoning fields (PR #4370 by @baendlorel; harvested with co-authorship).
• Prepare native Windows ARM64 codewhale, codew, and codewhale-tui
  binaries, npm selection, updater support, and standard/portable release
  archives. Build and smoke them on GitHub's native Windows 11 ARM runner,
  and move Linux ARM64 release builds to the native Ubuntu ARM runner to
  remove the slower multi-arch cross-link setup (#4267 by @w1w218).
• load_skill tool now supports listing: omit name or pass "list" to
  see all available skills without loading one (#4651).
• Add a unified /skills manager with one precedence-aware root catalog,
  bounded duplicate/shadow/conflict auditing, package provenance, and
  validated install, update, remove, and trust mutations (PR #4679 by
  @SamhandsomeLee).
• Add a safe Agent Details view and bounded, structured current_activity to
  the single Work projection, sourced from worker events instead of renderer
  string inference. Rows stay compact, exact evidence is opt-in, and raw child
  output never enters the parent transcript (#2889 and #4636; design direction
  by @aboimpinto, preserved from #2694).
• Make exact results and delegated coordination durable: non-inline tool output
  becomes immutable session-owned evidence behind bounded receipts; File
  mutations add configurable success-only diffs; and decisions and write
  contention survive restart with typed neutral-fan-in records (#4619, #4636,
  #4647).
• Runtime API provider registry and atomic provider-switch endpoints
  (GET /v1/providers, GET /v1/providers/{id}/models,
  POST /v1/providers/{id}/switch) so the web GUI renders a dynamic
  provider/model picker without the setConfig+reload clobber (#4658).
• Typed filter (/) in the Fleet setup wizard's Model step: substring
  match over provider id, display label, and model id keeps
  OpenRouter-scale catalogs navigable (#4639).
• [auto.router] config: explicit provider/model/thinking for the Auto
  mode classifier route; unset keeps the DeepSeek flash default, and
  missing credentials fall back to the local heuristic.

Changed

• Keep the top activity bar literal and actionable: active To-dos appear first,
  followed by Sub-agents, while generic operations and coordination stay in
  the detail surface. Completed-only bars auto-hide, and top/side layouts can
  be resized by dragging their divider and retain the chosen size (#4700,
  #4702).
• Use each theme's semantic colors for composer mode and permission rails, and
  show a larger inline reasoning preview with clearer local/full expansion
  affordances (#4699, #4701).
• Simplify the model-facing runtime around stable action tools (File, Git,
  Run, deferred Web, and durable task and automation families), with legacy
  spellings hidden for replay. Fresh sessions no longer reserve a Work surface
  before real work exists (PR #4675).
• Give the terminal shell one deliberate visual language: cool Plan → Act →
  Operate and warm Ask → Auto-Review → Full Access ramps match between header
  and split composer edges; transcript rhythm groups related activity; a
  refined whale keeps the empty state calm; and one-cell live motion with
  truthful labels distinguishes reasoning, reading, tool use, and verification
  without exposing private reasoning text. Reduced-motion and animation-off
  settings freeze it, while ASCII-safe terminals retain the signal (#4676,
  #4677).
• Unified shell tool: the model now sees a single Bash tool with an action
  parameter (run/wait/interact/cancel). Legacy exec_shell* names remain as
  hidden compat aliases for transcript replay, and the tool-search catalog
  keeps Bash active by default (#4625).
• Tool output inline preview increased from 6 to 12 lines (4 head + 4 tail)
  before the fold indicator; full pager (v key) unchanged (#4603).
• Mode changes (/mode agent|plan|operate) now persist to settings.toml
  and restore across sessions (#4628).
• Billing provenance: every outgoing API request carries an
  x-codewhale-provenance header with client version and provider (#4324).
• The /model picker's typed search now ranks results: provider-name
  matches first (drill-down), then exact id, then id-prefix, then the
  active provider's rows (#4639).
• System prompt text consolidated into a single prompts/text.rs
  module (byte-exact constants replacing 17 layered files);
  composition order, constitution-first binding, and locale/personality
  variants unchanged.
• Ask, Auto-Review, Full Access, and Never resolve through one permission
  contract: resolve_tool_permission in the engine and
  resolve_approval_request_disposition in the UI share one truth table for
  session grants/denials, non-bypassable policy holds, and modal prompts
  (#4412).
• Collapsed multi-struct tool families into single action-dispatched tools
  (AutomationTool, TasksTool, GithubTool, RlmTool) while keeping
  legacy tool names as hidden compatibility aliases for transcript replay.
• Operate-mode children default to leaf depth (max_depth=0) unless the
  caller explicitly grants a deeper budget (#4598).

Fixed

• Restore uwu theme config round-tripping and keep header permission colors
  and authored idle-whale geometry aligned with the selected theme (#4696).
• Default canonical Bash runs with no explicit cwd to the active
  ToolContext.workspace, including an isolated sub-agent worktree, instead of
  falling through to the shared shell manager's parent workspace. The regression
  test detects the selected workspace through marker files so it remains
  meaningful across PowerShell path spellings (#4674, PR #4673 by @fleitz).
• Generate QuickJS bindings for aarch64-unknown-linux-ohos with the native
  SDK's libclang and sysroot, carry the OHOS target and sysroot through final
  linking, and keep unsupported persistent PTY dependencies out of the target
  while retaining non-PTY exec_shell support (#4470 by @shenjackyuanjie;
  original bindgen approach in #4384 by @shenyongqing).
• Honor [auto] cost_saving = true in provider-aware heuristic and classifier
  routing, using only validated same-provider fast siblings and deriving
  fallback candidates from their actual provider so Auto cannot invent a
  cross-provider model. Providers without a known fast sibling stay on the
  active model (#4486; partial #4405).
• Make terminal-client clipboard behavior truthful over SSH: use OSC 52
  outside tmux, stock tmux load-buffer -w inside tmux, and bracketed paste
  for client-to-remote text. Graphical text and image access now requires
  credible forwarding or an explicit override, transport failures no longer
  claim success, and help distinguishes terminal text paste from graphical
  image attachment (#4484).
• Keep a fresh TUI Work surface from rendering prior-session worker snapshots
  or durable-task terminal receipts whose creation or completion predates the
  current app start. Active durable tasks remain visible, and shared history
  stays available through /tasks and archived agent views (#4488; partial
  #4416).
• Make doctor and setup output distinguish static configuration, command
  availability, MCP protocol readiness, and backend health instead of
  presenting configured routes as live-healthy. Ordinary doctor runs no
  longer wake loopback/self-hosted providers unless --probe-local is
  explicitly requested (#4485; partial #4406).
• Serialize test-only configuration-path readers with temporary environment
  redirects so the Windows provider-persistence matrix cannot observe another
  test's transient CODEWHALE_HOME or config path (#4483, closing #4463).
• Restore direct Moonshot kimi-k3 to its documented 1,048,576-token
  context window and 131,072-token output limit instead of treating the live
  model as an unknown legacy 128K route. The existing Kimi Code tiered k3
  route and credential reuse remain unchanged (#4481).
• Keep read-before-edit snapshots in the engine session so a file read remains
  valid across turns and context compaction, while a new session still starts
  with an empty tracker (#4475 by @Angel-Hair).
• Make apply_patch expose the canonical replace operation while continuing
  to accept deprecated changes payloads through one validation path. Mixed
  patch, replace, and compatibility modes now fail before any write (#4476 by
  @Angel-Hair).
• Show the prompt-cache hit rate in the phase strip when the Cache status item
  is enabled, using overflow-safe rounded integer math and leaving compact or
  disabled status layouts unchanged (#4474 by @dmitri-0).
• Preserve Solarized Light's canonical Base3 (#fdf6e3) shell background
  instead of tinting it green-grey through the default underwater Ombre
  treatment, while retaining foreground ambient life (#4457 by
  @AiurArtanis; PR #4471 by @nightt5879).
• Register /slop and /canzha as compatibility aliases of /debt, while
  keeping user-command ownership truthful across dispatch, help, slash
  completion, alias copy, and typo suggestions (PR #4680 by @nightt5879).
• Fail closed on legacy Kimi CLI credential imports: remove Codewhale's
  hard-coded first-party-client impersonation and refresh request, never
  auto-enable or rewrite imported credentials, and label the compatibility
  route as a read-only imported token. An explicitly configured, still-valid
  access token remains usable until expiry; missing, malformed, and expired
  imports recover through the supported Kimi Code API-key route while
  first-class OAuth awaits Codewhale's own vendor registration (#4417,
  partially addressed).
• Restore xAI/Grok device-code OAuth login against the live xAI OIDC
  contract: discovery with issuer/endpoint validation and documented
  fallbacks, user-principal scope set, RFC 8628 slow_down backoff capped at
  code expiry, bounded, sanitized error reporting for denial, expiry, and
  malformed responses, and a shared blocking-worker boundary for both CLI and
  TUI login so reqwest's blocking client never creates or drops its private
  runtime inside Codewhale's Tokio runtime (#4410).
• Anchor FREQ=HOURLY automations with BYHOUR/BYMINUTE to persisted
  local-calendar slots so intervals keep their wall-clock phase across DST,
  restart, resume, RRULE updates, duplicate-slot recovery, and post-run
  advancement. Nonexistent clock slots are skipped and ambiguous slots run at
  their first occurrence (#4381 by @h3c-hexin).
• Give content-watch drafts canonical identities: the link and semantic-drift
  watchers now write and dedup through one canonical draft-storage key with
  deterministic hash-suffixed IDs, validate and bound model drift output
  before any KV writes, and show truthful admin draft labels, so unchanged
  findings dedup and changed findings re-draft instead of colliding (#4453).
• Make model-policy JSON repair consider object and array payloads in source
  order, matching nested delimiters across quoted strings and escapes and
  returning the earliest balanced candidate that parses, instead of letting
  an unmatched opening delimiter or object-first preference corrupt array
  payloads (#4430).
• Convert persisted sub-agent completion and still-running control events into
  concise, non-authoritative resume checkpoints, keeping their raw runtime
  envelopes, sentinels, and retry instructions out of restored model and TUI
  conversation state (#4409).
• Deliver failed, stopped, and stale sub-agent outcomes exactly once to the
  awaiting parent, lifecycle mailbox, and TUI before closing their runtime
  state. Restart now reconciles orphaned queued/model/tool-wait worker records
  to interrupted while preserving checkpoints, and cancelled workers no
  longer read as completed in the TUI (#4408).
• Give host applications a cancellation boundary for MCP OAuth login so a
  stalled or abandoned provider login no longer hangs the calling session
  (#4380).
• Avoid blocked reader joins after Windows process kills so terminated shell
  sessions cannot hang their readers (#4383).
• Give stdin-less observer hooks immediate EOF and contain timed-out hook
  process trees so descendants and pipe readers cannot leak after the parent
  shell exits (#4489 by @luismateusvargas).
• Preserve the full unsigned Windows PTY process status instead of collapsing
  every high-bit exception or NTSTATUS to 2147483647, including decimal and
  hexadecimal diagnostic metadata for device retests (#4100 by
  @redjade75723).
• Keep the Hotbar Setup action list synchronized with keyboard focus when the
  selection moves beyond the visible rows, including Down past /export
  (#4418).
• Route Windows OpenHarmony Cargo links through the repository's target-aware
  clang launcher so the final Rust link keeps its target, sysroot, and MUSL
  flags, and extend the no-SDK release guard to protect that contract. This
  completes @shenjackyuanjie's PR #4470
  setup alongside @shenyongqing's original
  bindgen approach in PR #4384.
• Reconcile the website roadmap with reality: the retired share-link
  direction is now an explicit non-goal, Workrooms is the considered
  direction, and the local web client appears as underway, in English and
  Chinese (#3418).
• System-prompt skills block and skill-load warnings no longer embed absolute
  home/workspace paths; entries render workspace-relative or ~/… so the
  byte-stable prompt prefix never leaks private paths. A new invariant test
  guards absolute paths, API keys, and workspace paths in the prefix (#4632).
• Mode/permission baseline unit tests no longer read the developer's live
  settings.toml; they isolate config I/O to a temp directory (#4628).
• Enter no longer freezes the composer on send: dispatch splits into a
  sync prepare phase (instant history + spinner) and a spawned async
  phase (auto-route, preflight, engine send), with submits gated while
  a dispatch is in flight (#4605).
• Self-hosted routes keep explicit per-model output limits for unknown
  wire aliases instead of the generic 4K fallback (#4655 by @h3c-hexin;
  PR #4656).
• Chat Completions idle-timeout errors now include received-byte and
  timing telemetry, distinguishing prefill stalls from mid-stream
  stalls with truncated tool-call arguments (#4657 by @h3c-hexin).
• set_config provider writes now keep the in-memory route in step,
  so a following model write lands in the new provider's table instead
  of clobbering the previous provider's root default_text_model (#4658
  by @gaord, with a follow-up route-sync fix).

Security

• Restrict cross-origin Runtime API browser preflights to the documented
  authentication and content headers, explicitly allowing Authorization
  instead of relying on a wildcard (#4454).

Security

• Harden the public community-site boundary: scheduled review drafts now use
  one canonical freshness namespace, admin discard is restricted to validated
  draft objects, public feed requests cannot spend the server-held GitHub
  token, and maintainer login bodies are type- and size-bounded before parsing.

Contributors

Thank you to the contributors whose code, reports, and reviews shaped v0.9.1:

• @h3c-hexin — calendar-anchored hourly
  automation recurrence (PR #4381), the MCP OAuth cancellation report
  (#4380), explicit limits for unknown local models (PR #4656 / #4655),
  and idle-timeout progress telemetry (PR #4657).
• @gaord — Runtime API provider registry and
  atomic provider-switch endpoints (PR #4658).
• @SamhandsomeLee — the unified /skills
  root catalog, audit/provenance model, validated mutations, manager UI, and
  acceptance coverage (PR #4679), plus Enter-send lag diagnosis and fix
  direction for #4605 (PR #4654; landed via the release-lane async-dispatch
  split).
• @aboimpinto — the Layer 5.1 user-command
  registry boundary from PR #3278; the exact authored evidence commit from PR
  #4046, preserved intact in the integration graph; and the #2870 follow-up
  audit whose metadata and malformed-sibling gaps shaped the final corrections.
  Paulo also provided the structured, redacted Agent Details and
  current_activity direction preserved from #2694/#2889 and the real-PTY
  lifecycle acceptance direction from #2886.
• @baendlorel — TelecomJS TokenHub provider
  support and key-scoped live-catalog direction from PR #4370, harvested into
  the current provider architecture with co-authorship preserved.
• @zhangweiii and
  @sternelee — the original first-class
  OpenCode Go implementations (PRs #773 and #1050), harvested into the
  current provider architecture.
• @seanthefuturegorilla — the
  canonical OpenCode Go/Zen provider request and acceptance direction
  (#1481).
• @nightt5879 — /debt compatibility aliases
  with dispatch-consistent user-command shadowing across discovery surfaces
  (PR #4680), plus the Solarized Light background preservation fix (PR #4471).
• @AiurArtanis — the Solarized Light
  regression report and reproduction (#4457).
• @shenjackyuanjie — the HarmonyOS
  workflow-js bindgen, portable-pty gating, and SDK environment work
  (PR #4470).
• @shenyongqing — the original HarmonyOS
  bindgen approach (PR #4384), carried into the landed implementation.
• @luismateusvargas — the Windows hook
  process-leak reproduction, process-tree analysis, and EOF fix direction
  (#4489).
• @redjade75723 — the persistent Windows PTY
  report that exposed lossy high-bit process-status handling (#4100).
• @w1w218 — the Windows ARM64 release request and
  real-device motivation (#4267).
• @Angel-Hair — session-owned read-before-edit
  tracking and the explicit, backwards-compatible apply_patch replacement
  contract (PRs #4475 and #4476).
• @dmitri-0 — configurable cache-hit visibility
  in the phase strip (PR #4474).
• @fleitz — the canonical Bash no-cwd
  workspace fix and regression test that keep isolated sub-agent commands in
  their own worktree (PR #4673, closing #4674).
• @SparkofSpike — the Windows Ctrl+O
  reproduction that exposed pre-pager result truncation and conflicting composer
  shortcut routing (#4482), and the exact Vim-space regression reproduction
  verifying the v0.9.1 input path already contains the needed global binding
  (PR #4477).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.