Release v0.9.12 · Hmbown/Codewhale

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — official GitHub release

New macOS/Linux install (checksummed binaries from this release):

curl -fsSL https://codewhale.net/install.sh | CODEWHALE_VERSION="v0.9.12" sh
"$HOME/.local/bin/codewhale" --version

For Windows, use the matching installer or archive below. For an existing
direct install, run codewhale update; it prints the executable path and
keeps newer builds. If the install directory is occupied by a different build,
use the fresh-directory migration in the installation guide.

Secondary packaging — npm and Cargo

npm install -g codewhale
# or build from source
cargo install codewhale-cli --locked

The wrapper downloads the matched codewhale and codew command assets
from this Release. Both contain the same compiled runtime.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.12

The image exposes the same runtime as both codewhale and codew. The
latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli --locked

The Cargo package installs codewhale. Cargo cannot create a second command
alias from one binary target; users who want the shorter spelling can add a
codew symlink to that installed executable. The npm, Homebrew, archive,
shell-installer, and container channels install both command names directly.

Manual download — platform archives (recommended)

Each archive below contains the same runtime under the codewhale and
codew command names, plus an install script:

Platform	Archive	Install script
Linux x64	`codewhale-linux-x64.tar.gz`	`install.sh`
Linux ARM64	`codewhale-linux-arm64.tar.gz`	`install.sh`
Android ARM64 (Termux)	`codewhale-android-arm64.tar.gz`	`install.sh`
macOS x64	`codewhale-macos-x64.tar.gz`	`install.sh`
macOS ARM	`codewhale-macos-arm64.tar.gz`	`install.sh`
Windows x64 (installer)	`CodeWhaleSetup.exe`	NSIS setup
Windows x64	`codewhale-windows-x64.zip`	`install.bat`
Windows x64 (portable)	`codewhale-windows-x64-portable.zip`	—
Windows ARM64	`codewhale-windows-arm64.zip`	`install.bat`
Windows ARM64 (portable)	`codewhale-windows-arm64-portable.zip`	—

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

For the installer path, run CodeWhaleSetup.exe; it installs
codewhale.exe, codew.exe, and codewhale.bat under
%LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
current-user PATH, and creates a Start Menu shortcut that prefers
Windows Terminal (wt.exe) when it is installed.
Extract the archive for your machine: codewhale-windows-x64.zip or
codewhale-windows-arm64.zip
Double-click codewhale.bat (not the raw .exe) to launch
Run install.bat to copy the binaries and launcher to %USERPROFILE%\bin
Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived codewhale-<platform> and
codew-<platform> assets. The seven codewhale-tui-<platform> filenames
attached to v0.9.5 are byte-identical compatibility copies used only to let
already-installed v0.9.4 clients discover and cross this single-binary
transition; current installers do not expose a third runtime. The legacy npm
package deepseek-tui is deprecated and is not republished. For migration
from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.12

Codewhale v0.9.12 puts computer use in the binary, opens two new routes —
Alibaba Model Studio through the data-driven provider table and Concentrate
as an opt-in BYOK Responses gateway — and adds cloud dispatch plus a
config-gated per-session control socket. The shell is the other half of the
release: a new launch card, the work surface docked under the composer, one
focus owner for Tab, tool cells that carry their own state, and fleet as
the public word for the live collective. The complete item-level change
record is retained below the categorized release highlights.

Added

Computer use ships with the binary. The computer-use plugin — 38 tools
across macOS, Windows, Linux and HarmonyOS, accessibility-first observation
with pixel fallback, screenshots, zoom, screen recording, and registered
remote computers over ssh and hdc — is embedded in Codewhale and written to
$CODEWHALE_HOME/builtin-plugins on first run, so every install channel
carries it. It lists as builtin · not-reviewed and stays disabled until
you review and enable it: shipping it is not consenting to it. The
stdlib-Python computer-use server it replaces is gone.
Alibaba Model Studio joins the data-driven provider table as an
openai-compatible descriptor: international compatible-mode endpoint,
DASHSCOPE_API_KEY credential, live /v1/models discovery. Qwen 3.8
Flash and Qwen 3.8 Max arrive through the catalog authority — never a
hard-coded id.
Concentrate: first-class opt-in BYOK Responses gateway with live models
discovery and typed SSE streaming (#5725).
Cloud dispatch: remote runner offloads coding agent tasks to isolated
cloud sandboxes with machine token auth and structured job tracking
(#5701, #5712).
Per-session control socket: config-gated [control_socket] table binds
<sessions-dir>/<session-id>/control.sock per running session, exposing
message, interrupt, relaunch, and status JSON-RPC verbs (#5533, #5831).

Changed

Anonymous usage counting is on by default. The 0.9.11 release asked
first; 0.9.12 counts the same aggregate version/platform, session, feature
and error totals unless you turn it off, and says so once at first launch
(policy notice version 5, schema 3, notice_version replacing
consent_version). Every recorded opt-out stays off: a durable
telemetry = false, a decline recorded under the old opt-in notice,
unreadable privacy state, and the CODEWHALE_TELEMETRY=0 / --telemetry false kill switches. Showing the disclosure records only that it was
shown, never an acceptance. codewhale config set telemetry false turns
it off and wipes queued counts; codewhale config set telemetry true
deliberately re-enables it. Nothing new is collected: no conversations,
code, prompts, files, names, model content, credentials, or IP.
The launch screen is our own card take: a thin top line
⑂ branch path; a centred bordered card with the whale mark,
Codewhale + version, one announcement line only when it is true (the
no-model warning, or MCP news), and the menu New worktree / Resume
session / Changelog / Quit with their real chords right-aligned. Enter
runs the highlighted entry, Up/Down move it, and typing goes straight to
the composer. The card dissolves on the first keystroke or command
(≤240 ms, instant under reduced motion) (#5826, #5801, #5815, #5286).
The work surface sits under the composer by default, keeping history
readable and leaving the stage unencumbered (#5809).
Skills command shapes: FEAT-022 command shapes and retained-host
validation (#5825, #5829).
After the card dissolves, the working screen shows ⑂ branch path with
⋮ MCP n/m on the right, the transcript starts with the
◆ session_start receipt (naming the configured session-start hooks),
and the composer's bottom rule carries model (effort) · permission —
the route's one launch reading. The posture bar and metrics line appear
only once a session exists.
Vocabulary: fleet is the public term and Pod is retired from copy —
roster, setup, detail, worker-runtime and managed-API messages now say
Fleet (/fleet canonical, /pod alias). The workflow wire accepts the
canonical role spellings (general/explore/planner/reviewer/implement/
test/advisor) with the pre-rename ones kept as load-time aliases, and
serializes canonical names.
The Operate mode-picker hint is shortened to fit 80 columns.
The footer always shows the permission posture; when only one chip
fits, the permission chip outranks the mode word (#5796).
Local Ollama: the header names a model only when the local catalog can
serve it, and says unknown until it knows. The startup mark, web and
app icon carry the new side-view prompt-eye whale (#5795).
One focus owner: Tab and Shift+Tab work regardless of what is in the
composer; Alt shortcuts survive mid-draft; Ctrl+Tab no longer cycles the
mode by accident (#5798).
Tool cells carry their own state: a running, failed or warned tool
reads as such in the transcript itself, with per-entry rail dots and
family-coloured glyphs (#5799).
Web: docs hub with task search, shared empty/loading/error states, an
offline-to-back-online banner, /changelog in every locale, and real
404s with correct metadata (#5743).
Web: the app's colours come from one file generated from the TUI whale
palette; re-typing a colour by hand fails web CI (#5797).
Web: a one-way ceiling on isZh branching outside the i18n spine —
the count may only go down (#5805).
An internal agent handoff doc was removed from the public tree and
.playwright-mcp/ is now ignored (#5800).
First run paints the composer immediately: the Welcome/language/provider/
trust gates no longer precede the first keystroke. Missing-key and
workspace-trust recovery stay for returning users; language and provider
remain in /setup.
The canonical whale-tile mark propagates beyond web to the exact-raster
surfaces that can carry it (#5738).
Dead-code sweep: delete proven-unreferenced helpers (unused builders,
wrappers, and leftover identifiers) and drop stale #[allow(dead_code)]
where the item is production-called or test-exercised. No runtime behavior
change (#5791, #5587).
Remote-control recovery gives every fresh pre-dispatch attempt a new lease
generation while preserving that generation across its typed start (#5605).
Public roster language is Pod. /pod is the customer surface; fleet remains
the internal wire, storage, and migration name (#5776).
Compaction replacement history keeps a bounded last user round (assistant +
tool results) instead of dropping them behind a summary. /context names
the compaction path and /anchor survival. Failed compact still does not
replace live history (#4394).
Provider catalogs: compatible hosts (Baseten, Groq, Cerebras, SenseNova,
Command Code) no longer compile a frozen model roster. Descriptors name the
wire, URL, and env; live GET /v1/models and a Codewhale-owned catalog
layer are the offering list. Command Code is a catalog/descriptor row, not
a ProviderKind. Catalog presence is not an availability, entitlement, or
provider-acceptance claim (#5783).
Provider selection no longer probes or adopts an external CLI credential on
ordinary picker use. Reuse requires an explicit "Use external CLI credentials"
choice, exact-path confirmation, and Codewhale-owned revoke (#5772).
TUI: startup no longer presents an approximate ASCII or block-glyph whale as
the product mark. It keeps the direct Tideline prompt while exact-raster
surfaces remain responsible for the canonical asset.
TUI: the active-session composer paints the same three-cell [↑] send
target as Startup and clicks it through the existing Enter submit
dispatcher (#5771). Compact/quiet composers still omit the control.
TUI/CLI: Pod is the public roster surface. User-facing Fleet wording
moves to Pod; durable receipt keys stay compatible (#5776).

Added

Native ChatGPT sign-in for the openai-codex route: codewhale auth chatgpt opens a browser PKCE flow and stores refreshable tokens in
Codewhale-owned credentials — no Codex CLI install required.
/auth chatgpt-revoke clears them off the event loop (#5784, #5778).
MCP servers and plugins can be connected self-serve from the session: a
unified auth flow with rotation-safe token handling, a spoken authorization
URL, and catalog refresh when stored credentials stop working (#5747).
/operate reads match the landed CWC OperateRecord contract: fetching an
absent record returns a truthful not-found view instead of a fabricated
operation, and an empty evidence path is rejected rather than resolving to
the workspace directory (#5703).
TUI: scheduled automations project into the top strip
(⏱ N scheduled · M running, compact ⏱ N·M) with typed
HistoryCell::Automation receipts when a run this session watched settle.
/automation acknowledges failures. The merged footer does not carry the
work fact (#5748).
The app-server can listen on a unix domain socket and advertise a
daemon/attach handshake, so a local client can attach to an already-running
engine instead of spawning its own. The socket is created with
owner-only permissions and stale sockets are reclaimed on start. Non-unix
hosts return a typed unsupported-platform refusal; the Windows named-pipe
endpoint is named but not yet implemented (#5749).
The engine's internal Op/Event types and the wire protocol's Op/
EventMsg now carry a compile-enforced twin for every variant: adding an
engine variant without a protocol counterpart fails the build instead of
drifting silently. Internal durability work — no user-visible surface
change yet (#5751).
Machine tokens: with CODEWHALE_API_KEY set, the CLI authenticates as the
Codewhale account with no local session file and no browser — the CI
authentication path, with a typed token shape and redaction (#5721).
Compaction publishes a structured survival contract for session-tree
journal entry types (crates/tui/src/compaction/SURVIVAL_CONTRACT.md) and
fails closed when the last user round, tool results, /anchor text, or
checkpoint receipt would vanish (#4394, #5782).
Internal: codewhale-config gains RouteAuthoritySnapshot, one immutable
authority that owns a compiled provider catalog together with the route
resolver projected from it, so a picker, a readiness view, and an execution
path can no longer resolve against different catalog snapshots without a
type-level signal. Resolution still goes through the sole resolver; the
returned receipt distinguishes an exact catalog row, a custom-endpoint route
whose provider facts are deliberately not reused, and an allowed
pass-through route with no catalog row. All state is secret-free. No call
site changed and no user-visible behaviour changed yet (#5766).
Computer session records now count only time a provider actually accepted the
session as active, at per-second granularity. Idle, queued, stopped, and
teardown time are excluded, and a session whose allocation does not match a
standard profile is refused rather than recorded approximately. Covered by
hermetic fixtures; no live provider call and no deploy (#5781).
Website: the public site moves to the Tideline deep-ocean design language
(dark by default with an opt-in light documentation sheet, palette grounded
in the TUI's WHALE_* tokens) and the new whale brand mark across the favicon,
app icons, web manifest, nav wordmark, and social card (#5573).
Add codewhale dispatch / /dispatch so a local session can propose a
Codewhale cloud agent against an explicit github, cnb, or gitee remote.
Confirmation is required; missing credentials fail closed; cloud jobs share
the existing /jobs surface as kind=cloud. See
DAYTONA_CLOUD_DISPATCH.md.
/login reports the Codewhale account session and provider-key next
steps. The internal cloud-agent credential is not user surface: there is
no auth set-slot/auth clear-slot command, no hint, and no completion
entry for it — signing in with codewhale login is the only door.
Add the Tideline component family from the ratatui translation spec
(#5698's screens, riding the #5699 work-strip layout): hero startup
surface with quick actions and option strip, notifications inbox, merged
footer band, pod ledger, receipt
stream, theme list with motion toggles, live preview, settings rail,
and the left rail — each a standalone render module pinned by 28 new
byte-exact golden buffers. Frame wiring follows the Tideline acceptance
gate; NO_COLOR is now honored by palette depth detection.
Route Contract Phase 1: RouteResolver is the runtime path for
resolve_runtime_options; codewhale providers export --json ships the
owned descriptor catalog; CLI --provider accepts any catalog route id
(the closed ProviderArg enum is deleted). Catalog layers are
bundled → models.dev → provider /v1/models → config.toml → user, with
policy DENY last and never overridden.
Add provider-native web search for documented Xiaomi MiMo 2.5 Pro and 2.5
chat routes while keeping neighboring models and custom gateways fail-closed.
Add structured provider-native web search for exact Z.AI global and Zhipu
China general API routes, using each site's documented search engine value.
Existing open.bigmodel.cn configurations now share Z.AI's official model
namespace and credential scope; unknown model IDs still pass through.
Add provider-native web search for documented Qwen models on ModelStudio
Token Plan's Responses Harness, without enabling Coding Plan or Anthropic
routes.
Added /copy to place the latest completed assistant response on the
clipboard without copying tools, system messages, hidden reasoning, or
active partial output (#5668).
Add provider-native web search for documented DeepSeek V4 routes through the
Responses API, with fail-closed capability gating for compatible custom
endpoints.
Add provider-native search for exact Moonshot K3 Formula, legacy K2.6
built-in search, and Kimi Code membership /search routes. Treat the exact
Moonshot China endpoint as a first-party direct route.
Z.ai GLM-5.3-Flash and OpenRouter z-ai/glm-5.3-flash are first-class
picker rows (/model GLM-5.3-Flash). Flash is the faster/explore sibling
of GLM-5.3; the Z.ai default stays GLM-5.3. List price is $0.15/$0.50
per 1M (durable; the 50% promo through 2026-09-09 is not the catalog row).
Baseten, Groq, and Cerebras are bundled OpenAI-compatible setup templates
([providers.<id>] kind = "openai-compatible"), not new ProviderKind
variants. /provider fills URL, model, and env from one catalog row.
MCP manager copy now names the server, the failure, and one recovery
command (The X MCP server requires OAuth reauthentication. Run /mcp login X).
Settings Advanced exposes clickable MCP Connect, Reconnect, and Diagnose
actions, while Extensions and Problems route recovery through the existing
/mcp login, /mcp reload, /mcp validate, and /plugin validate commands
(#5643, #5655).
Plugin prompt matching (#5579): sending a task can toast the next review
step when the prompt strongly matches an installed-but-idle plugin or a
marketplace catalog you added (for example a Supabase prompt suggesting
/plugin trust supabase). A live composer CTA offers the same review
command while you type, matching turns append a bounded
<recommended_plugins> user block, and request_plugin_install surfaces
review without installing. /plugin suggest now ranks manifest keywords and
catalog candidates, never auto-installs, and on-disk plugin changes also
nudge /plugin reload between turns.
Added /import-claude (#5557): reads ~/.claude.json and
~/.claude/settings.json read-only and renders an explicit, reviewable
migration plan plus a written report. MCP servers route through the
existing /mcp import <name> --approve consent flow, allowlisted env keys
become an unapplied portable bundle for codewhale config import, and
permissions/hooks map to manual follow-ups; secret-shaped values are named
but never echoed or imported.
Added the managed Chat relay: account-owned Chat commands now execute on the
native runtime thread engine through a new runtime_chat_relay module
instead of a second execution path. Each Chat thread is a dedicated,
isolated runtime thread with an empty model-visible tool allowlist, a
chat-only system prompt, and no workspace, memory, skill, credential, or
local-path context; the active interactive TUI thread is never reused. The
relay keeps one durable state file per scope behind a session-wide owner
lock, binds a saved session permanently to its first remote target, replays
exact duplicate commands from retained results instead of starting a second
inference turn, terminalizes orphaned reservations on restart, and rejects
(never queues into) a busy local Work turn with an immediate retryable
result. Stop commands require the exact run and turn identity, and a worker
aborts on any account or target mismatch during token refresh.
Added a verified Omarchy/AUR packaging path: packaging/aur now carries a
PKGBUILD template, .SRCINFO renderer and tests, release-candidate
render step, and docs; the live AUR compatibility alias codewhale-tui -> codewhale is preserved, AUR dependencies match the live package, and the
self-updater refuses to fight an Omarchy/package-manager installation.
Added a Fleet run-wide cost/token usage ceiling (R6, #5567): an accumulator
plus admission gate and alert bound a whole run's spend across workers.
Added the real provider cache hit rate to /context (C3, DSH #3): the
token-weighted provider-reported rate from the same telemetry /cache
aggregates, plus an honest "no cache telemetry yet" state when nothing is
recorded.
Added per-step cost movement: TurnUsage receipts are priced as they land
so the live cost surface moves during long agentic turns instead of only at
TurnComplete (#5578), and the footer now honestly shows cost: unknown
when nothing can be priced instead of hiding the line.
Added the underwater session surface: the ambient water reads session state
from across the room, its animation shape follows live agent activity, and
attention tints are steady (no breathing) with a distinct reading treatment
and no mid-water seam on tall windows.
Added @path:START-END ranged line mentions (#5550, picker half to follow),
a predictable last-copy backup file for clipboard exports with the path
named when the clipboard fails (#5555), wait on multiple background shell
tasks with until=any|all (#5549, named-kill half to follow), and composer
double-click word / triple-click line selection.
Added workflow parallel-schema slot partial success (#5583): a slot that
produces a schema-valid partial result no longer fails the whole parallel
branch.
Added plugin load-failure startup hints (#5579) and OpenRouter app
attribution headers on outbound requests.
Added codewhale doctor --fix (with --yes for non-interactive consent):
the doctor now computes a concrete repair plan — delete stale .tmp*
leftovers from interrupted atomic writes, tighten secret-store file
permissions to 0600, disable structurally broken (Error-status) MCP
entries through the atomic MCP save path, and scaffold missing user-global
skills/tools/plugins directories — shows it, and applies it only after
explicit consent. Every action is narrowly scoped and idempotent; JSON and
context-JSON modes stay read-only and conflict with --fix (#5552, v1).
Added /context reporting of the real provider prompt-cache hit rate (C3)
alongside token pressure.

Changed

Provider-native web search now applies domain constraints before accepting an
attempt, discards generated answers when returned citations violate those
constraints, and preserves the caller's configured/local timeout as an
independent fallback budget (#5681).
Idle session metrics omit zero facts (0 turns, LLM 0s) until the
runtime has evidence. Working chrome says in the current instead of a
generic working.
Deleted nine uncompiled runtime_contract/ staging files. Live contracts
remain model.rs and termination.rs.
The first #5587 dead-code sweep converts audited test-only helpers to
#[cfg(test)], keeping production builds free of test-only APIs without
changing runtime behavior.
/plugin reload is now discoverable when on-disk plugin bundles change: the
next send and /plugin list nudge once with Run /plugin reload to apply
instead of silently keeping the stale catalog (#5579). Trust is unchanged;
this does not auto-reload.
Context-pressure warnings and critical alerts now remain visible in sticky UI
status until compaction or explicit dismissal, instead of disappearing into
scrolling turn metadata (#5620).
The Runtime thread store defaults to a per-session root
($CODEWHALE_HOME/sessions/<id>/runtime) so multiple Codewhale processes on
one machine no longer share one owner lock (#5630). The exclusive lock is
unchanged; CODEWHALE_RUNTIME_DIR still selects a shared root when that is
intended.
Session token totals now include display-only per-model-call deltas while a
turn is running, including input/output and cache-class counters; the
authoritative TurnComplete totals still reconcile exactly once (#5581).
Transcript focus now exposes per-block actions: y copies content, Y
copies the rendered metadata view, Enter opens a fullscreen block pager, and
r opens raw detail; the existing Tasks rail shortcuts remain unchanged
(#5551).
Provider neutrality (#5588): model resolution of omitted/aliased models is
now provider-relative, OpenAI-native defaults no longer route through
another provider's table, CLI credentials stay provider-scoped, and NVIDIA
credentials no longer leak into the DeepSeek keychain. Neutrality test
matrices exercise several providers instead of standing in with one.
The workflow engine module was decomposed out of its 3k-line mega-file into
journal, usage, and report modules plus a module directory (#5586
slices 1a/B/C/D), a semantic-free move verified by normalized-content hash.
Compaction refusals are now always named (#5577): silent holds under context
pressure are gone, the context meter honors the same provider-billed prompt
the trigger uses (T1), and prune outcomes are projected without cloning the
transcript.
Step budgets now end honestly: an ~80% soft landing nudges the model to
write its final report, and exhaustion grants exactly one bounded
report-on-exhaustion turn instead of dying silently (A1/A2).
Contributor credit: recognized agent contributors (e.g. Codewhale Agent)
may now carry Co-authored-by trailers; unknown bot/tool trailers are
still rejected by the credit gate.

Fixed

Fast typing no longer corrupts the composer. The paste-burst heuristic ran
on every session until a real bracketed paste arrived, holding, buffering,
retro-grabbing, and absorbing Enter on timing guesses; it is now
fallback-only (gated off when the terminal provides bracketed paste), the
retro-grab is deleted, and Enter on held command text flushes and submits.
Ctrl+C works on the pre-session launch menu and speaks everywhere: the
first press arms the two-second exit window with a visible localized
"Press Ctrl+C again to quit" hint (previously silent), the second exits.
The worktree name input keeps Ctrl+C as cancel-input.
Fresh interactive sessions no longer leave a phantom one-message duplicate
behind. The TUI claimed one session id (Runtime store lock, turn-start crash
checkpoint) while the engine minted a second one; the first SessionUpdated
re-keyed the App, the completion commit cleared only the engine id's
checkpoint, and codewhale --continue later "recovered" the orphaned
checkpoint as a duplicate session instead of the real one. The engine now
adopts the host-owned id at spawn (EngineConfig::session_id) and /clear
mints the next id in the App like /new. A non-TTY --continue no longer
promotes and consumes the crash checkpoint before failing the terminal
check, and the root codewhale --resume <id> / --session-id <id> flags
documented in the operations runbook now parse instead of being swallowed
as a prompt.
Website: /signin, /signup, and /auth/callback are locale-aware public
routes instead of localized 404s. Sign-in and create-account send the person
to the CWC app; OAuth callbacks hop to app.codewhale.net with the query
intact; /login and /register are aliases. Local CLI use is not presented
as requiring an account (#5767).
The sandbox read deny-list matches a rule's resolved path as well as its
literal spelling. On macOS /etc and /var are symlinks into /private,
so a read of /private/etc/sudoers walked around the /etc/sudoers rule,
and a rule written against a symlinked directory never fired for the real
path that canonicalize and the process cwd hand back.
Background shells are first-class work-strip rows (▾ Shells N) you can
open, watch, and cancel by the shell_* id on the row. /jobs cancel all
cancels running shells; it no longer looks up a task named all. The
composer hourglass crumb no longer stands in for a shell surface.
codewhale logout and /logout now clear the Codewhale account session
and the Daytona secret slot, not only provider API keys. The TUI crate's
leftover login --api-key path no longer claims to save a key.
Account sessions no longer read the macOS Keychain. Unsigned or rebuilt
codewhale binaries were a new Keychain ACL principal every time, so
codewhale web and the TUI popped a password dialog on start. Sessions
now use ~/.codewhale/secrets/secrets.json (mode 0600), the same store
as provider keys. Extracted from the Keychain-retirement half of #5632.
Hardened the dispatcher-side config parse the same way: ConfigStore
loads and project-config parsing now deserialize ConfigToml on a
dedicated 16 MiB-stack thread (the guided-setup save path could overflow
a 2 MiB worker stack the same way the TUI's ConfigFile parse did), and
the #5585 setup-confirm toast test runs its runtime on an equally sized
thread instead of overflowing the default libtest stack.
Fixed detached interactive agents reporting worker usage after the parent
turn ends with the usage missing from the session/live /cost total
(#5597): interactive turns acquire an owner-scoped runtime usage lease,
late usage enters the session cost pool without reopening the sealed
mailbox, and worker/session/reload accounting share one hashed response
identity so retried deliveries stay exactly-once.
Fixed the sub-agent fiasco class: in-workspace absolute git -C no longer
trips the read-only child shell gate with a coherent bounded gate (#5595),
turn end parks turn-owned children resumably instead of silently cancelling
them (#5596), stale write-claims are released by liveness with coordinate
release (#5562), and the verifier role description matches its real
surface (#5562).
Fixed workflow responseSchema failure handling (#5583): bounded repair with
typed receipts (kind + attempt), raw-output receipts persisted as artifacts
that survive reload, and failures surfaced instead of null success (#5528).
Degraded owner snapshots no longer project as ordinary Completed runs
(#5582), typed task error kinds enable fail-fast parallel/pipeline (R9), and
/workflow confirm finds the draft despite interleaved messages.
Fixed the DeepSeek session that never auto-compacted at 842k/1M (#5577): the
exact billed_842k_on_a_1m_window_compacts_despite_a_small_estimate
regression pins the trigger.
Fixed sandbox escapes and authority gaps: workspace-write tools resolve
hard-linked files before writing (S2, #5569), an opt-in read deny-list
bounds full-disk reads in any posture (S1, #5568), and session grants match
the command family instead of widening the whole tool (R2).
Fixed provider-transport robustness: non-streaming HTTP requests are bounded
by a read timeout (R4), and Chat-Completions mid-stream error frames surface
instead of hanging (R3). MCP OAuth expiry now reacts to 401/403 with a named
recovery path and login hint instead of looking like a broken server (T4,
#5572).
Fixed Fleet lifecycle gaps: detached workers are reaped when their manager
dies (R7) and the per-task wall-clock timeout is enforced (R5); the local
Fleet host compiles on non-Unix targets; detached schema repair stays within
the runtime budget.
Fixed prompt-cache correctness: the tool catalog is fingerprinted in
provider wire order (C1), prefix changes between requests are always
declared (C5) — including the newly named mid-turn change:tool_surface
reasons for deferred-tool admission, tool-search activation, and runtime MCP
tool arrival — and a reasoning-only response stopped at the output limit now
fails the turn honestly instead of re-issuing a request that can only
reproduce the stop.
Fixed docs/public-surface drift: REBRAND.md no longer presents
api.deepseeki.com as a China fallback (#5564), and the web facts/tool
counts match the repository.
Heavy pull requests now run the real Linux workspace nextest, doctest, and
lockfile lanes directly on GitHub Actions instead of reporting a green
placeholder while waiting for a branch-specific CNB mirror (#5547).
Fleet roster members in a selected Fleet now expose a visible edit affordance
and a direct m model-picker shortcut, while the coordinator row remains
read-only (#5604, covers #5589).
The context inspector now attributes bounded tool-schema cost to the built-in
catalog and each discovered MCP server without changing prompt assembly or
cache behavior (#5553).
The goal-continuation quiet period ([goal] continuation_delay_seconds,
added in #5508) now applies on every dispatch path. Previously the
within-turn dispatch hook fired the next continuation prompt immediately
whenever a model step ended with the goal still active, so CLI-resumed and
host-managed sessions never observed the configured delay (measured
end-to-start gaps of ~9 s with a 300 s delay configured). The wait now
runs unconditionally inside goal_continuation_message_if_needed,
remains cancellable, and pause/clear/terminal update_goal calls still
cancel a pending pass (#5534).
Two unit tests no longer depend on process-global environment state that
sibling tests mutate concurrently.
route_budget::tests::v4_trigger_uses_window_percent_when_it_fits_spendable_input
asserted no-override output-budget values while reading
CODEWHALE_MAX_OUTPUT_TOKENS / DEEPSEEK_MAX_OUTPUT_TOKENS without
holding lock_test_env(), so a concurrent writer could flip the value
mid-assertion (the order-dependent full-suite flake).
prompts::tests::system_prompt_prefix_never_leaks_private_content read the
real home via HOME/USERPROFILE, so a machine with
~/.codewhale/instructions.md leaked its absolute path into the prompt and
failed the no-private-paths assertion unless a sibling's temporary HOME
guard happened to be live. Both tests now hold the env barrier and pin the
variables (the route-budget test removes the overrides; the prompts test
points HOME/USERPROFILE at a scratch dir). Assertions unchanged.
TUI sessions now apply a subtle OSC 12 cursor accent only on explicitly
supported terminals and restore the terminal default through normal, panic,
and signal cleanup paths (#5554).

Contributors

hexin (@h3c-hexin) — provider-native web
search across four routes (#5682, #5683, #5685, #5687), authoritative
edit-last-turn boundaries (#5621), Kimi Code k3-256k (#5622),
post-compaction input-token reporting (#5623), and preserving the scheduled
model selection in automations (#5650).
秋月凉梦 (@qiuYliangM) — co-authored the
edit-last-turn boundary fix (#5621), Kimi Code k3-256k support (#5622), and
post-compaction input-token reporting (#5623).
Isabel Wu (@wuisabel-gif) — live
session token totals (#5624), persisted context-pressure warnings (#5629),
discoverable Fleet roster editing (#5604), the capability-gated cursor
accent (#5599), and /copy for the latest completed response (#5692).
Paulo Aboim Pinto (@aboimpinto) —
Windows verbatim-path operands preserved through POSIX word splitting
(#5610), the plugins group moved onto the command shapes (#5657), FEAT-022
skills command shapes with retained-host validation (#5825), and FEAT-020
plugin command shapes re-landed on main (#5865).
Alex Musichen (@musichen) — a stable
DeepSeek heading in the configured-view model picker, keeping every official
catalog model for the active provider visible (#5689).
@gaord — the GET /v1/fleet/profiles
runtime API endpoint, reusing the FleetManager validation path (#5688).
Sh1Zuku (@SparkofSpike) — corrected
English documentation inaccuracies and the first zh_hans translations for
the Tier-2 docs (#5613).
@M-Maciej — goal continuation cadence
(#5591) and the per-session control socket (#5533, #5831).
Serephus (@serephus) — nixpkgs update
(#5669).
@whp233 — wire = responses|anthropic for
openai-compatible custom routes and opencode-zen muse-spark (#5716, landed
as #5719).
Gabriel Degret (@Gabriel-Degret) —
found the reasoning-only retry gap and built the first fix; landed as the
[reasoning_only] retry ceiling with a request-scoped nudge (#5867).
@huangxianzhan — the
x-opencode-session header for OpenCode Go and Zen gateways (#5868).
@zhuowp — task origin preserved in job
snapshots (#5869).
AdityaG (@AdityaVG13) — a ten-commit
performance pass: a zero-copy LaTeX fast path for streaming render,
single-pass token accounting on the per-turn pressure paths, memoized
provider resolution in the catalog cutline, parsing the bundled and
on-disk models.dev catalogs once per process (interactive boot -70%),
adaptive poll cadence for foreground shell completion, and worker caps
across the read-only diagnostic family.
Nightt (@nightt5879) — isolated remote
recovery lease generations (#5790).
@yiheng-kkk — replaced stale todo
transcript snapshots so a rewritten todo list renders its current tasks
(#5871, #5873).
@Lfanxing — Moonshot routes now degrade
incompatible tool definitions per request instead of failing the turn.
WissssleyL (@Lstarsky0) — moved
docs/subagents and docs/mcp onto the dictionary spine (#5337), with the
metaTitle probe that keeps them there.

Reports and reproductions that shaped this release:

@slowly247 — reported the Ollama input
budget collapsing to 1,024 tokens on 32K local models (#5820).
@ronohara — reported the engine stopping
after recoverable network errors, with the reproduction that pinned the
discarded approval (#5769).
@Lujc0523 — asked for ACP session
configuration of mode and model (#5863).
@senka9h — reported that serve --acp
lacked session/list and session/load (#5864).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.

Navigation Menu

v0.9.12

Choose a tag to compare

Sorry, something went wrong.

Sorry, something went wrong.

Uh oh!

No results found

Install

Recommended — official GitHub release

Secondary packaging — npm and Cargo

Docker / GHCR

Cargo (Linux / macOS)

Manual download — platform archives (recommended)

Verify (recommended)

What's in v0.9.12

Added

Changed

Added

Changed

Fixed

Contributors

Uh oh!