v0.8.65

> **CodeWhale** is the canonical project, command, npm package, and
> release-asset name. The legacy npm package `deepseek-tui` is
> deprecated and receives no further releases. Users coming from
> v0.8.x legacy `deepseek` / `deepseek-tui` names should migrate
> with `docs/REBRAND.md`.

## Install

### Recommended — npm (one command, both binaries)

```bash
npm install -g codewhale
```

The wrapper downloads the matched runtime binaries from this Release and places them in the same directory.

### Docker / GHCR

```bash
docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v ~/.deepseek:/home/codewhale/.deepseek \
  ghcr.io/hmbown/codewhale:v0.8.65
```

The image ships the `codewhale` dispatcher, `codew` shim, and `codewhale-tui` runtime. The `latest` tag is also updated on release.

### Cargo (Linux / macOS)

```bash
cargo install codewhale-cli codewhale-tui --locked
```

Both crates are required — `codewhale-cli` produces the `codewhale` dispatcher and `codew` shim, while `codewhale-tui` produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a `MISSING_COMPANION_BINARY` error.

### Manual download — platform archives (recommended)

Each archive below contains the `codewhale` dispatcher, `codew` shim, and `codewhale-tui` runtime, plus an install script:

| Platform | Archive | Install script |
|---|---|---|
| Linux x64 | `codewhale-linux-x64.tar.gz` | `install.sh` |
| Linux ARM64 | `codewhale-linux-arm64.tar.gz` | `install.sh` |
| Linux RISC-V | `codewhale-linux-riscv64.tar.gz` | `install.sh` |
| macOS x64 | `codewhale-macos-x64.tar.gz` | `install.sh` |
| macOS ARM | `codewhale-macos-arm64.tar.gz` | `install.sh` |
| Windows x64 (installer) | `CodeWhaleSetup.exe` | NSIS setup |
| Windows x64 | `codewhale-windows-x64.zip` | `install.bat` |
| Windows x64 (portable) | `codewhale-windows-x64-portable.zip` | — |

**Unix (Linux / macOS):**
```bash
tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh
```

**Windows:**
- For the installer path, run `CodeWhaleSetup.exe`; it installs `codewhale.exe`, `codew.exe`, and `codewhale-tui.exe` under `%LOCALAPPDATA%\Programs\CodeWhale\bin` and adds that directory to the current-user PATH.
- Extract `codewhale-windows-x64.zip`
- Run `install.bat` (copies to `%USERPROFILE%\bin`)
- Add `%USERPROFILE%\bin` to your PATH

The **portable** Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has **bare, unarchived** binaries attached below (`codewhale-<platform>`, `codew-<platform>`, and `codewhale-tui-<platform>`) — the npm wrapper and the in-app `codewhale update` download the matched runtime binaries, whereas the `.tar.gz` / `.zip` archives above are the recommended manual download and additionally bundle an install script. The legacy npm package `deepseek-tui` is deprecated and is not republished. For migration from v0.8.x legacy binary names, see `docs/REBRAND.md`.

### Verify (recommended)

Download the checksum manifests from this Release and verify:

```bash
# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt
shasum -a 256 -c codewhale-artifacts-sha256.txt
```

## What's in v0.8.65

### Added

- **Provider/model/route resolution (EPIC #2608).** Canonical provider, model,
  offering, and route types with a single `RouteResolver` that produces a
  resolved `ReadyRouteCandidate` (endpoint, wire protocol, model id, context
  limit, price) for every switch (#3458, #3084, #3384). The executing client is
  now constructed from the resolved candidate rather than re-derived from config
  (#3384). A committed, network-free Models.dev-shaped catalog gives models real
  context windows and pricing, with a secret-free live cache (#3497, #3498,
  #3385). Offering pricing with provenance is projected onto candidates (#3501,
  #3085), and route limits feed a route-aware context-budget service (#3508,
  #3523, #3086).
- **Fleet execution substrate (EPIC #3154).** Fleet profile types and config
  (#3469), durable manager resume, workspace agent-profile loading resolved into
  the worker runtime (#3367), loadout intent carried in task specs (#3512), and
  receipts that persist the resolved route for inspection (#3154, #3166). Worker
  status is folded into the unified `/fleet` surface and exposed through the
  Runtime API.
- **Provider surfaces.** A `/provider` readiness dashboard with reasoning
  readiness, an experimental/supported maturity marker, and an "open models for
  this provider" action (#3083, #2984, #3485); cross-provider `/model` search
  with scroll and provider type-ahead (#3484, #3075); inline `<think>`
  reasoning-stream routing with per-provider overrides (#3222); usage telemetry
  normalized into canonical token classes including Responses cache-miss and
  reasoning tokens (#2961, #3509); and remote MCP OAuth login with bearer/header
  auth precedence (#3527).
- **More providers and routes.** User-defined OpenAI-compatible custom providers
  via `[providers.<name>]` (#1519); a DeepSeek Anthropic-compatible route (#2963,
  #3449); a Qianfan route (#3425); Zhipu folded into Z.ai with equal-treatment
  model normalization (#3539); DashScope/Together fixtures.
- **Localized mode picker and composer indicators.** The `/mode` picker prompt,
  mode names, and hints, plus the composer's Vim mode indicator, now render in
  all seven shipped locales (model-facing mode labels stay English). Harvested
  from #2239 by @gordonlu.
- **Website and automation.** A runtime/integrations page, provenance and
  mirror-trust copy, a fact-drift CI gate, a published install script, and a
  weekly community digest archive on codewhale.net (#3419, #3421, #3415, #3482,
  #3420); per-automation mode/shell/trust/approval settings (#3467).
- **Model reference browser.** A read-only `/modeldb` command (aliases
  `model-reference`, `modelref`) opens a pager over the bundled catalog — every
  model's factual context window, max output, modality, and price, grouped by
  provider/kind. Labels only: it never selects, routes, or tiers a model
  (#3205, #2300).
- **Transcript presets.** A `/config preset <name> [--save]` mechanism with a
  first `calm` preset — calm mode, calm tool collapse, comfortable spacing, and
  low motion — presentation-only and evidence-preserving (#3478).
- **Model capability profiles.** A typed `model_profile` module separates
  intrinsic model facts from resolved provider-route capability, so compact
  routes defer heavier nonessential tools while standard/full routes keep the
  eager tool surface (#3451, #3365).
- **Live provider catalog refresh.** A secret-free `/models` live-fetch layer
  (401/403/404/429 mapped to typed outcomes) feeds the catalog cache; the API
  key authorizes the request but is never persisted into the delta or cache
  (#3385).

### Changed

- **Config modularization (#3311).** `ProviderKind` (#3505), harness posture
  (#3507), and provider default seeds (#3503) moved into dedicated modules, and
  the `config.rs` monolith split into clean leaf modules (paths, search,
  model/base-URL constants, sub-agent limits) behind a `pub use` facade.
  `AppMode` helpers were centralized (#3510), and mode-vs-permission policy is
  now derived through a single `base_policy_for_mode` resolver instead of
  scattered mutation (#3386, advisory review-intent behavior preserved).
- **Leaner tool surface.** Dropped `task_shell_*` from the active set and folded
  `tool_search_*` (#3463); ablated the in-turn loop_guard and encoded reasoning
  dispositions (#3462); added the Orchestration disposition to the constitution.
- **Routing.** Provider/model switches and the capability-aware fallback chain
  resolve through `RouteResolver`; reasoning effort is normalized for the
  *resolved* provider; the fallback chain now skips providers that lack auth
  (#2574); and context window and memory-pressure come from the resolved route
  (#3086).
- **UX.** Approval modal gained a group divider and selected-row caret (#3515);
  picker scroll/type-ahead and selection contrast hardened (#3500); the README
  was rewritten as an architecture end-cap (#3087); and repo agent guidance was
  de-hardcoded to live truth.
- **Fleet identity and defaults.** Fleet workers now enter with an explicit
  "summoned Fleet member" operating contract, setup/profile prompts keep the
  default model behavior as same-route inheritance, and generated worker
  instructions avoid leaking recursive topology that only the orchestrator
  needs.
- **Legacy swarm cleanup.** Removed the obsolete `/swarm` core command/menu
  registration so `/fleet` is the product surface, while `/subagents` remains a
  compatibility shortcut to worker status.
- **Running-state animation.** Tool cards and background-task rows now share one
  faster braille spinner cadence, so Bash/background work reads consistently
  alive across the transcript and sidebar.
- **Restored contributor credit.** Threaded machine-readable credit
  (`docs/CONTRIBUTORS.md` + `.github/AUTHOR_MAP`) for earlier merged work that
  shipped without it, including the `/jobs cancel-all` action and the npm
  retry-timeout hint (#1538) by @jieshu666, and the community ACP adapter
  reference by @rockeverm3m.

### Fixed

- **Release hygiene.** The strict `cargo clippy --workspace --all-targets --locked
  -- -D warnings` gate passes; `npm run build` no longer dirties the generated
  web facts; the site sets `metadataBase`; the community digest page parses each
  record independently and localizes its chrome; and `cargo audit` is clean with
  the starlark-transitive unmaintained advisories documented.
- **Routing and mode correctness.** Ordinary prompt text is no longer
  interpreted as a mode switch (#3387, #3491); model candidates are scoped to the
  active provider; Together-owned DeepSeek routes are accepted (#3426); insecure
  `http://` custom endpoints raise an advisory warning (#1519); and the Fleet
  setup planner's role/model selection now drives the generated profile.
- **Runtime stability.** MCP connection drops are explicit (#3524), HTTP API
  calls reuse a shared MCP pool (#3532), and per-agent sub-agent mailbox
  telemetry is throttled to cut UI lag (#3454).
- **YOLO background-shell approvals.** A background shell command no longer pops
  an approval modal in YOLO mode. `classify_risk` marks all shell commands
  destructive, so the auto-review safety floor held every *background* shell for
  review, and the `ForcePrompt` site never checked `auto_approve` — only
  background commands surfaced it, since foreground shells take the
  `Interactive` origin and skip that branch.
- **Bash approval modal fit.** The shell approval modal now labels Bash
  commands directly, avoids repeating command/workdir in the impact summary,
  wraps long commands, and switches to compact controls on short terminals so
  the decision keys stay visible.
- **Custom-provider picker rows.** Concrete `[providers.<name>]` entries now
  appear in the provider picker (id, endpoint, auth readiness, wire protocol,
  current model) instead of only the generic placeholder; auth readiness honors
  per-entry key/env/metadata/no-auth/loopback.
- **Passive MCP tool discovery.** Runtime API-owned stdio MCP processes are no
  longer spawned from passive `/v1/apps/mcp/tools` requests; live discovery
  remains available through `?connect=true`. `doctor` now warns on relative-path
  stdio MCP commands without `cwd`.

## Credits

Contributor credits for this release live in the changelog entry above —
thank you to everyone whose reports, PRs, reviews, and reproductions shaped it.

See [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) for full notes and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md) for older releases.