v0.9.1

> **Codewhale** is the public product from Shannon Labs. The `codewhale`
> command, npm package, and release-asset names remain lowercase technical
> identifiers. The legacy npm package `deepseek-tui` is deprecated and
> receives no further releases. Users coming from v0.8.x legacy `deepseek` /
> `deepseek-tui` names should migrate with `docs/REBRAND.md`.

## Install

### Recommended — npm (one command, all three entrypoints)

```bash
npm install -g codewhale
```

The wrapper downloads the matched `codewhale`, `codew`, and `codewhale-tui`
binaries from this Release and places them in the same directory.

### Docker / GHCR

```bash
docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.1
```

The image ships the `codewhale` dispatcher, `codew` shim, and `codewhale-tui` runtime. The `latest` tag is also updated on release.

### Cargo (Linux / macOS)

```bash
cargo install codewhale-cli codewhale-tui --locked
```

Both crates are required — `codewhale-cli` produces the `codewhale` dispatcher and `codew` shim, while `codewhale-tui` produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a `MISSING_COMPANION_BINARY` error.

### Manual download — platform archives (recommended)

Each archive below contains the `codewhale` dispatcher, `codew` shim, and `codewhale-tui` runtime, plus an install script:

| Platform | Archive | Install script |
|---|---|---|
| Linux x64 | `codewhale-linux-x64.tar.gz` | `install.sh` |
| Linux ARM64 | `codewhale-linux-arm64.tar.gz` | `install.sh` |
| Android ARM64 (Termux) | `codewhale-android-arm64.tar.gz` | `install.sh` |
| macOS x64 | `codewhale-macos-x64.tar.gz` | `install.sh` |
| macOS ARM | `codewhale-macos-arm64.tar.gz` | `install.sh` |
| Windows x64 (installer) | `CodeWhaleSetup.exe` | NSIS setup |
| Windows x64 | `codewhale-windows-x64.zip` | `install.bat` |
| Windows x64 (portable) | `codewhale-windows-x64-portable.zip` | — |
| Windows ARM64 | `codewhale-windows-arm64.zip` | `install.bat` |
| Windows ARM64 (portable) | `codewhale-windows-arm64-portable.zip` | — |

**Unix (Linux / macOS):**
```bash
tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh
```

**Windows:**
- For the installer path, run `CodeWhaleSetup.exe`; it installs `codewhale.exe`, `codew.exe`, and `codewhale-tui.exe` under `%LOCALAPPDATA%\Programs\CodeWhale\bin` and adds that directory to the current-user PATH.
- Extract the archive for your machine: `codewhale-windows-x64.zip` or
  `codewhale-windows-arm64.zip`
- Run `install.bat` (copies to `%USERPROFILE%\bin`)
- Add `%USERPROFILE%\bin` to your PATH

The **portable** Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has **bare, unarchived** binaries attached below (`codewhale-<platform>`, `codew-<platform>`, and `codewhale-tui-<platform>`) — the npm wrapper and the in-app `codewhale update` download the matched runtime binaries, whereas the `.tar.gz` / `.zip` archives above are the recommended manual download and additionally bundle an install script. The legacy npm package `deepseek-tui` is deprecated and is not republished. For migration from v0.8.x legacy binary names, see `docs/REBRAND.md`.

### Verify (recommended)

Download the checksum manifests from this Release and verify:

```bash
# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing
```

## What's in v0.9.1

### Dogfood follow-ups (2026-07-24)

### Added

- `/compact [focus]`: the manual compaction command now accepts an
  optional focus argument that is injected into the summary prompt, and
  the compaction summary itself becomes a structured nine-section
  successor briefing (primary intent, key concepts, files and code,
  errors and fixes, problem solving, user messages, pending tasks,
  current work, next step) that carries earlier compaction summaries
  forward and explicitly forbids tool use — replacing the free-form
  "under N words" instruction. Codewhale's pin/working-set and
  V4 prefix-cache-aligned machinery are unchanged.

- Saved workflows become slash commands: `*.workflow.js` files under
  `<workspace>/.codewhale/workflows/` and `~/.codewhale/workflows/` are
  discovered as `/name` commands that accept custom arguments (forwarded
  to the run's `args`), launch through the `workflow` tool in the
  background, and report their run id. Hand-written `.md` commands with
  the same name always win. The workflow tool's `source_path` now also
  accepts the user-global `~/.codewhale/workflows/` store, and every
  settled run leaves a durable synthesized report under
  `.codewhale/reports/<run_id>.md` (status, goal, gates, progress,
  result, verification).

### Fixed

- Disambiguate the two Kimi K3 model-picker rows, which read as an
  unexplained duplicate: bare `k3` is now labeled "Kimi Code plan route"
  with its default 262K window annotated as the plan-tier floor (raisable
  via the provider `context_window` setting for plans that include 1M),
  and `kimi-k3` is labeled "Moonshot direct route" with its 1M window.
  Both remain distinct, valid routes for the same underlying model.
- Close the model-facing `agent` tool role schema: the `type` property now
  publishes the canonical JSON Schema enum `["worker", "scout", "planner",
  "reviewer", "builder", "verifier", "custom"]` instead of describing the
  accepted values in prose. Legacy aliases are no longer advertised to
  models; they remain accepted only at replay/deserialization boundaries.
  Provider schema sanitizers (Chat Completions, strict mode, Anthropic
  Messages / OpenAI Responses, Moonshot/Kimi) are pinned by test to
  preserve the closed enum.

### Changed

- Rework the ambient idle ocean: the water now holds exactly one loose
  wedge school of fish, jellyfish, bubbles, and the rare whale cameo —
  seaweed and bio-dust are removed. Fish swim on a wrap-around path and
  always face the way they move (direction can only change while the
  school is off-screen); the lead fish carries an eye (`><o>`).
  Jellyfish become a pulsing bell with a lagging swaying tentacle. All
  ambient marks now glow via background→ink color lerp: a travelling
  sin² wave through the school, a floor-bounded pulse for jellyfish,
  and occasional raised-cosine glints on bubbles, with deliberately
  non-matching periods so nothing strobes in sync.

- Consolidate Anthropic Messages and OpenAI Responses stream opening
  through the shared `client/stream_entry.rs` transport seam already used
  by Chat Completions: one bounded response-header wait, shared
  dual/HTTP-1.1 client policy selection, at most one HTTP/1.1 fallback
  retry on a classified HTTP/2 header stall (never after a stream body
  has begun), and the shared idle-timeout diagnostics format. Both
  adapters gain the bounded open wait and `CODEWHALE_FORCE_HTTP1`
  H1 pinning; wire-specific headers, authentication, endpoints, and
  stream decoding stay at the adapter edge, and the Responses provider
  retry loop for rate limits / transient upstream errors is preserved.
- Rename the internal delegated-worker role type from `SubAgentType` to
  `FleetRole` with canonical variants (`Worker`, `Scout`, `Planner`,
  `Reviewer`, `Builder`, `Verifier`, `Custom`) matching the public Fleet
  vocabulary one-to-one. Wire behavior is unchanged: serialization emits
  canonical Fleet values only, and persisted `agent_type` fields plus
  documented legacy spellings (`general`, `explore`, `plan`, `review`,
  `implementer`, …) continue to load at deserialization/parse boundaries;
  unknown role tokens still fail closed with the canonical vocabulary in
  the error.


The Codewhale v0.9.1 source candidate includes a first-class local web client over the Runtime API,
first-class OpenCode Go and TelecomJS TokenHub providers and restored xAI device login,
calendar-correct hourly automations, a buildable OpenHarmony workflow-js
target, and hardening for Auto routing, remote-terminal clipboard transport,
restart recovery, and a coherent TUI, Work, evidence, and public release
surface.

### Added

- Add `codewhale web [--port 7878]`, a first-class loopback-only browser
  client over the canonical Runtime API. The dependency-free embedded shell
  supports thread lifecycle, snapshot-then-SSE transcripts, turn start/steer/
  interrupt, approvals, and user questions, including pending-request recovery
  across tab reloads, while leaving unsupported managed,
  files, PTY, model-selection, and Fleet controls absent. Browser auth uses a
  short-lived one-time loopback capability exchanged for an opaque, bounded,
  process-local HttpOnly, SameSite=Strict session cookie with a same-origin
  mutation guard; Runtime tokens never enter URLs, HTML, browser storage, logs,
  or browser-launch arguments (#4423).
- Add OpenCode Go as a first-class, subscription-backed Chat Completions
  provider with `[providers.opencode_go]`, `OPENCODE_GO_API_KEY`, and the eight
  models currently documented on its `/v1/chat/completions` endpoint. Models
  served only through OpenCode Go's Anthropic `/messages` endpoint remain out
  of this narrow route until Codewhale supports per-model wire selection
  (#1481 by @seanthefuturegorilla; implementation harvested from PR #773 by
  @zhangweiii and PR #1050 by @sternelee).
- Add TelecomJS TokenHub as a first-class Chat Completions provider with
  `[providers.telecomjs]`, `TELECOMJS_API_KEY`, and a key-scoped live
  `/v1/models` refresh. Models.dev and provider-specific catalogs remain in
  separate source partitions so either refresh order preserves both; refreshes
  do not delete the other source's rows, matching model ids from unrelated
  providers do not fabricate metadata, and chat requests omit unsupported
  reasoning fields (PR #4370 by @baendlorel; harvested with co-authorship).
- Prepare native Windows ARM64 `codewhale`, `codew`, and `codewhale-tui`
  binaries, npm selection, updater support, and standard/portable release
  archives. Build and smoke them on GitHub's native Windows 11 ARM runner,
  and move Linux ARM64 release builds to the native Ubuntu ARM runner to
  remove the slower multi-arch cross-link setup (#4267 by @w1w218).
- `load_skill` tool now supports listing: omit `name` or pass `"list"` to
  see all available skills without loading one (#4651).
- Add a unified `/skills` manager with one precedence-aware root catalog,
  bounded duplicate/shadow/conflict auditing, package provenance, and
  validated install, update, remove, and trust mutations (PR #4679 by
  @SamhandsomeLee).
- Add a safe Agent Details view and bounded, structured `current_activity` to
  the single Work projection, sourced from worker events instead of renderer
  string inference. Rows stay compact, exact evidence is opt-in, and raw child
  output never enters the parent transcript (#2889 and #4636; design direction
  by @aboimpinto, preserved from #2694).
- Make exact results and delegated coordination durable: non-inline tool output
  becomes immutable session-owned evidence behind bounded receipts; File
  mutations add configurable success-only diffs; and decisions and write
  contention survive restart with typed neutral-fan-in records (#4619, #4636,
  #4647).
- Runtime API provider registry and atomic provider-switch endpoints
  (`GET /v1/providers`, `GET /v1/providers/{id}/models`,
  `POST /v1/providers/{id}/switch`) so the web GUI renders a dynamic
  provider/model picker without the setConfig+reload clobber (#4658).
- Typed filter (`/`) in the Fleet setup wizard's Model step: substring
  match over provider id, display label, and model id keeps
  OpenRouter-scale catalogs navigable (#4639).
- `[auto.router]` config: explicit provider/model/thinking for the Auto
  mode classifier route; unset keeps the DeepSeek flash default, and
  missing credentials fall back to the local heuristic.

### Changed

- Keep the top activity bar literal and actionable: active To-dos appear first,
  followed by Sub-agents, while generic operations and coordination stay in
  the detail surface. Completed-only bars auto-hide, and top/side layouts can
  be resized by dragging their divider and retain the chosen size (#4700,
  #4702).
- Use each theme's semantic colors for composer mode and permission rails, and
  show a larger inline reasoning preview with clearer local/full expansion
  affordances (#4699, #4701).
- Simplify the model-facing runtime around stable action tools (`File`, `Git`,
  `Run`, deferred `Web`, and durable task and automation families), with legacy
  spellings hidden for replay. Fresh sessions no longer reserve a Work surface
  before real work exists (PR #4675).
- Give the terminal shell one deliberate visual language: cool Plan → Act →
  Operate and warm Ask → Auto-Review → Full Access ramps match between header
  and split composer edges; transcript rhythm groups related activity; a
  refined whale keeps the empty state calm; and one-cell live motion with
  truthful labels distinguishes reasoning, reading, tool use, and verification
  without exposing private reasoning text. Reduced-motion and animation-off
  settings freeze it, while ASCII-safe terminals retain the signal (#4676,
  #4677).
- Unified shell tool: the model now sees a single `Bash` tool with an `action`
  parameter (run/wait/interact/cancel). Legacy `exec_shell*` names remain as
  hidden compat aliases for transcript replay, and the tool-search catalog
  keeps `Bash` active by default (#4625).
- Tool output inline preview increased from 6 to 12 lines (4 head + 4 tail)
  before the fold indicator; full pager (`v` key) unchanged (#4603).
- Mode changes (`/mode agent|plan|operate`) now persist to `settings.toml`
  and restore across sessions (#4628).
- Billing provenance: every outgoing API request carries an
  `x-codewhale-provenance` header with client version and provider (#4324).
- The `/model` picker's typed search now ranks results: provider-name
  matches first (drill-down), then exact id, then id-prefix, then the
  active provider's rows (#4639).
- System prompt text consolidated into a single `prompts/text.rs`
  module (byte-exact constants replacing 17 layered files);
  composition order, constitution-first binding, and locale/personality
  variants unchanged.
- Ask, Auto-Review, Full Access, and Never resolve through one permission
  contract: `resolve_tool_permission` in the engine and
  `resolve_approval_request_disposition` in the UI share one truth table for
  session grants/denials, non-bypassable policy holds, and modal prompts
  (#4412).
- Collapsed multi-struct tool families into single action-dispatched tools
  (`AutomationTool`, `TasksTool`, `GithubTool`, `RlmTool`) while keeping
  legacy tool names as hidden compatibility aliases for transcript replay.
- Operate-mode children default to leaf depth (`max_depth=0`) unless the
  caller explicitly grants a deeper budget (#4598).

### Fixed

- Restore `uwu` theme config round-tripping and keep header permission colors
  and authored idle-whale geometry aligned with the selected theme (#4696).
- Default canonical `Bash` runs with no explicit `cwd` to the active
  `ToolContext.workspace`, including an isolated sub-agent worktree, instead of
  falling through to the shared shell manager's parent workspace. The regression
  test detects the selected workspace through marker files so it remains
  meaningful across PowerShell path spellings (#4674, PR #4673 by @fleitz).
- Generate QuickJS bindings for `aarch64-unknown-linux-ohos` with the native
  SDK's libclang and sysroot, carry the OHOS target and sysroot through final
  linking, and keep unsupported persistent PTY dependencies out of the target
  while retaining non-PTY `exec_shell` support (#4470 by @shenjackyuanjie;
  original bindgen approach in #4384 by @shenyongqing).
- Honor `[auto] cost_saving = true` in provider-aware heuristic and classifier
  routing, using only validated same-provider fast siblings and deriving
  fallback candidates from their actual provider so Auto cannot invent a
  cross-provider model. Providers without a known fast sibling stay on the
  active model (#4486; partial #4405).
- Make terminal-client clipboard behavior truthful over SSH: use OSC 52
  outside tmux, stock `tmux load-buffer -w` inside tmux, and bracketed paste
  for client-to-remote text. Graphical text and image access now requires
  credible forwarding or an explicit override, transport failures no longer
  claim success, and help distinguishes terminal text paste from graphical
  image attachment (#4484).
- Keep a fresh TUI Work surface from rendering prior-session worker snapshots
  or durable-task terminal receipts whose creation or completion predates the
  current app start. Active durable tasks remain visible, and shared history
  stays available through `/tasks` and archived agent views (#4488; partial
  #4416).
- Make doctor and setup output distinguish static configuration, command
  availability, MCP protocol readiness, and backend health instead of
  presenting configured routes as live-healthy. Ordinary doctor runs no
  longer wake loopback/self-hosted providers unless `--probe-local` is
  explicitly requested (#4485; partial #4406).
- Serialize test-only configuration-path readers with temporary environment
  redirects so the Windows provider-persistence matrix cannot observe another
  test's transient `CODEWHALE_HOME` or config path (#4483, closing #4463).
- Restore direct Moonshot `kimi-k3` to its documented 1,048,576-token
  context window and 131,072-token output limit instead of treating the live
  model as an unknown legacy 128K route. The existing Kimi Code tiered `k3`
  route and credential reuse remain unchanged (#4481).
- Keep read-before-edit snapshots in the engine session so a file read remains
  valid across turns and context compaction, while a new session still starts
  with an empty tracker (#4475 by @Angel-Hair).
- Make `apply_patch` expose the canonical `replace` operation while continuing
  to accept deprecated `changes` payloads through one validation path. Mixed
  patch, replace, and compatibility modes now fail before any write (#4476 by
  @Angel-Hair).
- Show the prompt-cache hit rate in the phase strip when the Cache status item
  is enabled, using overflow-safe rounded integer math and leaving compact or
  disabled status layouts unchanged (#4474 by @dmitri-0).
- Preserve Solarized Light's canonical Base3 (`#fdf6e3`) shell background
  instead of tinting it green-grey through the default underwater Ombre
  treatment, while retaining foreground ambient life (#4457 by
  @AiurArtanis; PR #4471 by @nightt5879).
- Register `/slop` and `/canzha` as compatibility aliases of `/debt`, while
  keeping user-command ownership truthful across dispatch, help, slash
  completion, alias copy, and typo suggestions (PR #4680 by @nightt5879).
- Fail closed on legacy Kimi CLI credential imports: remove Codewhale's
  hard-coded first-party-client impersonation and refresh request, never
  auto-enable or rewrite imported credentials, and label the compatibility
  route as a read-only imported token. An explicitly configured, still-valid
  access token remains usable until expiry; missing, malformed, and expired
  imports recover through the supported Kimi Code API-key route while
  first-class OAuth awaits Codewhale's own vendor registration (#4417,
  partially addressed).
- Restore xAI/Grok device-code OAuth login against the live xAI OIDC
  contract: discovery with issuer/endpoint validation and documented
  fallbacks, user-principal scope set, RFC 8628 `slow_down` backoff capped at
  code expiry, bounded, sanitized error reporting for denial, expiry, and
  malformed responses, and a shared blocking-worker boundary for both CLI and
  TUI login so reqwest's blocking client never creates or drops its private
  runtime inside Codewhale's Tokio runtime (#4410).
- Anchor `FREQ=HOURLY` automations with `BYHOUR`/`BYMINUTE` to persisted
  local-calendar slots so intervals keep their wall-clock phase across DST,
  restart, resume, RRULE updates, duplicate-slot recovery, and post-run
  advancement. Nonexistent clock slots are skipped and ambiguous slots run at
  their first occurrence (#4381 by @h3c-hexin).
- Give content-watch drafts canonical identities: the link and semantic-drift
  watchers now write and dedup through one canonical draft-storage key with
  deterministic hash-suffixed IDs, validate and bound model drift output
  before any KV writes, and show truthful admin draft labels, so unchanged
  findings dedup and changed findings re-draft instead of colliding (#4453).
- Make model-policy JSON repair consider object and array payloads in source
  order, matching nested delimiters across quoted strings and escapes and
  returning the earliest balanced candidate that parses, instead of letting
  an unmatched opening delimiter or object-first preference corrupt array
  payloads (#4430).
- Convert persisted sub-agent completion and still-running control events into
  concise, non-authoritative resume checkpoints, keeping their raw runtime
  envelopes, sentinels, and retry instructions out of restored model and TUI
  conversation state (#4409).
- Deliver failed, stopped, and stale sub-agent outcomes exactly once to the
  awaiting parent, lifecycle mailbox, and TUI before closing their runtime
  state. Restart now reconciles orphaned queued/model/tool-wait worker records
  to interrupted while preserving checkpoints, and cancelled workers no
  longer read as completed in the TUI (#4408).
- Give host applications a cancellation boundary for MCP OAuth login so a
  stalled or abandoned provider login no longer hangs the calling session
  (#4380).
- Avoid blocked reader joins after Windows process kills so terminated shell
  sessions cannot hang their readers (#4383).
- Give stdin-less observer hooks immediate EOF and contain timed-out hook
  process trees so descendants and pipe readers cannot leak after the parent
  shell exits (#4489 by @luismateusvargas).
- Preserve the full unsigned Windows PTY process status instead of collapsing
  every high-bit exception or NTSTATUS to `2147483647`, including decimal and
  hexadecimal diagnostic metadata for device retests (#4100 by
  @redjade75723).
- Keep the Hotbar Setup action list synchronized with keyboard focus when the
  selection moves beyond the visible rows, including Down past `/export`
  (#4418).
- Route Windows OpenHarmony Cargo links through the repository's target-aware
  clang launcher so the final Rust link keeps its target, sysroot, and MUSL
  flags, and extend the no-SDK release guard to protect that contract. This
  completes [@shenjackyuanjie](https://github.com/shenjackyuanjie)'s PR #4470
  setup alongside [@shenyongqing](https://github.com/shenyongqing)'s original
  bindgen approach in PR #4384.
- Reconcile the website roadmap with reality: the retired share-link
  direction is now an explicit non-goal, Workrooms is the considered
  direction, and the local web client appears as underway, in English and
  Chinese (#3418).
- System-prompt skills block and skill-load warnings no longer embed absolute
  home/workspace paths; entries render workspace-relative or `~/…` so the
  byte-stable prompt prefix never leaks private paths. A new invariant test
  guards absolute paths, API keys, and workspace paths in the prefix (#4632).
- Mode/permission baseline unit tests no longer read the developer's live
  `settings.toml`; they isolate config I/O to a temp directory (#4628).
- Enter no longer freezes the composer on send: dispatch splits into a
  sync prepare phase (instant history + spinner) and a spawned async
  phase (auto-route, preflight, engine send), with submits gated while
  a dispatch is in flight (#4605).
- Self-hosted routes keep explicit per-model output limits for unknown
  wire aliases instead of the generic 4K fallback (#4655 by @h3c-hexin;
  PR #4656).
- Chat Completions idle-timeout errors now include received-byte and
  timing telemetry, distinguishing prefill stalls from mid-stream
  stalls with truncated tool-call arguments (#4657 by @h3c-hexin).
- `set_config` provider writes now keep the in-memory route in step,
  so a following model write lands in the new provider's table instead
  of clobbering the previous provider's root default_text_model (#4658
  by @gaord, with a follow-up route-sync fix).

### Security

- Restrict cross-origin Runtime API browser preflights to the documented
  authentication and content headers, explicitly allowing `Authorization`
  instead of relying on a wildcard (#4454).

### Security

- Harden the public community-site boundary: scheduled review drafts now use
  one canonical freshness namespace, admin discard is restricted to validated
  draft objects, public feed requests cannot spend the server-held GitHub
  token, and maintainer login bodies are type- and size-bounded before parsing.

## Contributors

Thank you to the contributors whose code, reports, and reviews shaped v0.9.1:

- [@h3c-hexin](https://github.com/h3c-hexin) — calendar-anchored hourly
  automation recurrence (PR #4381), the MCP OAuth cancellation report
  (#4380), explicit limits for unknown local models (PR #4656 / #4655),
  and idle-timeout progress telemetry (PR #4657).
- [@gaord](https://github.com/gaord) — Runtime API provider registry and
  atomic provider-switch endpoints (PR #4658).
- [@SamhandsomeLee](https://github.com/SamhandsomeLee) — the unified `/skills`
  root catalog, audit/provenance model, validated mutations, manager UI, and
  acceptance coverage (PR #4679), plus Enter-send lag diagnosis and fix
  direction for #4605 (PR #4654; landed via the release-lane async-dispatch
  split).
- [@aboimpinto](https://github.com/aboimpinto) — the Layer 5.1 user-command
  registry boundary from PR #3278; the exact authored evidence commit from PR
  #4046, preserved intact in the integration graph; and the #2870 follow-up
  audit whose metadata and malformed-sibling gaps shaped the final corrections.
  Paulo also provided the structured, redacted Agent Details and
  `current_activity` direction preserved from #2694/#2889 and the real-PTY
  lifecycle acceptance direction from #2886.
- [@baendlorel](https://github.com/baendlorel) — TelecomJS TokenHub provider
  support and key-scoped live-catalog direction from PR #4370, harvested into
  the current provider architecture with co-authorship preserved.
- [@zhangweiii](https://github.com/zhangweiii) and
  [@sternelee](https://github.com/sternelee) — the original first-class
  OpenCode Go implementations (PRs #773 and #1050), harvested into the
  current provider architecture.
- [@seanthefuturegorilla](https://github.com/seanthefuturegorilla) — the
  canonical OpenCode Go/Zen provider request and acceptance direction
  (#1481).
- [@nightt5879](https://github.com/nightt5879) — `/debt` compatibility aliases
  with dispatch-consistent user-command shadowing across discovery surfaces
  (PR #4680), plus the Solarized Light background preservation fix (PR #4471).
- [@AiurArtanis](https://github.com/AiurArtanis) — the Solarized Light
  regression report and reproduction (#4457).
- [@shenjackyuanjie](https://github.com/shenjackyuanjie) — the HarmonyOS
  workflow-js bindgen, portable-pty gating, and SDK environment work
  (PR #4470).
- [@shenyongqing](https://github.com/shenyongqing) — the original HarmonyOS
  bindgen approach (PR #4384), carried into the landed implementation.
- [@luismateusvargas](https://github.com/luismateusvargas) — the Windows hook
  process-leak reproduction, process-tree analysis, and EOF fix direction
  (#4489).
- [@redjade75723](https://github.com/redjade75723) — the persistent Windows PTY
  report that exposed lossy high-bit process-status handling (#4100).
- [@w1w218](https://github.com/w1w218) — the Windows ARM64 release request and
  real-device motivation (#4267).
- [@Angel-Hair](https://github.com/Angel-Hair) — session-owned read-before-edit
  tracking and the explicit, backwards-compatible `apply_patch` replacement
  contract (PRs #4475 and #4476).
- [@dmitri-0](https://github.com/dmitri-0) — configurable cache-hit visibility
  in the phase strip (PR #4474).
- [@fleitz](https://github.com/fleitz) — the canonical `Bash` no-`cwd`
  workspace fix and regression test that keep isolated sub-agent commands in
  their own worktree (PR #4673, closing #4674).
- [@SparkofSpike](https://github.com/SparkofSpike) — the Windows Ctrl+O
  reproduction that exposed pre-pager result truncation and conflicting composer
  shortcut routing (#4482), and the exact Vim-space regression reproduction
  verifying the v0.9.1 input path already contains the needed global binding
  (PR #4477).

See [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) for full notes and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md) for older releases.