v0.9.10
Hmbown/Codewhalev0.9.10Aug 20, 2026by github-actions[bot]
AI Summary
A retention and identity release that prevents unbounded memory usage and improves session state visibility.
Key Highlights
- Shell and transcript no longer retain unbounded tool output
- Mid-turn history inserts no longer strand in-flight tool rows
- Every agent is visible from `/agents list`
- PTY acceptance lane has a stall watchdog
Full Release Notes
> **Codewhale** is the public product from Shannon Labs. The `codewhale` > command, npm package, and release-asset names remain lowercase technical > identifiers. The legacy npm package `deepseek-tui` is deprecated and > receives no further releases. Users coming from v0.8.x legacy `deepseek` / > `deepseek-tui` names should migrate with `docs/REBRAND.md`. ## Install ### Recommended — npm (one command, both entrypoints) ```bash npm install -g codewhale ``` The wrapper downloads the matched `codewhale` and `codew` command assets from this Release. Both contain the same compiled runtime. ### Docker / GHCR ```bash docker run --rm -it \ -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \ -v codewhale-home:/home/codewhale/.codewhale \ ghcr.io/hmbown/codewhale:v0.9.10 ``` The image exposes the same runtime as both `codewhale` and `codew`. The `latest` tag is also updated on release. ### Cargo (Linux / macOS) ```bash cargo install codewhale-cli --locked ``` The Cargo package installs `codewhale`. Cargo cannot create a second command alias from one binary target; users who want the shorter spelling can add a `codew` symlink to that installed executable. The npm, Homebrew, archive, shell-installer, and container channels install both command names directly. ### Manual download — platform archives (recommended) Each archive below contains the same runtime under the `codewhale` and `codew` command names, plus an install script: | Platform | Archive | Install script | |---|---|---| | Linux x64 | `codewhale-linux-x64.tar.gz` | `install.sh` | | Linux ARM64 | `codewhale-linux-arm64.tar.gz` | `install.sh` | | Android ARM64 (Termux) | `codewhale-android-arm64.tar.gz` | `install.sh` | | macOS x64 | `codewhale-macos-x64.tar.gz` | `install.sh` | | macOS ARM | `codewhale-macos-arm64.tar.gz` | `install.sh` | | Windows x64 (installer) | `CodeWhaleSetup.exe` | NSIS setup | | Windows x64 | `codewhale-windows-x64.zip` | `install.bat` | | Windows x64 (portable) | `codewhale-windows-x64-portable.zip` | — | | Windows ARM64 | `codewhale-windows-arm64.zip` | `install.bat` | | Windows ARM64 (portable) | `codewhale-windows-arm64-portable.zip` | — | **Unix (Linux / macOS):** ```bash tar xzf codewhale-<platform>.tar.gz cd codewhale-<platform> ./install.sh ``` **Windows:** - For the installer path, run `CodeWhaleSetup.exe`; it installs `codewhale.exe`, `codew.exe`, and `codewhale.bat` under `%LOCALAPPDATA%\Programs\CodeWhale\bin`, adds that directory to the current-user PATH, and creates a Start Menu shortcut that prefers Windows Terminal (`wt.exe`) when it is installed. - Extract the archive for your machine: `codewhale-windows-x64.zip` or `codewhale-windows-arm64.zip` - Double-click `codewhale.bat` (not the raw `.exe`) to launch - Run `install.bat` to copy the binaries and launcher to `%USERPROFILE%\bin` - Add `%USERPROFILE%\bin` to your PATH The **portable** Windows archive skips the install script — extract and run `codewhale.bat` from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline. Each platform also has **bare, unarchived** `codewhale-<platform>` and `codew-<platform>` assets. The seven `codewhale-tui-<platform>` filenames attached to v0.9.5 are byte-identical compatibility copies used only to let already-installed v0.9.4 clients discover and cross this single-binary transition; current installers do not expose a third runtime. The legacy npm package `deepseek-tui` is deprecated and is not republished. For migration from v0.8.x legacy binary names, see `docs/REBRAND.md`. ### Verify (recommended) Download the checksum manifests from this Release and verify: ```bash # Linux — archive bundles sha256sum -c codewhale-bundles-sha256.txt --ignore-missing # Linux — individual binaries sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing # macOS shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing ``` ## What's in v0.9.10 - Show the full slash-command or `/model` completion row in a bounded, wrapping hover popover whenever narrow terminals truncate it, closing the remaining scoped gap from [#998](https://github.com/Hmbown/CodeWhale/issues/998). Thanks [@AiurArtanis](https://github.com/AiurArtanis) and [@formp3](https://github.com/formp3) for identifying the affected surfaces. - `registry_sync` no longer ships the full MCP Registry catalog into the conversation. It takes a required query, scores the local snapshot host-side, and returns at most eight matches; the complete catalog stays on disk, and the compaction and spillover exemptions that let a multi-hundred- kilobyte dump reach the model unchanged are gone. - Providers that mirror the outgoing `(reasoning omitted)` replay placeholder back as a reasoning delta no longer have that echo ingested as real thinking: the exact transport placeholder is dropped on arrival, so live sessions stop showing a stream of placeholder reasoning blocks and saved transcripts stay free of them. - Mid-stream connection drops during an interactive turn no longer persist a synthetic `[runtime]` user message. Retry state is a typed engine-internal descriptor; a thinking-only drop re-issues the request without claiming a partial reply was preserved, the retry budget is enforced in mechanism, and recovery produces exactly one authoritative final answer. Codewhale v0.9.10 is a retention, identity, and product-clarity release: the shell and transcript can no longer retain unbounded tool output in memory or on disk, mid-turn history inserts no longer strand in-flight tool rows, every agent that ran this session is visible from `/agents list`, the PTY acceptance lane has a stall watchdog and bounded CI steps, approval outcomes are durable and fail closed (cyq1017, #5360), and three $HOME disk leaks are reclaimed. Extension surfaces now name their real state and act only through the reviewed install and trust flows, and sub-agent, shell, task, and workflow state is owned by the session that created it (#5518). Test threads get an 8 MiB stack so the lib suite can no longer abort under load. ### Fixed - First run starts on the welcome screen again. A missing key no longer skips Welcome and auto-opens the local-provider list: Enter walks to the calm provider explanation, then Enter opens the picker so a first API key can be set. Returning missing-key recovery still opens the picker on launch. - A foreground `bash` command that named no timeout is bounded again. The model-facing `bash` tool left an omitted `timeout_ms` at the internal ceiling (~24.8 days) instead of the 120 s default its own schema advertises, so a CLI that blocked on an interactive prompt or a hung network call held the turn open indefinitely — one report sat on a single unauthenticated CLI call for over two hours with the tool row simply counting seconds. The advertised default now applies, which arms the existing recovery: the process is killed and the model is told to rerun with `background=true` and poll with `action="wait"`. An explicit `timeout_ms` is still honored for genuinely long foreground work, and background and interactive runs keep their own lifetimes. - The Extensions (`/plugin`) Marketplace is no longer a read-only list. Every recommendation and stored candidate names its truthful state and primary action — Add, Enable, Configured, or Unavailable — and Enter or a mouse click runs that action through the existing reviewed `/mcp add recommended`, `/mcp enable`, and `/plugin` install/trust controllers, so no second trust path exists. Browser Use and Sandbox Runtime stay honestly Unavailable with their real setup routing instead of implying an install Codewhale cannot perform. - The Extensions MCP tab now renders one honest inventory: the header count and the visible rows derive from the same configured-server set, so `MCP (6)` can no longer sit above two rendered rows. Disabled servers stay visible and labeled disabled instead of silently disappearing, and configured servers absent from the live snapshot list as not-yet-inspected with their own explicit reload affordance through the MCP command controller. - Installed plugin rows now act on their real state: Enter opens an active bundle (`/plugin show`), offers Enable for a trusted-but-disabled bundle, or routes an untrusted bundle to the existing trust review — through the same confirmation and persistence controllers as the slash commands. - Sub-agent handoffs and rosters, background shell jobs, durable tasks, delayed continuations, and workflow controls are now scoped to the session that owns them. Records carry immutable root-session ownership, stale completion-channel payloads are rejected before deduplication, background work drains and reports only to its owning session, and legacy ownerless jobs fail closed (#5518 failure class reported by @hxfhd; the report's exact JavaScript provenance was not claimed as reproduced). - The resolved route envelope now reaches every outbound model call: all wire dialects and auxiliary calls clamp at the shared transport seam under one wire/reservation budget, provider input limits are honored, and switching models on the same protocol no longer inherits the previous model's limits (#5516, #5518). - First-run continuity: the chosen onboarding provider persists across restarts, a missing first-run config no longer interrupts the flow, and the automatic working-agreement checkpoint renders as a standalone setup handoff instead of regressing the onboarding rail to the full wizard's 4/10 progress. - Explicitly worded natural-language `/goal` declarations now create a durable goal in the provider-neutral engine before model dispatch, while ordinary tasks and quoted transcripts stay out of goal mode and prose acknowledgement alone can no longer stand in for goal creation. - `/model` now keeps the current Z.ai default (`GLM-5.3`) visible when an older installation has an explicit `GLM-5.2` route saved. The saved 5.2 route remains exact; choosing 5.3 sends and remembers the distinct 5.3 ID. - The constitution checkpoint now leads with the bundled balanced agreement; the default path writes no custom constitution. The startup launch surface distinguishes read-only Chat from folder-bound, approval-gated Work. - Tabby and other IME bridges no longer observe a stale visible caret while a frame diff is being painted; Codewhale hides the cursor during the diff, restores the canonical composer cell, and only then reveals it again (BrathonBai, #5023). - Pre-header HTTP/2/SSE transport failures get one bounded HTTP/1.1 retry; authentication, provider-semantic, response-body, and already-pinned HTTP/1 failures remain fail-closed (demian-welt, #4683). - MCP `tools/call` images now travel as bounded typed content instead of leaking base64 through model-visible JSON. Direct and parallel calls share the same MIME, size, validation, and one-image boundary (PR #5515 by @cacdcaecawae). - Linux npm installs and updates race GitHub Releases against the CNB mirror at the checksum-manifest layer, then download from the first verified source without making users wait through a doomed slow-source timeout. - `CODEWHALE_PREFER_BWRAP` now applies the documented Linux sandbox override, and Codewhale-era names own build metadata, hook session/tool-call IDs, and sandbox child markers. The corresponding `DEEPSEEK_*` names remain as 0.9.x compatibility aliases (#5443). - Windows default launch prefers Windows Terminal: zip archives ship `codewhale.bat` (CRLF, `wt.exe` then the exe), `install.bat` copies that launcher, and the NSIS Start Menu shortcut opens it instead of the raw binary (#1854). - `fix(tui): make the header status mark honour its setting` — `status_indicator` did nothing for three of its four documented values. The header hardcoded a leading `cw` span *and* asked for a second mark beside the effort chip, then filtered the second one against the literal `"cw"`; because `cw`, the legacy `whale` opt-in, and every unknown value all normalize onto that same mark, the filter discarded them and left `off` with nothing to turn off. `cw`, `whale`, `off`, and a typo all rendered byte-identical headers. There is one mark now and the setting owns it: `cw`/`whale` draw the typographic mark, `dots` draws the activity frames, `off` removes it (thejayjetson, #5512). - `fix(tui): rebase active-cell tool bindings on every mid-turn history insert` — `/rename` mid-turn left the running tool row spinning forever (#5478). - `fix(tui): bound what the shell and transcript retain from tool output` — a 1.1 MB Bash call kept over a megabyte resident for up to an hour; raw streams now cap at 16 MiB in flight and release delivered output, and retained tool outputs cap at 64 KiB per record / 8 MiB per transcript (#5472). - `fix(tui): reclaim the three $HOME disk leaks` — orphaned session dirs, the unbounded audit.log, and stranded writer temp files. - `fix(tui): persist approval outcomes before execution` (cyq1017) — approval receipts are committed to a session-owned log before execution proceeds; unpersistable evidence blocks the tool; resume reconstructs closed and interrupted approvals (#5360). - `test(tui): break the LazyLock/env-barrier deadlock in the test harness`. - `ci: give test threads the 8 MiB stack they need` — the lib suite aborted with SIGABRT under load on the default 2 MiB stack. - YOLO entry points honor a locked approval policy: `--yolo`, `/mode yolo`, `/zidong`, and Alt+Y can no longer set Full Access + trust + shell when config or managed requirements own the posture. - Terminal PTY tools fail closed without a sandbox backend under a narrowed filesystem posture, and otherwise start `$SHELL -i` through `SandboxManager::prepare` like `bash`. - Skill update refuses to replace a directory that has no `.installed-from` marker — same ownership gate plugins already used. - `cp`/`mv` are workspace-safe only when every path operand stays inside the workspace — Auto-Review no longer auto-allows `cp /etc/passwd .`. - Main CI no longer shares one concurrency group per branch: each SHA gets a verdict instead of a cancelled pending run. A hermetic Safety gate job runs authorization tests in under 15 minutes (test bankruptcy restructuring — no tests deleted). - Config-fixture tests no longer honor `lock_test_env` as a license to read a populated `~/.codewhale/config.toml`; they need an `EnvVarGuard` like settings already did. Safety-gate and CNB workspace tests pin a hermetic `CODEWHALE_HOME`. `exec_persistent_service` is serialized in nextest and inside the cargo-test binary instead of dropped (#5355). - Short CLI no longer waits up to three seconds for a telemetry POST on exit; `session_end` is recorded and the buffer ships on the next interactive session. - Bare `/` now opens a deliberately small starter set: `/help`, `/setup`, `/model`, `/settings`, `/resume`, and `/rc`. The full command inventory remains searchable through `/help`, the command palette, and direct prefix typing, without front-loading the entire control surface (#5442, #5439). - First run now asks only for decisions needed to become usable, keeps the offline route explicit, and leaves optional provider, tools, policy, and appearance work in the progressive `/setup` repair guide. The idle aquarium asks one task-oriented question instead of advertising a tutorial or command billboard, and the localized telemetry choice appears after the workspace is ready without blocking the composer. - Provider, active model, and reasoning effort moved out of the crowded header into a quiet, width-aware footer identity. Compact layouts keep model and effort before provider detail and shed whole low-priority groups instead of clipping the composer or control hints. - The model picker no longer re-parses `~/.codewhale/config.toml` once per provider when deciding who has a saved key. ### Added - `/workflows` opens a live run dashboard over this workspace's durable workflow journal: every retained run with status, phases, child roster, progress, and host-side cancel — observation only, it never launches a run. - Repository instructions now assemble from the actual containing checkout: applicable `AGENTS.md` files resolve repository-root to current-directory in order under one aggregate budget, a linked worktree is its own root, and scope is never inferred from path mentions or whichever branch is named `main`. - `/goal` is a codex-style control plane: setting an objective dispatches it to the engine, which owns the goal and starts the first goal turn itself — the objective is never echoed back as the user's own message, pause/resume are real control ops, and the hunt-era vocabulary and trophy cards are gone. - `/extensions` and `/plugins` open one localized inventory for Hooks, Plugins, local Marketplace catalogs, Skills, and MCP. Reviewed suggestions include Playwright, Chrome DevTools, Cua Computer Use, Browser Use, and the sandbox runtime without granting trust or installing anything on open. - Turn Inspector now opens the newest turn and pages across complete recorded user, reasoning, tool/subagent, and assistant output with page-scoped search, copy, and export (sky-sun-moon, #1682). - Background tasks have bounded incremental persistence, durable terminal reasons, truthful timeout/cancellation receipts, restart recovery, and interruptible continuous-goal delays (#5497, #5508). - `/title` once again controls the terminal window title independently from `/rename`, survives session save/load, and sanitizes control, bidi, and zero-width characters (PR #5509 by @SparkofSpike). - MCP snapshots preserve whether capabilities were advertised by the server, discovered through the bounded legacy fallback, or not observed (#4170). - `codewhale auth status --diagnostic` reports canonical paths, isolation source, backend class, and value-free provider-source presence without opening credential stores or creating/migrating state (#2369). - `codewhale doctor --probe-search` performs an explicit credential-free, policy-checked transport probe for the selected search provider; ordinary doctor and JSON output remain offline (#5442). - The safe deferred `read_media` tool is available to supported read-only roles, and history receipts distinguish localized tool execution outcomes without exposing raw payloads (#5102). - **npm Linux x64 first-party source selection.** The wrapper concurrently fetches the GitHub Releases and CNB checksum manifests for the exact package version, locks the first source whose HTTP response and manifest validate, and downloads binaries only from that source. Explicit `CODEWHALE_RELEASE_BASE_URL` / `CODEWHALE_USE_CNB_MIRROR=1` still skip the race; other targets stay on GitHub. - `/workflow <objective>` and `/workflow run <path>` now produce a bounded, tool-less proposal for review. Only `/workflow confirm` can launch that reviewed draft; status, cancel, settings, and the `/workflows` dashboard stay host-owned and do not spend a model turn (#5439). - `feat(tui): add cancellable cadence to continuous goals` (M-Maciej) — `[goal] continuation_delay_seconds` gives coordinator goals a visible quiet period between successful turns while reusing the existing coalesced goal continuation token; Esc, Ctrl+C, pause/done/blocked/clear cancel before the next provider request, and failures never continue (#5508). - `feat(tui): add command context adapters and migration gate (FEAT-015)` (aboimpinto) — TUI-owned capability facets, a dual-path dispatch seam, and source-aware CI enforcement so a command slice cannot claim to be migrated while it still accepts concrete `App`. Zero production commands migrate in this slice (#5316). - `feat(web): move docs/hooks and docs/troubleshooting onto the dictionary spine` (Lstarsky0) — both pages now read copy from the locale dictionaries instead of inline bilingual literals (#5337). - `feat(web): move docs/constitution and docs/runtime-api onto the dictionary spine` (Lstarsky0) — both pages now read copy from the locale dictionaries instead of inline bilingual literals; another incremental phase of #5337, not completion of the full epic (#5517). - `docs(i18n): complete Tier 1 of Chinese docs localization` (SparkofSpike) — Chinese and Indonesian docs move to `docs/zh_hans/` and `docs/id/`, with redirect stubs at the old paths for one release cycle (#5482). - `feat(tui): show repository context in git chrome` (wuisabel-gif) — the TUI header now identifies the active repository or linked worktree before the branch and dirty marker, so operators can see where the agent is working without opening the worktree manager (#5437). - `feat(tui): formalize the status-bar color grammar` — seven semantic families live in `docs/design/STATUS_BAR_COLOR_GRAMMAR.md` and `palette::grammar`; header and phase-strip ink resolve through named `ChromeInk` slots so chrome cannot invent an eighth meaning or spend Failure red on a dirty worktree or selected mode. The footer's session metrics strip resolves through the same inks, and the red reservation is checked against every selectable theme, not just the whale default; typed footer toasts resolve through the grammar too. Repo/worktree chrome stays metadata and still renders when Git names a location but not a ref (#5437). - `feat(tui): first slice of the agents roster` — every agent that ran this session, receipts-only, via `/agents list` and the sidebar fan-out rows (#5479 spec items 1 and 5). - `ci: bound PTY acceptance and add a stall watchdog to the harness` — QA_PTY_STALL_TIMEOUT_SECS aborts a wedged PTY run with a diagnostic; the isolated PTY step is capped at 15 minutes; Windows NSIS provisioning gets a bounded retry (#5496). - `chore(scripts): dev-cache warns before it fills a disk` (#5465 class). ## Contributors - [Sh1Zuku](https://github.com/SparkofSpike) (`@SparkofSpike`) — restored `/title` as an independent, persistent terminal-window title in PR #5509, in addition to the Tier 1 Chinese and Indonesian documentation work below. - [Sun Zhenyuan](https://github.com/bistack) (`@bistack`) — extracted the turn-loop stream processor in PR #5514 while preserving retry, cancellation, usage, TTFT, steering, and partial-response behavior. - [OctoBored](https://github.com/OctoBored) (`@OctoBored`) — supplied the working no-token Star History mirror used across the localized README set after the canonical chart endpoint began returning a restricted placeholder (#5510). - [cacdcaecawae](https://github.com/cacdcaecawae) (`@cacdcaecawae`) — added provider-neutral typed MCP image forwarding in PR #5515; the harvested version also makes malformed image fields produce a visible omission receipt. - [DingYong4223](https://github.com/DingYong4223) (`@DingYong4223`) — reported the narrow-terminal completion truncation closed by the bounded hover reveal (#998). Thanks also to @AiurArtanis and @formp3 for identifying the affected completion surfaces. - [sky-sun-moon](https://github.com/sky-sun-moon) (`@sky-sun-moon`) — reported the missing full per-turn input, reasoning, tool, and assistant pages that shaped Turn Inspector navigation (#1682). - [cy2311](https://github.com/cy2311) (`@cy2311`) — reported the Windows launch path that now ships and installs a Windows Terminal-aware batch launcher (#1854). - [demian-welt](https://github.com/demian-welt) (`@demian-welt`) — provided the reproducible pre-header SSE transport failure behind the bounded HTTP/1.1 retry (#4683). - [BrathonBai](https://github.com/BrathonBai) (`@BrathonBai`) — reported the Tabby/CJK IME candidate-window jump that led to the hide-diff-position-show cursor transaction (#5023). - M-Maciej (@M-Maciej) — the real-world organization-coordinator use case and 5–30 minute cadence requirement behind cancellable cross-turn goal delays (#5508). - cyq1017 (@cyq1017) — approval outcomes are persisted before execution can proceed: receipts commit to a session-owned log first, unpersistable evidence blocks the tool, stale decisions are rejected, and resume reconstructs closed and interrupted approvals (#5491, closes #5360). - aboimpinto (@aboimpinto) — the TUI-owned dependency-injection and migration infrastructure that makes slash-command extraction safe: seven capability facets, a dual-path dispatch seam, and source-aware CI enforcement so a command slice cannot claim migration while it still accepts concrete `App` (#5506, EPIC-005/FEAT-015 under #5316, which they also filed). - wuisabel-gif (@wuisabel-gif) — the TUI header now names the active repository or linked worktree before the branch and dirty marker, derived from Git's common directory and capped by shell density tier (#5511, the repo/worktree slice of #5437). - SparkofSpike (@SparkofSpike) — Tier 1 of the Chinese docs localization: Chinese and Indonesian documentation moves to `docs/zh_hans/` and `docs/id/` with redirect stubs held at the old paths for one release cycle (#5507, epic #5482, which they also filed). - Lstarsky0 (@Lstarsky0) — `docs/hooks` and `docs/troubleshooting` move onto the dictionary spine, retiring their inline bilingual literals in favor of locale dictionaries with token-aware code spans (#5504, closes #5337, which they also filed). - Lstarsky0 (@Lstarsky0) — `docs/constitution` and `docs/runtime-api` follow the same dictionary spine: 28 inline `isZh` branches become typed English and Chinese dictionaries held to key and token parity, while the other sixteen locales keep the English fallback (#5517, a further phase of #5337). - @thejayjetson — the header status-indicator report that pinned the regression to a specific setting, with every value, theme, and `fancy_animations` combination already ruled out (#5512). - hxfhd (@hxfhd) — reported the deterministic cross-session contamination class behind this release's session-ownership boundary, plus route budgeting evidence (#5518). - sfdzhmr (@sfdzhmr) — reported the route budgeting root causes that exact route-limit propagation now closes (#5516). See [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) for full notes and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md) for older releases.