v0.9.6

> **Codewhale** is the public product from Shannon Labs. The `codewhale`
> command, npm package, and release-asset names remain lowercase technical
> identifiers. The legacy npm package `deepseek-tui` is deprecated and
> receives no further releases. Users coming from v0.8.x legacy `deepseek` /
> `deepseek-tui` names should migrate with `docs/REBRAND.md`.

## Install

### Recommended — npm (one command, both entrypoints)

```bash
npm install -g codewhale
```

The wrapper downloads the matched `codewhale` and `codew` command assets
from this Release. Both contain the same compiled runtime.

### Docker / GHCR

```bash
docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.6
```

The image exposes the same runtime as both `codewhale` and `codew`. The
`latest` tag is also updated on release.

### Cargo (Linux / macOS)

```bash
cargo install codewhale-cli --locked
```

The Cargo package installs `codewhale`. Cargo cannot create a second command
alias from one binary target; users who want the shorter spelling can add a
`codew` symlink to that installed executable. The npm, Homebrew, archive,
shell-installer, and container channels install both command names directly.

### Manual download — platform archives (recommended)

Each archive below contains the same runtime under the `codewhale` and
`codew` command names, plus an install script:

| Platform | Archive | Install script |
|---|---|---|
| Linux x64 | `codewhale-linux-x64.tar.gz` | `install.sh` |
| Linux ARM64 | `codewhale-linux-arm64.tar.gz` | `install.sh` |
| Android ARM64 (Termux) | `codewhale-android-arm64.tar.gz` | `install.sh` |
| macOS x64 | `codewhale-macos-x64.tar.gz` | `install.sh` |
| macOS ARM | `codewhale-macos-arm64.tar.gz` | `install.sh` |
| Windows x64 (installer) | `CodeWhaleSetup.exe` | NSIS setup |
| Windows x64 | `codewhale-windows-x64.zip` | `install.bat` |
| Windows x64 (portable) | `codewhale-windows-x64-portable.zip` | — |
| Windows ARM64 | `codewhale-windows-arm64.zip` | `install.bat` |
| Windows ARM64 (portable) | `codewhale-windows-arm64-portable.zip` | — |

**Unix (Linux / macOS):**
```bash
tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh
```

**Windows:**
- For the installer path, run `CodeWhaleSetup.exe`; it installs
  `codewhale.exe` and `codew.exe` under
  `%LOCALAPPDATA%\Programs\CodeWhale\bin` and adds that directory to the
  current-user PATH.
- Extract the archive for your machine: `codewhale-windows-x64.zip` or
  `codewhale-windows-arm64.zip`
- Run `install.bat` (copies to `%USERPROFILE%\bin`)
- Add `%USERPROFILE%\bin` to your PATH

The **portable** Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has **bare, unarchived** `codewhale-<platform>` and
`codew-<platform>` assets. The seven `codewhale-tui-<platform>` filenames
attached to v0.9.5 are byte-identical compatibility copies used only to let
already-installed v0.9.4 clients discover and cross this single-binary
transition; current installers do not expose a third runtime. The legacy npm
package `deepseek-tui` is deprecated and is not republished. For migration
from v0.8.x legacy binary names, see `docs/REBRAND.md`.

### Verify (recommended)

Download the checksum manifests from this Release and verify:

```bash
# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing
```

## What's in v0.9.6

Codewhale v0.9.6 is a subtractive release: fewer runtime guards, one stable
prompt, truthful provider endings, and a smaller compaction path that preserves
the provider cache. The changes were grounded by matched Terminal-Bench 2.1
runs against Pi 0.8.41 and by dogfooding repeated manual compaction.

### Added

- `web_search` defaults to Firecrawl Cloud without an API key; keyless requests
  are headerless and quota-bounded, while an optional user key raises limits.
- Green web builds on `main` now emit an actionable manual-deploy reminder, so
  site changes cannot quietly appear shipped while Cloudflare still serves an
  older revision.
- Mistral AI is a first-class provider route, including Codestral models,
  first-party reasoning support, authentication, picker entries, and aliases.
- Headless `Bash` can transfer explicitly requested persistent Unix services
  out of an exec run, with ownership and cleanup receipts.
- `/remote-env` opens hosted Work from the current GitHub or CNB branch tip and
  states exactly which unpushed, dirty, ignored, secret, and session state stays
  local.
- Linux ARM64 release and nightly assets are static musl builds with native
  launch checks.
- Maintainers can report observed daily active installs from the same anonymous,
  aggregate telemetry dataset; no additional client data is collected.
- Fleet-dispatched members under a read-only evidence (no-network) ceiling now
  keep the `Web` tool's read-only `search` and `fetch` actions — parity with an
  ordinary scout — while every reaching surface (`web.run`, `fetch_url`,
  `github`, MCP) stays denied and the sentinel-backed capability envelope
  remains the fail-closed backstop.
- `/fleet setup` can show an optional, deterministic, unratified role-to-model
  advisory built only from configured ready routes. Accept, edit, and reject
  all remain inside the existing human-reviewed profile save boundary; the
  advisory never launches a Fleet or writes a second configuration.
- `/update` checks for a newer Codewhale release and installs it from inside
  the TUI, while `tui_help` gives agents the same command and key map users see.
- Markdown file paths render as OSC 8 links where the terminal supports them,
  and every agent row can open that agent's transcript directly.
- ACP editor sessions can execute multi-round file, search, Git, patch, and
  explicitly enabled shell tool calls through the shared Runtime registry.
  Shell access requires both the client's terminal capability and Codewhale's
  headless shell opt-in, and cancellation stops an in-flight tool before the
  turn returns (#5225 by @rafaelcavalheri).
- Lowercase `read` returns bounded typed PNG, JPEG, GIF, and WebP results to
  image-capable Chat, Responses, Anthropic, and ACP routes. Text-only routes
  receive an explicit omission receipt; image bytes never spill into ordinary
  transcript, export, compaction, or relay text.

### Changed

- Anonymous usage counting is on by default for fresh installs and disclosed in
  a native first-run Codewhale modal with an immediate opt-out. Prior declines
  remain off. Codewhale does not collect conversations, code, prompts, files,
  repo or branch names, credentials, model content, or per-turn activity
  timelines.
- Wide terminals use a responsive, full-screen ocean canvas with modest
  gutters: prose keeps a readable measure while tools, diffs, work surfaces,
  the composer, and status chrome can use the available width. Turn and major
  activity seams breathe without padding every call inside a tool group.
- Root CLI help describes product actions directly instead of exposing internal
  TUI/runtime layers.
- `Bash action="wait"` now blocks by default when a wait is requested; callers
  can still ask for a nonblocking snapshot, and persistent service ownership
  remains explicit.
- Compaction is one cache-stable summary request followed by one committed
  replacement summary and a bounded recent-message tail. Older saved sessions
  still restore.
- Ask, Work, Auto-Review, and Full Access share one stable base prompt. Modes
  continue to differ through permissions and the live tool catalog; the former
  Act label is now Work throughout the product and shipped locales.
- Full Access now auto-approves non-bypassable tools consistently, and the
  default choice shown on ordinary approval cards is configurable.
- Model, context-window, dispatch-name, and nested-agent spawn receipts report
  the route and limits actually used rather than silently substituting a
  guessed identity.
- Child-agent launches mint one immutable route receipt before admission and
  preserve it through status, interruption, completion, resume, Work Graph,
  and ledger projections, so provider/model attribution cannot drift (#5305).
- Goal runs no longer stop because of internal continuation, repeated-gap, or
  unanswered-question guards. Explicit user limits and terminal goal states
  remain authoritative.
- Account-owned `/rc` remote control now keeps exclusive ownership and a
  crash-recoverable delivery journal until the server acknowledges terminal,
  approval, failure, and snapshot state.
- `todo_write` is an optional progress surface rather than required model
  ceremony.
- New turns use one small, stable toolbox: `read`, `write`, `edit`, `bash`,
  `agent`, `todo_write`, and `tool_search`. The optional progress tool stays
  visible as familiar working memory; specialized native, Web, MCP, plugin,
  memory, task, and verification tools are policy-filtered and searchable;
  activated schemas stay in a bounded per-conversation cache. Every sub-agent
  keeps its own search and cache, including policy-allowed Web research, while
  forked context and parent activations remain warm starts rather than allowlists.
- The direct file and shell schemas follow Pi's deliberately small contract:
  bounded complete-line reads, hash-free writes, unambiguous multi-edit with
  BOM/CRLF preservation and conservative fuzzy matching, and one foreground
  `bash` command with a bounded chronological output tail. Modes change
  execution authority, not those primitive names.
- Codewhale no longer re-states the To-do list to the model. The model learns
  what is on the list from the tool result its own `todo_write` call returned,
  which is ordinary conversation history — the same way Pi's To-do works. The
  transient `<codewhale:work_state>` block that used to ride the tail of every
  parent turn-loop and sub-agent step request is gone, along with the stable
  system prefix being disturbed by list changes. A snapshot is still shown once,
  where a person asked for it: the `<codewhale:fork_state>` block a newly forked
  sub-agent is handed, `/relay` handoff instructions, and the agent card. The
  complete To-do stays visible in the UI. A structural test asserts real
  outbound provider request bodies do not carry the list.
- Scout and Reviewer name the read-only investigator roles. Both expose exactly
  one shell entry point — canonical lowercase `bash`, bounded by the strict
  read-only classifier — and the legacy `Bash` alias stays denied in the catalog
  and at dispatch. Previously a case-insensitive name match let a call spelled
  `Bash` execute through that carve-out, returning raw shell to a read-only role.

### Fixed

- Sending more context while a lowercase `bash` command is running now moves
  the command to `/jobs` and returns a successful running receipt instead of
  falsely reporting `Command exited with code -1`; the process keeps running
  and its completion still arrives through the normal runtime event.

- First-run usage disclosure now opens as a native Codewhale modal instead of a
  shell questionnaire before application startup. Telemetry remains unarmed
  until the native choice is made, and an in-memory Disable choice governs the
  current session even when its preference cannot be saved.
- `/compact` completion, failure, queued, duplicate, and mailbox outcomes are
  durable transcript receipts instead of short-lived toasts. A stray terminal
  event can no longer leave every later compaction stuck as already running.
- Compaction now follows Codex's simple transcript shape: recent user context
  followed by one ordinary history checkpoint. It never appends the summary,
  the To-do list, or volatile shell/worker state to the standing system prompt;
  reloads migrate the persisted carrier back into exactly one history item.
- Automatic compaction uses a percentage of the real context window, clamped to
  the route's spendable ceiling. Pressure comes from the current parent-route
  prompt, not cumulative billing or child-model usage.
- Compaction, review, verify, routing, setup, Fleet, MCP, RLM, vision,
  translation, and sub-agent calls inherit the resolved route's normal output,
  sampling, and reasoning policy. Small internal-task token caps no longer
  truncate thinking routes or special-case individual providers.
- Incomplete provider responses fail truthfully across ordinary turns and every
  internal model consumer. Partial text stays interrupted, pending tool calls do
  not execute, and billed usage is retained.
- Transport-only `(reasoning omitted)` placeholders no longer enter new
  transcripts and are filtered from restored sessions. Reasoning expand/collapse
  actions stay attached to the exact rendered cell, including after replacement,
  restore, filtering, and resize (#5291).
- Step-budget exhaustion is a typed failure and cannot release a pending
  persistent service. Cancellation after terminal usage still charges the turn.
- Deferred tools now preserve a completed result when a provider reuses its
  tool-call ID on the retry turn, preventing successful plugin calls from
  entering a repeated execution loop.
- Website setup, provider, diagnostics, Fleet, and single-runtime claims now
  match the source candidate.
- Opening the sub-agent register no longer hides the to-do list: the Agents
  panel shows the full register and the durable checklist together, and the
  register header is a two-way door that returns to Tasks on a second click.
- The ⌥V / Alt+V details chord opens the selected work-surface row's own
  inspector instead of the transcript's nearest tool cell, so a selected
  to-do row shows its own content rather than the latest reasoning.
- The first-run usage disclosure now asks a clear question — "Help improve
  Codewhale?" — with unambiguous "Yes, keep anonymous counts" / "No, turn off
  tracking" choices in every shipped locale, and states the persistent opt-out
  command. Consent semantics are unchanged: telemetry stays unarmed until a
  choice is made.
- macOS screencapture screenshots referenced in a message are copied to a
  stable attachments directory the moment the message is received, and the
  reference is rewritten to the stable path, so the image still exists when
  the agent reads it. Only files under a screencapture "Temporary Items"
  directory are touched; copies are idempotent and a failed copy keeps the
  original reference.
- Manual `/compact` during an active turn now queues even when the engine's
  bounded op mailbox is saturated. The request defers client-side, retries as
  mailbox slots free, and cannot latch as already running after it settles.
- Interactive `/load`, startup `--resume`, and `/resume` picker paths preserve
  the persisted provider, endpoint, and model identity; picker resume also
  leaves a durable transcript receipt.
- Relative `mcp_config_path` values no longer depend on the launch directory or
  silently load an empty server pool: Codewhale warns and falls back to the
  user-global MCP configuration. Explicit absolute paths remain authoritative.
- Alibaba Model Studio `qwen3.8-max` and `qwen3.8-max-preview` still stream
  their current reasoning, but no longer replay historical `reasoning_content`
  that those routes do not accept. Historical reasoning replay is now gated by
  the exact provider/API/model contract, so unknown `*-thinking` lookalikes
  fail closed while documented Qwen, Kimi, DeepSeek, Mistral, Anthropic, and
  Responses continuity rules remain intact.
- Compatibility File/patch calls retain optional content-hash guards when a
  caller supplies them. The new direct `write` and `edit` schemas do not expose
  hash or prior-read ceremony.
- Shell previews hold back incomplete UTF-8 sequences instead of emitting
  replacement characters, and compaction receipts report token deltas.
- Nested agents may narrow but can never widen their inherited depth budget
  (#5317 by @ousamabenyounes).
- Container publication now assembles AMD64 and ARM64 images in parallel on
  native runners from the already-verified static release binaries, then
  publishes and checks one multi-architecture manifest. It no longer rebuilds
  both targets through the single long-running QEMU job that lost its runner.

### Removed

- The no-progress guard, repeated-read guard, and injected tool-error strategy
  coaching. Productive polling, repeated inspection, and model-owned recovery
  are no longer interrupted by runtime heuristics.
- Never-wired decision-card, keybinding, hover, shell-execution, engine-op, and
  release-script paths were deleted so the supported runtime has one route for
  each behavior.

## Contributors

- Xavier Pestel (@xavierpestel-ai) — Mistral AI provider route (#5295).
- Ben Younes (@ousamabenyounes) — inherited nested-agent depth cap (#5317).
- Rafael Cavalheri (@rafaelcavalheri) — ACP agentic tool turns (#5225).

See [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) for full notes and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md) for older releases.