Hmbown/CodeWhale v0.9.10

on GitHub

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, both entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale and codew command assets
from this Release. Both contain the same compiled runtime.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.10

The image exposes the same runtime as both codewhale and codew. The
latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli --locked

The Cargo package installs codewhale. Cargo cannot create a second command
alias from one binary target; users who want the shorter spelling can add a
codew symlink to that installed executable. The npm, Homebrew, archive,
shell-installer, and container channels install both command names directly.

Manual download — platform archives (recommended)

Each archive below contains the same runtime under the codewhale and
codew command names, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs
  codewhale.exe, codew.exe, and codewhale.bat under
  %LOCALAPPDATA%\Programs\CodeWhale\bin, adds that directory to the
  current-user PATH, and creates a Start Menu shortcut that prefers
  Windows Terminal (wt.exe) when it is installed.
• Extract the archive for your machine: codewhale-windows-x64.zip or
  codewhale-windows-arm64.zip
• Double-click codewhale.bat (not the raw .exe) to launch
• Run install.bat to copy the binaries and launcher to %USERPROFILE%\bin
• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run codewhale.bat from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived codewhale-<platform> and
codew-<platform> assets. The seven codewhale-tui-<platform> filenames
attached to v0.9.5 are byte-identical compatibility copies used only to let
already-installed v0.9.4 clients discover and cross this single-binary
transition; current installers do not expose a third runtime. The legacy npm
package deepseek-tui is deprecated and is not republished. For migration
from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.10

• Show the full slash-command or /model completion row in a bounded, wrapping hover popover whenever narrow terminals truncate it, closing the remaining scoped gap from #998. Thanks @AiurArtanis and @formp3 for identifying the affected surfaces.
• registry_sync no longer ships the full MCP Registry catalog into the
  conversation. It takes a required query, scores the local snapshot
  host-side, and returns at most eight matches; the complete catalog stays on
  disk, and the compaction and spillover exemptions that let a multi-hundred-
  kilobyte dump reach the model unchanged are gone.
• Providers that mirror the outgoing (reasoning omitted) replay placeholder
  back as a reasoning delta no longer have that echo ingested as real
  thinking: the exact transport placeholder is dropped on arrival, so live
  sessions stop showing a stream of placeholder reasoning blocks and saved
  transcripts stay free of them.
• Mid-stream connection drops during an interactive turn no longer persist a
  synthetic [runtime] user message. Retry state is a typed engine-internal
  descriptor; a thinking-only drop re-issues the request without claiming a
  partial reply was preserved, the retry budget is enforced in mechanism, and
  recovery produces exactly one authoritative final answer.

Codewhale v0.9.10 is a retention, identity, and product-clarity release: the shell and
transcript can no longer retain unbounded tool output in memory or on disk,
mid-turn history inserts no longer strand in-flight tool rows, every agent
that ran this session is visible from /agents list, the PTY acceptance
lane has a stall watchdog and bounded CI steps, approval outcomes are
durable and fail closed (cyq1017, #5360), and three $HOME disk leaks are
reclaimed. Extension surfaces now name their real state and act only
through the reviewed install and trust flows, and sub-agent, shell, task,
and workflow state is owned by the session that created it (#5518). Test
threads get an 8 MiB stack so the lib suite can no longer
abort under load.

Fixed

• First run starts on the welcome screen again. A missing key no longer
  skips Welcome and auto-opens the local-provider list: Enter walks to the
  calm provider explanation, then Enter opens the picker so a first API key
  can be set. Returning missing-key recovery still opens the picker on
  launch.
• A foreground bash command that named no timeout is bounded again. The
  model-facing bash tool left an omitted timeout_ms at the internal
  ceiling (~24.8 days) instead of the 120 s default its own schema
  advertises, so a CLI that blocked on an interactive prompt or a hung
  network call held the turn open indefinitely — one report sat on a single
  unauthenticated CLI call for over two hours with the tool row simply
  counting seconds. The advertised default now applies, which arms the
  existing recovery: the process is killed and the model is told to rerun
  with background=true and poll with action="wait". An explicit
  timeout_ms is still honored for genuinely long foreground work, and
  background and interactive runs keep their own lifetimes.
• The Extensions (/plugin) Marketplace is no longer a read-only list.
  Every recommendation and stored candidate names its truthful state and
  primary action — Add, Enable, Configured, or Unavailable — and Enter or a
  mouse click runs that action through the existing reviewed /mcp add recommended, /mcp enable, and /plugin install/trust controllers, so
  no second trust path exists. Browser Use and Sandbox Runtime stay
  honestly Unavailable with their real setup routing instead of implying an
  install Codewhale cannot perform.
• The Extensions MCP tab now renders one honest inventory: the header count
  and the visible rows derive from the same configured-server set, so
  MCP (6) can no longer sit above two rendered rows. Disabled servers
  stay visible and labeled disabled instead of silently disappearing, and
  configured servers absent from the live snapshot list as not-yet-inspected
  with their own explicit reload affordance through the MCP command
  controller.
• Installed plugin rows now act on their real state: Enter opens an active
  bundle (/plugin show), offers Enable for a trusted-but-disabled bundle,
  or routes an untrusted bundle to the existing trust review — through the
  same confirmation and persistence controllers as the slash commands.
• Sub-agent handoffs and rosters, background shell jobs, durable tasks,
  delayed continuations, and workflow controls are now scoped to the
  session that owns them. Records carry immutable root-session ownership,
  stale completion-channel payloads are rejected before deduplication,
  background work drains and reports only to its owning session, and
  legacy ownerless jobs fail closed (#5518 failure class reported by
  @hxfhd; the report's exact JavaScript provenance was not claimed as
  reproduced).
• The resolved route envelope now reaches every outbound model call: all
  wire dialects and auxiliary calls clamp at the shared transport seam
  under one wire/reservation budget, provider input limits are honored, and
  switching models on the same protocol no longer inherits the previous
  model's limits (#5516, #5518).
• First-run continuity: the chosen onboarding provider persists across
  restarts, a missing first-run config no longer interrupts the flow, and
  the automatic working-agreement checkpoint renders as a standalone setup
  handoff instead of regressing the onboarding rail to the full wizard's
  4/10 progress.
• Explicitly worded natural-language /goal declarations now create a
  durable goal in the provider-neutral engine before model dispatch, while
  ordinary tasks and quoted transcripts stay out of goal mode and prose
  acknowledgement alone can no longer stand in for goal creation.
• /model now keeps the current Z.ai default (GLM-5.3) visible when an
  older installation has an explicit GLM-5.2 route saved. The saved 5.2
  route remains exact; choosing 5.3 sends and remembers the distinct 5.3 ID.
• The constitution checkpoint now leads with the bundled balanced agreement;
  the default path writes no custom constitution. The startup launch surface
  distinguishes read-only Chat from folder-bound, approval-gated Work.
• Tabby and other IME bridges no longer observe a stale visible caret while a
  frame diff is being painted; Codewhale hides the cursor during the diff,
  restores the canonical composer cell, and only then reveals it again
  (BrathonBai, #5023).
• Pre-header HTTP/2/SSE transport failures get one bounded HTTP/1.1 retry;
  authentication, provider-semantic, response-body, and already-pinned HTTP/1
  failures remain fail-closed (demian-welt, #4683).
• MCP tools/call images now travel as bounded typed content instead of
  leaking base64 through model-visible JSON. Direct and parallel calls share
  the same MIME, size, validation, and one-image boundary (PR #5515 by
  @cacdcaecawae).
• Linux npm installs and updates race GitHub Releases against the CNB mirror
  at the checksum-manifest layer, then download from the first verified source
  without making users wait through a doomed slow-source timeout.
• CODEWHALE_PREFER_BWRAP now applies the documented Linux sandbox override,
  and Codewhale-era names own build metadata, hook session/tool-call IDs, and
  sandbox child markers. The corresponding DEEPSEEK_* names remain as 0.9.x
  compatibility aliases (#5443).
• Windows default launch prefers Windows Terminal: zip archives ship
  codewhale.bat (CRLF, wt.exe then the exe), install.bat copies that
  launcher, and the NSIS Start Menu shortcut opens it instead of the raw
  binary (#1854).
• fix(tui): make the header status mark honour its setting — status_indicator
  did nothing for three of its four documented values. The header hardcoded a
  leading cw span and asked for a second mark beside the effort chip, then
  filtered the second one against the literal "cw"; because cw, the legacy
  whale opt-in, and every unknown value all normalize onto that same mark,
  the filter discarded them and left off with nothing to turn off. cw,
  whale, off, and a typo all rendered byte-identical headers. There is one
  mark now and the setting owns it: cw/whale draw the typographic mark,
  dots draws the activity frames, off removes it (thejayjetson, #5512).
• fix(tui): rebase active-cell tool bindings on every mid-turn history insert — /rename mid-turn left the running tool row spinning forever
  (#5478).
• fix(tui): bound what the shell and transcript retain from tool output —
  a 1.1 MB Bash call kept over a megabyte resident for up to an hour; raw
  streams now cap at 16 MiB in flight and release delivered output, and
  retained tool outputs cap at 64 KiB per record / 8 MiB per transcript
  (#5472).
• fix(tui): reclaim the three $HOME disk leaks — orphaned session dirs,
  the unbounded audit.log, and stranded writer temp files.
• fix(tui): persist approval outcomes before execution (cyq1017) —
  approval receipts are committed to a session-owned log before execution
  proceeds; unpersistable evidence blocks the tool; resume reconstructs
  closed and interrupted approvals (#5360).
• test(tui): break the LazyLock/env-barrier deadlock in the test harness.
• ci: give test threads the 8 MiB stack they need — the lib suite aborted
  with SIGABRT under load on the default 2 MiB stack.
• YOLO entry points honor a locked approval policy: --yolo, /mode yolo,
  /zidong, and Alt+Y can no longer set Full Access + trust + shell when
  config or managed requirements own the posture.
• Terminal PTY tools fail closed without a sandbox backend under a narrowed
  filesystem posture, and otherwise start $SHELL -i through
  SandboxManager::prepare like bash.
• Skill update refuses to replace a directory that has no .installed-from
  marker — same ownership gate plugins already used.
• cp/mv are workspace-safe only when every path operand stays inside
  the workspace — Auto-Review no longer auto-allows cp /etc/passwd ..
• Main CI no longer shares one concurrency group per branch: each SHA
  gets a verdict instead of a cancelled pending run. A hermetic Safety
  gate job runs authorization tests in under 15 minutes (test bankruptcy
  restructuring — no tests deleted).
• Config-fixture tests no longer honor lock_test_env as a license to
  read a populated ~/.codewhale/config.toml; they need an EnvVarGuard
  like settings already did. Safety-gate and CNB workspace tests pin a
  hermetic CODEWHALE_HOME. exec_persistent_service is serialized in
  nextest and inside the cargo-test binary instead of dropped (#5355).
• Short CLI no longer waits up to three seconds for a telemetry POST on
  exit; session_end is recorded and the buffer ships on the next
  interactive session.
• Bare / now opens a deliberately small starter set: /help, /setup,
  /model, /settings, /resume, and /rc. The full command inventory
  remains searchable through /help, the command palette, and direct prefix
  typing, without front-loading the entire control surface (#5442, #5439).
• First run now asks only for decisions needed to become usable, keeps the
  offline route explicit, and leaves optional provider, tools, policy, and
  appearance work in the progressive /setup repair guide. The idle aquarium
  asks one task-oriented question instead of advertising a tutorial or command
  billboard, and the localized telemetry choice appears after the workspace is
  ready without blocking the composer.
• Provider, active model, and reasoning effort moved out of the crowded header
  into a quiet, width-aware footer identity. Compact layouts keep model and
  effort before provider detail and shed whole low-priority groups instead of
  clipping the composer or control hints.
• The model picker no longer re-parses ~/.codewhale/config.toml once per
  provider when deciding who has a saved key.

Added

• /workflows opens a live run dashboard over this workspace's durable
  workflow journal: every retained run with status, phases, child roster,
  progress, and host-side cancel — observation only, it never launches a run.
• Repository instructions now assemble from the actual containing checkout:
  applicable AGENTS.md files resolve repository-root to current-directory in
  order under one aggregate budget, a linked worktree is its own root, and
  scope is never inferred from path mentions or whichever branch is named
  main.
• /goal is a codex-style control plane: setting an objective dispatches it
  to the engine, which owns the goal and starts the first goal turn itself —
  the objective is never echoed back as the user's own message, pause/resume
  are real control ops, and the hunt-era vocabulary and trophy cards are
  gone.
• /extensions and /plugins open one localized inventory for Hooks,
  Plugins, local Marketplace catalogs, Skills, and MCP. Reviewed suggestions
  include Playwright, Chrome DevTools, Cua Computer Use, Browser Use, and the
  sandbox runtime without granting trust or installing anything on open.
• Turn Inspector now opens the newest turn and pages across complete recorded
  user, reasoning, tool/subagent, and assistant output with page-scoped search,
  copy, and export (sky-sun-moon, #1682).
• Background tasks have bounded incremental persistence, durable terminal
  reasons, truthful timeout/cancellation receipts, restart recovery, and
  interruptible continuous-goal delays (#5497, #5508).
• /title once again controls the terminal window title independently from
  /rename, survives session save/load, and sanitizes control, bidi, and
  zero-width characters (PR #5509 by @SparkofSpike).
• MCP snapshots preserve whether capabilities were advertised by the server,
  discovered through the bounded legacy fallback, or not observed (#4170).
• codewhale auth status --diagnostic reports canonical paths, isolation
  source, backend class, and value-free provider-source presence without
  opening credential stores or creating/migrating state (#2369).
• codewhale doctor --probe-search performs an explicit credential-free,
  policy-checked transport probe for the selected search provider; ordinary
  doctor and JSON output remain offline (#5442).
• The safe deferred read_media tool is available to supported read-only
  roles, and history receipts distinguish localized tool execution outcomes
  without exposing raw payloads (#5102).
• npm Linux x64 first-party source selection. The wrapper concurrently
  fetches the GitHub Releases and CNB checksum manifests for the exact
  package version, locks the first source whose HTTP response and manifest
  validate, and downloads binaries only from that source. Explicit
  CODEWHALE_RELEASE_BASE_URL / CODEWHALE_USE_CNB_MIRROR=1 still skip the
  race; other targets stay on GitHub.
• /workflow <objective> and /workflow run <path> now produce a bounded,
  tool-less proposal for review. Only /workflow confirm can launch that
  reviewed draft; status, cancel, settings, and the /workflows dashboard stay
  host-owned and do not spend a model turn (#5439).
• feat(tui): add cancellable cadence to continuous goals (M-Maciej) —
  [goal] continuation_delay_seconds gives coordinator goals a visible quiet
  period between successful turns while reusing the existing coalesced goal
  continuation token; Esc, Ctrl+C, pause/done/blocked/clear cancel before the
  next provider request, and failures never continue (#5508).
• feat(tui): add command context adapters and migration gate (FEAT-015)
  (aboimpinto) — TUI-owned capability facets, a dual-path dispatch seam, and
  source-aware CI enforcement so a command slice cannot claim to be migrated
  while it still accepts concrete App. Zero production commands migrate in
  this slice (#5316).
• feat(web): move docs/hooks and docs/troubleshooting onto the dictionary spine (Lstarsky0) — both pages now read copy from the locale dictionaries
  instead of inline bilingual literals (#5337).
• feat(web): move docs/constitution and docs/runtime-api onto the dictionary spine (Lstarsky0) — both pages now read copy from the locale dictionaries
  instead of inline bilingual literals; another incremental phase of #5337,
  not completion of the full epic (#5517).
• docs(i18n): complete Tier 1 of Chinese docs localization (SparkofSpike) —
  Chinese and Indonesian docs move to docs/zh_hans/ and docs/id/, with
  redirect stubs at the old paths for one release cycle (#5482).
• feat(tui): show repository context in git chrome (wuisabel-gif) — the TUI
  header now identifies the active repository or linked worktree before the
  branch and dirty marker, so operators can see where the agent is working
  without opening the worktree manager (#5437).
• feat(tui): formalize the status-bar color grammar — seven semantic
  families live in docs/design/STATUS_BAR_COLOR_GRAMMAR.md and
  palette::grammar; header and phase-strip ink resolve through named
  ChromeInk slots so chrome cannot invent an eighth meaning or spend
  Failure red on a dirty worktree or selected mode. The footer's session
  metrics strip resolves through the same inks, and the red reservation is
  checked against every selectable theme, not just the whale default;
  typed footer toasts resolve through the grammar too.
  Repo/worktree chrome stays metadata and still renders when Git names a
  location but not a ref (#5437).
• feat(tui): first slice of the agents roster — every agent that ran this
  session, receipts-only, via /agents list and the sidebar fan-out rows
  (#5479 spec items 1 and 5).
• ci: bound PTY acceptance and add a stall watchdog to the harness —
  QA_PTY_STALL_TIMEOUT_SECS aborts a wedged PTY run with a diagnostic;
  the isolated PTY step is capped at 15 minutes; Windows NSIS provisioning
  gets a bounded retry (#5496).
• chore(scripts): dev-cache warns before it fills a disk (#5465 class).

Contributors

• Sh1Zuku (@SparkofSpike) — restored
  /title as an independent, persistent terminal-window title in PR #5509,
  in addition to the Tier 1 Chinese and Indonesian documentation work below.
• Sun Zhenyuan (@bistack) — extracted the
  turn-loop stream processor in PR #5514 while preserving retry, cancellation,
  usage, TTFT, steering, and partial-response behavior.
• OctoBored (@OctoBored) — supplied the
  working no-token Star History mirror used across the localized README set
  after the canonical chart endpoint began returning a restricted placeholder
  (#5510).
• cacdcaecawae (@cacdcaecawae) — added
  provider-neutral typed MCP image forwarding in PR #5515; the harvested
  version also makes malformed image fields produce a visible omission receipt.
• DingYong4223 (@DingYong4223) — reported
  the narrow-terminal completion truncation closed by the bounded hover reveal
  (#998). Thanks also to @AiurArtanis and @formp3 for identifying the affected
  completion surfaces.
• sky-sun-moon (@sky-sun-moon) — reported
  the missing full per-turn input, reasoning, tool, and assistant pages that
  shaped Turn Inspector navigation (#1682).
• cy2311 (@cy2311) — reported the Windows launch
  path that now ships and installs a Windows Terminal-aware batch launcher
  (#1854).
• demian-welt (@demian-welt) — provided the
  reproducible pre-header SSE transport failure behind the bounded HTTP/1.1
  retry (#4683).
• BrathonBai (@BrathonBai) — reported the
  Tabby/CJK IME candidate-window jump that led to the hide-diff-position-show
  cursor transaction (#5023).
• M-Maciej (@M-Maciej) — the real-world organization-coordinator use case and
  5–30 minute cadence requirement behind cancellable cross-turn goal delays
  (#5508).
• cyq1017 (@cyq1017) — approval outcomes are persisted before execution can
  proceed: receipts commit to a session-owned log first, unpersistable
  evidence blocks the tool, stale decisions are rejected, and resume
  reconstructs closed and interrupted approvals (#5491, closes #5360).
• aboimpinto (@aboimpinto) — the TUI-owned dependency-injection and migration
  infrastructure that makes slash-command extraction safe: seven capability
  facets, a dual-path dispatch seam, and source-aware CI enforcement so a
  command slice cannot claim migration while it still accepts concrete App
  (#5506, EPIC-005/FEAT-015 under #5316, which they also filed).
• wuisabel-gif (@wuisabel-gif) — the TUI header now names the active
  repository or linked worktree before the branch and dirty marker, derived
  from Git's common directory and capped by shell density tier (#5511, the
  repo/worktree slice of #5437).
• SparkofSpike (@SparkofSpike) — Tier 1 of the Chinese docs localization:
  Chinese and Indonesian documentation moves to docs/zh_hans/ and
  docs/id/ with redirect stubs held at the old paths for one release cycle
  (#5507, epic #5482, which they also filed).
• Lstarsky0 (@Lstarsky0) — docs/hooks and docs/troubleshooting move onto
  the dictionary spine, retiring their inline bilingual literals in favor of
  locale dictionaries with token-aware code spans (#5504, closes #5337, which
  they also filed).
• Lstarsky0 (@Lstarsky0) — docs/constitution and docs/runtime-api follow
  the same dictionary spine: 28 inline isZh branches become typed English
  and Chinese dictionaries held to key and token parity, while the other
  sixteen locales keep the English fallback (#5517, a further phase of #5337).
• @thejayjetson — the header status-indicator report that pinned the
  regression to a specific setting, with every value, theme, and
  fancy_animations combination already ruled out (#5512).
• hxfhd (@hxfhd) — reported the deterministic cross-session contamination
  class behind this release's session-ownership boundary, plus route
  budgeting evidence (#5518).
• sfdzhmr (@sfdzhmr) — reported the route budgeting root causes that exact
  route-limit propagation now closes (#5516).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.