Hmbown/CodeWhale v0.9.2

on GitHub

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui
binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.2

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.
• Extract the archive for your machine: codewhale-windows-x64.zip or
  codewhale-windows-arm64.zip
• Run install.bat (copies to %USERPROFILE%\bin)
• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.2

This is the Codewhale v0.9.2 source candidate. It is not a published release
until the matching tag, packages, checksums, and release assets exist.

Changed — behavior

• Legacy model = auto no longer elects a network classifier on its own.
  Holding a DeepSeek API key used to silently select deepseek-v4-flash as the
  classifier for every Auto turn — a per-turn cost on a route nobody asked for,
  and one provider privileged over the rest. Auto now stays local and free
  unless an explicit [auto.router] block names a provider and model.

  If you relied on the implicit default, restore it explicitly:

  [auto.router]
  provider = "deepseek"
  model = "deepseek-v4-flash"

  [auto.router] remains legacy model = auto configuration. It is unrelated
  to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by
  name from a Fleet file and decides only how hard an already-frozen route
  thinks.

Landed since v0.9.1, not yet released. A cluster of defects found by a
read-through audit of the policy engine, the MCP proxy, the session index,
and the app-server bridge — several of them cases where the wrong outcome
was reached silently, behind a response or a log line that looked fine. The
release also adds opt-in session, reasoning, localization, and inspectability
surfaces; existing defaults remain stable unless an entry below explicitly
says otherwise.

Added

• /permissions now lists the active user permission-rule source, each rule's
  effective matcher and global/repository scope, and whether that scope applies
  in the current workspace. /permissions remove <number> previews deletion
  and requires a snapshot-bound confirmation token, so a concurrent edit
  cannot move a different rule under the confirmed index. Appends and removals
  share one adjacent lock, preserve unrelated TOML formatting and comments,
  atomically replace permissions.toml, and reload the live user ruleset
  without clearing session-only approvals. /config ask-rules remains a
  compatibility entry; rule creation, glob/directory rules, and deny
  persistence remain out of scope (#1186, PR #4960 by @greyfreedom).

• /preview-request (aliases /dryrun and /preview_request) is a human-only,
  provider-free inspection of the next primary turn. Production dispatch and
  preview share one prepared-request seam across Chat Completions, Anthropic
  Messages, and OpenAI Responses, so the manifest reads the final wire model,
  reasoning controls, tool choice, tool schemas, and body hash from the same
  value production sends. Route, tool, or body facts that require Auto's
  provider classifier, an MCP connection, mutable hooks, compaction, or queued
  runtime injections remain typed unavailable. The manifest reports exact
  primary role/lane identity, upstream route-source provenance, requested and
  effective reasoning, canonical JSON sizes, conservative offline estimates,
  and provider-reported usage as unavailable because no request ran. It never
  adds a model-visible tool, sends a provider call, or prints prompt, message,
  credential, endpoint-path, or workspace-path content. The explicit
  /preview-request base-prompt mode prints only the exact effective base
  prompt; effective system text remains protected behind its final hash. The
  exact body includes the same authoritative transient Work/To-do tail used by
  production, including graph-backed state newer than the legacy projection.
  Preflight preserves production's separately framed base-plus-Work estimate,
  and fails closed when the authoritative projection is unavailable. An
  exhausted active goal token budget also produces a typed unavailable result
  before any outbound request is built.
  (#1004, #3928; dry-run concept harvested from PR #1099 by @GTC2080 / TaoMu.)

• Slash commands, hotbar actions, and CLI entrypoints for the same Lane/Fleet
  lifecycle operation now share one typed control-plane contract
  (codewhale-lane::control): a stable <domain>.<verb> id, read-vs-write
  authority, persistence scope, exact-identity target selection, retryability,
  lifecycle outcome, and one bounded, sanitized receipt. docs/COMMAND_CONTROL_PLANE.md
  documents it (#1888).

• /lane [list|status|interrupt|restart|resume] — durable Lane control from the
  composer, backed by the same executor codewhale lane … calls. codewhale lane interrupt|restart|resume are the matching CLI verbs; lane stop stays as
  a compatibility spelling of lane interrupt. Appending @<lifecycle-seq> to a
  lane id fences a write to the exact durable generation you observed, so a
  concurrent transition is rejected as a conflict rather than acted on (#1888).

• codewhale fleet list and /fleet [list|status|interrupt|resume] — durable
  Fleet run inspection and control from either surface, through shared DTOs that
  carry the exact provider, provider-table id, model, effective reasoning tier,
  and route source when the ledger records them, and a typed not_recorded /
  not_applicable / redacted reason when it does not. Requested-vs-effective
  reasoning is never back-filled: the ledger persists the effective tier only, so
  the requested tier reports not_recorded (#4022).

• The bundled skill pack now ships a help skill (catalog generation 7). It is
  invocation: explicit-only, so it never enters the model's ambient catalogue
  and costs no prompt budget. Its body is a routing card that points at the
  surfaces this build actually exposes — /help and /help <command>,
  /skills and /skills inspect, /config, doctor, and the docs/ tree
  when the workspace is a Codewhale checkout — and explicitly forbids pasting a
  command list or settings table into context (#4698).

• crates/tui/assets/skills-catalog-matrix.json: an authored, provider-free
  expectation matrix covering every bundled skill (tier, invocation, aliases,
  ambient-catalogue eligibility, shadowed aliases). Contract tests in
  crates/tui/src/skills/catalog_matrix.rs assert a bijection between the
  fixture and the shipped bundle, so the starter pack cannot change without an
  explicit fixture update. The matrix covers positive eligibility and explicit
  load, non-activation negatives, alias resolution, explicit-only exclusion,
  alias-vs-canonical collision precedence, and prompt-budget invariants (no
  duplicate catalogue entries, no aliases as extra entries, and the shipped
  pack fitting inside the 12 000-char budget with no omitted-skills line). These
  are deterministic registry/catalog/resolver assertions and make no claim about
  semantic model routing (#4698).

• Locale-routing coverage for the complete bundled catalog across every shipped
  locale (en, ja, zh-Hans, zh-Hant, pt-BR, es-419, vi, ko). No
  bundled skill ships a localized routing description and none was invented;
  the tested contract is deterministic fallback to the canonical English
  description, with the rendered catalogue byte-identical across locales.
  Exact-tag match, primary-subtag fallback, and English fallback are covered
  against a synthetic authored fixture, and the parity test fails if a bundled
  skill ever gains localized metadata without source-backed coverage (#4698).

• docs/LIVE_SMOKE.md: copy-pasteable, opt-in live-smoke instructions for Kimi
  K3 and a second provider/model (DeepSeek). The runs are manual only — nothing
  in CI, tests, or skills invokes them. They use env -i plus a throwaway
  CODEWHALE_HOME; HOME is left unset rather than repurposed, and ambient
  provider variables are not forwarded. The operator names the credential
  variable explicitly, and the isolated child reads its value with echo off,
  restores the prior terminal state on exit or interruption, and never persists
  the value or puts it in a command argument. The page states the expected
  route/model/reasoning/tool receipt fields while treating provider errors as
  unclassified until provider configuration, authentication/entitlement, and
  harness behavior have been corroborated independently (#4698).

• Approval cards can now remember eligible safe shell and file-write approvals
  as exact allow rules scoped to the current repository. Remembered shell
  commands use complete-command matching, validated file and patch paths remain
  workspace-relative, and dangerous, critical, or repo-law-held requests stay
  ineligible and continue to require review.

• tui.header_items (array of strings, optional, default []): an opt-in
  header chip showing cumulative session token usage as input / cache-hit /
  output. Set header_items = ["tokens"] under [tui] to enable it. The
  chip is the only elidable element of the header — the git label, context
  meter, and version stamp keep their space, and narrow terminals drop the
  chip rather than the baseline chrome. Unknown entries are warned about and
  skipped so configs written by newer builds stay loadable by older ones
  (#4520 requested by @eugenicum; PR #4610 by @XhesicaFrost, harvested with
  co-authorship).

• thinking_default_expanded lets reasoning blocks start open while keeping
  Space as the per-block toggle. The setting is persisted, available through
  native and runtime configuration, and documented for SSH/tmux accessibility
  (issue #4925 and PR #4928 by @M-Maciej).

• The transcript renders a conservative subset of LaTeX math as readable
  Unicode without rewriting fenced/inline code, ordinary currency, escaped
  dollars, or unknown commands. The contribution from PR #4973 by
  @SparkofSpike was hardened and landed through PR #4974; reported by
  @antarikshraya in #4957.

• Session control now includes a sessions rail, shared archive projection,
  picker archive controls, and opt-in interactive auto-resume with explicit
  handoff behavior. The work closes the remaining session-browsing direction
  from #2934; thanks @cy2311 for the original report.

• The bundled contributor-onboarding skill can sync contribution context,
  select the appropriate gate, and prepare a digest without inflating the
  ambient skill catalog. It follows the contributor-navigation request in
  #4227 by @JayBeest.

• Bahasa Indonesia now has a complete repository documentation suite and a
  registered website dictionary alongside the shipped TUI locale (PRs #4962
  and #4972 by @atmosuwiryo, closing #4789).

• Reasoning content can keep its rail, italics, cursor, and expansion controls
  while disabling only the warm background highlight. The independent setting
  is persisted and localized (#4089; reported by @elijahchan2019).

• StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the
  two endpoint/billing routes distinct, and localizes the choice across the
  complete packs (#4526; reported by @whp233).

• OpenCode Zen is a separate model-aware API-key provider. Its curated catalog
  selects Responses, Anthropic Messages, or Chat Completions per model;
  unsupported Gemini and unknown models fail closed, and missing Zen
  credentials never fall through to ChatGPT/Codex OAuth guidance. The
  implementation from closed PR #4467 by @snail-vs (snailoniu) is preserved in
  the candidate.

• Markdown exports correlate prompts with stable workspace restore-point ids
  and say when correlation is unavailable or ambiguous, completing the
  remaining restoration/export direction from #2494 by @wywsoor.

Fixed

• Permission setup now consistently presents the product postures Ask,
  Auto-Review, and Full Access instead of leaking the internal never token.
  The same resolved sandbox policy now drives execution and UI receipts: Plan
  stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access
  is actually unsandboxed unless a stricter effective configuration wins.

• Fleet setup no longer stalls when a user explicitly selects a configured
  Codex or Grok external-consent route. The selected route is activated and
  validated before saving, roster roles open directly on their Model step,
  Review saves on the first Enter, and new profiles default to the personal
  profile directory that the roster loads on the next session.

• Provider credential dialogs now share one wrapping, secret-safe API-key
  surface across every non-OAuth provider. A key already present in durable
  storage is reported as configured without rendering it, typing or pasting is
  clearly framed as replacement, narrow help text remains visible, and Codex
  and Grok OAuth flows remain token-free in this modal.

• Ctrl+O again opens the complete recorded reasoning detail for the selected,
  active, or latest reasoning block. The whole-turn Turn Inspector moved to
  Ctrl+Alt+O and /turn inspect, removing the shortcut collision while keeping
  raw leaf detail and post-flush reasoning discoverable.

• Failed child agents now deliver a distinct high-priority failure receipt to
  their owning parent with a sanitized failure class, elapsed work, and a full
  transcript handle. Parent-to-child message, follow-up, and interrupt tools
  now use one hierarchy-checked mailbox path, and persisted nested completion
  envelopes remain safely restorable across instruction-text revisions.

• Background-shell completion events now carry only bounded tails plus a
  retrievable exact-evidence handle. Terminal foreground Bash results are
  acknowledged at the direct tool-result boundary and are no longer emitted a
  second time as background completion artifacts.

• Providerless Fleet and child-agent fixed-model routes now reject only
  high-confidence foreign-provider model ids before creating a worktree, while
  explicit provider/model pairs, custom and local endpoints, unknown ids, and
  aggregator wire-id resolution retain their intended behavior.

• Manual compaction now preserves and reports the supplied provider failure
  class instead of replacing it with an opaque generic error. This does not
  infer quota exhaustion when the recorded failure does not prove it.

• The ambient jellyfish keep complete, readable silhouettes while animating,
  and the website favicon now uses the Signal Current desktop tile instead of
  the legacy whale mark.

• ACP JSON-RPC responses preserve numeric request ids for avante.nvim while
  retaining the negotiated string-id exception for Zed (PR #4929 by
  @atmosuwiryo).

• Restored shell cells whose job no longer exists stop displaying live
  spinners and settle into a truthful stale/no-output state across transcript,
  phase strip, and sidebar (PR #4937 by @LI-Jialu, closing #4547).

• Interrupted checkpoints and timed recovery snapshots remain checkpoints
  instead of being promoted into orphan session files, preventing duplicate
  /resume entries (PR #4963 by @SparkofSpike).

• Every shipped locale is admitted by the typed settings schema and native
  chooser, with complete/partial status kept independent and tested (PR #4856
  by @nightt5879, closing #4786). Context-menu hover hit-testing also accounts
  for its title row (PR #4897 by @XhesicaFrost; reported by @SparkofSpike in
  #4803).

• OSC 52 and SSH/tmux clipboard transport run on one bounded background worker
  rather than blocking input and rendering on the TUI loop; late transport
  failures still surface through the status path (PR #4896 by @nightt5879,
  closing #4159).

• Non-streaming model calls receive a generation-length response budget rather
  than the SSE header-open timeout, while actual SSE opens share the bounded
  cross-provider transport seam. The equivalent fix direction came from
  closed PR #4743 by @vibecoding-skills.

• Resumed sessions diagnose a deleted inherited workspace before shell launch
  instead of failing as an opaque Windows process error (report #4100 by
  @redjade75723). DeepSeek native tool-call wrapper tokens are also scrubbed
  from visible streaming and completed output as a grounded fail-soft follow-up
  to report #3880 by @hardy922; that report's exact emitted marker remained
  unconfirmed.

• Auto model routing now preserves the user's requested reasoning effort
  through startup, provider/model changes, session restore, the picker,
  Ctrl+T, and Hotbar actions. The tier is normalized only after the concrete
  provider route is known instead of being silently replaced by Auto
  (#4941, PR #4961 by @nightt5879).

• Auto-compaction now defaults on for every known model context window,
  including Kimi K3's 1,048,576-token routes. Persisting only an
  auto_compact_threshold or auto_compact_threshold_percent now counts as
  opt-in intent, while an explicit auto_compact = false remains authoritative.
  /config reports the effective state, percentage, and computed token trigger.

• Per-provider context_window overrides are now documented and visible in
  /config, provider setup help, diagnostics, and the example configuration.
  The effective override consistently drives preflight budgeting, the context
  meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their
  Coding Plan tier has the smaller window.

• Agent Details now projects status, model, elapsed time, and step counts from
  the same row snapshot as the primary agents list, eliminating contradictory
  worker state between the two surfaces.

• Composer submission and its hints now share one state machine. Portable
  terminals use Enter to queue during a running turn and Enter again to steer;
  Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is
  no longer advertised as universally available.

• edit_file now matches LF-only model search text against CRLF files,
  preserves the file's line-ending style for replacement text, and still
  rejects newline-normalized duplicate matches as non-unique (#4764).
  Implemented in PR #4942 by @nightt5879; reported and root-caused by
  @LmeSzinc.

• /fleet status read the current TUI session's sub-agents while codewhale fleet status read the durable .codewhale/fleet.jsonl ledger — two different
  things wearing one name, so a run started by codewhale fleet run never
  appeared in the TUI. /fleet status now reads the durable ledger through the
  same code path as the CLI; the session view keeps its own name as
  /fleet workers (/subagents and n still work). When a workspace has no
  ledger, both surfaces report a typed no_fleet_ledger reason instead of an
  empty-looking "all clear", and neither creates the ledger as a side effect of
  reading it (#4022).

• codewhale fleet status (and list/interrupt/resume) created
  .codewhale/fleet.jsonl as a side effect of opening the manager, then
  reported no_fleet_ledger for the file it had just made — so the second
  invocation showed an empty Fleet where none existed. The CLI now refuses
  those verbs before the manager is constructed, matching /fleet (#4022).

• fleet resume <run-id> accepted any string. An id absent from the ledger
  reconciled nothing but still wrote a run-status record keyed by whatever was
  typed, and reported no_change. Unknown ids are now refused as not_found
  before any durable write (#4022).

• lane interrupt reported transitioned even when it changed nothing —
  another process's stop looked like our own. The Runtime backend now reports
  whether this call performed the transition, and a no-op is no_change.
  The @<lifecycle-seq> fence is also evaluated inside the registry's per-Lane
  lock rather than before it, so a stale fence refuses without running Runtime
  teardown instead of racing between the check and the stop (#1888).

• /lane no longer runs Runtime teardown on the TUI composer thread. Reads on
  the slash surface skip reconciliation (which probes tmux and takes a lock)
  and say so on the receipt instead of implying freshness; lane interrupt is
  CLI-only until that work runs off-thread, and reports
  surface_not_supported naming codewhale lane interrupt (#4022).

• The hotbar is no longer modelled as a third control surface. A slot binds a
  slash command and fires it with no argument, so it runs as the slash
  surface; the contract now declares which verb a bare press actually reaches
  (hotbar_bare_dispatch, true only for lane.list) instead of advertising
  target-taking verbs as hotbar-reachable (#1888).

• codewhale lane list --json and lane status --json keep emitting the
  LaneRecord shape they always have — the receipt did not replace it. The
  human lane status output also regained branch, session, socket,
  attach, and log, which the first cut of the shared DTO had dropped
  (#1888).

• No surface advertises a backend it does not have. lane restart and
  lane resume have no implementation — a Lane is re-created by
  codewhale lane start, and a stopped Lane's Runtime session is gone — so all
  three surfaces refuse them with backend_not_implemented and say why.
  fleet restart drives the manager loop to completion, which only the CLI
  runs, so /fleet restart reports surface_not_supported and names the CLI
  command rather than quietly doing a smaller thing (#1888).

• Deny rules in permissions.toml no longer miss a command because of an
  intervening flag: deny matching is token-based with flag-skipping and
  backtracking, so a git push rule still catches
  git -c foo=bar push. Path matching folds case only on platforms whose
  filesystems are case-insensitive, and the default approval branch no
  longer proposes the working directory as a network host.

• MCP tool calls run once. A failed call is no longer retried as if it
  were a failed lookup, qualified-name resolution collects every match and
  reports an ambiguity instead of taking whichever the hash map yielded
  first, and registering a server whose name collides with an existing one
  after sanitization is now an error rather than a silent overwrite.
  The equivalent call-once fix direction came from closed PR #4756 by
  @adity982.

• The session index survives a torn line: an unparseable entry is skipped
  rather than aborting the whole read, appends carry their data through to
  disk, and appends and compaction share a lock so a compaction can no
  longer race an append into a lost record.

• Edit counts as a write tool for workflow elevation, and the TUI's
  write/shell classification now delegates to one shared allowlist rather
  than keeping a second copy that could drift.

• A rejected app/config/set stays a no-op. Previously an invalid value
  still tore down the cached runtime bridge, killing the child runtime and
  orphaning every other in-flight stdio thread behind a response that
  correctly reported failure.

• A malformed project config.toml is no longer indistinguishable from
  having no project config. Because a project config may only tighten
  approval and sandbox policy, silently discarding a broken one dropped a
  repository's restrictions back to the looser user defaults; the setup
  wizard now says so, naming the file but never quoting its contents.

• An expired lane worktree no longer leaves its branch behind, which made
  reusing the same lane name fail with "branch already exists". A branch
  still carrying unmerged commits is kept — a TTL lapsing is not consent
  to delete someone's work.

• An in-flight thread/message turn can be stopped. The stdio loop keeps
  reading while a turn streams, so the new thread/interrupt request (and
  shutdown) can reach a runaway turn instead of waiting on the very turn
  they were meant to stop.

• Precedence is stated only in the constitution's "Whose word wins" section.
  Memory hygiene no longer ships an inverted Tier list that put the
  constitution above the user's current request; approval, compaction, and
  personality overlays describe behavior without rank vocabulary; and the
  authority recap points at the single source rather than restating a second
  ladder.

• <turn_meta> carries facts (mode, posture, model, workspace), not mode
  doctrine or permission-question essays re-asserted every user message.

• The project context pack (pretty-printed workspace tree) is off by default
  and opt-in via [context] project_pack = true. Language law is compressed
  while keeping the English-constitution / user-language-reply contract.

• Modal lists and config pickers wrap selection at both ends (Down past the
  last row returns to the top). Home-directory resolution prefers
  HOME/USERPROFILE via effective_home_dir across remaining call sites so
  Windows tests that fake the home env vars match production paths. The
  equivalent home-directory sweep came from closed PR #4760 by
  @EvanProgramming.

Changed

• Prefix-cache tool catalog entries store only the SHA-256 digest, not the
  joined catalog string. Unused plan-transition validation helpers are removed.

• Settings sections now hold only what they claim (#4751). Fleet keeps
  Fleet/member concerns; /goal moved to a Session section and Workflow
  orchestration to its own Workflow section. The inert DeepSeek-only
  default_model fallback moved out of Model settings into an explicit
  Legacy section — exact-Fleet users switch Fleets, not fallback models;
  the config field is retained because the runtime still reads it. This is
  presentation only: the persisted keys (goal_command, workflow,
  default_model), their values, scopes, and runtime behavior are unchanged.

• Auto model routing is scoped to the active provider. The classifier
  inventory no longer discloses other providers' runnable routes (or the fact
  that their credentials exist), a classifier reply naming another provider is
  refused, the local heuristic no longer falls back to a different provider
  when the active one is unusable, and the implicit DeepSeek-flash classifier
  is skipped for non-DeepSeek sessions. Auto receipts and the model picker
  hint report the active-provider-only scope instead of "runnable providers".
  Cross-provider Auto is available only through the persisted [auto] cross_provider = true opt-in (an explicit [auto.router] route remains its
  own opt-in for the classifier call). Same-provider strong/fast selection and
  [auto] cost_saving are unchanged.

• The QA pseudo-terminal acceptance harness now parses frames with rio-vt
  behind its existing neutral frame/color surface, retaining the assertions
  while removing the vt100 dependency (PR #4931 by @raphamorim).

• Anthropic Messages and OpenAI Responses stream opening now share the
  client/stream_entry.rs seam already used by Chat Completions: one bounded
  response-header wait, shared dual/HTTP-1.1 policy selection, at most one
  HTTP/1.1 fallback on a classified HTTP/2 header stall, and common idle-timeout
  diagnostics. Wire-specific authentication, headers, endpoints, decoding, and
  rate-limit behavior remain at each adapter edge. The timeout-placement
  diagnosis and fix direction came from closed PR #4743 by
  @vibecoding-skills.

Security

• Release containers now publish an SBOM attestation and pin maximum-mode
  provenance explicitly so supply-chain metadata cannot silently weaken with a
  builder-default change (PR #4958 by @kobihikri).

Contributors

Thank you to the contributors whose code, reports, and reviews shaped v0.9.2:

• @greyfreedom — exact repository-scoped
  allow grants and cross-platform path semantics (PR #4761), plus safe
  permission-rule listing and snapshot-bound removal (PR #4960).
• @nightt5879 — off-event-loop clipboard
  writes (PR #4896), complete locale exposure in settings (PR #4856), CRLF-safe
  edits (PR #4942), and reasoning-effort preservation across automatic model
  routing (PR #4961).
• @XhesicaFrost — the configurable
  session-token header (PR #4610) and context-menu hover alignment (PR #4897).
• @cyq1017 — the hooks configuration/executor
  split from PR #4087.
• @snail-vs (snailoniu) — OpenCode Zen's
  model-aware routes, authentication, documentation, and test isolation from
  closed PR #4467, whose contributor commits are preserved in the candidate.
• @SparkofSpike — the zh-Hans translation
  quality review harvested from PR #4908, duplicate-session fix in PR #4963,
  LaTeX implementation from PR #4973 landed through #4974, and the context-menu
  reproduction in #4803.
• @GTC2080 — the request-preview concept from
  PR #1099.
• @h3c-hexin — non-UTF-8 fetch_url
  decoding direction from PR #4909.
• @fleitz — required source-candidate credit for
  the canonical Bash no-cwd workspace fix and regression in PR #4673
  (issue #4674).
• @LmeSzinc — the Windows CRLF edit_file
  reproduction, root-cause analysis, and affected-code anchors in issue #4764.
• @atmosuwiryo — ACP numeric-id compatibility
  (PR #4929) and the Indonesian documentation and website locale (PRs #4962
  and #4972).
• @M-Maciej — the expanded-by-default reasoning
  setting and its original report (PR #4928, issue #4925).
• @raphamorim — migration of the QA PTY frame
  parser to rio-vt (PR #4931).
• @LI-Jialu — truthful finalization of restored
  stale shell cells (PR #4937).
• @kobihikri — release-container SBOM and
  explicit provenance mode (PR #4958).
• @EvanProgramming,
  @adity982, and
  @vibecoding-skills — equivalent fix
  direction for the effective-home sweep (#4760), MCP call-once behavior
  (#4756), and streaming/non-streaming timeout split (#4743).
• @antarikshraya — the LaTeX transcript
  rendering report in #4957.
• @eugenicum — the token-header request and
  output-presentation measurements in #4520 and #4468.
• @whp233 — the StepFun/OpenCode subscription-route
  request in #4526.
• @redjade75723,
  @hardy922,
  @JayBeest,
  @elijahchan2019,
  @cy2311, and
  @wywsoor — reports and product direction behind
  the stale-workspace diagnosis (#4100), native-tool-token filtering (#3880),
  contributor onboarding (#4227), optional reasoning highlight (#4089),
  session control (#2934), and export/restore correlation (#2494).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.