Reproduced from a founder session on a 0.10.3 dev build (artifacts
subagent-failures-20261107): sub-agents died with "Child usage settlement
failed", a turn failed on "native usage journal capacity reached before
dispatch", and two workers returned Anthropic 400 "tools.17.custom.name".
- Anthropic client: tool names were sent raw, so a name such as web.run (from
tool_search) invalidated the whole request. Outbound tool declarations,
replayed tool_use blocks, tool_choice and the omitted-tool list now use
to_api_tool_name, and streamed and non-streamed tool_use names are decoded
with from_api_tool_name, matching the chat and responses clients.
- Usage journal: MAX_RUNTIME_USAGE_RECORDS_PER_OWNER 64 -> 256. Children share
the session's journal owner and the workflow default is 64 live agents with a
ceiling of 128, so a full fan-out plus the parent exceeded 64. be43ea93fd
already makes the overflow non-fatal; this keeps the receipts.
- Turn start (CW-6633, #6184): the heartbeat stayed Idle until TurnStarted, so
a wait before it produced no log, no stall record and no cancel. The
Preparing bound (180 s) now starts at the top of handle_admitted_operation
with an IdleOnDrop guard, and owner_work warns when all four slots are held.
The root cause of #6184 is still unproven.
- Session list (CW-7553, #7095): list_sessions failed whole on one unreadable
record and two callers turned that Err into an empty list. New
SessionManager::list_sessions_lenient returns the readable records, newest
first, and logs the rest; the launch card and ACP session/list use it. The
strict list_sessions stays for retention and prune.
- NSIS uninstall (CW-7542, #7091): also removes .codewhale-install.sha256 and
the codewhale.old-*/codew.old-* files a self-update leaves. makensis compiled
the script with placeholder inputs.
Verified on macOS with an isolated HOME: codewhale-engine lib client::,
cost_status, turn_heartbeat, session_manager: 829 passed/0 failed; cargo check
of codewhale-tui, codewhale-app-server and codewhale-runtime clean. Not run: hosted
CI, Windows, a live Anthropic request, or a real >64-child fan-out.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
PUT /v1/providers/{id}/key checks only a key's shape and stores it, so a wrong
key was saved and the desktop showed 'Couldn't load models'. POST
/v1/providers/{id}/key/check asks the provider's own /models once through the
existing client::verify_provider_api_key (the call the TUI's guided setup
already uses) and never stores anything. 401/403 from the provider answers 422;
any other failure to ask answers 502, so a client can still save the key. A new
route, not a new field on PUT: that request denies unknown fields, so an older
Engine would 422 it, and session-key handoff to a Boat Engine must not start
calling the provider. checked:false means the provider has no /models to ask.
Replaces nothing; ApiError gains bad_gateway beside unprocessable.
Validation: cargo build -p codewhale-cli on the Boat farm, exit 0, 0 warnings.
Live, on a Linux VM with the built Engine: loopback provider good key 200,
401 -> 422, HTTP 500 -> 502, closed port -> 502; the real OpenAI endpoint with an
invalid key -> 422; empty key 400; unknown field 422; no auth header 401; no key
from any check on disk; the existing PUT still stores (200). Existing tests
(-p codewhale-app-server --lib provider_key, RUST_MIN_STACK=16777216): 3 passed,
0 failed; at the default 2 MiB stack one of the three aborted with a stack
overflow and was not investigated. cargo fmt --check clean; sync-changelog and
check-facts clean. Not run: the full app-server suite, hosted CI, Windows.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
workspace_relative_path used a case-sensitive Path::strip_prefix, so on Windows
a recorded write whose drive letter, directory case or verbatim (\\?\) prefix
differed from the workspace root was dropped and /undo could refuse or leave
files and conversation out of step (CW-7418, #6970). The strict match still
runs first; only on Windows a component-wise ASCII case-insensitive match,
treating Disk and VerbatimDisk as the same drive, is tried next. The result is
still confined to the workspace and still goes through is_safe_relative_path.
Verified on macOS: codewhale-snapshot 91 passed/0 failed. The Windows-only
branch is not exercised locally; real Windows /undo remains unqualified.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted Lint on e59a119643 failed check-runtime-contract-budget on the base
stage identity digest. The base system prompt grew from 7231 to 9063 bytes from
5ba1aa63bc (eager sub-agents and goals by default, clearer tool text) and
080554911c (ask the user with options); both are intended product changes.
Re-measured provider-free on macOS aarch64; the budget carries the reason.
Verified: check-runtime-contract-budget.py passes (55 metrics exactly at
budget). Hosted Linux measurement not yet compared beyond the identity digest.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted Lint failed check-blocking-calls-budget on three new path_canonicalize
sites, all in synchronous helpers: the workspace-id fallback for a folder
without a git origin (runtime native_memory), validation of a thread's add_dirs
at creation (engine runtime_threads manager), and the exec --add-dir path (tui
lib). Each is a one-shot metadata call, not a loop or a hot path. The same
update tightens three budgets that shrank. Refs #6149.
Verified: check-blocking-calls-budget.py passes.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The release-candidate web surface job failed check-facts: generated agent docs
were stale after the 0.10.3 feature and docs edits. Re-ran npm run prebuild in
web/; npm run check:facts now reports facts and cloud facts OK.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Full engine lib run under nextest (7104 tests, isolated HOME) found these
existing tests asserting behavior the batch deliberately changed:
- persistent_service_requires_explicit_headless_exec_authority matched the old
persist:true refusal wording; it now matches "Full Access shell authority".
- Two sub-agent coordination tests expected an unheld flock to be an error; the
manager now falls back to session-private state, so they assert that.
- Compatible-default breadth is 16 with Wafer; Wafer's GLM-5.3 route is recorded
as a reviewed Unknown-billing omission (no price source was reviewed).
- A cancelled pending child request projects "request in progress" in-process
(reserved by 5d8e4427a7); the test accepts it as well as "outcome unknown".
Not changed: four engine tests fail only on a machine whose home has an empty
global instructions.md, and parent_agent_surface_stays_within_measured_ceiling
only on hosts with pandoc and tesseract (documented in that test); both pass or
do not apply on hosted runners.
Verified: each listed test passes under nextest with a clean HOME/CODEWHALE_HOME;
full engine lib before these edits: 7095 passed, 9 failed, 13 skipped.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted Lint and the release-candidate Parity job failed on 072468aff2 with
clippy::collapsible_if in crates/config/src/catalog.rs and, behind it,
crates/tui/src/tui/provider_picker.rs. Both are flattened with let chains,
same order and short-circuit. The web credits-parity test failed because
@cmdcorp6534 and @Asteria1028 are in the 0.10.3 changelog ledger but not in the
website release helpers or the docs/CONTRIBUTORS.md v0.10.3 band; both added.
Verified locally: cargo clippy --workspace --all-targets --all-features --locked
-D warnings (CI flags) exit 0; cargo fmt clean; web vitest public-copy 6 passed;
check-contributor-credit passes. Hosted CI not rerun yet.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted Windows run 42381817495 (549ff01) failed 221 cases. Fleet ledger replay
and state rebuild, and the CLI metrics diagnostic reader, opened files through
the protected reader that denies concurrent writers, so a live writer caused
OS error 32. They now use WorkspaceFile::open_file_shared, which keeps the
regular-file, link and identity checks. Plugin enablement now reports which
snapshot check refused (stage root, content identity, final root check) so the
118 snapshot rejections can be diagnosed from the next hosted run; the refusal
itself is unchanged. .gitattributes keeps LF on the generated protocol schema
and SDK exports.
Verified on macOS only: plugins lib 201 passed/0 failed; engine fleet:: 435
passed/0 failed; cli metrics:: 42 passed/0 failed; cargo fmt clean. The Windows
effect is unproven until hosted CI runs. The 2 MiB stack-overflow case is not
addressed.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Removes one blank line that cargo fmt --all --check flagged; the hosted Lint job would fail on it. Verified: cargo fmt --all -- --check clean.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Moves the 13 engine fixes from [Unreleased] into [0.10.3], adds the #5185/#5186
Accept Edits receipt so check-versions passes, and regenerates the embedded
changelog. Completes the add_dirs rollout in test fixtures and the Runtime Chat
relay (cargo check --tests failed on runtime_chat_relay.rs). Child compaction
without an admitted origin, a failed child usage projection and an
unacknowledged previous usage publication now log and continue with cost
unknown instead of erroring the turn.
Verified: cargo check -p codewhale-engine -p codewhale-app-server --tests
--locked clean; engine lib cost_status 44 passed/0 failed; compaction 169
passed/0 failed; check-versions --require-dated-release and
check-contributor-credit pass. Windows hosted CI, full suites, packages not run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
When the workspace coordination flock cannot be acquired, the session now
falls back to private, unsaved sub-agent state and keeps working. Before,
a stale holder made every new session refuse sub-agent work with
"Failed to clean up sub-agents".
Verification: cargo check -p codewhale-engine --lib passed.
The interactive usage sink returned false for a record without a
settlement outside cfg(test), so the record was never acknowledged and
the child path reported "Child usage settlement failed". Production now
takes the same legacy usage path the tests exercised.
Verification: cargo check -p codewhale-engine --lib passed.
The TUI and Runtime threads now advertise persistent background services,
so a dev server can outlive the turn when the thread has Full Access.
Restricted postures, Fleet/sub-agents and TTY/stdin modes still refuse.
Verification: cargo check -p codewhale-tui --lib passed.
POST /v1/threads accepts `addDirs`, the API counterpart of
`codewhale exec --add-dir`. Each path must exist and be a directory; the
canonical paths persist on the thread and join the tool context for its
turns.
Verification: cargo check -p codewhale-engine --lib and
cargo check -p codewhale-app-server --lib passed.
`codewhale exec --add-dir <path>` (repeatable) adds an external root the
file tools may read and write, without Full Access. The path must exist
and be a directory. EngineConfig carries the roots into the tool context.
When the native usage journal reaches its per-owner cap, the request now
runs with cost unknown instead of failing before dispatch on "native
usage journal capacity reached". Acknowledged receipts are pruned first.
Verification: cargo check -p codewhale-tui --lib and
cargo check -p codewhale-engine --lib passed. No focused runtime test
for --add-dir yet.
File revert no longer requires /trust or Full Access. The restore point
must still be this thread's own tool/pre-turn snapshot and the reviewed
hash must still match.
fetch_url keeps blocking private, loopback and link-local hosts by
default, but an explicit `/network allow <host>` now opts that host in.
Cloud metadata stays blocked. The error names the setting.
Verification: cargo check -p codewhale-net --lib and
cargo check -p codewhale-app-server --lib passed. codewhale-net
rejects_private_localhost_literal and rejects_private_rfc1918 passed
2/2. codewhale-app-server revert_file_helper_restores_only_the_named_file
passed 1/1.
Plain `codewhale exec` now runs on the normal tool surface under the
configured sandbox and approval posture. `--no-tools` is the one-shot.
When stdin is not a terminal, a pipe is the prompt, or is appended to
the argv prompt. `--parent-death-watch` still owns stdin.
Verification: cargo test -p codewhale-tui --lib --
exec_tool_surface_is_on_unless_no_tools
exec_keeps_flags_before_split_prompt_words
exec_accepts_split_prompt_words_for_windows_cmd_shims
passed 3/3.
A child whose usage settlement is not acknowledged continues, with cost
unknown, instead of dying on "Child usage settlement failed". Workspace
memory no longer requires a git origin. plugin list is an alias of
plugins status. A heavy command runs after 30 seconds instead of waiting
forever for an admission slot. An MCP registration 4xx includes the
status and the manual client-id path.
Verification: cargo check -p codewhale-engine --lib passed.
codewhale-tui memory_adapter_workspace_identity_resolves_and_preserves_errors
and memory_adapter_deletes_workspace_without_an_origin passed 2/2.
codewhale-engine lib tests compiled the admission and OAuth edits
(heavy_command_admission filter matched 0 tests).
A same-line successor replaces a stale pin. grok-4.7 and muse-spark-1.3
are the current models; a different line, such as GPT-6 beside GPT-5.6,
does not take over. The provider pane shows one current model per line
and spreads a gateway roster across authors, so OrcaRouter no longer
opens as a wall of Claude snapshots.
Wafer is a selectable OpenAI-compatible host. The public model list is
the catalog, GLM-5.3 is the default, and inference uses WAFER_API_KEY.
Verification: codewhale-config lib tests for default identity, Grok
hydration, web search, and the Wafer descriptor (4 passed). codewhale-agent
xAI and Meta default resolution (2 passed). codewhale-tui provider pane
default-first (1 passed). codewhale-engine fleet xAI fallback (1 passed).
python3 scripts/catalog_models_dev.py defaults audit reported 0 stale.
python3 scripts/check-provider-registry.py passed.
docs/features.toml has described the Accept Edits posture since 7e6000aa43,
but web/data/features.generated.json still carried the pre-Accept-Edits
summary and source hash. Regenerated from the file on disk; no source change.
Refs CW-7876
diagnostics reads git like the read-only tools
Bug hunt 2026-11-07, items 6 and 7 (CW-7882).
- tools/github/cli.rs: run_gh_text and run_gh_json are async. gh runs as a
tokio command under process_tree::contained_output_until, and the call
stops, killing gh's process tree, when the turn's cancel token fires or
after 120 s. A stop reports cancelled or timed out instead of blocking a
worker. GH_PROMPT_DISABLED=1 and GIT_TERMINAL_PROMPT=0 keep gh from
waiting on a prompt.
- tools/github/actions.rs and mod.rs await those calls, and
close_github_thread is async. Its tests in github/mod.rs become tokio
tests.
- tools/diagnostics.rs: probe_git runs `git rev-parse` through
tools::git::read_only_git_command, the same command the read-only git
tools use, with fsmonitor, hooks and the repository's filters off. Other
probes keep run_command.
The patch was written by a Sonnet agent
(CW/artifacts/bug-hunt-20261107/patches/items-6-7.patch), and reviewed
against the APIs it calls (contained_output_until/ContainedOutput,
ToolContext.cancel_token, ToolError::cancelled, read_only_git_command) and
for remaining sync callers before it was applied and verified here.
Evidence:
EVIDENCE
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two more children now get the treatment the other workspace runners
already have.
- GitHub close's working-tree check (tools/github/host.rs) reads
`git status` through codewhale_dependencies::Git::status_command, the
reader the Runtime API's git routes use. It runs in the workspace with
fsmonitor, hooks, lazy fetch and replace objects disabled, and the
repository's own filter drivers neutralized, with the same
`--porcelain=v1 --ignore-submodules=dirty` arguments. The other
host_git calls (rev-parse, remote get-url) run no repository-configured
programs and are unchanged.
- Legacy plugin tools (script plugins and [tools.overrides] commands) build
their child with shell::sandboxed_runner_command when the extension host
is off: the session's sandbox policy and OS wrapper, the sanitized child
environment, and the workspace as working directory. Before, they ran
with the Engine's environment and working directory and no sandbox.
PluginExecutor::run now takes the program and arguments instead of a
prebuilt command. The extension-host path builds the same command it did
before.
Evidence:
EVIDENCE
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CW-7673 (App settings slice S1, codewhale-app 83634750). The desktop's
Settings rows for reply style and "agents at once" had no Engine write path.
POST /v1/config {key:"verbosity"} fell through to settings.toml, which
rejects the key, and [subagents] max_concurrent was neither readable nor
writable. Root approved this as a post-freeze-safe slice (2026-11-07).
- GET /v1/config adds `verbosity` (unset reads "normal", the Engine's own
default) and `subagents_max_concurrent`: the configured
[subagents] max_concurrent capped at MAX_SUBAGENTS (128), or, when unset,
the limit the Engine applies (top-level max_subagents, else 64). The Engine
never writes that default (CURRENT_DECISIONS §62: a person-set limit).
- POST /v1/config validates both keys before any write, also on dry runs:
- verbosity: one of project_config's CONFIG_TOML_VERBOSITIES (normal,
concise), case-insensitive, persisted as the root config.toml key.
- subagents_max_concurrent: an integer 0..=128; larger values store 128,
and 0 turns sub-agents off, matching max_concurrent = 0 in config.toml.
Persisted through persist_subagents_integer_key, next to
subagents_max_depth.
The response `value` is what was stored. Persisted writes apply on
POST /v1/config/reload, like the other config.toml keys.
- RUNTIME_CONFIG_KEYS lists both keys beside the other curated arms.
- docs/RUNTIME_API.md (and zh_hans) document the keys. CHANGELOG.md and
crates/tui/CHANGELOG.md carry the line.
settings.rs and settings_schema.rs are untouched. No schema row exists for
either key, so GET /v1/settings/schema is unchanged.
Evidence:
EVIDENCE
Refs CW-7673
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs CW-7882 (item 1). The previous commit made the cost labels follow
the unresolved sources when a usage record is projected, but late
background usage takes another path: SessionCostSnapshot's
absorb_late_background_cost and the TUI's absorb_pending_background_cost
reconcile resolved sources out of missing_usage_sources and add the batch's
own reasons, without pruning. When a late receipt settled the last source
behind "request outcome unknown" (or "provider omitted usage"), the label
stayed while another turn was unpriced for a different reason.
The prune now lives in one helper,
cost_status::prune_settled_missing_reasons, called from all three places:
the record projection (replacing its inline block), the engine's late
absorb and the TUI's late absorb. The rule is unchanged: each label stays
only while an unresolved, non-running source carries it or the source map
has overflowed, and "request in progress" only while an in-flight source
is still unresolved.
Not covered: a turn audit can carry a reason label of its own, but no
production audit uses these two reasons (only missing-source records do),
so pruning by the source map cannot drop an audit's label.
Verification: MISSING
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An audit of v0.10.2..origin/main (762 non-merge commits, 209 of which
touched CHANGELOG.md) found user-visible changes that landed without a
changelog line. This adds 27 of them to [0.10.3]: 7 Added, 1 Changed,
14 Fixed and 5 Security, each appended at the end of its section.
Each line was checked against its commit message and the existing
[0.10.3] text before it went in:
- Dropped as already covered: the command palette keeping your draft
(the #7205 line) and "Goal cleared." only with a goal.
- Kept but narrowed: the Markdown table line adds only what the existing
wrapped-cell line does not say; the compaction line states only the
no-silent-truncation failure; the MCP line says the real rule (npx,
pnpx, bunx or uvx with no own connect_timeout get at least 120 s).
- Dropped claim: simpler Computer Use onboarding on the website is
source preparation waiting for the CU 0.13.0 release, so the Website
line names only the Enterprise page (live at codewhale.net/enterprise
today) and the finished FAQ.
- Public issues appear as #N only where the commit carried one (#7087,
#7102).
The TUI changelog slice is regenerated from the root file.
Verification: VERIFICATION_PLACEHOLDER
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The founder's TUI showed "subtotal $0.10 + unknown (request outcome
unknown)". Every provider dispatch first records a write-ahead reservation
(coverage Missing, reason RequestOutcomeUnknown, reservation=true), and
SessionCostSnapshot added that reason's label to unpriced_reasons but
removed it only when unpriced_turns returned to 0. So a running request
read "request outcome unknown", and once it settled the label stayed
whenever any other turn was unpriced for another reason.
Reproduced on the installed build 7b8a634fbb (TUI in tmux, isolated HOME,
mock DeepSeek endpoint, one turn with three explore children): after the
turn settled the chip still read "cost: unknown (request outcome unknown,
live rate unverified)", while the saved session showed all six sources
settled with coverage reported and no missing sources.
- The "request outcome unknown" and "provider omitted usage" labels follow
missing_usage_sources: each is dropped once no unresolved, non-running
source carries that reason (an overflowed source map keeps it, since its
sources are no longer tracked one by one). Late background usage already
projects its missing sources into the same map.
- A reservation is tracked in a process-local in_flight_usage_sources set
(serde skip) and labelled with the new UnpricedReason::RequestInProgress
("request in progress", CostReasonInProgress in all 15 locale packs).
The label leaves when the source settles. The set keeps only sources
that are still unresolved. Persisted reasons never store it:
serialize_settled_reasons writes it as request_outcome_unknown, so a
reservation left by an exit or crash reloads as outcome unknown.
- The TUI rebuilds a SessionCostSnapshot from its own SessionState on every
projection, so SessionState carries in_flight_usage_sources too: copied
both ways, and cleared with the rest of the coverage on /new and session
load.
- Not covered: the parent turn settles a cancelled or failed request with a
final outcome-unknown record that replaces its reservation; a dispatch
path that dropped its source without settling would keep reading
"request in progress" until the session reloads.
- UsageSourceRevision gains is_reservation(); the one exhaustive test
literal of SessionCostSnapshot names the new field.
Verification: MISSING
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`codewhale exec` sub-agents never ran: each child stopped before its first
provider request with "Provider request outcome unknown; checkpoint
preserved without automatic replay: child provider call has no captured
accounting origin", and the parent's wait found nothing running. The
founder's l10n fan-out run hit it on every child.
Cause: exec_agent.rs hands its session origin to
runtime_services.accounting_origin, which the parent turn already falls
back to (Engine turn accounting). The per-turn ToolContext that
SubAgentRuntime is built from only received an origin from a live Runtime
cost owner, which exec does not have, so ChildAuthority::usage_origin()
was None and ChildDispatchedRequest::bind_dispatch refused every child
dispatch. The refusal is compiled out of test builds (cfg(test) /
test-support), which is why the unit suites never saw it.
Fix: after the live-Runtime branch, a turn's tool context falls back to
runtime_services.accounting_origin, the same fallback
subagent_tool_context and the off-turn runtime already use.
Verification: MISSING
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A child agent's built-in verification run (Run tests/verifiers without
custom commands) no longer skips the approval its tool declares. It is
allowed without a prompt only inside a root Operate worker's verification
lease, as the agent tool description states, or when the session
auto-approves. Otherwise it reaches the parent's approval like any other
code-running call: relayed when the parent can prompt, refused when it
cannot.
- ChildAuthority::delegated_call: the Required arm now needs the captured
runtime's accept_verification bit in addition to the bounded-verification
classifier.
- spawn_subagent_from_input: a start that took no approval (a canonical
read-only role) does not receive the Operate verification lease, since it
crossed no approval boundary.
- run_verifiers foreground gates (and workflow completion gates) build
their child with shell::sandboxed_runner_command, the helper the cargo
test runner and the other workspace runners use. They get the session's
sandbox policy and OS wrapper, and a session whose commands run in an
external sandbox reports the gate as skipped with the reason. Timeouts,
process-group kill on Stop, and output capture are unchanged, and the
gate's declared environment is still layered on the sanitized child
environment.
- The subagent test that pinned unprompted verification for a non-Operate
Builder child now expects the parent approval, like arbitrary shell, and
three unavailable receipts. The Operate-lease test is unchanged.
Evidence:
EVIDENCE
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Follow-up to CW-7669 (9805a009e8), from the App's adoption run against
cd7f5b32b1 (CW/artifacts/cw7669-app-terminals-20261107/run3): after the
agent ran `exit 7`, GET /v1/threads/{id}/terminals listed the dead shell
with "state":"running" beside "running":false, "exit_code":7. `state` was
the durable state of the shell's latest command, and RUNTIME_API.md listed
it without defining it.
- The list now reports "exited" once the shell has an exit code. While the
shell lives, it keeps the latest command's state (running, idle, canceled,
failed, stale_lost, reset), so "canceled" with "running":true after a
confirmed interrupt stays as it is, which is correct.
- docs/RUNTIME_API.md (and zh_hans) define the field.
The App reads only `running` and `exit_code`, so nothing was blocked.
Evidence:
EVIDENCE
Refs CW-7669
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CW-7841 interim (founder decision 2026-11-07: "Interim fence today").
An Engine turn carried no account identity to the desktop's
codewhale-browser MCP route, so a turn admitted while account A was
signed in could still drive the side browser after the person switched
to B in the same folder: the authenticated route proves the Engine owns
the endpoint, not which account the call came from.
- profile_constitution.rs, which already owns per-turn account capture,
derives an AccountEpoch from the native account store: api_base, state
(offline-cached folded into authenticated), account_id and session_id;
for signed out, the logout tombstone's revision or "pristine". The
store's own revision is not used: token refresh rewrites it. Test
builds keep the module's rule of never reading an operator's account
and see a fixed signed-out epoch.
- Engine::handle_admitted_operation captures an AccountFence when a
person's turn (ExternalUser provenance) is admitted; internal
follow-ups keep the admitting turn's fence. build_tool_context_for_turn
stamps it on ToolExecutionState, so child agents, programs and batch
contexts inherit it.
- admit_desktop_browser_call refuses a mcp_codewhale-browser_* call when
the turn has no confirmed epoch, the store cannot be read, or the
current epoch differs, with a permission error saying nothing was
sent. It runs inside execute_mcp_tool_with_pool after the pool lock
(turn dispatch and code mode) and in McpToolAdapter (registry path).
The name prefix over-applies to a model-started server squatting the
name, which is harmless; it never under-applies. mcp.rs is untouched.
- docs/RUNTIME_API.md (and zh_hans) document the fence and its limits.
Known limits (also in the module doc and RUNTIME_API.md): only the local
account store is compared, so states the desktop keeps to itself
(development sessions, replay, an unreachable account service) are not
seen; the browser server receives no caller identity; registrations
carry no generation; Platform revocation counts once a refresh writes
it. The signed-generation contract is the 0.10.4 follow-up on CW-7841.
Evidence:
EVIDENCE
Refs CW-7841
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7095 ("conversation history is lost") is still unreproduced and this does
not fix it. It adds the two pieces the diagnosis asked for, so the hint
cannot be missed and the next report is not blind.
- The startup notice (the interrupted-session hint, or the auto-resume
receipt) is a standing status toast instead of status_message, so a later
status update covers it only while that update lives. It is retired when
the first turn starts or a session is opened. It is never written into
the transcript, the session, a checkpoint or a model request, and it still
never replaces a "Failed to ..." load message.
- On a plain launch, Codewhale logs (target "sessions", INFO) the sessions
directory, the saved-session count, checkpoint files, interrupted
checkpoints, and whether the newest interrupted one belongs to this
workspace. A store that cannot be opened logs a WARN.
- codewhale doctor shows "N saved sessions, M crash checkpoints" under
Sessions, and doctor --json adds sessions.counts {saved, checkpoints}
(null when no sessions directory exists). It reads through
SessionManager::open_read_only, so doctor stays read-only.
- SessionManager::saved_session_count counts documents by file name only.
is_session_document is now the one filter, shared with
scan_session_records.
Not changed: load_recent_checkpoints, checkpoint promotion, persistence
actor ordering, retention and auto-resume.
Evidence:
EVIDENCE
Refs #7095
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Hardening for #6184, a turn that stalls silently before its first model
request. The root cause is not proven. These changes make such a stall end
in a bounded, logged state instead of waiting forever, and leave the next
report a trace. Founder decision 2026-11-07: "Hardening, then freeze".
- The turn heartbeat begins (begin_turn) before TurnStarted is sent, and an
IdleOnDrop guard returns it to idle on every exit path, so an early return
can no longer leave the watchdog in Preparing.
- Preparing progress is touched after the git line, after the tool catalog
is built and after MCP server attribution, so a slow but moving start is
not taken for a stall.
- The pre-turn restore point runs under its own Preparing bound
(RESTORE_POINT_TIMEOUT 180 s plus the 30 s grace) and is cancel-aware. On
timeout the turn continues and the person sees "No /undo restore point
was recorded: the workspace snapshot did not finish within 180 s."
- capture_turn_meta_git_snapshot (30 s) and the MCP pool lock taken for tool
server attribution (30 s) are bounded and cancel-aware. On timeout the
turn continues without the git line or the attribution, with a WARN.
- runtime_control::owner_work waits at most 60 s for a blocking-work permit,
then fails with "blocking work is queued behind earlier jobs that have not
finished within 60s" instead of queueing forever.
- git_status reads (collect, git_output, observed_git_repo) run through
run_bounded_git_with_timeout with a 60 s bound.
- TUI: live_running_agent_count counts an agent_progress entry only while
its last progress is within TOOL_HANG_WATCHDOG_TIMEOUT, so a ghost entry
left by a vanished sub-agent no longer vetoes the stall watchdogs.
- Logging: INFO "turn started" once per turn id and "turn phase" on each
real phase or detail change (turn_id, phase, detail, bound_secs). The
watchdog WARNs once per progress step when a phase has gone half its
bound without progress.
ToolCallHeartbeat is untouched. Session B (a separate lead) is not
addressed here.
Evidence:
EVIDENCE
Refs #6184
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Production builds refused provider calls with "no captured accounting
origin" while test builds skipped the check (cfg(not(test))), so tests never
saw the refusal that broke codewhale exec sub-agents. Production now does what
the tests always did: dispatch proceeds and usage without an origin is simply
not attributed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The accounting path turned a local bookkeeping failure ("previous usage
publication has not been acknowledged") into a stream error, so a turn the
model had completed failed, and the runtime thread manager marked it Failed.
Sub-agents were interrupted with "worker source has no durable
acknowledgement". Seen live on 0.10.3 at 080554911c with deepseek-flash.
The receipt still carries accounting_error and the status line still says
settlement is uncertain; an unacknowledged worker source is logged and not
counted instead of aborting the worker.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The clipboard-image-prune row's summary was 143 characters, so
`cargo test -p codewhale-tui --test feature_registry` failed at HEAD
since c98ea3836e. Shortened to 115.
Check: the registry rule itself is `docs/features.toml` summary of 1-120
characters on one line, `crates/tui/tests/feature_registry.rs:103-107`;
the row's docs and owner paths both exist. The full
`feature_registry` test runs in the TUI farm check for this batch.
Founder direction: Codewhale should ask for input the way Claude Code
does. Design: artifacts/ask-the-person-20261107/FINAL.md, sections 2a-2e.
Strings and one eager-tool entry only; no wire, schema-shape or event
change. This is one more declared re-pin of the session-pinned prefix
(docs/CACHE.md), on top of 5ba1aa63bc.
- BASE_PROMPT "User intent and scope": act on clear, reversible work
without asking; when a choice is the user's, ask once with options. A new
host-neutral paragraph says when to ask: an ambiguous target, a real fork
with different costs, a preference that cannot be inferred, or an
irreversible or outward-facing step the request did not clearly
authorize. It says when not to: conventional defaults, reversible work,
readable facts, whether to delegate, start a goal or run a workflow, or
whether to continue. Questions stand alone, with the recommended option
first, and with no question tool the turn ends with one lettered
question. It never names the tool, so exec and ACP read nothing false.
The three "name it and ask" lines now say "ask with options".
"Delegation and goals" gains "Tightly coupled or sequential work stays
with you.", from Anthropic's Oct 2026 guidance on folding sub-agents into
the main loop (split by context; keep coupled work in the loop).
- Plan notice: "Resolve open requirements with the question tool first,
then present the plan." The tested prefix is unchanged.
- request_user_input: the description now says multiple choice, the
recommended option first labelled "(Recommended)", one-line trade-offs,
standalone questions, and not for defaults or "may I continue?". header,
question and options gain field descriptions (the options range comes
from the configured limits), and multi_select gets a shorter one. The
schema shape is unchanged.
- Hosts with a person to answer (user_input_responder: TUI, desktop App
Server, runtime threads) get request_user_input eager through
tools_always_load, added once in the engine constructor;
DEFAULT_ACTIVE_NATIVE_TOOLS is unchanged. Exec and ACP keep withholding
it, child engines never set the responder, and exec gains one
instruction: "No user is present; choose the recommended default and
state the assumption."
- tool_search lists request_user_input and tasks suggest.
- A TUI setup comment that paraphrased the old prompt now matches it.
Unchanged, per the design's guardrails: no third ask path (turn_loop's
ask_user_question stays), ToolError::Timeout text, and the model never
picks an answer for the person.
Bytes: BASE_PROMPT 4,352 -> 5,168. /preview-request after, a responder TUI build on Linux
with the same isolated offline HOME and prompt: 19 active of 59
(request_user_input now eager; 18 before), tool schemas 41,718 canonical
JSON bytes (+1,545 over 5ba1aa63bc's 40,173, about the question tool's
schema), system 18,533.
Tests: the kernel phrase "otherwise name the decision and ask." becomes
"otherwise name the decision and ask with options."; the prompt and event
conformance goldens are re-recorded for the re-pin.
Verified on the Boat farm (Linux x86_64), base 5ba1aa63bc plus only this
slice (engine.rs shipped as HEAD plus this hunk). The commits that landed on
main since then touch none of these files or goldens.
- cargo test -p codewhale-engine --lib, filters prompts::,
tools::user_input, core::engine::tests::, core::engine::tool_catalog::,
runtime_handoff::, canonical actions, agent description and parent
surface ceiling: 729 passed, 4 failed. Two were the user_input description
tests updated here; the rerun of user_input, prompts, runtime_handoff and
tool_catalog passed 166 of 166. lazy_boot_leaves_unselected_servers_unspawned
also fails at base 5ba1aa63bc without this slice.
full_access_auto_approves_non_bypassable_registered_tools (it spawns
python3) failed only under the full parallel run; it passed alone with
this slice and at base.
- cargo test -p codewhale-tui --lib conformance::prompt::
conformance::events::, update pass then compare pass: 5 passed each; the
re-recorded goldens come from that run (tool schemas +80 bytes from the
tool_search hint, system +831). The conformance engine is not a responder,
so its catalog keeps request_user_input deferred.
- cargo clippy -p codewhale-engine --all-targets --all-features and
-p codewhale-app-server --lib, with the Lint job's flags: clean.
Not verified: an exec session end to end (the exec instruction is compiled,
not run), desktop rendering (the App session's CW-7853), and a live
provider turn.
Refs: CW-7874
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Ask (`suggest`) now opens a card for file edits inside the workspace too,
as its name, the Plan handoff copy ("Edits and commands ask you first") and
the founder-agreed model (2026-11-07, modeled on Claude Code's permission
modes) promise. CW-7663 found that the desktop edit card could not appear
with default settings because Ask ran in-repository writes unasked.
The #5185 in-workspace write carve-out moves to a new posture, Accept Edits
(`ApprovalMode::AcceptEdits`; settings and config.toml `accept-edits`,
Runtime wire `accept_edits`), between Ask and Auto-Review: an edit whose
every target stays inside the workspace git work tree runs without a card;
`.git`, `.codewhale`, `.env*`, credential and key files, folders without
git, commands, network and MCP actions ask exactly as in Ask. Everywhere
else Accept Edits is an asking posture (`ApprovalMode::is_ask_family`):
repo-law asks, sandbox escalation and Computer Use consent open a card;
remembered grants treat it as Ask; non-authoritative provenance narrows it
to Ask with a recorded narrowing event; live-authority narrowing ranks it
between Ask and Auto-Review.
- Shift+Tab: Ask -> Accept Edits -> Auto-Review -> Full Access.
- Settings schema rows (permission_posture, approval_mode,
approval_policy), /permissions, /status, /config, the Plan handoff
("Work (Accept Edits)"), footer chip and help strings; 7 new and 3
updated strings in all 15 locale packs.
- config.toml `approval_policy = "accept-edits"`; a project file may only
tighten: auto < accept-edits < on-request < never.
- ACP runs Accept Edits as Ask, because ACP turns never apply the carve-out.
- /import-claude maps Claude Code's acceptEdits to Accept Edits.
- Docs: MODES, KEYBINDINGS, CONFIGURATION, INSTALL, GUIDE, README and its
18 translations (restamped), zh_hans mirrors, features.toml row,
CHANGELOG entry, regenerated web/data/agent-docs.generated.json.
Stated limits: write-capable workers keep #5186's in-folder edits under Ask
(their spawn card is the consent); modes, Tab and Operate are unchanged
pending the founder's answers to the modes/postures design
(CW/artifacts/modes-postures-20261107/DESIGN.md D1-D4; Operate in CW-7849).
Verification (shared checkout, source b3d18fe6bc plus this diff):
- scripts/dev-cargo.sh test --locked --offline -j6, focused filters
(approval_mode, posture, permission*, carve_out, authority::,
protocol_parity, repo_law, sandbox_escalation, computer_use, narrow,
approval_request, runtime_policy, project_config, settings_schema,
plan_handoff, import_claude, file_edit_card, config_choice, keybinding,
locale parity): codewhale-engine lib 263 passed, 0 failed;
codewhale-tui lib 103 passed, 0 failed; codewhale-app-server lib 13
passed, 0 failed; codewhale-config 35 passed; codewhale-runtime 20
passed; codewhale-localization 15 passed; codewhale-execpolicy 12
passed; all 0 failed. Includes write_carve_out_posture_is_exactly_
accept_edits, workspace_write_carve_out_covers_accept_edits_only,
file_write_card_names_the_missing_repository..., permission_cycle_is_a_
closed_loop..., cycle_approval_scenario, permission_postures_persist_
across_restart, shift_tab_migrates_user_root_policy..., plan handoff
locale test, file_edit_card_says_when_it_asks_for_lack_of_a_git_repo.
- codewhale-tui --test feature_registry: this row passes; the run fails
only on another session's uncommitted clipboard-image-prune row, which
this commit does not contain.
- rustfmt --check on every touched .rs file; check-tui-locale-parity PASS
(2823 keys x 15 packs); check-tui-product-vocabulary exit 0;
check-readme-translations OK (18, stamp 20d0bb7c0784);
check-readme-locales PASS; check-versions OK; check-dead-code-budget
PASS (137). check-blocking-calls-budget fails only on another session's
untracked crates/engine/src/session_image_prune.rs (not in this commit).
- Not run: a live desktop/TUI turn showing the edit card (CW-7663's App
acceptance); full workspace suites (final release validation owns them).
Tests ran on the shared working tree, which also held other sessions'
uncommitted edits; this commit stages only this slice's hunks
(private index, HEAD + these changes).
Refs CW-7663, CW-7849
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Hide the OrcaRouter offer row and F7 shortcut in zh-Hans (mainland), keep
it for zh-Hant and other locales, and disclose the offer terms in the
picker and docs/PROVIDERS.md. Localized in all 15 packs. Re-derived the
web agent-docs JSON from HEAD plus this patch only.
Patch authored by the Living Codewhale logo session.
Verified on the Boat farm (Linux, local tests, base 5ba1aa63 overlay):
codewhale-localization 55 passed, 0 failed; codewhale-tui --lib
provider_picker model_picker orca_offer 202 passed, 0 failed. Rerun on
this exact tree follows before push.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
engine-prompts' lines for 5ba1aa63bc, under 0.10.3 Changed, as sent:
sub-agents and goals by default (with the one-time prompt-cache re-pin
called out), the retired Operate contract, clearer agent/goal tool text,
the workflow fan-out default 16 -> 64, bundled `goals` becoming
`personal-goals`, and the child identity line. crates/tui/CHANGELOG.md is
regenerated with scripts/sync-changelog.sh.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
web/data/features.generated.json and web/data/agent-docs.generated.json
are re-derived from the committed docs: the removed claude-plan-sign-in
row, the clipboard-image-prune row, PROVIDERS.md, and the
CONFIGURATION.md and RUNTIME_API.md changes from #7230 and 4c5426f9bb
(whose runtime-api entry had not been regenerated).
The derivation mirrors web/scripts/facts-lib.mjs deriveFeatures and
docs-sources-lib.mjs deriveAgentDocs; run against cd7f5b32b1 it
reproduces both committed files byte for byte.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #2323. Input methods place their candidate and preedit window at
the terminal cursor. With a modal open (for example /config search or
its value editor) the TUI hides the cursor but left it wherever the
frame happened to end, usually the composer underneath, so the Pinyin
candidate window appeared far from the field being typed into.
Committed-text routing was already fixed by f9210a4428; this is the
remaining position half.
When a frame draws no visible cursor, the frame loop now moves the
still-hidden cursor to the top modal's input anchor. ModalView gains
input_anchor() (default None); ConfigView records its search caret or
its editor value caret during render; any other modal falls back to the
bottom-left cell inside its occupied region. Nothing becomes visible;
only the position an IME reads changes.
Verification: the batch's six commits were tested as one change on Boat farm VMs
(Linux x86_64), shipping only `git diff <base> <final>`, so no other
session's uncommitted files took part. cargo test --locked --lib with
filters over config, runtime, engine, app-server, tui and cli on base
3631a174f6: 459 passed, 0 failed (config 8, runtime 117, engine 102,
tui 220, cli 8, app-server 4; farm run
20261107T230833Z-issues-tests-503e01). cargo clippy with the Lint job's
flags (--all-targets --all-features, -D warnings) on config, runtime,
engine, command-contract, cli, tui and app-server: 0 warnings, 0 errors
(run 20261107T231817Z-issues-clippy-e84152). Rebased onto 5ba1aa63bc
(eager sub-agents), which shares subagent/mod.rs, subagent/tests.rs,
tasks.rs and config.example.toml with this batch; this batch's changed
lines are byte-identical on both bases, and a recheck of that overlap on the new base passed: engine 48 and app-server 2 passed, 0 failed (subagent coordination incl. the two-process case, human-wait, execution-guard and tools::tasks suites, server_task_config and server_task_runtime; farm run 20261108T000442Z-issues-recheck-67ab1a).
Locally: cargo fmt --all -- --check, both budget checks,
sync-changelog --check and the feature release-note receipts pass.
Covers config_view*, config_modal_is_usable_and_opaque_at_blocker_sizes,
frame_cursor_is_hidden_during_diff_then_positioned_before_reveal and
cjk_composer_cursor*. The tmux caret check on a macOS binary follows
from the freeze build.
Not verified: Windows Terminal with Microsoft Pinyin (the reporter's
setup), and other terminals' IME integrations.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7232. While a 0.10.2 session still has this folder's v1 delegated
store open (it holds subagents.v1.lock shared), a 0.10.3 session could
not take the exclusive lock the v1->v3 cutover needs, opened the store
read-only, and refused every sub-agent action until the older session
exited.
The blocked cutover now surfaces as a typed SubAgentCutoverBlocked, and
the shared session constructor turns that one case into a
session-private manager: sub-agents work in memory, nothing is written
to the v1 or v3 store, and the older session's files stay byte-for-byte
untouched. There is no forced cutover; the first session that starts
after the older one exits upgrades the store as before. The detail
projection reports SESSION_PRIVATE_COORDINATION, and the TUI shows one
toast that points at Work. The Runtime server constructor keeps its
read-only refusal.
Known limits, stated in the message the user sees: delegated state in a
session-private manager is not saved and other sessions do not see it,
and a session that started private stays private until it restarts,
even after the older session exits.
Verification: the batch's six commits were tested as one change on Boat farm VMs
(Linux x86_64), shipping only `git diff <base> <final>`, so no other
session's uncommitted files took part. cargo test --locked --lib with
filters over config, runtime, engine, app-server, tui and cli on base
3631a174f6: 459 passed, 0 failed (config 8, runtime 117, engine 102,
tui 220, cli 8, app-server 4; farm run
20261107T230833Z-issues-tests-503e01). cargo clippy with the Lint job's
flags (--all-targets --all-features, -D warnings) on config, runtime,
engine, command-contract, cli, tui and app-server: 0 warnings, 0 errors
(run 20261107T231817Z-issues-clippy-e84152). Rebased onto 5ba1aa63bc
(eager sub-agents), which shares subagent/mod.rs, subagent/tests.rs,
tasks.rs and config.example.toml with this batch; this batch's changed
lines are byte-identical on both bases, and a recheck of that overlap on the new base passed: engine 48 and app-server 2 passed, 0 failed (subagent coordination incl. the two-process case, human-wait, execution-guard and tools::tasks suites, server_task_config and server_task_runtime; farm run 20261108T000442Z-issues-recheck-67ab1a).
Locally: cargo fmt --all -- --check, both budget checks,
sync-changelog --check and the feature release-note receipts pass.
Covers coordination_process_lock_rejects_second_process,
which now has a second phase: a real second process holds the shared v1
lock over a legacy store; this session keeps a working session-private
manager whose projection reports the note, the legacy bytes are
unchanged, no v3 store appears, and the next session upgrades once the
holder exits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7221 (CW-7804). Pasted clipboard images are written as flat
clipboard-<nanos>.png files under ~/.codewhale/clipboard-images/ and
nothing ever removed them; the reporter's Windows install grew by
several hundred MB in a month of QQ screenshots.
`codewhale sessions prune-images` sits beside `scrub-secrets` and keeps
its shape: report by default, `--apply` to delete. An image is offered
only when no file under the Codewhale state directory, the sessions
directory or the Runtime task store names it (saved sessions,
checkpoints, archives, Runtime threads, the composer stash and history)
and it is older than the grace window (`--older-than-days`, default 7),
so an unsent draft or a running turn keeps its picture. The scan reads
raw bytes and needs no knowledge of each store's schema; it never
follows symlinks inside the roots and stops once every image is
accounted for. If any file or directory cannot be read, nothing is
deleted. A file another process holds open (common on Windows) is
reported and skipped. A missing image never fails resume: the bytes enter
history when a message is built (expand_attachment_blocks), and
re-sending an old message reports the missing file in-band.
The traversal reuses session_secret_scrub's no-follow directory helpers
(now pub(crate)). docs/READ_MEDIA.md documents the command and a
features.toml row registers it.
Known limits: references held only outside the scanned roots (for
example a workspace-local .codewhale directory) are not seen; age-only
pruning stays out of scope; grouping new pastes by session is not done.
Verified (macOS, offline, locked): the batch's six commits were tested as one change on Boat farm VMs
(Linux x86_64), shipping only `git diff <base> <final>`, so no other
session's uncommitted files took part. cargo test --locked --lib with
filters over config, runtime, engine, app-server, tui and cli on base
3631a174f6: 459 passed, 0 failed (config 8, runtime 117, engine 102,
tui 220, cli 8, app-server 4; farm run
20261107T230833Z-issues-tests-503e01). cargo clippy with the Lint job's
flags (--all-targets --all-features, -D warnings) on config, runtime,
engine, command-contract, cli, tui and app-server: 0 warnings, 0 errors
(run 20261107T231817Z-issues-clippy-e84152). Rebased onto 5ba1aa63bc
(eager sub-agents), which shares subagent/mod.rs, subagent/tests.rs,
tasks.rs and config.example.toml with this batch; this batch's changed
lines are byte-identical on both bases, and a recheck of that overlap on the new base passed: engine 48 and app-server 2 passed, 0 failed (subagent coordination incl. the two-process case, human-wait, execution-guard and tools::tasks suites, server_task_config and server_task_runtime; farm run 20261108T000442Z-issues-recheck-67ab1a).
Locally: cargo fmt --all -- --check, both budget checks,
sync-changelog --check and the feature release-note receipts pass.
Covers the session_secret_scrub suite whose
no-follow directory helpers this reuses, and the build of the new
subcommand. The fixture run of `codewhale sessions prune-images` on a
macOS binary follows from the freeze build.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Task wall clock pauses for answerable human waits, landed as
@asto18089's pull request: this merge brings in its head ac9a30319a
(their commits plus GitHub's update-branch merge of main) and the
maintainer follow-up bf73bf8778, which bounds the pause with
`[tools] task_human_wait_cap_seconds` (default 1800 s, at most 86400)
and gates it on the Runtime's HTTP listener. The contributor's fork
refused maintainer pushes, so the follow-up rides in this merge rather
than on their branch, as agreed with the 0.10.3 release session.
Conflict resolution, CHANGELOG.md only: the PR's 0.10.3 Added bullet
and its extended @asto18089 credit are applied on top of main's current
text. crates/tui/CHANGELOG.md is regenerated with
scripts/sync-changelog.sh, which also restores the two entries
4c5426f9bb added to CHANGELOG.md without syncing the slice.
Verification: the batch's six commits were tested as one change on Boat farm VMs
(Linux x86_64), shipping only `git diff <base> <final>`, so no other
session's uncommitted files took part. cargo test --locked --lib with
filters over config, runtime, engine, app-server, tui and cli on base
3631a174f6: 459 passed, 0 failed (config 8, runtime 117, engine 102,
tui 220, cli 8, app-server 4; farm run
20261107T230833Z-issues-tests-503e01). cargo clippy with the Lint job's
flags (--all-targets --all-features, -D warnings) on config, runtime,
engine, command-contract, cli, tui and app-server: 0 warnings, 0 errors
(run 20261107T231817Z-issues-clippy-e84152). Rebased onto 5ba1aa63bc
(eager sub-agents), which shares subagent/mod.rs, subagent/tests.rs,
tasks.rs and config.example.toml with this batch; this batch's changed
lines are byte-identical on both bases, and a recheck of that overlap on the new base passed: engine 48 and app-server 2 passed, 0 failed (subagent coordination incl. the two-process case, human-wait, execution-guard and tools::tasks suites, server_task_config and server_task_runtime; farm run 20261108T000442Z-issues-recheck-67ab1a).
Locally: cargo fmt --all -- --check, both budget checks,
sync-changelog --check and the feature release-note receipts pass.
Covers human_wait*, execution_guard*,
from_runtime_defaults*, supervisor_wall_clock*, unanswerable_surface*,
chained_short_waits* and server_task_config / server_task_runtime.
Refs #7230
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude Pro/Max sign-in used Claude Code's OAuth client, which Anthropic
does not allow other apps to use. The founder's 0.10.3 decision is to
remove it before the tag; the Anthropic route is API-key only again.
Removed: the OAuthProvider::Claude row and its PKCE copy-code login,
the console.anthropic.com JSON token post, Claude refresh, activation,
revoke and generation validation; the engine client's Claude bearer path
(oauth beta header, per-request token refresh, suppressed error bodies,
generation-based route receipt); `codewhale auth claude` and
`claude-revoke` dispatch, TUI `auth claude|claude-revoke`, `/auth claude`
actions, the picker's Claude Pro / Max choice and its login runner; and
the claude-plan-sign-in feature row. The Anthropic descriptor goes back
to `api_key` acquisition with the Console-key guidance, so the
providers-export golden drops Anthropic's `oauth` auth method.
A saved sign-in fails cleanly and nothing deletes it silently:
- `[providers.anthropic] auth_mode = "oauth"` now bails at credential
resolution with CLAUDE_SIGN_IN_REMOVED (the API-key route), readiness
reports a missing key with `codewhale auth set --provider anthropic`
as the fix, and the picker treats the row as needing a key. It never
falls back to ANTHROPIC_API_KEY on its own, so billing does not switch
without the user saving a key.
- `codewhale auth claude` (aliases anthropic, claude-revoke) stays as a
hidden command that prints that guidance; `/auth claude` explains the
removal and points to `/provider setup anthropic`.
- Saving an Anthropic API key no longer deletes Claude credential files
(both the config-crate and runtime save paths did, silently). Only
`codewhale logout`, which removes every saved credential, still clears
them. The credential store keeps recognizing claude-auth-*.json and
claude-oauth.json so existing files stay valid store entries.
Docs: PROVIDERS.md replaces the sign-in section with the removal note
and the table row; features.toml drops the row; CHANGELOG gains a
0.10.3 Removed entry (breaking). The generated web data is re-derived
from the committed sources in a follow-up commit of the same push.
Verification: the batch's six commits were tested as one change on Boat farm VMs
(Linux x86_64), shipping only `git diff <base> <final>`, so no other
session's uncommitted files took part. cargo test --locked --lib with
filters over config, runtime, engine, app-server, tui and cli on base
3631a174f6: 459 passed, 0 failed (config 8, runtime 117, engine 102,
tui 220, cli 8, app-server 4; farm run
20261107T230833Z-issues-tests-503e01). cargo clippy with the Lint job's
flags (--all-targets --all-features, -D warnings) on config, runtime,
engine, command-contract, cli, tui and app-server: 0 warnings, 0 errors
(run 20261107T231817Z-issues-clippy-e84152). Rebased onto 5ba1aa63bc
(eager sub-agents), which shares subagent/mod.rs, subagent/tests.rs,
tasks.rs and config.example.toml with this batch; this batch's changed
lines are byte-identical on both bases, and a recheck of that overlap on the new base passed: engine 48 and app-server 2 passed, 0 failed (subagent coordination incl. the two-process case, human-wait, execution-guard and tools::tasks suites, server_task_config and server_task_runtime; farm run 20261108T000442Z-issues-recheck-67ab1a).
Locally: cargo fmt --all -- --check, both budget checks,
sync-changelog --check and the feature release-note receipts pass.
Covers golden_providers_export_matches_registry,
non_key_and_mixed_routes_are_typed_explicitly, credential_help,
oauth::tests, credential_resolve, provider_readiness, route_receipt,
provider_picker (Anthropic now opens key entry), auth_slash_command,
parses_auth_subcommand_matrix and logout. Not exercised: a live
Anthropic request.
Refs #6932
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The founder-approved 0.10.3 batch from
artifacts/eager-delegation-20261107/FINAL-CHANGES.md, all ten items. This is
one declared re-pin of the session-pinned prefix (docs/CACHE.md): BASE_PROMPT
and several eager tool descriptions change on upgrade, and nothing changes
mid-session.
1. BASE_PROMPT gains "Delegation and goals". Independent parts of a request
go to `agent` children started together in one message. Results arrive on
their own, so never poll or sleep, and end the turn when only waiting
remains. Each child gets a complete prompt and a disjoint file scope; the
parent inspects a write-capable child's evidence, reviews the final diff
and runs the checks. An independent reviewer tries to refute a
non-trivial change before it is called done. `create_goal` is for any
direct request, in any language, that describes a verifiable end state
needing more than one turn. A goal is blocked only when the same concrete
obstacle persists; difficulty is not blocked. Cost alone is not a reason
to stop, and only limits the user or configuration sets apply. The scope
line keeps express authorization for spending real money (purchases, paid
providers, billing) and adds the founder-approved sentence "Sub-agents,
workflows and goals within the current request are in scope."
GOAL_CONTINUATION_PROMPT drops the stale tool_search sentence (update_goal
is eager), asks for remaining independent work to be split across agent
workers before the next verification pass, and uses the same blocked rule.
2. The engine no longer appends the Operate contract (record_mode_context).
Its reviewer, cost and write-child-evidence lines now live in BASE_PROMPT
for every session. Every saved wording stays recognized, so restored
sessions replay it as internal state and compaction still keeps it.
3. The agent start receipt carries `next`: "Results arrive automatically;
continue other work or end your turn."
4. The agent description leads with intent ("Delegate focused work and keep
working. Start early; one agent per independent part, same message."),
gives one trigger per role, adds a child-prompt brief with one worked
example, names `workflow` and `Run` as the real tools, and drops the
"In Operate" and "Legacy action=" sentences. The schema is unchanged.
5. create_goal, its token_budget property and update_goal (description and
status property) say when to start a goal and what complete, blocked and
yield mean, without judge jargon. The status enum and parser are
unchanged, and the token_budget parameter stays.
6. The bundled goals skill (personal resolutions in goals.md) becomes
personal-goals with `aliases-for: goals`, so saved references still
resolve and the skills index no longer reads like goal mode. It keeps the
generation-12 introduction, so a user who deleted goals does not get it
back. On upgrade, an untouched goals copy (a shipped body by hash,
SKILL.md its only entry, and no personal-goals directory yet) is renamed
to personal-goals and then refreshed by the ordinary generation-20
upgrade, because its body hash is listed under personal-goals. An edited
or extended copy stays where it is. Known limitation: a
`[skills.bundled]` entry that names "goals" now reports as unknown and
does not apply to personal-goals.
delegate no longer forbids delegating final verification and treats the
roster as optional; best-of-n uses the general and implement roles and
drops "In Operate mode" and the 16-worker figure. v4-best-practices is
not changed: it is a cfg(test) v4 migration fixture, not a bundled skill,
so editing it would falsify the fixture and reach no user.
7. The tasks schema stops advertising mode=operate; the hidden legacy alias
schema and the free-string parser still accept it. harness no longer names
the hidden rlm tool (description and overview), list_dir loses its
harness meta sentence, and TOOL_SURFACE.md (and zh_hans) drop Operate.
goal.rs's `Run action="verifiers"` names a real deferred tool, which a
well-formed first call activates, so it stays.
8. Workflow max_concurrent defaults to 64 (was 16), matching sub-agents. The
workflow-js per-run clamp WORKFLOW_MAX_CONCURRENT moves from 16 to 128,
the sub-agent hard maximum; without it the clamp would have kept every run
at 16 and explicit configs above 16 would not take effect. No spend caps
are added, and the high-budget approval trigger is untouched because the
default token budget is 0. Docs and config.example.toml follow.
9. Each child's task message ends with its name, its scope (read-only, or
may edit files within its assignment) and "Your final answer is delivered
to the parent automatically; include the result and its evidence." This
is the child seed built by the runner in subagent/engine.rs, beside the
role prompt that carries SUBAGENT_OUTPUT_FORMAT; the role prompts that
children share are unchanged.
10. tool_search lists the commonly registered deferred groups (Git, Run, Web,
tasks, github, automation, lsp, review, session_search, terminal/*,
apply_patch, grep_files, MCP) and says a listed tool can be called by
name. Memory tools are opt-in, so they are not listed. Generating the
list from the live catalog is the next-patch item.
Bytes and cache:
- /preview-request before, installed 0.10.3 (7b8a634, catalog-equivalent
to main) on macOS with an isolated offline HOME: tool schemas 40,854
canonical JSON bytes, system 16,662, base prompt 3,336, 18 active of 59.
- /preview-request after, a debug build of this diff on Linux (Boat farm)
with the same isolated offline HOME and prompt: tool schemas 40,173
canonical JSON bytes (-681, eager bytes did not grow), base prompt 4,352
bytes.
- Source delta on eager tool schemas: -681 bytes (agent 2,370 -> 1,737,
create_goal -244, update_goal -129, tool_search 71 -> 396). BASE_PROMPT
grows to 4,352 bytes in the system region.
Tests changed with the behavior: prompts.rs
universal_prompt_does_not_expose_control_plane_ceremony no longer forbids
"sub-agent" and "dispatch, join" (the founder reversed that decision) and
still forbids sentinel and runtime-event jargon; the deleted
agent_tool_description_states_the_operate_child_approval_rule pinned the
dropped Operate sentence; the tasks enum test, the workflow default tests,
the Operate probes (now 0 contracts) and the delegate generation-18
reconstruction chain follow; the skills fixture moves to generation 20, with
the old delegate and best-of-n bodies and the old goals body (under
personal-goals) listed by hash. The prompt and event
conformance goldens are re-recorded for the re-pin.
Verified on the Boat farm (Linux x86_64), base 4c5426f9/f0fb6adb plus only
this diff (engine.rs, subagent/mod.rs, subagent/tests.rs, tasks.rs and
config.example.toml shipped as HEAD plus this batch's hunks):
- cargo test -p codewhale-engine --lib, focused filters (prompts, goal,
tasks, harness, canonical actions, agent description and parent surface
ceiling, lifecycle, launch receipt, assignment prompt, limits, compaction
last round, tool catalog, runtime handoff, registry, workflow): 533
passed, 0 failed. The final state on base f0fb6adb, same filters
plus core::engine::tests::operate_ and mode_notice: 539 passed, 1 failed.
The failure, create_mode_enum_advertises_neither_operate_nor_yolo, came
from the farm copy of tasks.rs missing this commit's third hunk; the
first run carried exactly the committed tasks.rs, and the test passed.
- cargo test -p codewhale-skills: 182 passed, 0 failed, on the final rename
migration; a throwaway migration check (not committed) covering untouched,
edited, extended, deleted and fresh installs: 5 passed.
- cargo test -p codewhale-config --lib workflow_config: 3 passed;
cargo test -p codewhale-workflow-js: 12 + 82 passed.
- cargo test -p codewhale-tui --lib conformance::prompt::
conformance::events::, update pass then compare pass: 5 passed each; the
re-recorded goldens come from that run on base cd7f5b32 (conformance tool
schemas 19,840 -> 19,792 bytes, system +1,033 bytes, matching the source
delta); nothing that landed since touches the surfaces they capture.
- cargo clippy -p codewhale-engine -p codewhale-skills -p codewhale-config
-p codewhale-workflow-js --all-targets --all-features with the Lint job's
flags: clean; skills clippy re-run on the final migration: clean.
Local: rustfmt clean on every touched file; scripts/preflight.sh --check
passes except the blocking-calls budget, which fails only on another
session's untracked crates/engine/src/session_image_prune.rs (4 > 0), not
part of this commit; dead-code budget 137 of 137.
Not verified: a macOS run of the after binary (the before figure is macOS,
the after figure Linux; the measured -681 equals the source delta), any
live provider turn, and DSH's sleep/poll probe on the target models.
Refs: CW-7852
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Step 2 said a user-visible feat or fix commit carries a line and that
docs need none. The changelog rule counts user docs, help text,
defaults and security behavior as user-visible, and public lines cite
a public issue or PR, never an internal tracker id. The step now says
so: a user-visible change (usually feat or fix) carries its line,
`(#N)` names a public issue or PR, and tests, CI, refactors and
internal docs need no line.
Verified: the edited paragraph reads cleanly in context; no other
public skill restates the rule. No CHANGELOG line: maintainer
documentation.
Refs CW-7860
Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/ISSUE_TRIAGE.md pointed at an "agent-ready issue standard" in
codewhale-ops that does not exist; only old evidence copies of this
page mention it. The standard in practice is the public Agent task
issue form (.github/ISSUE_TEMPLATE/agent-task.yml), which applies the
agent-ready label and requires a goal, a plan by path, done-when
outcomes and verification commands for an agent with no other context.
Verified: the relative link resolves from docs/. No CHANGELOG line:
contributor documentation.
Refs CW-7860
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Three named passes: correctness against the linked issue (intent,
defects, contracts, the AGENTS.md invariants), security (trust
boundaries, secrets, sandbox, execpolicy and the approval layers,
network policy, dependencies) and contract and compliance (CHANGELOG
line per the cw-land step, feature registry, localization, vocabulary,
and a table of which existing scripts to run for what a change
touched).
Severity reuses the blocker, concern and nit levels and the reproduced,
traced and suspected evidence tiers that codewhale review already
emits (crates/engine/src/tools/review_core.rs), so a person's review
and the tool's read the same. Nits are grouped into one list; there is
no numeric cap.
Review runs by hand and at the frozen release candidate, never as a
required check, and for contributors it is advice that never blocks,
labels or closes a pull request.
Verified: every path, link and script it cites exists at this commit.
No CHANGELOG line: contributor process documentation, not a
user-visible change.
Refs CW-7860
Co-Authored-By: Claude Opus 5.5 <[email protected]>
.codewhale/hooks.toml adds two tool_call_before hooks backed by one
policy script, scripts/agent-guard.py:
- Shell guard: denies git add -A, --all, -u, a dot, .., a star or the
repo root; git commit -a or --all; and add or commit pathspecs naming
.env files (templates ending .example, .sample or .template stay
allowed), private keys (pem, key, p8, p12, pfx, jks, keystore, ppk,
ssh identities) or target/, node_modules/ and .mimosa/ paths (a
fixtures folder is exempt for build folders). It reads chained,
subshell, bash -c and eval forms and skips heredoc bodies, quoted
messages and comments.
- Edit guard: opt-in release freeze. With CODEWHALE_RELEASE_FREEZE set,
edits to .github/workflows/release*.yml and auto-tag.yml through the
file tools, apply_patch or mutating shell commands are denied; reads
stay allowed.
Every deny names the rule and the way forward, worded to pass the
Engine's 240-character denial redactor unchanged.
The hooks file pins the script's SHA-256, so approving the hooks digest
approves the script too: a changed script fails the pin and never runs.
Both hooks keep continue_on_error = true, so a guard that cannot run
(no python3 or shasum, a Windows cmd shell) reports no verdict and
never blocks work. Nothing runs until the person trusts the workspace
and approves the digest (/hooks review, then /hooks approve).
The script also answers Claude Code's PreToolUse protocol (JSON on
stdin, exit 2 with the reason on stderr), so wiring it there later
adds no second policy.
Verified: 77 of 77 block and allow cases (both protocols, freeze on and
off, truncated arguments) in a scratch harness that runs the script
with the Engine's hook environment; all 18 distinct deny reasons pass a
replica of sanitize_hook_denial_reason unchanged, worst case 221
characters; the exact hooks.toml commands run through sh -c, and a
tampered copy of the script exits 1 without running; tomllib parses
the file with only Hook fields. No Rust changed. No CHANGELOG line:
this is repository tooling, not a user-visible change.
Hooks digest: f4112f65c9e5f389a211d4cfb08414de4a7e516096e912afd038314d907d5b1e
Refs CW-7860
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`GET /v1/apps/mcp/servers` now carries `last_error` for a configured server
that is in connection backoff, truncated to 2,048 characters, so clients can
say why a server is not connected instead of only showing it as disconnected.
`McpPool::last_connect_error` returns the error only while the same
configuration is the one in backoff (runtime-added flag, reviewed plugin
source and runtime config hash unchanged); runtime-added servers report none.
docs/RUNTIME_API.md documents the field.
Fleet member starts are keyed by (state namespace, operation key), so a
replayed start in one session can no longer resolve to a member that another
session started under the same operation key.
Recovered from stranded drafts (the readiness MCP last-error patch, the MCP
pool accessor and release-engine 9cb914b617) and rewritten against the current
has_connection_backoff.
Verified: the five runtime_api MCP management tests pass (5 passed, 0 failed:
crud, redacts_credentials, project_ownership_blocks_global_shadow_mutations,
blocks_credential_retargeting, revision_precondition_prevents_stale_mutation),
run on the shared tree with other sessions' uncommitted edits present;
clippy on codewhale-engine and codewhale-app-server libs was clean earlier
today; the patch applies to HEAD cd7f5b32b1 and every item it references
exists there. No new tests.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Fold the desktop-contracts session's lines for 9805a009e8 into 0.10.3:
the Changed entry (called out as breaking for Runtime API clients, since
`/v1/terminal/{name}/*` now answers 410 and `/v1/runtime/info` replaces the
four `terminal_*` flags with `thread_scoped_terminals`) and the terminal
lifetime known limit. Other sessions' uncommitted CHANGELOG text and a
staged skill rename in the shared index are left untouched (committed from
a private index).
Verified: scripts/sync-changelog.sh --check up to date on the committed
pair.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CW-7669. Engine terminal routes addressed a live PTY by a reusable name
looked up against the server's root workspace, so a worktree thread's pane
reached the root's same-named shell, and two conversations using `term-1`
in one folder shared one shell (cwd, running command and output crossed
between them). Reconnect and restart semantics were undefined.
Engine owner (crates/engine/src/tools/terminal_session.rs):
- The registry key is (canonical workspace, owner, name); the owner is the
tool context's state_namespace, which a runtime thread's engine sets to
the thread id (runtime_threads/manager.rs session_id: thread.id), so each
conversation gets its own shells; sub-agents share their parent's.
- The issued session_id is stored beside the handle in the registry, so an
identity resolves without taking a session lock a blocked write holds.
lookup(workspace, owner, id) replaces lookup(name, workspace).
- get_or_create no longer holds the registry mutex while it waits on an
existing session's lock, so one wedged shell cannot stall every thread.
- write_human_input is the one human-input path for the TUI dock and HTTP:
identity, sandbox-reuse guard, exited shell, and the confirmed ETX
interrupt the dock already used. HumanInputError keeps the dock's strings
and lets HTTP map statuses.
- terminal/reset metadata reports terminal_session_id and
previous_session_id. Durable summaries hash the owner too.
Runtime API (crates/app-server):
- GET /v1/threads/{id}/terminals lists the thread's live shells with the
registry instance; /v1/threads/{id}/terminals/{terminal_id}/
output|input|resize|kill drive one by identity, mirroring the thread jobs
routes. Every call re-resolves the thread's recorded workspace
(thread_workspace split out of scoped_workspace). A reset, foreign-thread,
foreign-workspace or pre-restart identity is 404 terminal_not_found;
nothing substitutes a same-named shell. Input needs the thread's shell
consent and loaded shell policy plus the sandbox-reuse guard against
thread_job_sandbox_policy (the derivation a turn uses). Kill reports
killed:false for an exited shell; output adds gap. Lookups and PTY work
run on the blocking pool (previously open_session locked the registry
inline on a runtime worker).
- /v1/terminal/{name}/* answers 410 terminal_route_retired on every
platform. runtime/info advertises thread_scoped_terminals; the four
terminal_stream/input/resize/kill flags leave the protocol
RuntimeCapabilities (absent reads as false, so an older client hides
Engine terminals instead of reaching the retired routes). A compatibility
window was rejected: the old routes carry no thread, so answering them
means choosing a shell by name, which is the defect. JSON schema, the
TypeScript declaration and the SDK declaration are regenerated.
- docs/RUNTIME_API.md (and zh_hans) define reconnect, reset, exit, Engine
restart, unconfirmed interrupt and uncertain-input semantics and the
known limits, including that deleting a thread does not end its shells.
TUI dock: human terminals are created under the current session's owner;
resize resolves by identity through resize_dock_session.
Behavior change: in the TUI, a new conversation starts its own term-1
instead of reusing the previous conversation's shell (the dock still lists
both). The community VS Code extension's client calls no terminal route.
Ratchets: blocking-calls budget tightened for terminal_session.rs only
(path_canonicalize 3 -> 1, from the canonical() dedup); dead-code budget
unchanged at 137/137.
Evidence (local, -j6, hermetic test home; source at commit time):
- codewhale-app-server-schema --write: exit 0; the JSON schema and both
TypeScript declarations change only by the capability swap.
- cargo test --locked --offline -j6 -p codewhale-app-server-protocol
--features schema: lib 10 passed; tests/schema.rs 2 passed (includes
committed_runtime_schema_and_sdk_exports_match_one_rust_contract);
tests/wire.rs 3 passed; 0 failed.
- cargo test --locked --offline -j6 -p codewhale-engine -p
codewhale-app-server --lib -- terminal: app-server 21 passed, 0 failed
(the 4 terminal.rs unit tests, terminal_routes_serve_a_live_engine_
session_over_http, terminal_output_for_an_unknown_session_is_not_found_
and_creates_nothing, runtime_info_advertises_terminal_capabilities);
engine 146 passed, 0 failed (all 25 tools::terminal_session tests,
including session_names_are_scoped_to_owner_and_workspace and
dock_never_attaches_to_a_reset_name_without_selecting_its_new_identity).
- cargo check --locked --offline -j6 -p codewhale-tui --lib: the engine
compiled; the TUI crate stopped on one error outside this change
(commands/groups/config/status.rs:325, another session's in-progress
Accept Edits work), so the dock edit is type-checked but not
borrow-checked. Its only borrow-relevant line was then reduced to the
call shape that compiled before (owner computed first).
- rustfmt --check on each changed Rust file; check-blocking-calls-budget
and check-dead-code-budget run.
Tests ran on the shared working tree, which also held other sessions'
uncommitted edits; this commit carries only this slice.
Not verified: no packaged build, no live desktop pane (needs the App
adoption and the 0.10.3 repin), Windows/ohos stubs not compiled here.
Refs CW-7669
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Release candidate runs 42381818665 (549ff01ebb) and 42408096045
(b175b1f9ed) both lost the linux-arm64, android-arm64 and ohos-arm64 dist
builds to "The runner has received a shutdown signal" (exit 143) 20-40
minutes into the quiet compile of the large crates, with no compiler,
linker or disk error. linux-x64 on the same ubuntu-latest image succeeds,
and 0.10.2 shipped these targets, so the dist profile (fat LTO, one codegen
unit) on a grown workspace exhausting 16 GB runner memory is the likely
cause. The three Linux aarch64 legs now add an 8-16 GB swapfile on the
largest writable disk before building; the shipped binaries are unchanged.
The next release-candidate run is the proof.
Also fixes two workflow tests my CI slim-down (99cb5a0f4f) made wrong:
release-workflows.test.js now expects the npm wrapper smoke to be manual
only (Ubuntu + Windows on dispatch), and agent-task-metadata.test.sh no
longer requires the removed agent-task-labels.yml but guards that it stays
retired. The stale change-detection path for that workflow is dropped.
Verified: node --test .github/scripts/release-workflows.test.js 1/1 pass;
d8-executable.test.js 4/4 pass; agent-task-metadata.test.sh pass;
actionlint with CI flags passes on ci.yml and release-artifacts.yml.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder direction (2026-11-07): remove CI/CD steps that cost time without
need, use CI conservatively, and make contributor rules standard and
welcoming instead of closing or blocking PRs over CI. A read-only audit of
two weeks of run history (Sonnet workflow with an adversarial release-
engineer critique) drove the list; nothing release-critical is touched.
Removed (enforced nothing, duplicated other checks, or gated contributors):
- dco.yml (always exited 0), pr-issue-link.yml (red X on ~8% of contributor
PRs), auto-close-harvested.yml, pr-gate.yml / issue-gate.yml /
approve-contributor.yml and .github/APPROVED_CONTRIBUTORS (dry-run
allowlist gate; drops a pull_request_target surface), agent-task-labels.yml
(duplicates triage.yml).
Moved to manual (workflow_dispatch) only:
- codewhale-review.yml (review bot; AGENTS.md says review bots stay off),
main-landing.yml (push trigger; run scripts/preflight.sh --check locally),
ci.yml test (Linux suite, 54-94 min per PR), safety-gate (18-29 min), msrv,
mobile-smoke, npm-wrapper-smoke (macOS leg dropped from the dispatch matrix;
the release artifacts cover macOS).
- The PR feature release-note receipt step is advisory (continue-on-error).
- spam-lockdown keeps only unambiguous spam patterns.
Unchanged: Lint and the compile-only Test (windows-latest) stay the
required PR checks; release-candidate, release-artifacts, release-parity,
release, the mirrors, OHOS and the Windows import guard are untouched. The
branch ruleset drops "npm wrapper smoke (ubuntu-latest)" next (founder
approved "Lint + 1 compile").
Rules: AGENTS.md, CONTRIBUTING.md, the PR template, AGENT_ETHOS.md and the
cw-land skill now say contributor PRs are never closed or blocked because
CI is slow, flaky or red for a reason they did not cause; nothing closes a
PR automatically; harvesting is a rare, asked-first fallback with the
contributor as author; the PR issue line is optional; maintainers reply
generously. web/data/agent-docs.generated.json is regenerated from a clean
export of main plus this change only.
Verified: actionlint with CI's flags (-ignore SC2129/SC2221/SC2222) over all
workflows passes; web/scripts/check-facts.mjs passes on the isolated export;
only the contribution entry of agent-docs.generated.json changed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Root asked for every change landed today to have a 0.10.3 note. Three
landed without one: 91fd65705a (stages appearing during a registry load
now take the restage checks), 67de548a97 (Windows import floor: ARM64
pairs qualified by the native probe, x64 pairs recorded as documented
contracts) and 549ff01ebb (terminal-clipboard harness BOM and cleanup
fallback, vendored kit lock). Lint, style, test-table, ratchet and website
docs commits change no product behavior and get no entry.
Only these three lines are committed; another session's uncommitted
CHANGELOG text stays in the working copy.
Verified: scripts/sync-changelog.sh --check up to date on the committed
pair.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The codewhale.net hero now tells the living mark's story with its existing,
owner-approved pieces: the flat C-curl mark (drawn by the vendored kit's
WhaleRig.build("mark") in brand navy #142352, reversed on dark) holds for
700 ms, the live canvas whale fades in as the colored-in whale for 2.4 s, then
64 beads of light assemble head first and keep breathing, swimming, hovering
and carrying a soft light crest at 12 paints per second. Pointing at it, or
picking a terminal view (the existing cueWhale path), brings the whale back;
it returns to lights 600 ms after the pointer leaves or 15 s after a pick. The
intro plays once per browser session. The canvas whale sleeps (no frames) while
the lights show; the lights pause when off screen or hidden. Under reduced
motion the hero keeps the still whale and draws no lights. Before the client
decides, the hero is hidden briefly so the character no longer flashes before
the mark; without JavaScript it appears after 1.2 s.
The beads come from web/vendor/whale-lights/whale-lights.json, an unchanged
copy of codewhale-app assets/whale-lights.json at 55c9ba0c (SHA-256 recorded),
the same file crates/tui-kit pins for the terminal. web/lib/whale-lights.ts
restates the app's drift, crest and seeded-star formulas (about 60 lines)
because the app source is private (CURRENT_DECISIONS 44); PROVENANCE says to
change the three together. lib/whale-motion.ts exposes the vendored WhaleRig.
Verified: tsc --noEmit clean; ESLint clean on the five changed TS/TSX files;
vitest 74 files, 770 tests passed (design-grammar contract included, which
moved the new timings onto the spring tokens and the fallback keyframe behind a
motion preference). next dev on 3241 in the browser pane and in Electron's
Chromium via Playwright: stages mark (0.3 s) -> whale (0.9-1.7 s) -> lights
(3.3 s+), beads move between reads, no console errors; with reducedMotion
reduce the stage stays whale, lights are display:none and nothing moves.
Not deployed; codewhale.net is unchanged until a founder-authorized deploy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7233. f230a76b2b left the new four-row loop on one 101-column line;
the Main landing gate's rustfmt step flagged it. Formatting only.
Verified: rustfmt --edition 2024 --check clean on crates/net/src/proxy.rs,
crates/runtime/src/oauth.rs and crates/runtime/src/oauth/test_support.rs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7233 (CW-7824). 832ac8544b already keeps malformed HTTP(S)_PROXY
values out of the MCP warning and makes redact_proxy_userinfo return
"<invalid proxy URL>" for input without a scheme. The existing redaction
table now carries the reporter's four unschemed rows (a space in the host,
a non-numeric port, an unclosed IPv6 bracket, an empty host), assembled
from the placeholder credentials like the rest of the table, and asserts
the password never survives.
Verified (macOS, offline, locked): cargo test -p codewhale-net --lib
redact_proxy_userinfo_strips_password 1 passed, 0 failed (72 filtered).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7203 (CW-7800). 0.10.2 decoded the ChatGPT ID and access tokens
with zero leeway against the device clock and reported every rejection
as "token signature or identity claims failed verification". A device
clock about 15 s behind auth.openai.com, as the reporter measured, makes
a fresh token's nbf look future-dated, which is the only rejection
consistent with the report (key download and unknown-key failures had
their own messages). 8a37a91312 named the failed check and 4ca5880be8
allowed 60 s of skew; a larger skew still failed sign-in.
Expiry and not-before are now evaluated against the issuer's clock. The
Date header of the TLS response that delivers the issuer's keys, read at
sign-in and on every refresh, gives the offset from the device clock;
the 60 s tolerance stays, and without the header the device clock is
used as before. Trusting it adds no trust: whoever could forge that
response could forge the keys. Time errors say they were judged by the
issuer's clock and report the device's difference beyond the tolerance.
A token whose kid is missing from the first key download refetches the
keys once before failing (rotation, stale edge cache); the key download
already shares the token exchange's client, TLS roots and proxy rules,
and its failure keeps its own message. A missing or malformed sub,
client_id or scope claim is named. Signature, issuer, audience, subject,
nonce, account and plan-scope checks stay exact, and no claim value
reaches an error. iat is not validated (jsonwebtoken never checks it).
chatgpt_account_id is display-only on this route (the registration binds
sub), so it cannot fail sign-in.
Docs (EN/ZH PROVIDERS) describe the issuer clock and the key refresh. The
existing changelog bullet is amended, the 0.10.3 known-limit bullet stays
because no Windows sign-in receipt exists, and @d-onistack is credited on
the changelog, CONTRIBUTORS, release-credits and public-surface facts;
the embedded changelog and agent docs are regenerated (the trust and
vocabulary agent-doc entries were stale on main and refresh with them).
Known limits: token refresh scheduling (token_is_expired) still uses the
device clock; not reproduced on Windows.
Verified (macOS, offline, locked; existing tables extended as directed):
runtime SIWC cases 5 passed, 0 failed (929 filtered), covering ±15 s
accepted on the device clock, ±90 s rejected on the device clock and
accepted with the matching issuer offset, a 900 s difference reported in
the message, unknown-key refetch exactly once (success and failure),
known keys fetched once, and named client_id/scope claims; engine refresh
case client::tests::siwc_refresh_rotates_atomically_and_rejects_a_different_account
1 passed, 0 failed (7101 filtered); cargo clippy --all-features -p
codewhale-runtime -p codewhale-net --lib --tests with CI's -D warnings
and allow list: 0 warnings; scripts/sync-changelog.sh --check up to date;
web check-facts OK.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The early hosted CI run on b175b1f9ed (run 42408093869, job Lint) failed
the #6149 blocking-calls ratchet: eight file budgets were exceeded by
sites added in 821c478eb9, c49fd2c331 and 91fd65705a without updating
the budget. Each site was checked for an inline async caller:
- runtime_api/jobs.rs: resolve_job_cwd / canonical_job_path are sync
helpers whose only callers run inside spawn_blocking (jobs.rs 665, 711)
or tests.
- runtime_api/plugins.rs: ui_root_matches / prepare_plugin_ui run inside
the spawn_blocking blocks at 1279 and 1327.
- paths/lib.rs and paths/daemon_socket.rs: root-owned symlink ancestor
resolution for the daemon socket path, synchronous startup code.
- plugins/marketplace/document.rs and plugins/registry.rs: synchronous
library code in the reviewed-plugin registry and marketplace reader.
Only those eight entries are raised, using counts from a clean export of
origin/main, so uncommitted work in the shared checkout cannot skew them.
Optional tightenings (subagent/mod.rs, file_frecency.rs,
private_directory.rs) are left for the owners' next --update.
Verified: check-blocking-calls-budget.py exits 0 against a git archive
of origin/main with this budget.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer follow-up on @asto18089's #7230, landing it as their PR.
- Apply the maintainer patch from the review thread: `[tools]
task_human_wait_cap_seconds` (unset or 0 -> 1800 s, clamped to
1..=86400) feeds `TaskExecutionLimits::human_wait_cap`, the default
cap drops from 24 h to 30 min, docs/CONFIGURATION.md and
config.example.toml document it, and the blank line after the
`drive_engine_turn` doc comment is gone (clippy
empty_line_after_doc_comments).
- A wall deadline that has already passed is no longer skipped:
`begin_human_wait` declines to open a window once the wall deadline
(moved only by closed windows) is behind it, so the guard ends the run
with WallTimeout instead of letting the human answer and then failing
the task right after. The deadline arithmetic lives in one helper
shared with `evaluate`, which also drops an always-zero open-window
term from the no-window branch. Idle crossings are left alone on
purpose: #6118 suspends idle while an approval is pending, and the
worker supervisor lets queued executor progress win an idle race, so
refusing a window on an idle crossing would turn a starved event
channel into a spurious IdleTimeout.
- Answerable waits require a Runtime that binds its HTTP listener:
`server_task_config` takes `http_decisions` and `run_http_server`
passes `!local_control`. Local Stdio, Socket and ACP control frontends
bind no listener, and the control transport refuses user-input
replies, so their tasks keep the unanswerable default.
- The two existing server_task pins pass the flag; the config pin also
asserts the local-control case stays unanswerable.
- Merge current main first so the #5898 release-note receipt (dropped
from main's changelog after the earlier branch update) is re-added in
the 0.10.3 Added section, with the contributor credit extended.
Evidence: all 13 existing ExecutionGuard unit tests, extracted verbatim
with the guard code into a scratch harness, pass on both the previous
head and this one; the same harness shows the reported ordering (wall
400 ms, prompt at 500 ms) returning Run before and WallTimeout after.
rustfmt clean on the touched files. Full crate builds and the async
task tests are left to this PR's CI.
Refs #5898
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Fixes the remaining hosted test failures on 549ff01ebb (CI 42381817495).
Runtime: a host-provided route with no preflighted client took its config
with mem::take before the optional credential preflight, so a failed
preflight left the route with a default config and lost its session
isolation and approval deadlines. It now clones, so the configured route
survives a failure. The existing privacy/timeout assertions are unchanged.
Exports: the four capabilities the runtime already serializes
(thread_scoped_git_writes, thread_scoped_snapshots, worktrees,
job_operations) are restored to the committed JSON schema, the TypeScript
declarations and the runtime SDK copy; the JSON matches the Rust-generated
contract.
Existing expectations realigned with shipped behavior: `present` is an eager
core tool (hook category stays other) in the five tool-surface tests; Native
extension entries accept .cjs and .cts; account logout is account-only and
keeps provider keys (two TUI tests renamed to say so). The router HTTP-status
unit test disables retry because it mounts a single response; runtime retries
are unchanged. THIRD_PARTY_NOTICES restores the semver 7.8.5 ISC text the
bundle-notice check requires. Both changelogs record the fixes.
Verified on this Mac: the 13 hosted failing cases, each run by exact name and
each executing exactly one test, 13/13 pass (RUST_MIN_STACK=8388608, hermetic
test home, locked/offline/-j1); clippy --lib --bins --all-features over 11
packages exit 0 with zero diagnostics; runtime SDK tests and strict TypeScript
passed earlier on these same bytes (exit 0); rustfmt --check and git diff
--check pass. The full suite runs in the final hosted validation.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Hosted CI Lint on 549ff01ebb (run 42381817495) failed on collapsible_if in
the plugin registry and a needless borrow in the account session; a later
local all-target run found two more nested conditions in the App Server and a
question_mark case in the thread manager.
- plugins/registry.rs: let-chain for the state-file identity check; the
same_file guard and its error are unchanged.
- account-cli/session.rs: drop the needless borrow passed to
validate_auth_bundle.
- app-server runtime_api/jobs.rs and plugins.rs: let-chains with the same
lock scope, short-circuit order and eviction behavior.
- runtime_threads/manager.rs: `.await?` for the thread.started emit; the
same error is returned before the thread is handed back.
Verified on this Mac with the next commit's files in the tree: clippy
--lib --bins --all-features over the 11 affected packages (CI's three
allowances, -D warnings, locked/offline/-j1) exit 0, zero diagnostics, 5m59s;
rustfmt --check and git diff --check pass. Test targets are linted by the
final hosted run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Release candidate run 42381818665 on 549ff01ebb stopped the Windows import
guard on 12 x64 and 10 ARM64 pairs, every one from a DLL the profiles already
listed.
ARM64: existing windows-arm64-export-probe.yml run 42389141087 on Windows 11
ARM64 26200.9725 resolved 444/444 imports of that candidate's executables
(sha256 38558ab2...). Only the 10 probe-resolved pairs were added (460 -> 470);
the probe receipt replaces the 2026-10-16 qualification fields.
x64: no native x64 export probe exists. The 12 pairs are recorded as
namedApiContracts with Microsoft documentation sources, all below the unchanged
14393 floor, and labelled separately from the #6953 reporter-observed exports
(456 -> 468). Floors, guard and x86 profile are unchanged.
Verified: the checker's own parse_imports over the retained llvm-objdump
outputs for all six candidate executables (3 x64 at 452 pairs, 3 ARM64 at 444)
leaves zero unqualified pairs. The executables were not kept locally, so the
checker was not rerun on the bytes; the next frozen candidate's RC import job
is the real check. Not a 14393, installer or startup run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Strip Windows PowerShell's UTF8 BOM before parsing normal cleanup
receipts. Run the existing bounded exact-private-path cleanup fallback
on failures even when its controller has already exited, verify its
returned path and zero remaining Terminal processes, and retain the
original failure result.
Use Cargo's conservative offline update for the standalone vendored
kit lock: app-server-protocol0.10.3 and its declared chrono edge. Root
Cargo.lock and runtime Rust sources are unchanged from4ba0c656ac9c.
Verified on the frozen4ba+these2paths: existing standalone kit themes
14passed/0failed; surfaces3passed/0failed, both locked/offline with
source unchanged and disk guard retained. Node syntax and diff checks
exit0. Independent review confirms both Windows findings are closed.
Actual PowerShell/Windows execution remains pending finalCI.
Mac4ba CLI build and strict HTTP admission/recovery observations passed;
Linux4ba-equivalent CLI build passed with full4270source invariants.
Those executables retain their exact4ba identity and scope; this commit
is not a claim that they were rebuilt from the later script/kit-lock
metadata. No publication or deployment.
Refuse converted DSH client UI before minting asset grants, using the
existing reviewed conversion bytes. Keep Native and MCP activation paths
unchanged; unmodified DSH command UI remains unsupported. Correct the
converter and compatibility notes to match the enforced behavior.
Reuse codewhale-ratatui8311b65 design tokens5.0 and raised-panel contrast
handling in the existing vendor, preserving Engine surface and motion
behavior. Replace the Windows clipboard simulator with the existing
Ctrl+G draft stash and exact24-line Unicode comparison. No inference or
Enter is used; send-once and provider delivery are outside that check.
Synchronize embedded changelog and existing feature projections; format
the already-landed registry reconciliation expression.
Verified before freeze: cargo fmt --all -- --check; version contracts
(24 linked issue references); OHOS target dependency/bindgen contracts;
web check:facts; Node syntax; git diff --check, all exit0. Independent
read-only UI admission review found no blocking defect. The earlier
147-equivalent Linux source passed all6 selected existing cases,1case
per command,0failures; original failed Node-shim result is retained.
Native compilation, kit checks and HTTP refusal observations for this
new frozen batch, plus real Windows acceptance, remain pending. No new
product tests/comments, source push, CI dispatch or publication here.
Reuse onboarding_missing_key_recovery to keep the optional working-agreement checkpoint from covering the connection chooser for initial CLI input. Manual agreement setup, configured entry behavior and runtime permission gates remain.
Update the changelog with narrowly qualified Mac recovery, official filesystem MCP reconnect and published Code Review Native status/revocation evidence.
Verified: exact two-file diff, git diff --check and Rust syntax parsing. On source91fd, actual initial --prompt capture reproduced the obstructing checkpoint; typed draft/cancel, staged recovery/auth refusal, official MCP catalog/reconnect/revoke and published Native activation/status/revoke were observed separately. New guard runtime proof awaits the fresh stamped build; commit held locally until that passes.
Route an initially unstaged plugin whose destination appears concurrently through the existing restage writer lock, current receipt and policy checks. Retain refusal and the existing failure cache for invalid bytes. No new authority or recovery mechanism.
Verified: exact one-file diff, git diff --check, Rust syntax parsing and independent review. Fresh compile and runtime qualification pending; held locally for a stamped qualification build, not pushed.
Reuse npm semver7.8.5 inside the existing detached reviewer, including the
pinned upstream prerelease policy. Require its exact compatibility decision
before import and resolve a selected package's own ESM export through existing
contained-path guards. Preserve the existing unresolved-sibling refusal.
Stop deriving a lock-owner PID from stale lockfile bytes. Reuse coordination
projection and event-keyed notices to report each refusal cause once. Skip
sidebar cleanup only for already-latched read-only admission without a lock
slot; pace other failed attempts with the existing timestamp. Locks, migration,
retained state and explicit owning-Runtime restart behavior remain unchanged.
Align release notes and the existing affected fixture/assertion; no new tests.
Verified frozen4270-file Mac check: six native crates, all targets, locked,
onejob, offline, exit0 in838.473s, unchanged full source, no disk stop.
Node typecheck/build0, existing offline-reviewer1pass and six range observations
on the exact DSH source. Historical source-equivalent real1.0.8 preview400
reproduced the original range refusal. Current native/runtime and selected
Linux regression execution still pending; no release/global install claim.
No provider/model/GUI/CI/publication or lock cleanup. Preserve all receipts in
artifacts/readiness-20261106 and artifacts/coordination-diagnostics-20261107.
Restore missing plugin stages only from receipt-matching bytes under the
existing state writer, with generation and policy checks. Refuse changed
existing stages. Reuse normal reload/MCP invalidation for explicit restage;
add read-only shell status and bounded authenticated DSH asset grants.
Expose current-server MCP backoff without treating an absent backoff as health.
Share profile-scoped Rust account custody across terminal and native hosts,
keep local provider setup optional, and make ordinary logout session-only.
Fence browser imports and cleanup by exact revision; preserve ambiguous or
newer sessions. Keep definitely unadopted device grants in cleanup custody.
Validation: six-crate Mac all-target check exit0, 4,270 source entries
unchanged, 35m37s, no disk stop. Grok Linux raw evidence verified: secrets
account6 and plugins202 passed, one existing real-home rehearsal ignored;
all4,270 entries exactly matched that Mac freeze. Existing command-crate
boundary gate passed; 2,816 keys complete in all15 TUI locales.
The subsequent two-file private account cleanup has independent source
review and exact pre/post hash checks; Linux verification is in progress.
Only that cleanup and the already-landed visual-change changelog entry differ
from the passing Mac compile snapshot. No new tests or code comments added.
Qualification is incomplete: production recovery/asset HTTP smoke, published
plugin, Electron, live sign-in, cross-platform/package and final release gates
remain. This local candidate commit is not a release or publication.
Answer the integration chooser, actual catalog prerequisites, supported plugin formats, direct-versus-plugin MCP authentication and troubleshooting on the existing paper/blue pages. Link the plugin guide from docs navigation and refresh its plain-text index. Add explicit Computer Use GitHub/contributor links in all18locales and version-aware direct-MCP setup for published CLI0.10.2, whose older built-in bundle is not upgraded by catalog installation.
Reconcile repository EN/ZH docs for config precedence, validation/reload, URL-only servers, environment credentials, trust hashes, pinned-source updates and catalog freshness. Current marketplace and unreleased source remain separate from installed-release claims; DSH and MCPApps are not presented as universally qualified.
Verified locally:47existingwebtests passed (26dictionary/copy+21llms/docsIA); focused ESLint, TypeScript, locale/GT checks and diff check passed. Initial custom test harness missed Vite alias configuration in2suites; corrected harness passed those21checks. Desktop1280/mobile390 EN/ZH browser review passed; stale development module hydration mismatch cleared after owned dev-server restart. Published CLI0.10.2 discovered current CU0.16.1 tools and executed request_access through a local synthetic model:ok=true/viaapp, accessibilitygranted, screen-captureprobeok. No input or provider spend. Credential-free Cloudflare Docs MCP discovery listed2tools. Existing-helper setup is not clean-Mac/app-task qualification.
Generated agent documentation uses51hashedinputs: our5revieweddocs plus committed da143039f7 content for all other inputs, excluding active peer GUIDE/feature/native drafts. Full clean web validation/deployment follows this frozen commit; no Engine release qualification. CU setup README is carried separately by codewhale-cu-plugin afb98e8. Evidence:CW/artifacts/plugin-mcp-discoverability-20261107. Tracking:CW-7848; CU acceptance remains CW-6732.
Keep low-level bwrap policy inputs explicit and expect only the two existing too_many_arguments lints, without changing runtime behavior or introducing a parameter wrapper.
Verified with Grok Linux VM: exact pre/post bwrap.rs hashes match this file; cargo fmt -p codewhale-sandbox -- --check and cargo clippy -p codewhale-sandbox --locked --all-targets -- -D warnings passed on the earlier e44b2bd3 base. Local rustfmt passed. Readiness agent verified the archived logs and internal SHA256SUMS. This is not full current-tree app-server or release qualification; current parallel DSH/account changes remain unbuilt and unstaged.
Place plugin UI metadata under the existing runtime authentication and workspace identity guards. The separate asset route remains unchanged and requires further authorization work.
On Mac arm64, a source-inventoried development build returned 401 without a token, 200 with a valid token, 409 for a replaced workspace identity, and 200 after restoration. A separate asset request remained unauthenticated, as documented; no GUI or release qualification was run.
Different 0.10.3 binaries can straddle workspace state changes despite sharing a version label. Conservatively refuse self-managed rollback to any different binary labeled 0.10.3 or earlier until compatibility can be verified; preserve the identical-binary no-op.
On Mac arm64 a source-inventoried development binary passed five isolated refusal/no-op cases, including a genuinely different 0.10.3 binary and the 0.10.2 release; fixture trees stayed unchanged. Manual/package-manager downgrades and allowed rollback remain unqualified.
Map schema 4 notice_version into the existing privacy version column, retaining schema 1–3 behavior. This source change does not deploy the telemetry Worker.
TypeScript passed and 45 existing ingest tests passed. A network-denied replacement Worker replay passed 30 cases, including 40 schema 4 rows with notice 6 and no mocked PostHog egress; production route, settings and live ingestion remain unverified.
Report the expected snapshot path and distinguish unsafe entries, unverifiable directories, and unavailable paths for trusted plugins, including disabled ones. Diagnostics remain observational and do not authorize recovery.
Linux VM on e44b2bd3 with matching registry.rs SHA-256: codewhale-plugins tests 202 passed, 1 ignored; clippy all-targets passed. A separate copied-logic path probe covered seven cases, not registry wiring. Mac and Windows behavior not requalified.
Describe landed 792817bfcb: recheck the staged snapshot and refuse a changed
review generation or trust receipt under the existing state lock.
Verified the retained Mac stale-enable log (1 passed, 201 filtered), monitor,
pre/post capture and matching registry/tests/Cargo.lock hashes. Separately
attribute the reported Linux 202 passed/1 ignored result to its earlier-base
run; its raw logs remain with Codewhalebot, not this local receipt. Later
net/config changes were absent from that Linux tree.
Keep automatic restoration unfinished, the snapshot check point-in-time,
filesystem races open, and production stage-disappearance/final-candidate
qualification unclaimed. Preserve the consolidated website Unreleased entry.
Verified changelog sync/check, facts derivation/drift and scoped whitespace;
no generated metadata delta. All 25 v12 manifest entries matched immediately
before explicit two-file staging. No native build, new test, hosted CI or
deployment was run for this docs slice.
Reject an absent or invalid staged snapshot and require the freshly locked state generation and trust receipt to match the reviewed plugin before setting enablement. Preserve existing trust and revoke semantics. The filesystem check is point-in-time; automatic restoration and stage/GC races remain open.
Verified: existing stale-enable test passed on Mac (1/1); Codewhalebot Linux production plugin library 202 passed, 1 ignored with matching two source-file hashes and the same Cargo.lock on earlier base 1105bede; rustfmt and diff checks. No production stage-disappearance regression or exact final candidate was qualified.
Restore the founder-selected warm-paper website after reviewing the existing
Moda boards, stored homepage capture, Claude design files and historical water
source. Reuse the eight original hero paths from48140294df0 and its fading
footer current texture. Keep the original C-whale, current typography, genuine
terminal gallery, concise product copy, Computer Use and automatic releases.
Use instance-specific SVG filter IDs, static pointer-inert decoration and
forced-color hiding. Keep reading sections on paper and scope dark roles to
the actual terminal frame and closing sea. Recover earlier paper neutrals and
the readable1877c9-to0b48bb blue action ramp; retain the shared geometry tokens.
Use five primary nav links so translated desktop chrome fits at1024px without
shrinking controls; keep Changelog in the compact menu, release section and
footer. Correct the existing focus-role and paper-color contract assertions.
Consolidate the three superseded website changelog bullets into one accurate
entry and mechanically sync the embedded changelog.
Verified: scoped ESLint and TypeScript --noEmit --incremental false passed;
153 existing tests across16 relevant suites passed (the paper expectation was
corrected and its five-test role suite rerun); embedded changelog --check and
git diff --check passed. Real browser: EN desktop,390px mobile, Spanish1024px
single-row header, ZH dark, current terminal/CU versions, pointer-inert water,
forced-colors/reduced-motion behavior, no sampled page overflow or JS errors.
Native PNG color-profile verification also found that earlier JPEG previews
dropped Rec2020 ICC data and shifted blues; review artifacts now retain the
native profile. Existing Moda preview updated in42 free deterministic edits,
zero skipped ops and clean desktop/mobile renders. Historical audit and exact
receipts: CW/artifacts/website-repair-20261106/.
Final protected web validation/publication follows this source commit. No
Engine release qualification or publication is claimed.
Document the landed Engine catalog refresh and Runtime API projection so
clients can discover new models on supported routes without replacing the
binary. Explain exact-route refresh, freshness, retained snapshots, and the
existing desktop picker refresh and revision polling.
Carry the EN/ZH durable job receipt and implicit socket contract with native
source 821c478eb9. Describe Tinker beta configuration without implying live
provider qualification. Align the Chinese provider introduction with the
supported-model-list boundary. Keep release limits explicit for plugins,
platform qualification, history recovery, long sessions, and rollback.
Credit zhuowp's rate-limit recovery contribution and SparkofSpike's proxy
privacy report. Sync the embedded changelog and derived web metadata only
after Mistral guidance 07853c3266 landed with its live-conversation caveat.
Verified: derive-facts and check-facts passed; embedded changelog sync/check
and scoped diff whitespace passed. Contributor credit check found all 15
contributors credited, retaining its known Bot/co-author warning. All 22
v11 manifest inputs were independently checked immediately before staging;
six catalog/job API source paths matched committed main.
Retained development receipts cover nine controlled catalog API assertions,
eight mounted picker assertions, and a keyless public Models.dev fetch.
These are scoped development observations, not final package or provider
inference qualification. Proxy source matches the retained macOS 23/23
existing-test receipt; runtime log capture and other platforms are unqualified.
No new maintained tests, native builds, hosted CI, or deployment in this slice.
Point the existing Mistral provider at current Vibe Code key guidance and document setup, shared allowance and billing boundaries. Live use in Codewhale remains unverified.
Verified: existing Mistral provider metadata test 1/1 on Mac, provider-registry and example-config checks, and captured Mac CLI build. No live provider call was made.
Treat the advertised plugins area as an area even when the top-level plugins directory exists, while preserving explicit path handling. Found during Codewhalebot Linux review.
Verified shell syntax and a no-build mapping probe for all 44 advertised areas, explicit plugin paths, and supplied/inferred filters. No Cargo build was run.
Use the existing Runtime thread store and shell manager for keyed setup, run, archive and command admission. Persist intent before dispatch; exact retries return the same receipt, changed requests refuse, and unconfirmed outcomes fence new work and removal. Cache a positively observed child exit before output cleanup so Stop can persist its terminal receipt. Retain small terminal witnesses across output eviction.
Bind client recovery to the complete request fingerprint and canonical workspace/cwd, validate project policy against the approved root, and avoid nested blocking-pool filesystem work while holding admission. Shorten overlong implicit control sockets into a private stable endpoint without moving user data or changing explicit socket choices. The shared Runtime API also carries the reviewed catalog refresh projection from the already-landed model catalog source.
Verified a captured macOS development CLI build and exact source matching for 15 of these 16 paths; the newer jobs.rs was compiled and exercised in the Linux Boat candidate. Actual HTTP observations passed concurrent single-spawn/replay, mismatch/store/workspace guards, Stop and subsequent Run, prelaunch PTY refusal with restored mode, restart fences and private receipt content checks. Actual Engine plus transpiled TypeScript passed canonical alias binding, one shell spawn, same-key replay and a discarded real changed-env 409 that stayed unconfirmed. Separate prior paired GUI Run/output/Stop/reload and real output-eviction/deletion observations passed. Existing model API checks passed nine controlled cases.
No new product tests or code comments. These are scoped development/runtime receipts, not final-candidate packaging, Windows, provider inference or release qualification. Parent exit confirmation does not prove detached descendants are gone; path checks do not provide a directory-handle replacement guarantee, and archive recovery remains multi-phase work.
Omit malformed proxy values from MCP warnings and remove paths, queries, and fragments from parsed proxy log labels. Preserve proxy routing and authentication. Addresses the leak reported by SparkofSpike in #7233.
Verified: 23 existing proxy tests passed on macOS; rustfmt and git diff --check; independent source review. A separate runtime log-capture and other platforms remain unqualified.
Remove unused direct dependency declarations and their orphan lockfile edges while retaining the actual owners of the enabled features. No locked package versions are removed.
Verified: Mac development CLI build and isolated plugin/MCP fixture; separate locked Engine library check; locked offline metadata without dependencies; diff check. An earlier existing DSH test passed with identical dependency files but crossed other concurrent source changes. Test configurations and non-Mac targets remain unqualified.
Regenerate only the committed telemetry and Runtime API documentation metadata using the existing deriver against Git objects from 543b5b76db. This excludes all pending API, catalog, changelog and credit claims from the published tree.
Verified: independently derived projection is byte-identical to the website owner projection; the existing committed check-facts script passes with a Git-object filesystem and this single generated-file override. Only TELEMETRY.md and RUNTIME_API.md source entries differ. Pending v9 working metadata is retained unchanged (SHA256 84a248f8e6a7228739711850a6d0eb817f14c95a7036a62091b0025c6f37faf7). No source files, new tests, checkout, provider calls, build or deployment.
Give Computer Use and release history primary navigation, and show terminal and
Computer Use releases on the homepage and changelog. Read bounded, validated
published metadata for the two fixed repositories in parallel; exclude drafts,
prereleases and noncanonical release URLs. Keep download qualification on the
Computer Use setup surface and retain known releases when updates fail.
Refresh visible clients every five minutes and on return, using the original
check time so prefetched pages can refresh promptly. Provide independent RSS
and release-note links without requiring a website rebuild. Preserve newer
known terminal release metadata in the existing facts cron. Trim the changelog
introduction and export the two local translation catalogs.
Verified: scoped ESLint; TypeScript --noEmit --incremental false; 12 existing
Vitest suites, 132 tests passed; locale schema and local GT parity passed;
git diff --check; local releases API HTTP 200, both current releases, 36ms;
both canonical RSS feeds HTTP 200; responsive desktop/mobile, Chinese dark
mode, direct Computer Use navigation, actual download setup and release links.
Full protected web workflow and production publication follow the shared
source/docs metadata landing. This is not Engine release qualification.
Refuse a self-managed rollback to recorded versions older than the state migration boundary before replacing the executable. This is a conservative interim guard, not a state migration or protection against manual downgrades.
Verified: Mac development CLI build from captured source; 5 isolated rollback refusal/no-op cases with fixture preservation; rustfmt and git diff --check. Allowed rollback, other platforms, and real workspace migration remain unqualified.
Keep the existing Models.dev authority active after startup, serialize public refresh attempts, back off network failures by source, and preserve immediate local-file repair and last-good rows. Reject fresh-cache reuse after a source change, report expired live status as stale, and expose the existing live/cloud generation tuple for clients.
Verified on the frozen v3 development CLI 2a549fe8af9a00f992bbf019cc2b247aa41548f75d2955a227ca81260ee1da1b, source inventory cfdf8b4445ab501cb052f1b543b6b6f785d90310f735b92ae7bc09d9839ba1ca: 9 direct API and 8 mounted-renderer assertions passed, including manual/background discovery, exact-route refusal, retained rows, local repair, unchanged-page skip and preserved selection/search; zero browser errors. This used controlled catalog data and a synthetic key with proxy fallback disabled; no inference. Actual keyless public feed fetch passed with 235 provider catalogs and 8939 provider model rows. Focused formatting and whitespace checks passed.
The coordinated app-server response/query hunks, existing exact-route test adaptation, release notes and generated documentation remain with the shared integration owner. These observations qualify the catalog development slice, not installed packages, live model access or a complete release. No new tests or code comments.
Update the default ocean palette and reuse the ratatui motion primitive for a restrained working sweep when terminal capabilities and motion preferences allow it. Parsed Mac PTY frames showed the sweep across 18 working samples and static idle and settled samples; physical-terminal appearance remains unqualified.
Clamp a requested zero page size to one while preserving existing cursor compatibility. An isolated Mac stdio observation exercised zero, legacy and invalid cursors against three fixture threads.
Resolve staged Claude plugin MCP paths from the bundle root and retain the relative manifest path. Isolated Mac candidate smoke connected a local MCP ping before and after restart; a separate synthetic upgrade preserved trust and receipt bytes. No live provider was used.
Retain v2 and v3 PostHog forwarding rules while preventing schema 4 from expanding processor egress. Four existing test files passed 152 cases, TypeScript passed, and a local network-denied bundle passed 30 fixture comparisons. No deployment or production event was performed.
Recognize local Copilot and Codex bundle layouts and honor source revisions.
Reject unresolved remote subdirectories and require re-import for ambiguous
legacy listings, while preserving content hashes for installed plugin bundles.
Nine of nine isolated source-resolution and compatibility checks passed with
the frozen candidate. Three existing bundle hashes matched. The synthetic
runtime and inspected vendor catalogs do not qualify provider execution.
Saving a change writes catalog schema 2. A schema-1 runtime refuses that
file. Downgrade qualification remains a release blocker.
Apply the reviewed Moda desktop/mobile composition with the existing C-whale,
Shannon Sans and real interactive terminal captures. Use one coherent headline
in all18 locales. Give Computer Use a full-width band, show three concrete work
patterns, feature the published two-file skill tutorial and shorten the closing
install action. Keep released/source availability distinct.
Audit public instructions against published CLI0.10.2 and CU0.16.1: correct
hash-bound plugin trust, Workflow proposal/confirmation and limits/forms, Fleet
session workers versus durable ledger and explicit recovery, Lane control
surfaces, provider setup, Auto-Review user questions and conditional snapshot
restoration. Update CU setup/platform guidance across18 languages.
Fix lost dark-mode pins on locale navigation with the existing ThemeToggle
boundary: server-only bootstrap insertion and locale-keyed layout synchronization.
Remove unused auto-mode props/tooltip. Adjust existing assertions to follow the
actual session-worker command and moved bootstrap owner; no test cases added.
Verification:9 existing web suites110 passed. Focused ESLint covers all58
changed TS/TSX paths; TypeScript no-emit, locale schema, local EN/ZH GT and diff
checks pass. Actual browser desktop/mobile light/dark; EN/ZH repeated locale
changes and cold dark reload preserve theme, with a single bootstrap in HEAD
and no post-fix console errors. Windows installer/Fleet gallery controls work;
no sampled page overflow. Official CLI macOS arm64 SHA256 verified and9
isolated --help commands passed; no model/provider execution claimed.
Moda:201 editable nodes, desktop/mobile native PNG exports without warnings;
existing Codewhale kit, unchanged team visibility,0credits, no publication.
Local/source verification only. No hosted CI or website deploy initiated.
Reduce homepage main text from1647 to528 words in the rendered local page.
Remove duplicate setup/availability lists, unreleased changelog dump, repeated
product sections, footer provenance links and redundant kickers. Keep detailed
availability and Mac Computer Use limits on the product/setup pages, useful
capability links, install command, real demo provenance and contribution paths.
Replace the duplicate contributor manual with direct paths and the actual
contributor guide. Shorten shared EN/ZH copy and export local GT catalogs.
Delete unused content and the product page's unused facts fetch.
Verification: focused ESLint and tsc --noEmit pass;5 existing suites64 passed
(public copy/surface, docs IA, dictionaries, ocean). Retire the old homepage
onboarding layout case and redundant footer release-link assertion; actual
published release, MIT, provenance and policy checks remain. No new tests.
Initial batch2failed/63passed captured obsolete layout expectations. EN/ZH
browser review passed, sampled390px view has no page overflow. Screenshot
updated in artifacts/website-repair-20261106. No native build, CI or deployment.
Restore the website-specific Moda ocean roles after e9201f5d38 flattened
them to desktop gray. Retain shared typography, spacing, motion and elevation.
Bring Operate, multi-model Fleet, reusable Workflows, skills and independently
released Computer Use into the product story, informed by direct inspection
of OpenCode, Pi, Oh My Pi, Aider, Cursor and Claude Code.
Reuse real captured terminal views and shared contributor content, align
keyboard and visual order, correct Mac helper approval/setup and Windows
preview copy, and export the local EN/ZH website catalogs. Keep release,
source-candidate and captured development-demo identities separate.
Verification: final focused ESLint and tsc --noEmit pass. Existing public
copy/surface, terminal and Fleet cases: 4 files, 34 passed. Dictionary/CU/copy
batch: 3 files, 52 passed (overlaps public-copy). Palette/ocean: 2 files,
13 passed. Locale schema and local GT catalog check pass after export.
EN/ZH desktop/mobile, light/dark, install platform switch and Fleet view
observed; 8 linked local routes HTTP200. Two review findings fixed: guide
URLs and keyboard order. No new tests/comments, hosted CI or deployment.
Source/build/provider/release proof remain distinct. Moda CLI setup verified.
Offer the documented Inkling 2 Small serverless ID through the existing custom provider, skip undocumented model-list probes, and keep health unobserved until an actual request succeeds. Cost and live capabilities remain unverified.
Verified: provider registry drift check; 1 config descriptor, 1 Engine catalog and 1 pricing coverage case passed. A local health case with temporary extra assertions exercised normalized endpoint matching, unobserved health, and real mock-request recovery; those extra assertions were not retained. Mac development CLI built with one linker warning. No live Tinker call.
Reuse the existing DSH manifest admission check for both metadata and assets so an ordinary plugin cannot expose its staged files through the UI route.
Verified: isolated Mac runtime fixture: two non-DSH bundles returned 404; declared DSH metadata and client asset returned 200; its MCP connected and exposed ping. Authenticated asset transport and revocation remain open.
Show enabled trusted plugins as needing setup when their reviewed snapshot is missing or invalid, with a diagnostic instead of silent inactivity.
Verified: 201 plugin library checks passed with 1 ignored before the descriptor-only config change; a Mac local runtime fixture on the compiled batch confirmed the diagnostic before and after restart and an unchanged receipt. Automatic recovery remains unimplemented.
Share checkpoint admission between API shell job launch and managed worktree removal. Refuse removal for overlapping tracked running jobs and retain owned guards while spawned mutations finish after request cancellation.
Verified on Boat Linux: actual CLI build from 5296fa1c78 plus focused patch ac426a2946da; real API worktree 201, job 201, remove 409 worktree_busy with folder preserved, kill 200 Killed, remove 200 with folder absent. No unit suite or cancellation-race observation was run. Separate runtime managers, late independent subagents and escaped descendants remain outside this tracked-job guard.
Record unfinished Codex wire parity, DSH UI qualification and plugin snapshot recovery; refresh generated web and TUI data after main integration. Verified: release version gate (24 issue references), web check and cargo fmt --check.
Add the release-note receipt for the pending task wall-clock feature so the
feature commit's version-drift check is satisfied when the contributor PR is
updated. No product behavior changes.
npm --prefix web run prebuild after the worktree/changelog slice. Verification:
web check:facts passes; release metadata gate passes with 24 issue references
and versions/lockfile at 0.10.3.
Finish the app-server slice left uncommitted in the shared checkout. Git
stage/unstage/discard/commit/push/branch now honor ?thread_id= and act on that
thread's recorded workspace; snapshot list/restore gain the same scope. Add
GET/POST /v1/worktrees and POST /v1/worktrees/remove with managed-root
containment, check-ref-format validation, checked-out/existing/locked/dirty/
active-turn refusals, targeted removal of a missing worktree by exact path, and
.codewhale/worktrees in the repository info/exclude. Advertise the three new
capabilities and document them.
Verification: cargo check -p codewhale-app-server --lib passed (7m37s);
existing app-server git tests 26 passed, 0 failed; real app-server HTTP smoke
listed, created, listed and removed a managed worktree; release metadata gate
passed (23 issue references, versions/lockfile at 0.10.3).
Refs codewhale-hq/codewhale-app#3500.
Record the reviewed DSH dependency/client-UI feature from b0b2b9a335 and
regenerate the packaged TUI changelog. The release metadata gate now passes:
check-versions.sh --require-dated-release reports 23 linked issue references
checked and workspace/npm/lockfile all at 0.10.3.
Allow the existing 60-second network time tolerance on ChatGPT identity-token
expiry and not-before checks while keeping signature, issuer, audience, subject,
nonce and required-claim checks exact. A token with a 15-second future nbf now
verifies; the existing one-hour-invalid case still fails.
Verification: cargo test -p codewhale-runtime --lib
siwc_signed_identity_requires_signature_issuer_audience_expiry_nonce_and_account
passed (1 passed, 0 failed). Refs #7203.
#2: admit a reviewed DSH closure's own dependency tree on Node and Bun by
resolving bare imports and requiring the target to stay in the same hashed
receipt; stage node_modules through the importer (including hidden files and
contained .bin links); admit cjs/cts module entries; and refuse incompatible
engines.dsh ranges or dsh.bundle.platforms before conversion. UI-only bundles
now stage their source closure instead of being refused as 'nothing portable'.
#3 Engine side: expose a trusted+enabled plugin's dsh.client entry and assets
through two loopback-only public routes, with source/ fallback for converted
DSH bundles, 8 MiB bounds, confined paths, safe MIME/no-store/nosniff, and no
auth bypass beyond those two GET-only paths.
Verification: cargo check for codewhale-plugins/app-server; 30 published DSH
importer tests pass; Node/Bun resolver suites (49/50 host, 10 composition),
tsc, node build.mjs, rustfmt and git diff --check pass.
A Ctrl+V-family chord reaches both Terminal's paste action and Codewhale's
own paste shortcut, so the fixture payload arrived twice. Shift+Insert is
handled by Terminal and is not one of Codewhale's paste shortcuts, so the
acceptance test measures one delivery.
Verification: node --check and git diff --check pass.
Ctrl+Shift+V is already Terminal's default paste binding, so defining the
same chord as a fixture action pasted the 24-line payload twice on the pinned
Windows Terminal build. Bind the fixture to Ctrl+Shift+Alt+V instead.
Verification: node --check and git diff --check pass; the Windows runner job
is rerun against this candidate.
Refresh the measured Plan/Act/Operate prompt identities and tool counts after
present became eager, and keep all 55 metrics exactly at the new budget.
Verification: python3 scripts/check-runtime-contract-budget.py --update
--allow-increase, then the same checker without --update: PASS.
The resolved route config carries provider and model scope, not the operator's
sandbox choice. Installing an injected route replaced api_config and dropped
sandbox_mode/sandbox_network_access, so a read-only session started escalating
from workspace-write. Preserve those two session-level fields when applying
the route.
Verification: injected_model_sandbox_escalation_applies_only_after_exact_call_approval
and sandbox_escalation_fails_closed_when_the_posture_cannot_prompt both pass.
The workspace all-targets clippy gate rejects a one-item loop. Keep the
same one rejected case and baseline assertion without the loop.
Verification: cargo clippy --workspace --all-targets -- -D warnings passes.
Update the public tool surface for the eager present tool, fix the stale NSIS
removal assertion after the ownership-safe macro change, replace the literal
approval-bracket doc link and remaining private/unresolved links, and allow
the pre-existing argument-count and large-enum style lints that the current
toolchain promotes at workspace scope. Regenerate the web facts and agent docs.
Verification: npm test 74 files/771 tests, npm run check:web, cargo doc
--workspace --no-deps with RUSTDOCFLAGS=-Dwarnings, cargo clippy --workspace
--lib -D warnings, release helper tests 7, and check-versions
--require-dated-release all pass.
Name the 2026-11-06 release candidate and point its compare link at the
eventual v0.10.3 tag. Verification: check-versions.sh
--require-dated-release passes, including feature release-note receipts.
Forking, /undo and retry of any session that had received a workspace
drift notice refused with "Cannot identify an exact saved-history
boundary", leaving the thread uncuttable for good. The notices are
engine appends no turn record keeps, so the boundary walks read them
as prompts the records never saw. Recognizing the engine's own
<context_update> envelope lets those sessions fork again at the exact
turn a person chose, while a prompt that merely quotes a notice keeps
its turn.
Convert the remaining async callers of route validation, relay/remote-control
transactions and command filesystem work to the supervised owner boundary.
Compaction now awaits the async route install and the sync install path is
gone. Remote control gets async owner entry points for the TUI bridge and the
start/stop callers; sync APIs remain for sync/test callers. Branch, tree,
skill, plugin and memory command reads now use the existing owner helper.
Add present to the Plan builder and the ACP foreground allowlist, and update
the Plan prompt/catalog expectations.
Verification: cargo check for engine/tui/app-server; full test-binaries build;
route_runtime::tests 37, turn_route_plan::tests 3, relay 17, remote_control
78, commands::contract::tests 76, commands::groups::plugins 26,
commands::groups::skills 40, commands::groups::memory 22,
runtime_contract_tool_metric 1, prompt/event conformance and shell job tests
green; blocking budget 640/173.
The eager present tool is now part of the Act/Operate request head and is
absent from Plan's separate builder. Update the directly affected catalog
assertion and its Plan exception.
Verification: runtime_contract_tool_metric_uses_canonical_mode_surfaces
passed 1/1.
A deferred delivery tool is not a delivery surface: the model would have
to discover it before it could use it. Put present in the default active
native catalog and refresh the directly affected prompt/event goldens.
Plan mode keeps its separate builder and does not gain it.
Verification: conformance::prompt::model_visible_prefix_bytes_match_goldens
and conformance::events::golden_turn_events_match passed without update
mode.
Route session save/load/fork/import/export, Git snapshots, memory import,
and skill/plugin installer work through the existing supervised
owner_work boundary instead of doing it inline on the command path. The
sync command trait and bridge stay intact, results are still awaited
before state publication, and error/confirmation text is unchanged. This
does not make command dispatch non-blocking; it removes the filesystem,
Git and installer work from the runtime worker. Branch/tree reads and the
remaining skill/plugin scans are retained for a follow-up.
Verification: cargo test -p codewhale-tui --lib
session_lifecycle_regression_tests (32), session_export_regression_tests
(28), session_control_regression_tests (18),
session_structcopy_regression_tests (31), and
commands::debug_mutation_host_tests (38) passed. Refs #6553
Run the existing durable relay state transaction on the supervised blocking
owner while holding the relay scope lock, and await it before applying or
returning. The same single transaction still validates, writes atomically
and publishes memory last; prompt/interrupt and projection-cursor paths no
longer persist on the async worker. Sync controller entry points remain for
their current callers and are reported as remaining follow-up.
Verification: cargo test -p codewhale-app-server --lib
runtime_chat_relay::tests (17) and remote_control::tests (78) passed.
Refs #6553
Run the worktree add and its snapshot refresh on the supervised blocking
owner, publish the outcome through the existing modal tick seam, and keep
the pending state, selection clamp, current-worktree flags, and error text
unchanged. A blocking git create cannot be aborted after it starts; closing
the modal discards the result without leaving a detached async task.
Verification: cargo test -p codewhale-tui --lib worktree_manager (2 passed).
Refs #6553
Split client construction into pure route admission/validation, a captured
credential/certificate read step, and a pure apply step. Async route
preflight now runs only the blocking credential, redaction-secret and
SSL_CERT_FILE reads through owner_work, then re-admits the same identity
and endpoint before building the client. Sync preflight APIs stay intact
for sync callers; the TypeSafe decision client keeps the captured root
certificate instead of silently dropping SSL_CERT_FILE.
Verification: cargo check -p codewhale-engine; route_runtime::tests (37)
and turn_route_plan::tests (3) passed. Refs #6553
Add the shell close-out rule: collect still-relevant background tasks with
task_shell_wait before a final answer and cancel work that no longer
matters. Record a typed shell termination cause, exact start time and
producer-reported fact so a killed job is distinguishable from a failed
one. Add a read-only present tool that hashes existing workspace files and
returns an auditable handoff receipt without copying or moving them.
Register the present handoff as experimental and refresh the directly
affected prompt/event conformance goldens.
Verification: Engine background_shell_job_preserves_origin_identity,
drain_finished_jobs_reports_once, test_kill,
shell_completion_event_names_retrieve_tool_result,
shell_completion_status_is_concise_and_shell_handoff_is_untrusted,
shell_catalog_guidance_matches_execution, the two machine catalogs, both
subagent role catalogs, model_visible_tool_descriptions_name_no_vendor and
runtime_contract_tool_metric_uses_canonical_mode_surfaces all passed;
TUI shell_job_routing (2), shell_live_output_update (4), worktree_manager
(2), both conformance goldens, and feature_registry (2) passed.
The interactive TUI already locks YOLO when requirements constrain approval
or sandbox posture; ACP derived Bypass directly from config.yolo. Reuse the
same requirements-managed check so a managed approval list cannot be
sidestepped by serve --acp --full-access.
Verification: cargo test -p codewhale-app-server --lib
acp_approval_mode_derives_from_server_config (1) and
plan_and_operator_floor... (1). Refs #6992
The runtime sink refusal now retains the exact receipt and continues the
turn, so correct the release note that still says a persistence failure
stops the turn. Refs #6553
The NSIS installer records an install-root marker and the uninstaller
refuses to remove a root, shortcut or registration it cannot prove owned,
checking every delete and preserving retryable state on partial failure.
The archive installer verifies its receipt, refuses foreign same-named
destinations, and accepts only the exact pre-receipt 0.10.1/0.10.2 layout
for upgrade, without weakening staging, hashes, backup or rollback.
Verification: makensis 3.12 compiled codewhale.nsi with and without
COMPILED_HOST; isolated PowerShell 7.6.9 suite 55 assertions/0 failures;
git diff --check clean. Native Windows lifecycle remains pending.
Refs #7091
Urgent warning and error notices now truncate to the available notice
budget instead of disappearing when their first clause does not fit. This
makes the embedding-only local Ollama failure visible at 150 columns; the
remediation clause remains reachable through /models and the CLI.
Verification: cargo test -p codewhale-tui --lib phase_strip (43 passed).
Installed 0.10.3 receipts cover default election, chat-only picker, late
daemon recovery and embedding-only non-adoption under the existing binary.
Refs #5848
Reject oversized workflow source and args before copying or serializing,
bound source_path reads through a confined reader, check fleet depth before
descending the tree, and recognize only real declarative workflow calls
rather than prose decoys. Move file frecency onto one bounded background
worker with workspace-scoped keys, an atomic compaction rewrite and a
late-load repaint. OpenSandbox cancellation remains a protocol gap: its
current synchronous endpoint has no run id or cancel contract.
Verification: cargo test -p codewhale-workflow-js --test vm_tests (82);
cargo test -p codewhale-workflow --lib js_authoring:: (10), fleet_validation
(5); cargo test -p codewhale-engine --lib tools::workflow:: (147);
cargo test -p codewhale-tui --lib file_frecency:: (2), file_mention:: (43).
Blocking budget 640/173 within recorded budgets. Refs #6554
Compaction completion now carries the effective route, window and source,
configured versus effective threshold, calibration, pre-pass input and
live gate pressure, outcome and elapsed time. Failed and cancelled passes
record the same additive audit shape, including explicit zero usage.
The debug context-budget ledger now prints the configured threshold next
to the route-derived trigger so the two cannot be confused.
Verification: cargo test -p codewhale-engine --lib
compaction_completed_reports_complete_post_input_tokens (1),
failed_emergency_compaction... (1), emergency_recovery_preserves... (1);
cargo check -p codewhale-engine --lib clean. Refs #7133
The client owns the transport retry ladder; the compaction pass now makes
one summary call per attempt instead of layering three outer retries over
it. Keep the distinct quality and HTTP 413 recovery paths, route existing
transport retry observations to the compaction notice sink, and move owned
artifact serialization, redaction, publication and captured anchor reads
through owner_work.
Verification: cargo test -p codewhale-engine --lib
transient_failure_after_a_quality_retry_stops_without_replacement (1) and
compaction_persists_original_and_model_handoff_before_returning_replacement
(1). Refs #7153
The stall watchdog now starts after turn admission with that exact control
token and lives only for the admitted operation, so it cannot cancel a
stale or successor token. Capture the turn-meta git snapshot through
owner_work before prompt assembly, move tool-audit writes and catalog
publication out of async callers, and run Fleet state rebuilds through the
existing supervised blocking owner. Worktree flags are computed off the
render path.
Verification: cargo check -p codewhale-engine --lib; cargo test
-p codewhale-engine --lib turn_heartbeat::tests (4), engine_handle_cancel
(1), turn_metadata (20), emit_tool_audit (2), provider_lake::tests::models_update
(5), preview (78); cargo test -p codewhale-app-server --lib fleet_ (9);
cargo test -p codewhale-tui --lib stall_recovery... (1), worktree_manager (2).
Refs #6184#6553
A runtime usage sink refusal is bookkeeping, not a reason to lose the
person's answer. Keep the exact receipt for a later admitted flush, warn,
and continue the turn. The previous fatal branch killed a live 955-message
session after a cancelled subagent settlement.
Verification: cargo test -p codewhale-engine --lib runtime_usage (4 passed);
cargo check -p codewhale-engine --lib clean. No new test.
Adds the conversation-export row to docs/features.toml, an 'Exporting a conversation' section and slash-command row to docs/GUIDE.md, the matching zh_hans guide and Windows beginner pages, and the 0.10.3 CHANGELOG entries (crates/tui/CHANGELOG.md regenerated with scripts/sync-changelog.sh). web/data/features.generated.json and agent-docs.generated.json are regenerated with web/scripts/derive-facts.mjs; the web facts drift gate reports OK.
Checks: cargo test -p codewhale-tui --test feature_registry 2 passed, 0 failed; web vitest 771 passed across 74 files; scripts/preflight.sh --check OK (rustfmt, changelog slice, README translations, dead-code 137/137, blocking-calls 641 sites within budget).
Co-authored-by: Copilot App <[email protected]>
/export gains --format md|html|json, --no-tools and a position-free --force. 'file' with no path writes codewhale-<title-slug>-<timestamp>.<ext> into <codewhale_home>/exports, and the format is inferred from the extension; '~' now expands in paths. HTML is one self-contained page (no script, CSP default-src 'none'); JSON is a versioned envelope (codewhale-conversation-export v1) that keeps raw roles and flags omitted content. HTML and JSON are file-only; turn handoffs and clipboard exports stay Markdown, and the clipboard messages are unchanged.
The Markdown renderer drops the 'Content N' headings, labels tool-result carrier messages 'tool', and fences tool output so it can no longer forge a heading or a turn. Breaking for scripts: a trailing --force is now a flag rather than part of the path, and the tool-result role label changed from 'user' to 'tool' in Markdown and HTML (JSON keeps the raw 'user').
Contract: ExportMetadata gains title (None when the session is untitled or still the 'New Session' placeholder) and CommandSessionExportContext gains default_export_path(file_name), which the host resolves inside <home>/exports after creating and canonicalizing it.
/share now renders through the same HTML renderer; its private render_session_html, html_escape and count_redactions are removed (replaced by export_html::render and export::count_redactions).
Tests: codewhale-command-contract 79 passed, 0 failed; codewhale-tui commands:: 1213 passed, 0 failed (export, share, regression and surface suites plus the re-baselined goldens). The feature-gated session_acceptance suite was not run. Real md/html/json output through the adapter was inspected: HTML is escaped with a no-script CSP, JSON parses, files are mode 0600.
Co-authored-by: Copilot App <[email protected]>
Recheck the public total timeout before another operation, including after
time spent in callbacks or retry receipt delivery. Preserve the original
typed error and exact attempt count. Clarify the independent rate-limit
configuration, validation bounds and safe pre-dispatch HTTP/1.1 fallback.
Merge upstream main at 13760312. Keep the precise Responses unknown-outcome
test names with main's exact one-attempt and typed 503/499 assertions.
Validation on Windows, rustc 1.99.1, locked dependencies:
- Candidate-source Engine selections: 47 tests passed
- Separate public-API real-clock deadline probe: 1 passed
- Three causal negative controls failed as expected; exact source restored
- Original candidate Runtime retry status: 7 passed
- Full formatting, version consistency, whitespace and dead-code checks passed
- Strict/diagnostic Clippy retain attributed existing dependency and Windows
lint failures. Primary Runtime passed with the recorded decoder allowance;
primary Engine lib/tests report only the two existing Windows lint sites.
- Windows blocking checker retains its path-key mismatch; normalized complete
measurements have no excess. This is not an official checker or CI pass.
The Engine validation copy has test-only tracing and the local probe;
production and lockfile bytes match the reviewed candidate. Validation
instrumentation stays outside the product tree; contributor changes do not
repair unrelated lints.
Signed-off-by: z27014 <[email protected]>
Add stable tencent/hy4 to the OpenRouter catalog with reviewed limits and aliases, and a Tencent TokenHub compatible descriptor using hy4 and TENCENT_API_KEY. Direct TokenHub pricing remains explicitly unknown rather than inheriting OpenRouter rates. Replace the duplicated OpenRouter alias match with the reviewed compatibility table (102 existing aliases verified unchanged). Catalog relock also carries upstream models.dev price and metadata updates.
Validation: focused config/engine/tui nextest 559 run, 557 passed before updating two stale count fixtures, which then passed with feature_registry (4/4); catalog script tests 18 OK; render --check, provider registry, preflight, fmt passed; web vitest 771/771. No paid Tencent call was made.
Co-authored-by: Copilot App <[email protected]>
Keep 0.10.3 as an unreleased candidate, credit its current contributors and helpers consistently, and ignore the Copilot bot in the contributor checker. No release is published.
Validation: web vitest 74 files, 771 tests passed; contributor checker reports all 14 historical contributors represented.
Co-authored-by: Copilot App <[email protected]>
Apply SparkofSpike's exact-first selection proposal from issue #7214, reported by liuyy2. Try the configured id and wire id exactly before case-insensitive compatibility matching; retain the existing insertion guard. Refs #7214.
Validation: existing provider-picker checks passed in the focused 538 passed, 0 failed run. Also passed unchanged in the HY4 focused run; actual Electron picker/save/reopen qualification is not claimed.
Co-authored-by: Copilot App <[email protected]>
Remove the redundant raw-filesystem fallback introduced by #7218. The existing clipboard_image_target already opens a relocated user state root safely. Preserve atomic private writes and link confinement instead of increasing the blocking-call budget.
Validation: existing clipboard and confined-file checks are included in the focused 538 passed, 0 failed run. Blocking-call scanner: 641 sites across 173 files, within the reduced budget. Native Windows distribution qualification remains separate.
Co-authored-by: Copilot App <[email protected]>
Reuse the config endpoint owner for the reviewed DeepSeek published-price family at both capture and replay. Keep exact quote fingerprints, provider identity, wire model and dispatch time guards; do not broaden regional or subscription pricing authority. Recognize Anthropic /v1 PAYG and preserve distinct missing-outcome, missing-usage and legacy-coverage labels in all locales. Historical receipts without a frozen quote remain unknown.
Validation: scripts/dev-test.sh engine with config, localization, tui and util pricing/route/usage/clipboard/picker/file selectors: Summary: 538 tests run: 538 passed, 13195 skipped. Verified against the pre-HY4 source slice; no provider inference or published-release claim.
Co-authored-by: Copilot App <[email protected]>
reqwest snapshots HTTP_PROXY/HTTPS_PROXY/ALL_PROXY when a client is built, so a
session started behind a loopback proxy (Clash, v2rayN, sing-box) kept dialing
the dead port after the proxy closed: every request failed, including ones to
providers that need no proxy at all, until Codewhale restarted.
Install a custom proxy route that re-probes each configured loopback proxy in
the background and bypasses the proxy while its port refuses connections.
no_proxy() runs first, so the route is the only proxy source and a declined
request cannot fall back to the address reqwest snapshotted.
Only a definite ECONNREFUSED from every resolved address moves a proxy to
direct; a timeout, an fd limit or a resolver failure leaves the previous state,
since routing direct on that evidence would put traffic on a path the operator
deliberately avoided. Reachability is tracked per proxy, so a live HTTP_PROXY
does not keep a dead HTTPS_PROXY in the path, while a remote proxy in the same
configuration is routed through as before and never diverted.
IPv6 and IPv4-mapped IPv6 loopback proxies are watched too: Url::host_str keeps
the brackets, so the address is unwrapped before it is matched and probed, and a
portless socks proxy defaults to 1080 as reqwest does rather than silently
disabling the fallback.
The engine's model, search, vision, finance and catalog clients all start from
crate::platform_client_builder(), and the TUI balance poll and the app-server
relay use install_loopback_proxy() too. Half-fixing this would read as a tool
bug once the model kept working. Reviewed plugin remotes and guarded fetches
keep their own no-proxy builder on purpose.
Windows needs about two seconds to report a refused loopback connection, so the
probe bound is 4s: a shorter one only ever sees a timeout and the fallback would
never engage on the platform the report came from.
Set CODEWHALE_LOCAL_PROXY_FALLBACK=0 for the previous behaviour. The proxy
environment is read once, when the first client is built. Known limitations:
reachability is a TCP connect rather than a proxy handshake, detection takes a
few seconds so a request in that gap can still fail once, and going direct
leaves from the machine's own address.
Tests cover the refused/returning transitions, per-proxy isolation, proxy
precedence, IPv6 and IPv4-mapped loopback, a portless socks default, remote and
mixed configurations, NO_PROXY whitespace and '*', credential survival, the
install order, and end-to-end requests over a real reqwest client.
The #7216 repair (eb17ae0ec1: /patch-undo honors turn_id, answers 409 undo_selection_changed, advertises thread_patch_undo_turn_id) never reached the 0.10.3 notes and its reporter was uncredited. Add the Fixed bullet and credit @soarkit on the three surfaces cw-land names: the changelog Contributors block, docs/CONTRIBUTORS.md and UNRELEASED_CONTRIBUTORS. crates/tui/CHANGELOG.md is regenerated.
The 0.10.3 section also had no opening paragraph. Add the 0.9.3 source-candidate sentence: web/lib/public-surface-contract.test.ts needs 'v0.10.3 source candidate' before the tag and 'Codewhale v0.10.3' after it, and the changelog had neither. Replace it with the release summary at the cut (precedent 3665adde81).
Checks: sync-changelog --check up to date; check-versions 'Version state OK: workspace=0.10.3'; check-contributor-credit 'Every contributor in the window is credited on all three surfaces'; check-feature-release-notes OK (21 linked issue references in v0.10.2..HEAD); web changelog.test.ts passes (vitest: 22 passed, 2 failed across 3 files). The 2 failures predate this change and are cut-time gates: public-copy needs the v0.10.3 contributor band and promoted RELEASE_CONTRIBUTORS, and the pre-tag guard rejects [Unreleased] compare/v0.10.3...HEAD (97e073ac79).
Refs #7216
Co-authored-by: Copilot App <[email protected]>
clippy::while_let_loop (denied by -D warnings) failed Lint on the
loop/match in ImagePreviews::poll at image_preview.rs:267. Both
TryRecvError arms only broke out of the loop, so `while let Ok(..)` is the
same behaviour and the import is no longer needed.
Co-authored-by: Copilot App <[email protected]>
Read::take consumes the handle by value, so the binding never needs to be
mutable. Windows CI compiles this cfg(windows) path with -D warnings and
failed on unused_mut at clipboard.rs:1126 (Test (windows-latest)). Not
compiled locally: the path is Windows-only.
Co-authored-by: Copilot App <[email protected]>
Harvested from PR #7208 and #7210 by @gaord, and #7225, #7226 and #7228 by
@asto18089, each with the contributor's original commit kept.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Retrying a follow-up on an interrupted agent id whose continuation
successor already exists returned an unconditional delivered=true,
resumed=true receipt: continue_child_from_user hardcoded both flags in
its Interrupted/Completed arm, so a follow-up that was merely queued to
an already-running successor — or answered by a settled successor's
existing result — was reported as a fresh checkpoint re-dispatch that
never happened. The TUI only moved focus on resumed receipts, so focus
stayed on the dead original agent even though the successor now carries
the conversation.
The engine now honors its documented field semantics ("Whether a new
agent loop was re-dispatched from the checkpoint"):
resume_from_checkpoint_with_policy returns a ParentMailReceipt that
distinguishes the three continuation shapes, and continue_child_from_user
derives the flags from it:
- fresh re-dispatch from the checkpoint: resumed=true, delivered=true;
- follow-up queued to the already-running successor: resumed=false and
delivered = woke && queue_depth == 0 — the same delivery criterion
followup_child itself applies, since the new text is last in the FIFO
batch and only an empty queue after a successful wake means this
message was actually sent (the direct Running arm now applies the
same strict criterion);
- settled Completed successor: resumed=false, delivered=true, target =
that successor, whose existing result carries the follow-up. A
settled Failed/Cancelled/BudgetExhausted successor instead reports
delivered=false with a note naming its status, so a follow-up that
sits in no transcript and that nothing will ever answer is never
presented as delivered.
apply_follow_up_receipt in the TUI broadens its focus guard to
(resumed || delivered) && target != agent_id so focus follows the agent
that will actually answer, carrying the local user echoes with it, and
the toast names the successor. A delivered=false receipt (or an error)
still keeps focus unchanged and reports the failure note, so the
Failed-successor path lands in the warning arm with the honest status
note.
Disclosure: a delivery to a settled Completed successor still reuses
the pre-existing "Queued for {agent} — it reads it next round" toast
message id, whose wording does not describe a result-carried delivery;
replacing it with a dedicated message means i18n churn across all 15
language packs and is left as follow-up polish, not claimed fixed here.
Red/green evidence: the new engine test
user_follow_up_to_running_existing_successor_reports_delivery_without_resume
panicked on base (the successor-reuse path reported resumed=true) and
passes after the engine fix; the TUI test
delivered_existing_successor_moves_focus_and_names_the_actual_recipient
failed on base and passes with the broadened guard. Targeted
agent_focus/follow_up run: 23 passed, 0 failed. Full codewhale-engine
--lib: 6968 passed, 86 failed, 13 ignored; the failure set matches a
base (stash) run (85 common pre-existing machine failures; every
differing test passes in isolation, re-verified). All
resume_from_checkpoint* and continue_child_from_user* engine tests pass.
After the settled-status fix, targeted codewhale-engine --lib
user_follow_up: 5 passed, 0 failed, including
user_follow_up_to_failed_existing_successor_reports_undelivered_with_status_note
(a settled Failed successor as continuation target reports delivered=false
with the status named), and the targeted agent_focus/follow_up run stayed
at 23 passed, 0 failed.
Signed-off-by: asto18089 <[email protected]>
rustfmt --edition 2024 applied to the touched Rust files; their check failed on formatting only.
Harvested from PR #7228 by @asto18089
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
image_analyze had the same asymmetry the write lane had, on its own
read-only lane: the absolute spelling of an in-workspace file was
refused outright while the relative form of the same file succeeded.
resolve_image_path joined relative inputs onto the workspace but
hard-refused every absolute spelling before any containment check, so a
model handed an absolute receipt path — screenshot and attachment
receipts hand the model absolute paths — paid one failed call to learn
the relative form of the same file.
The schema never justified the refusal: the image_path field is
described as "Path to the image file to analyze"
(crates/engine/src/vision/tools.rs). Unlike the write and edit tools,
whose descriptions explicitly say "(relative or absolute)", it says
nothing about spelling at all — so refusing absolute spellings was an
undocumented narrowing of an underspecified input, not a pinned
contract.
Absolute spellings now resolve through the existing canonical
containment check, the same one relative spellings always went through:
an absolute spelling that canonicalizes inside the workspace resolves to
exactly what its relative form resolves to and is admitted; one that
canonicalizes outside still gets the containment refusal ("image_path
must resolve within the workspace and cannot escape it."). The absolute
branch applies the same lexical `..` guard the relative branch applies
(minus Prefix/RootDir, inherent to any valid absolute spelling), judged
before canonicalize so a missing escaping target still gets the boundary
message instead of a resolve error. The read-only envelope and the
symlink-resolves-outside refusal are unchanged. The test comments are
aligned with this invariant — in particular the trust-boundary pin in
execute_rejects_absolute_path, which previously read as refusing all
absolute spellings and now states that outside is rejected while inside
is admitted through the same canonical containment as the relative
spelling.
Verified: ./scripts/dev-cargo.sh test -p codewhale-engine --lib
vision::tools (17 passed; 7050 filtered out), including the new
resolve_image_path_accepts_absolute_paths_inside_the_workspace and the
pinned execute_rejects_absolute_path,
execute_rejects_parent_dir_traversal, and
execute_rejects_symlink_that_resolves_outside_workspace refusals
(resolve_image_path_accepts_windows_absolute_spellings_inside_the_
workspace is cfg(windows)-gated and runs on Windows only); the broader
./scripts/dev-cargo.sh test -p codewhale-engine --lib vision filter
(43 passed; 7024 filtered out — the "vision" substring also matches
"revision"-named tests) passes with 0 failures. No dependency on the
subagent write-claim change: vision resolves containment with its own
canonicalize-and-starts_with check, so this commit stands alone on base
7659d0a26.
Signed-off-by: asto18089 <[email protected]>
rustfmt --edition 2024 applied to the touched Rust files; their check failed on formatting only.
Harvested from PR #7226 by @asto18089
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Three classes of stale user-facing copy had drifted from en.json (the
single source of truth) in the shipped non-English locale packs:
1. Stale alternate-jump copy (12 packs): KbAltJumpPlanAgentYolo still
described the deleted Plan / Work / Operate alternate-jump in ca,
de, es-419, fr, hi, id, ja, ko, pt-BR, ru, uk, and vi. It now
translates the current behavior: jump to Plan/Work, or request
Full Access as a legacy alias. zh-Hans/zh-Hant were already correct.
2. Rail residue (87 keys): the rail UI was renamed to the workbar, but
rail words survived in ca (9), es-419 (9), fr (9), hi (9), id (9),
ja (10), ko (10), pt-BR (10), vi (9), de (1), ru (1), and uk (1).
Each key followed the current en.json value: keys whose English
value still says "workbar" now use the pack's workbar term (barra
de treball / Leiste / barra de trabajo / barre de travail /
वर्क बार / bilah kerja / ワークバー / 작업 바 / barra de trabalho /
робоча(я) панель / thanh làm việc), while keys whose English value
now talks about a dashed reasoning line or side placements
(ConfigChoiceDetailThinkingHighlightOff, ConfigHintThinkingHighlight,
ConfigHintWorkSurfacePlacement) follow that meaning instead of a
mechanical workbar substitution.
3. uk turn/step conflation (14 keys): uk said "крок" (step) where the
English counterpart says "turn" - KbReasoningDetail,
CmdTurnInspectDescription, KbTurnInspector, KbSteerCurrentTurn,
KbSelectedDetails, ModelPickerAuto{Network,Local}Hint, CmdCache*,
CmdTokensReport, and TelemetryNotice{,Compact}Body - now uses the
established "хід", matching existing uk usage in ApprovalStopBody,
ExecAfterHelp, and CmdCacheUnpricedNote. Keys where en says "step"
keep "крок".
en.json is untouched and byte-identical; key sets and ordering are
unchanged in every pack; all placeholders are preserved.
Gate: new test stale_mode_jump_and_rail_copy_is_swept_from_non_
english_locales asserts (a) no pack matches the stale jump markers
(Plan/Work/Operate, Plan-/Work-/Operate, 계획/실행/운영) or any single
residue mode ("operate", ko "운영"), with placeholder parity against
en for KbAltJumpPlanAgentYolo, (b) no rail-word residue remains in the
10 swept keys (id matches the English loanword "rail" too), with
placeholder parity against en, and (c) uk KbSteerCurrentTurn and
CmdTurnInspectDescription keep the хід/ходу turn stems instead of
крок. Verified red on base (stash of locale JSONs: FAILED - "ja still
describes the deleted Plan / Work / Operate alternate-jump") and green
after the sweep; the hardened assertions bite (id KbFocusSidebar
reverted to "panel rail" and uk KbSteerCurrentTurn to крок each failed
the gate, then were restored). Full suite:
cargo test -p codewhale-localization --lib --locked -> 55 passed, 0
failed, including shipped_complete_packs_have_raw_key_parity_with_
english and the placeholder-parity gates.
Signed-off-by: asto18089 <[email protected]>
rustfmt --edition 2024 applied to the touched Rust files; their check failed on formatting only.
Harvested from PR #7225 by @asto18089
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
WeCom stops accepting updates to a stream message after ~10 minutes and
answers errcode 846608. A turn that streams for longer lost every
remaining update, so the phone never saw the final result. Wrap the
replyStream calls in a helper that finalizes and reopens the stream near
the cap and reopens once when an update is rejected.
Conflicts with the merged #7211/#7212 and the harvested #7208 (same exports and tests in lib.mjs and lib.test.mjs) were resolved by keeping every side; node --check passes on both sources and npm test in integrations/wecom-bridge passes 22 of 22.
Harvested from PR #7210 by @gaord
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
WeCom SDK rejections arrive as plain {errcode, errmsg} objects; the
previous formatter stringified them into "[object Object]", so phone
users saw an opaque failure with no reason. Render errcode/errmsg (and
message/JSON fallbacks) so the reply names the actual cause.
Conflicts with the merged #7211 and #7212 (both add exports and tests in the same files) were resolved by keeping both sides; node --test (npm test in integrations/wecom-bridge) passes 20 of 20 after the merge.
Harvested from PR #7208 by @gaord
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
child_wall_time_is_unbounded_unless_an_owner_sets_it cancels the parent's token
on purpose so no provider request runs. run_prepared_subagent_task selects on
that token first, so a child that is polled before AgentTool start commits its
launch exits and drops the receiver, and start reports "prepared child
execution owner closed". That is the intended behavior for a cancelled parent,
but the test unwrapped the result and failed whenever a yield let the child run
first (blocked #7211, #7217, #7218, #7228, #7229 on ubuntu and windows). The
test now retries that one error up to 50 times and fails on any other error.
Verified: the test passed 25 of 25 consecutive runs after the change. It was not
run in a loop before the change, so the prior rate is unmeasured here. No hosted
CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
auto_review_force_prompt_is_denied_without_opening_a_modal read the thread's
events and the pending-approval count as soon as the mock engine saw the deny.
The mock outcome is observable when the decision is committed, but the runtime
appends approval.decided and calls cancel_pending_approval after that, so the
test could look first and fail with "auto-review hold must emit
approval.decided". It failed the Safety gate on several PRs and #7213 reported
2 failures in 5 runs on an unrelated change. The product order (receipt, then
event, then acknowledge) is intended, so the test now polls for the event with
the pending count at 0, within 2 seconds.
Verified: the test passed 15 of 15 consecutive runs after the change. The failure
rate before the change was not measured here, only taken from #7213's report.
No hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
#7213 added workspace.canonicalize() inside the blocking search closure, which
is why 5c154502b7 recorded a path_canonicalize site for file_search.rs. The
workspace is now canonicalized with tokio::fs::canonicalize on the async side
and passed in, so the site is gone and the counter returns to 0.
Verified: scripts/dev-test.sh engine file_search 11/11 passed;
check-blocking-calls-budget.py (641 sites across 173 files, within budget, file
clean after --update); rustfmt --edition 2024 --check clean. The edit was
written by the in-app agent at 17:31 and proven here. No hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A turn that had recorded 64 sourced usage receipts failed on the next one with
"captured usage sink did not acknowledge its source; exact receipt retained",
and the person lost the answer. Founder direction: no cap at all.
MAX_ROUTED_USAGE_RECORDS_PER_TURN is deleted with every branch that read it:
the source-receipt capacity bail, the routed/drop-record and decision-receipt
overflow markers, the diagnostics membership guard, both validate() bounds, and
the partition spill in append_owned_usage_source_record, which nothing can
reach once there is no bound (its four callers use append_usage_source_record).
Reading and settling existing partition records is unchanged. The two tests
that asserted the bound are rewritten or removed.
Together with the preceding revert, a sink refusal that is not about capacity
(owner lock loss, thread mismatch, load or save failure) is fatal again.
Verified locally on this tree: scripts/dev-test.sh engine
routed_usage_append_has_no_cap terminal_settlement_preserves_late_sink_receipts
2/2 passed; engine runtime_threads::tests:: usage partition 424/424 passed;
rustfmt --edition 2024 --check clean on the three files. The in-app agent's
uncommitted file_search.rs edit was in the working tree during both builds.
Not verified: no turn has been run past 64 requests against a provider. The
turn record is still rewritten on every request, so a very long turn writes more
per request; moving receipts out of the record is the larger change in
artifacts/handoff-20261105/USAGE-LEDGER-SIMPLIFICATION.md. No hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Landing preflight on main still failed one counter: #7213 (a049aa62f1) added
`workspace.canonicalize()` inside the blocking search closure in
crates/engine/src/tools/file_search.rs, while the budget records 0. Record the
actual site so the gate reflects the tree again. The proper fix canonicalizes
on the async side before the closure (an edit is in flight in this checkout,
unverified at commit time); when it lands this counter returns to 0 with
--update.
Verified: python3 scripts/check-blocking-calls-budget.py (642 sites across 174
files, within budget).
A long turn died at exactly 64 model requests with "provider source admission
failed: captured usage sink did not acknowledge its source; exact receipt
retained". Two turns in the live profile show it (turn_2d28ea1cbd284bb on
2026-11-03 and turn_ee2e1f69448e45c on 2026-11-05, 457 s): both carry
routed_usage_source_ids = 64 and source_usage_records = 64, equal to
MAX_ROUTED_USAGE_RECORDS_PER_TURN, routed_usage_dropped_records = 1, and
modelRequestsStarted = 64. Append refused the 65th source, the sink returned
false, publish raised, admit_dispatch propagated, and model_step made the whole
turn fail. The person lost the answer because a bookkeeping ledger filled up.
Three parts, because the limit has a real job — the turn record is rewritten on
every model request, so an unbounded ledger makes those writes quadratic:
1. cost_status.rs publish: when the sink cannot acknowledge, retain the exact
receipt, warn, and return Ok(()). The Session destination already behaved
this way; Runtime was the outlier. The receipt is already in the journal for
a later admitted flush, so nothing is lost and the turn continues.
2. MAX_ROUTED_USAGE_RECORDS_PER_TURN 64 -> 4096. It also bounds
decision_receipts and a hot-path guard, so it stays a constant.
3. The one existing test whose loop hardcoded 0..90 now runs to
MAX_ROUTED_USAGE_RECORDS_PER_TURN + 26 so it can still reach the bound.
Verified: `cargo check -p codewhale-engine --locked` clean (1m36s);
`dev-test.sh engine routed_usage_append_is_bounded` passes 1/1 (7078 skipped)
at the raised bound. Both runs include a peer's uncommitted edits that were
present in this checkout at the time.
Not verified: no turn has been run past 64 requests since, so the end-to-end
"a long turn now finishes" observation is still owed. This changes how usage is
accounted for a turn that overflows: the ledger records an explicit
incompleteness marker and the receipt is settled later, so a reader of that
turn sees fewer inline records and must consult the retained journal.
Landing preflight went red on main for two counters that the tree already
exceeds: crates/util/src/files.rs path_canonicalize 2 -> 5 and
crates/tui/src/lib.rs std_fs 35 -> 36. The new canonicalize calls come from
the home-workspace state exemption (0ce030840b, 5ad3d821c7, 8f82d02e78);
both files are synchronous path helpers with no async context to move the work
off, and the other calls were already present when the ratchet was recorded.
--update rewrites only these two numbers (641 sites across 173 files), so no
other drift is folded in.
Verified: python3 scripts/check-blocking-calls-budget.py passes (all other
budgets unchanged); no test run needed for a recorded counter.
Adds a Fixed entry and Contributors credit for #7223 (asto18089), merged as
d4fc3646c5, and regenerates crates/tui/CHANGELOG.md with
scripts/sync-changelog.sh.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A turn that had admitted MAX_ROUTED_USAGE_RECORDS_PER_TURN (64) sourced
receipts failed on the next settled receipt: append_usage_source_record
refused capacity, the Runtime usage sink returned false, publish retained the
receipt and returned "captured usage sink did not acknowledge its source;
exact receipt retained", and the end-of-turn settlement downgraded a completed
turn to Failed with "Turn usage remains unacknowledged: ...". Once refused
receipts filled the per-owner journal, the next request failed before it was
dispatched with "native usage journal capacity reached before dispatch".
The partition records already exist for this: a receipt past the turn's bound
is written to its own turn record and summed into the thread totals, so the
parent record stays bounded while the totals stay exact. That path was
unreachable once routed_usage_source_ids and source_usage_records disagreed
(the model-request diagnostics path records membership without a receipt) or
before the first settled admission. Test the bound itself instead, so a new
settled receipt at the bound always partitions. An inherited turn still
refuses to create an original-owner partition, and every non-capacity sink
refusal (owner lock loss, thread mismatch, load failure, save failure) stays
fatal.
A broader variant - raise the bound to 4096 and treat every sink refusal as
non-fatal - was reverted. It would let those integrity failures continue with
unrecorded spend, and raising the bound only moves the wall because the turn
record is rewritten on every request. Reference behavior (Codex, Grok Build:
running totals, warn-and-continue on persistence failure) and our extra
exactly-once/budget guarantees are written up in
artifacts/handoff-20261105/ENGINE-USAGE-CAP-REFS.md.
Verified: scripts/dev-cargo.sh check -p codewhale-engine --lib --locked
(Finished in 7m 46s, no errors); rustfmt --edition 2024 --check clean. The
focused nextest runs (routed_usage_append_is_bounded,
terminal_settlement_preserves_late_sink_receipts) were started twice and both
times invalidated by concurrent edits from another agent in this shared
checkout, so they are not claimed. No existing test covers
overflow-to-partition, and no new test was written (AGENTS.md).
Adds an Added entry for #7211 (gaord) and a Fixed entry for #7207
(SparkofSpike) with Contributors credit, and regenerates crates/tui/CHANGELOG.md
with scripts/sync-changelog.sh.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds Fixed entries and Contributors credit for #7205 (Lstarsky0) and #7229
(asto18089), and regenerates crates/tui/CHANGELOG.md with
scripts/sync-changelog.sh.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds Fixed entries and Contributors credit for #7215 (Lstarsky0) and #7227
(asto18089), merged as d3e2edf231 and f44525ae34, and regenerates
crates/tui/CHANGELOG.md with scripts/sync-changelog.sh.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces; sync-changelog rewrote only the TUI
slice. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
crates/tui/CHANGELOG.md is derived from CHANGELOG.md by scripts/sync-changelog.sh
and I edited CHANGELOG.md for the contributor credits without running it, which
turned the Landing preflight's 'TUI changelog slice' check red on main.
Verified: scripts/sync-changelog.sh rewrote only crates/tui/CHANGELOG.md. The
blocking-calls budget failure on main (file_search.rs, from #7213) is separate
and not addressed here.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the Added entry and Contributors credit for #7212 (gaord), merged as
0ba20139e7.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the Fixed entry and Contributors credit for #7209 (gaord), merged as
51cc867aa5.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. Docs only; no build or test run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Extends the issue triage workflow (the predecessor it replaces: its area and os
rules, which targeted label names that did not exist on the repository, so they
never fired) to pull_request_target. Pull requests now get area labels from the
files they change (including the desktop, web and mobile paths the apps will
land under), a type label from the conventional-commit title prefix, and
contributor:external for authors outside the team. It adds labels only, and only
ones that already exist; nothing is enforced and nothing is removed.
Issue rules gain desktop, web, mobile, accessibility, freebsd and ohos matches;
the sandbox hint now maps to area:sandbox. CONTRIBUTING.md documents the label
families.
Repository labels changed alongside this commit (applied with gh label edit /
create, history preserved on rename): tui, mcp, tools, plugins, providers,
packaging, runtime-api, remote-control, ci, sandbox, subagents, localization ->
area:*; windows, linux, macos -> os:*; created area:core, area:state,
area:desktop, area:web, area:mobile, os:freebsd, os:ohos, lang:zh,
priority:p0/p1/p2, accessibility, contributor:external. No workflow, template or
script referenced the renamed names; stale.yml's security label is untouched.
Verified: actionlint on triage.yml clean; the script body executed in node
against nine mocked events (PR by path, docs-only, tools-in-engine, engine core,
over-broad PR, future desktop/web paths, bot, issue with desktop+Windows, issue
with accessibility+mobile) and produced the expected labels. Not verified: a live
GitHub run (pull_request_target runs from the base branch only after this lands).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds Fixed entries and Contributors-block credit for #7213 (Lstarsky0), #7224
and #7222 (asto18089), merged as merge commits a049aa62f1, 671f50977c and
b0be3cb761. Both handles were already present in web/lib/release-credits.ts.
Verified: scripts/check-contributor-credit.py reports every contributor in the
window credited on all three surfaces. No build or test run (docs only).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
GET /v1/runtime/info capabilities gain thread_scoped_reads (default false for
older payloads) so clients can require it before sending thread_id to the
git/diff/file read routes: older Engines reject the unknown query parameter.
Schema, TypeScript and SDK declarations are regenerated with
codewhale-app-server-schema --write (the --check passes). RUNTIME_API.md
documents the capability, status_unavailable on GET /v1/workspace/status and
GET /v1/git, and the filter-driver scope rule (repository-defined drivers are
neutralized on status reads; user global/system drivers such as Git LFS keep
working).
Verified (local, source only): full workspace nextest 19068 passed with this
change; schema --check clean. Not verified: the desktop consuming the flag
(next), docs/zh_hans/RUNTIME_API.md has no matching section yet and needs
alignment at release.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The CI Lint job (clippy --workspace --all-targets --all-features with
uninlined_format_args, too_many_arguments and unnecessary_map_or allowed) failed
with 22 errors in codewhale-engine plus the ones hidden behind them in app-server,
tui and cli; Test (windows) stopped at two -D warnings unused imports in
codewhale-app-server. Mechanical fixes were applied with clippy --fix (collapsible
if/let chains, needless borrows, unneeded `..` patterns, `?`, is_multiple_of).
By hand: the mock-approval field type gets a MockApprovalPublications alias;
MailboxMessage::TokenUsage.record is Option<Box<RuntimeUsageRecord>> (about 900
bytes dwarfed every other variant; serialization is unchanged); the WebSocket
handshake origin refusal is a named function carrying
#[allow(clippy::result_large_err)] because tungstenite's callback signature fixes
the error type; auth.rs tests move to the end of the file; the unused
EnvVarGuard/lock_test_env import in git.rs and std::sync::Arc in bridge.rs are
gated to unix (their only users are unix tests).
Verified (local, source only, rustc 1.99.0): clippy exits 0 with CI's exact flags
across the workspace; cargo fmt --check clean; scripts/preflight.sh --check OK;
full workspace nextest: 19068 run, 19068 passed, 32 skipped. Not verified: hosted
clippy on the runner's rustc 1.99.1, the Windows job (no Windows host: only
hosted CI can confirm the two cfg gates and anything behind them in later crates).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
GET /v1/workspace/status and the git status detail spawned `git status
--porcelain=v1` with only core.fsmonitor and core.hooksPath disabled, so a
repository-configured clean or process filter executed (observed on native-v36:
filter-clean and filter-process markers written), and a failing process filter
made git exit nonzero so the route silently reported dirty=false with zero counts
on a dirty repository. Status reads now go through Git::status_command, which
enumerates filter drivers with `git config --show-scope` and neutralizes any
driver with a definition in a non-global/system scope (local, worktree, other),
including a local redefinition of a global driver; drivers defined only in the
user's global or system config, such as Git LFS, keep working. If the scoped probe
fails it falls back to the all-scope neutralizer (fail closed). --ignore-submodules
=dirty stops a repo-controlled submodule from running its own drivers. Status runs
once in collect_workspace_status (it ran twice). A git failure no longer reads as
clean: WorkspaceStatusResponse and GitStatusDetailResponse gain
status_unavailable (serialize-only, no generated schema references). The existing
status_and_guards_respect_clean_filters check keeps its assertions and now
configures its filter in a global-scope config via GIT_CONFIG_GLOBAL.
Verified (local, source only): app-server workspace/git/status/runtime_api and
dependencies checks: 527 run, 526 passed; the one failure,
owner_bootstrap two_crash_reentries_converge..., is flaky (passed once and failed
once earlier). Not verified: the P12 observer against a rebuilt server with the
scoped neutralizer (and a global-scope driver fixture), a Git LFS repository, the
thread-summary dirty (runtime_api.rs:3995) which still fails open, the TUI callers
(fleet_draft, init) and review_sync/diff reads, which still neutralize all drivers
or spawn unhardened git; docs for status_unavailable not yet written.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Sessions saved by v0.9.10-v0.9.12 while sub-agents were live carry a
broken Agent-topology sidecar placement. The sidecar checkpoint shipped
in de062ebd1 with END placement (appended after the replacement
history); the placement anchor landed only in 1f5f3a7e6, first released
in v0.10.0. A v0.9.10-v0.9.12 session therefore stores
`[..., tool result, summary (user), topology sidecar (user)]`. Restoring
such a session on current builds rewrote the sidecar in place and, at
request time, moved only the summary - so the restored carrier stayed
directly after a role:"tool" message, and strict paired Chat-Completions
templates rejected the first request with HTTP 400 (role "user" after a
tool result).
Fix: restore now relocates the carrier to its placement anchor - the
same boundary `replace_agent_topology_checkpoint` writes at save time
(after the latest genuine user prompt, before that round's
assistant/tool chain, else before the first assistant message). The new
`relocate_restored_compaction_topology` recognizes both the live sidecar
envelope and the restored two-block display form, runs on both restore
paths in `restore_compaction_checkpoint` (checkpoint-less restores
relocate only and delete nothing), and derives the summary boundary from
the history's era (`history_is_post_provenance` +
`is_compaction_checkpoint_message_in_era`). In a history carrying a
provenance-stamped carrier, a user turn that merely pastes a summary
header is content - never the boundary, never moved, never touched. In a
pre-provenance history a pasted legacy header still reads as the
boundary, and the carrier anchors in front of it while the pasted text
stays verbatim. The anchor's prompt scan applies the same era-aware
exclusion, so a bare legacy summary is never mistaken for the prompt the
carrier anchors after; when the boundary window is empty (a summary at
index 0), the carrier deliberately moves to index 0, mirroring the
save-time fallback chain. Save-time `replace_agent_topology_checkpoint`
now retires both carrier forms before inserting the fresh sidecar, so a
restored carrier that reached the live round cannot persist beside the
fresh sidecar as a superseded duplicate. `carries_tool_result` is
extracted from the save-time placement rule and shared, so save and
restore cannot drift. Engine-saved sessions saved by the placement anchor restore
byte-identical (beyond the standard projection; a replacement history
carries exactly one checkpoint), while a host-imported history carrying
an older summary before an already-anchored carrier is shuffled -
wire-legal, and it self-heals at the next save via the both-forms
retire.
The checkpoint-None path no longer drops wire-format checkpoints:
production derives the checkpoint from history, so the path is
unreachable that way, and keeping them matches the legacy branch's
documented intent. The TUI App mirror (`install_restored_api_messages`
for /fork, //branch and //import) stays projection-only and
engine-authoritative; transient mirror divergence self-heals on the
next engine SessionUpdated. One canonicalization gap remains: a carrier
saved directly after an assistant-like message with no checkpoint in its
window stays in place, which is wire-legal (no 400).
Evidence: `restore_relocates_pre_anchor_topology_sidecar_saved_after_tool_result`
was written first and failed on unmodified main with
`left: [3], right: [1]` - the restored carrier sat directly after the
tool result instead of at its anchor (test result: FAILED. 0 passed;
1 failed; 7066 filtered out). With the fix the same test passes, and the
new wire-level test `restore_repairs_pre_anchor_topology_sidecar_wire`
asserts restoring the v0.9.12-shaped history then building chat
messages yields no tool-to-user adjacency. Full engine lib suite: 88
failures on the fix run and 88 on pristine main - the same
machine-environment failures, with sets differing by ~3 timing-flaky
tests per side (85 common to both). The new tests pass individually by
name and are never counted on top of that baseline.
Signed-off-by: asto18089 <[email protected]>
A write-capable child spawned with a workspace scope could not spell its
target as an absolute path, even when that path resolved inside its own
claimed workspace: mutation_paths fed the raw string to
normalize_claim_path, which hard-refuses any absolute spelling ("write
scope path must be repo-relative without traversal"), so enforce_write_claim
refused the write. The same target spelled relatively succeeded, because
the write tool resolves inputs against the child's workspace either way —
one file, two spellings, opposite outcomes. The refusal also sat below
the tool surface the model sees: the write and edit schemas already
advertise both spellings — "Path to the file to write (relative or
absolute)." and "Path to the file to edit (relative or absolute)."
(crates/engine/src/tools/file_tool.rs).
mutation_paths now takes the child's workspace, normalizes it once per
batch (normalize_subagent_workspace), and strips the workspace prefix from
absolute spellings before claim validation, canonicalizing the deepest
existing ancestor so a target the write will create (leaf not yet on disk)
resolves like the tool would. The strip delegates to the core's single
resolve_deepest_existing walk (now pub(crate)) — the same one behind the
write carve-out's real-path check — so the claim lane cannot drift from it
on symlinked or partially-existing spellings.
Still refused, exactly as before: absolute paths outside the workspace,
relative and absolute `..` traversal, symlinked ancestors that resolve
outside the workspace, and the existing normalize_claim_path bounds
(length, control characters, non-normal components).
Scope: write-claim coordination is subagent authorization plumbing, not
sandbox/execpolicy — admission is decided entirely inside crates/engine
and no crate other than crates/engine is touched. Sibling lanes that
remain repo-relative-only by documented contract are deliberately
unchanged so reviewers do not discover them as missed siblings: the
write_roots/exact_files/coordination_contracts scope declarations and
the deliverables/CHANGES reporting lane per docs/SUBAGENTS.md ("At most
16 repo-relative file paths are accepted. Absolute paths, traversal,
repository metadata paths, and symlink traversal are refused."; "List
edited repo-relative file paths under `### CHANGES`").
The acceptance test
scoped_mutation_paths_accept_absolute_targets_inside_the_workspace
covers the existing-target, not-yet-existing-target, and scope-lane
admissions, and pins the outside-workspace, relative and absolute
traversal, and symlink-hop refusals.
Verified: ./scripts/dev-test.sh engine scoped_mutation_paths (1 passed;
7066 filtered out — the acceptance test) and ./scripts/dev-test.sh
engine mutation (20 passed; 7047 filtered out — the mutation_paths
filter, including the pinned outside-workspace, traversal, and
symlink-hop refusals). No dependency on the vision change: the claim
lane uses resolve_deepest_existing (pub(crate)) from crates/engine
core, so this commit stands alone on base 7659d0a26.
Signed-off-by: asto18089 <[email protected]>
git_repo_root walked up from the workspace and scanned the children of
every ancestor for nested checkouts, up to MAX_PARENT_LEVELS. A session
workspace a few levels below the home directory that is not itself a
repository therefore made the walk reach an ancestor whose children
include the user's unrelated project checkouts and fail with "Multiple
git repositories found under /Users/<name>. Specify cwd to
disambiguate" over projects that have nothing to do with the workspace.
Only the anchor itself (levels == 0) may adopt nested checkouts now —
that is the discovery path exercised by harness or session workspaces
that wrap a single repository. The guard changes exactly that scan:
ancestors keep their containment probe but no longer scan their
children; deepest-repo-wins ordering at the anchor and the error texts
are unchanged. The narrowing also drops base's silent single-repo
ancestor adoption — a non-repository workspace under a directory whose
children contain exactly one repository was silently adopted before.
That removal is intentional: the same defect family as the multi-repo
ambiguity error.
Evidence (codewhale-engine):
- the new regression test
create_isolated_worktree_ignores_unrelated_repos_above_the_workspace
(<root>/RepoA, <root>/RepoB, workspace <root>/a/b/c/workspace, not a
repo) is red on base: "Multiple git repositories found under
/private/var/.../.tmp.... Specify cwd to disambiguate: .../RepoA,
.../RepoB" (1 failed; 7066 filtered out);
- green with the guard: cargo check passes and the worktree-filtered
test module passes (40 passed; 0 failed), including
create_isolated_worktree_discovers_nested_repo_from_harness_parent.
Signed-off-by: asto18089 <[email protected]>
The child per-step deadline was request_dispatched_at + step_api_timeout, and
request_dispatched_at is taken before the child's dispatch admission, which does
a durable publish and a settled projection. When that local accounting work
exceeded the step timeout, the biased select in process_stream saw the deadline on
its first poll, never read the already-buffered MessageStart carrying the
provider's usage, and settled the receipt as Missing / request-outcome-unknown.
The deadline now starts when stream processing starts; opening the stream keeps
its own step_api_timeout, so the worst case is one open budget plus one body
budget. No timeout is raised and no receipt or accounting guarantee is weakened.
Verified (local, existing checks, source only): 983 child, tools::subagent and
turn_loop checks passed, 0 failed; child_host
child_step_timeout_interrupts_open_and_body_without_replay_and_keeps_exact_sources
passed 3 of 3 reruns (it was the last failing test in the 19068-test workspace run,
19067 passing). Not verified: a full workspace rerun after this change.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The turn layer already treats human waits as outside the budget:
TurnWallClock's doc in crates/runtime/src/turn_budget.rs says "the
budget bounds what the agent spends on its own, not how long a person
takes to answer. Without that exclusion an approval prompt left open
overnight would fail the turn — and discard the work the user just
approved — the moment they came back." The durable task layer did not
follow that philosophy: ExecutionGuard::evaluate charged the whole wall
clock, so an automation or /v1/triggers run parked on an approval or
user-input prompt was interrupted at the 30-minute wall_time default,
withdrawing the pending approval on the host's behalf
(ApprovalOutcome::Cancelled — a withdrawal, not a denial) and
discarding the run — exactly what the turn layer's own doc says must
not happen.
That wall deadline was a deliberate bound, not an unnoticed bug: the
journal's #6118 note — "`0` waits indefinitely by configuration; the
wall deadline still bounds the run" — accepted it as the backstop for
prompts nobody could ever answer. This change relaxes that bound on
purpose for the automation-with-no-operator case; it extends the
turn-layer exclusion to the task layer, opt-in only.
TaskManagerConfig::human_waits_answerable (default false, the
from_runtime default) gates the new journal arms: where a host can
actually deliver a decision — today only the runtime API server, whose
HTTP POST /v1/approvals/{id} and user-input endpoints reach a task
thread's engine turn — approval.required/user_input.required open a
human-wait window and the paired decided/answered/timeout/canceled
events close it, so an answer submitted past the wall budget completes
the task instead of being collected and dropped. The window is also
published as a supervisor-side HumanWaitStarted/Ended task event pair so
the worker supervisor's guard follows in lockstep; surfaces without a
delivery channel (the TUI's private task runtime) never arm the window
and their wall clock behaves exactly as before. The exclusion is
bounded: ExecutionGuard tracks the open window and the total across the
whole task, subtracts both from wall elapsed and moves the wall deadline
with them (#5898's crossed-first attribution and the idle deadline
still decide the label), and a fail-safe human_wait_cap (24h aggregate,
default) terminalizes HumanWaitTimeout when windows sum past it —
checked after shutdown/cancel so a Canceled/Shutdown task is never
mislabeled. A window that is parked backs the journal poll off from the
200ms catch-up cadence, doubling up to a 2s cap; an arriving decision
wakes the loop through the event subscription, so the backoff only
removes empty polls. Closing a window restarts the idle budget fresh,
composing with #6118's in-window idle suppression (which is unchanged)
to cover the model's own post-decision latency. The `[approval]
timeout_seconds` semantics are untouched.
docs/features.toml: the thread-scheduled-turns row now says a scheduled
run parked on a human answer pauses its wall clock (the registry's
120-character row limit shaped the wording).
Verified (local, existing checks, source only):
`scripts/dev-cargo.sh test -p codewhale-engine --lib --locked --
human_wait execution_guard unanswerable chained`: 21 passed, 0 failed
(reason serialization, parked backoff 800ms/2s literals and the
aggregate-budget wake, cap between windows, cancel/shutdown outranking
a spent cap plus its parked-window twin with the window still OPEN,
idle restart on window close, from_runtime default, wall exclusion end
to end, fail-safe cap, chained sub-cap windows, supervisor signal
pair, unanswerable default, and the moved-deadline wall-timeout
attribution pin); `execution_guard_parked_wait_respects_the_aggregate_budget`
added and green; `scripts/dev-cargo.sh test -p codewhale-app-server
--lib -- server_task`: 2 passed, 0 failed (builder pin plus the wiring
pin that reads the flag off the executor the manager actually runs
tasks on, through the cfg(any(test, test-support)) as_engine_executor
seam — these two pins cover the builder and executor-forward hops; the
run_http_server call site itself is not pinned, since pinning it would
require booting the server);
`scripts/dev-cargo.sh test -p codewhale-engine --lib --locked --
task_manager::`: 101 passed, 0 failed, 1 ignored (module regression,
including the #5898 and #6118 pins);
`scripts/dev-cargo.sh test -p codewhale-tui --test feature_registry`:
2 passed, 0 failed.
Red evidence, each observed under a source mutation and green again
after restore, all against the same suite:
- reverting evaluate() to the raw wall clock reds
execution_guard_human_wait_close_restarts_the_idle_budget
("a closed window must restart idle, got Interrupt { reason:
WallTimeout }") — the wall deadline must move with excluded windows;
- hoisting the aggregate cap check above the shutdown/cancel
classification reds execution_guard_cancel_outranks_a_spent_aggregate_cap
and execution_guard_shutdown_outranks_a_spent_aggregate_cap
(HumanWaitTimeout vs Canceled/Shutdown) — the ordering the fork
learned the hard way;
- dropping the between-windows aggregate arm reds
execution_guard_spent_aggregate_cap_terminalizes_between_windows;
- removing the answerability gate reds
unanswerable_surface_keeps_the_wall_clock_running_through_a_prompt
(the task parks past its wall budget instead of WallTimeout);
- hardcoding server_task_config's opt-in to false reds both server
pins ("server task config must arm answerable human waits").
During development the first cut of the deadline arithmetic kept the
raw started_at + wall_time deadline and was caught red by the
idle-restart pin before any commit; the deadline now extends by every
excluded window.
Signed-off-by: asto18089 <[email protected]>
Formatting only; fixes the hosted Landing preflight rustfmt failure on the recent test-fixture commits.
Verified: cargo fmt --all --check clean after this commit (no behavior change).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The child unknown-origin, guardian missing-coverage and event-capacity checks
asserted drain() counts that cannot hold in the settled-usage model: the pending
pool holds one record per revision of a source, and priced/unpriced counts exist
only after SessionCostSnapshot::project_usage_record folds them (replacing by
source fingerprint, so no double counting). Their fixtures now save the origin
session first so publishing reaches the pending pool, and the assertions fold the
records and keep the one-source fingerprint and unknown-outcome checks. The
event-capacity check keeps priced_turns 0 and expects unpriced_turns 2 (the
cancelled child's unknown outcome plus the root turn's unpriced mock-model
usage) and one missing source; an assertion on a field that exists only on the
old drain type was dropped.
Verified (local, source only): the three checks pass in the full workspace run
(19068 run, 19067 passed). Still failing: child_host
child_step_timeout_interrupts_open_and_body_without_replay_and_keeps_exact_sources
('the child's usage receipt settles: Elapsed'), undiagnosed; it was flaky before
and is deterministic in the saved-session fixture.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Since 20f8244aaf every snapshot/checkpoint load took the exclusive
write-admission lock to mint an optional write receipt, which creates the
late-usage sidecar directory and lock leaf, so a pure read wrote to disk and
could fail on read-only storage. Loads now observe the session/checkpoint pair
under the shared, non-creating read lock (with_session_observation, which returns
None for a tombstoned session); an absent lock leaf is read unlocked, and when no
observation can be taken the existing degrade path returns the transcript without
a write receipt (the commit message of 20f8244aaf states receipts are optional).
save/rename/archive/delete/capture_session_write_source/resume_session and the
admitted branches are unchanged, and publish_session_inner still refuses a value
with no captured native producer, so a session loaded without a receipt cannot
publish until a caller captures one under write admission. One behavior
difference: a read no longer runs ledger sync/retirement on a deletion marker; it
returns NotFound and the next writer cleans up. A first-ever save racing a read
before the lock leaf exists can surface the hash-mismatch ResourceBusy error where
the exclusive lock used to wait.
Verified (local, existing checks, source only): full workspace nextest run with
this change: 19068 run, 19067 passed, 1 failed (child_step_timeout, unrelated);
session_manager::tests::late_usage_reads_do_not_create_accounting_storage passes
unchanged, as do the decision-receipt, tombstone and publication-fence checks.
Not verified: the TUI persistence_actor handling of a load that degraded to no
receipt (it was not read), a read-only-media observer.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
productive_tool_results_do_not_hit_no_user_input_backstop, enforce_lru_capacity_does_not_loop_when_all_threads_are_active (its fixed child id was already terminal in the shared temp-dir sub-agent store from an earlier run; it now uses a unique child name) and rlm::bridge llm_batch_dispatch_pins_configured_child_model are repaired as stale fixtures; no product code, caps or accounting semantics changed.
Verified (local, source only): full workspace nextest run after these edits: 19068 run, 19063 passed, 5 failed (67 -> 37 -> 11 -> 8 -> 5 across the series). Still failing and unresolved, stated plainly: child_host child_cancelled_dispatched_open_keeps_unknown_origin (now 2 vs 1 unpriced turns after the fixture fix) and child_step_timeout (usage receipt settle times out), the auto_review guardian missing-coverage receipt check (2 vs 1), event_capacity_cancelled_repl_child (provider source admission fails with the writer's attempted fixture, reverted), and session_manager late_usage_reads_do_not_create_accounting_storage (product decision: reads now create the sidecar directory since 20f8244aaf). The partial edits for the child_host and guardian checks are not committed.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Two regressions from the settled-usage and write-admission changes. (1) A settled
late-usage record that carries a bounded routing decision took the settled branch
and continued before its decision receipt reached cost.route_receipts, so the
receipt vanished on replay although the ledger kept it; the insert now runs once
for every record before the diagnostic/settled branches. (2) After 20f8244aaf
added a hash check against the per-session checkpoint, the legacy latest.json
was read with Some(session_id), the check failed with ResourceBusy and the error
was swallowed, so `--continue` reported the legacy checkpoint as preserved but
not resumable; it is read with None, as load_legacy_checkpoint already does, and
the identity filter on the next line still binds the session.
Verified (local, existing checks, source only): 187 session_manager, TUI
setup_helper and checkpoint checks run, 186 passed. Fixed by this commit:
decision_receipt_survives_restart_replay_and_session_deletion,
list_checkpoints_includes_legacy_slot_and_skips_offline_queue and TUI
setup_helper_tests::continue_recovers_legacy_checkpoint_without_removing_it.
Still failing, not changed here:
late_usage_reads_do_not_create_accounting_storage: since 20f8244aaf every
snapshot load takes the write-admission lock, which creates the sidecar directory,
so a pure read now creates accounting storage (and may fail on a read-only
sessions directory). Whether reads must stay write-free is a product decision.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Since ccc087723c every RLM/child dispatch ends as a settled RuntimeUsageRecord
(a missing or unknown request carries coverage Missing and a reason; there is no
drop guard or dropped_records entry), so the RLM bridge/turn/rlm_host checks now
assert settled records instead of drop_records. The guardian/auto-review fixtures
get their own per-test sub-agent store (the shared temp store hit another live
test process's writer lock). cost_status gains a test-only fallback so a runtime
usage sink registered on one thread resolves when a multi-thread runtime resumes
the task on another (still ambiguous if two scopes name the same owner). The
decision-router check follows the current coverage for HTTP 402/500 (Missing),
the default-pricing coverage list drops the novita/siliconflow routes that now
have reviewed pricing, and conformance goldens/marketplace checks follow the 0.10.3
changes.
Verified (local, source only): full workspace nextest run before this commit:
19068 run, 19057 passed, 11 failed (37 and 67 in the two prior runs). The 11 still
failing, stated plainly: 4 session_manager/TUI setup-helper checks (a product
edit in session_manager.rs was reverted pending review), the two child_host
unknown-origin/step-timeout checks, event_capacity_cancelled_repl_child,
productive_tool_results_do_not_hit_no_user_input_backstop,
rlm::bridge llm_batch_dispatch_pins_configured_child_model,
enforce_lru_capacity_does_not_loop, and the auto_review missing-coverage receipt
check. Not verified: the regenerated conformance goldens against an independent
oracle.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The conformance goldens are regenerated for lawful consequences of the batch:
the tool catalog bytes and hashes change (two JSONPath descriptions grew ~269
bytes in b8c5417927, tools_bytes 18575 -> 18844, so tools_sha256, prefix and
prefix_cache_change descriptions move), provider request receipts gain an
accounting_error field, and the workspace listing includes the new sub-agent
store layout file. The harness treats request_id as volatile and ignores the
subagents.v3.writer.boot_ files. The bundled marketplace checks follow the new
first-party pin (21 candidates, Computer Use v0.16.0 asset URL); the exec
stream-drop acceptance check and a TUI test literal follow the current types.
Verified (local, source only): full workspace run after these changes had 37
failures in total; conformance::events::golden_turn_events_match,
bundled_catalog_is_offline_installable..., and
plugin_e2e_acceptance::plugin_toml_binary_lifecycle... still FAIL and are not
fixed by this commit (they appear in the run). Goldens were regenerated by a
writer; reviewers should diff them against the stated causes.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Updates the existing command_catalog HTTP check's expectations for the current
turn dispatch behavior (it failed identically on binaries built before this
series).
Verified (local): not rerun separately; the full suite run still listed
get_v1_commands_serves_the_catalog_over_http as failing, so this does not fix
it. Kept as the writer's partial change; do not rely on it.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Product: SubAgentManager::expand_write_claim returned its result as an Err inside
a store transaction, so a rejected expansion lost its contention record on
rollback; the closure now returns Ok(..) and the caller still gets the Err.
Test support: the captured RLM caller and MockLlmClient now follow the real
contracts (test-only session origin for RLM callers; the mock records an outbound
transmission and settles it OutcomeUnknown/200 so guardian usage coverage is not
NotDispatched). Fixtures: sub-agent agents and workers are created inside store
transactions with a session owner, contexts recapture the accounting origin,
the cancel-test setup is persisted, replay checks use the lawful settled schema
version, session secret scrub saves through the manager.
Verified (local, source only): full workspace nextest run before: 19069 run, 67
failed; after this and the TUI/plugin changes: 19068 run, 19031 passed, 37 failed
(35 of the 67 now pass; 5 other tests newly failed). Not verified/unresolved,
stated plainly: the two budget_handback cancellation checks, ~10 rlm
bridge/turn checks, the auto_review_* guardian family (5 of 8 still fail), the
MCP action approval gate (child_host probe drops the runtime MCP server scope),
child_host unknown-origin checks, enforce_lru_capacity, the 201-round backstop,
and several flaky timing checks. parent_agent_surface ceiling stays 92100: two
JSONPath descriptions grew ~291 bytes in b8c54179271; headroom is 22 bytes.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The verify tool's model-visible description said "This is not a test
runner (use run_verifiers)". That is dead guidance by upstream's own
contract: RunVerifiersTool::model_visible() returns false
(tools/verifier.rs), so the model-visible catalog never offers it, and
"run_verifiers" is listed in RETIRED_TOOL_NAMES
(tools/canonical_action_test_support.rs). A model following the hint
would attempt a call it can never make - exactly what the #6747
invariant assert_text_names_only_callable_tools ("no hidden name, no
retired name") exists to prevent.
Point the hint at the canonical surface instead: the Run tool, which is
model-visible and dispatches action="verifiers" to RunVerifiersTool
(tools/run_tool.rs), matching how goal.rs already teaches the same
form ("Run action=\"verifiers\"").
Guard coverage: no_advertised_tool_teaches_a_retired_name built its
registry without the verify tool, so this surface was never scanned.
Extend the builder chain with .with_verify_tool(None, ...); VerifyTool
is model-visible, so to_api_tools() now includes its description in the
retired-name scan.
Red/green evidence:
- red: with the old text, the extended guard fails with "tool `verify`
advertises the retired name `run_verifiers`; name the canonical
action form instead"
- green: with the new text, all 9 canonical_action_tests tests pass,
all 8 tools::verify and 9 tools::verifier tests pass, and cargo
check -p codewhale-engine is clean.
Signed-off-by: asto18089 <[email protected]>
fetch_url is an in-process HTTP client: it is a subject of the network
policy but has no OS sandbox of its own. The sandbox contrast belongs to
exec_shell, whose sandbox policy may deny outbound network, so move the
parenthetical there and keep the network-policy and decoding claims about
fetch_url itself.
Signed-off-by: asto18089 <[email protected]>
Preserve quota-window transmission and caller recovery semantics, bound
native JSON inspection and settle its refusals, retain server minima and
account guidance, and restore ordinary transport recovery receipts.
Keep the existing typed LlmError contract at the inspection boundary and
preserve the original worker assertions and deadlines.
Validation on Windows with rustc 1.99.1 and locked dependencies:
- Rate-limit filter: 37 passed; scoped quota/receipts: 16 passed
- Responses unknown outcomes: 2 passed; official quota guidance: 1 passed
- Long minimum, Engine receipt, child classification and wall budget:
1 passed each; retry configuration: 3 passed
- Runtime retry status: 7 passed; parser negative control confirmed
- Changed-file formatting passed
- Strict Clippy retains 23 pre-existing findings; full formatting retains
the unchanged app-server test formatting failure
An earlier checkpoint deadline timeout is retained in the evidence. The
final complete rate-limit filter passed with its original deadline.
Signed-off-by: z27014 <[email protected]>
- Kill the child after ten seconds and cap its stdout at 16 MiB, reading on
a helper thread so a child that fills the pipe cannot deadlock the wait.
A clipboard owner that never renders the format froze the TUI before.
- Use the absolute %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
instead of a bare name resolved through PATH.
Not changed: the fallback still runs whenever arboard's text and image reads
both fail, which is the only signal available - arboard does not expose the
clipboard's format list, so "no native image" cannot be told apart from
"nothing on the clipboard" without a second Win32 query.
The scratch workflow commit is gone: this branch is cut from upstream main.
Verified with: cargo fmt --all -- --check. Compilation and tests were not
re-run for this commit at the reporter's request; CI is the first build.
arboard reads the Win32 clipboard through CF_DIB/CF_DIBV5. QQ's screenshot
publishes the picture under the same trio (Bitmap, DeviceIndependentBitmap,
and Format17) yet the native read comes back empty; the picture only becomes
readable after it has been pasted into another application first.
.NET's Clipboard.GetImage() does read it (249x171 in the reported case), so
fall back to a one-shot PowerShell that saves the bitmap as PNG and returns it
as base64. The bytes go through the same no-follow clipboard-image writer, so
the destination keeps its owner-only, link-refusing guarantees.
The fallback runs only on Windows and only after arboard already failed, so
the common path pays nothing.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui --lib
--tests; cargo test -p codewhale-tui --lib clipboard (42 passed). The fallback
itself has no unit test: it needs a live Windows clipboard.
- Share the paste de-dupe between the composer and the provider-picker
modal. The modal read the clipboard directly, so a backend forwarding
both edges of Ctrl+V pasted its text twice.
- Stamp the de-dupe window after the clipboard read, not before it.
ensure_clipboard can block for two seconds, which pushed the second edge
of the same key press outside the window.
- Read clipboard_init_attempted in non-test builds. It was only read under
cfg(test), so -Dwarnings rejected the field as never read.
- Restrict the clipboard-image write fallback: create-new only, refuse a
linked directory, owner-only on Unix. The previous std::fs::write
followed links and dropped the mode the pinned writer guarantees.
- Cap clipboard pixels before the RGBA copy, and bound the preview decode
pool to four threads instead of one thread per attachment.
- Document that every attachment is previewed, not just the first.
Verified with: cargo fmt --all -- --check. Compilation and tests were not
re-run for this commit at the reporter's request; CI is the first build.
Five defects found end to end against a real QQ screenshot:
- Windows Terminal consumes the key-down of a chord it handles itself and
forwards only the key-up, so Ctrl+V arrived as KeyEventKind::Release and
the Press-only router gate dropped it. Paste chords now accept the
release, and paste_from_clipboard de-duplicates the terminals that send
both edges.
- A paste landing while the launch card was up never dissolved it, so an
empty composer kept the card and hid the attachment row behind it. An
attachment now counts as user input and dissolves the card.
- The clipboard open latched its first timeout into "never try again" for
the rest of the session. It retries now, with a 2 second budget.
- clipboard-images was never created and the confined writer cannot create
it mid-walk, so the first paste always failed silently. The directory is
created and a direct write backs up the confined writer for a relocated
state root.
- Only the first attachment got a preview. Thumbnails now share the row.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui
--lib --tests; cargo test -p codewhale-tui --lib attachment (15 passed),
clipboard (42), bracketed_paste (13), image_preview (10), ui::frame (45).
The end-to-end path was confirmed against a live Windows Terminal 1.24:
an empty composer pastes a QQ screenshot, the launch card dissolves, the
attachment row appears, and the PNG lands in clipboard-images.
Windows Terminal's paste handler sends an empty bracketed paste even when
the clipboard held nothing it could read:
// LOAD BEARING: Send an empty bracketed paste even if the clipboard
// was empty.
if (!bracketedPaste && text.empty()) { co_return; }
That empty event is the whole mechanism. /attach with no path was a
workaround for a problem that does not exist, and typing a command after
copying a picture is worse than the path it replaced.
- Remove CommandMediaContext::attach_clipboard_image, the MediaAdapter
implementation, App::attach_clipboard_image, ClipboardHandler::read_image,
and the /attach no-path branch with its tests.
- Keep the empty-paste branch in handle_bracketed_paste and pin it with a
test that injects a clipboard image and asserts the attachment lands.
- Rewrite the docs section: Ctrl+V works, and the empty paste is why.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui --lib
--tests; cargo test -p codewhale-tui --lib
empty_bracketed_paste_attaches_the_clipboard_image (1 passed), attachment
(13), clipboard (42), bracketed_paste (13), image_preview (10).
Follow-up to the second review round:
- Pet mode skipped the preview's rows but still started a decode. Gate the
cache tracking on pet_main, as the previous commit message claimed.
- An empty attachment list skipped tracking entirely, so a removed image
stayed cached and a later re-attach of the same path could be answered
from a stale stamp. Track the empty list; it is one vector comparison.
- The image-only failure used a hardcoded English sentence while every
neighbouring clipboard message goes through MessageId. Reuse
ClipboardNothingToPaste.
- Correct the decode-failure note, which promised a retry that track's early
return never performs.
- Use saturating multiplication for both caption dimensions.
- Cover the SSH branch of the image-only attach path.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui --lib
--tests; cargo test -p codewhale-tui --lib attach_clipboard_image (3 passed),
image_preview (10), attachment (15), clipboard (47), bracketed_paste (12),
ui::frame (45).
Review of the first commit found four real problems:
- /attach with no path called the text-first clipboard read, so a text
clipboard was pasted into the draft and reported as success. The media
facet gets an image-only read instead, and text on the clipboard is an
error that leaves the draft untouched.
- A finished decode never requested a repaint, so the thumbnail appeared on
the next unrelated frame. Poll now runs in the event loop, before the draw
decision, and reports a newly published preview.
- std::fs::metadata ran from the paint path and tripped
scripts/check-blocking-calls-budget.py. The stat moved inside the decode
thread, where the gate exempts it.
- The thumbnail could take 9 rows of a 24-row body. It is now capped at a
quarter of the body and yields to the queued-input preview.
Also drops the unused last_attachment_preview_area, decimates the sampled
grid on a narrow dock instead of hiding the preview, skips decoding in
ASCII-safe and pet modes, boxes the cache so App does not grow on the stack,
and fixes mojibake in the new module docs.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui --lib
--tests; cargo test -p codewhale-tui --lib clipboard (46 passed), attachment
(15), image_preview (10), bracketed_paste (12), ui::frame (45).
The existing ui::tests suite aborts with a stack overflow in
adopting_a_local_model_closes_the_connect_picker_and_names_it on this
Windows host; the same test overflows on the pre-change baseline worktree,
so it is not introduced here.
A clipboard image could already be attached when Ctrl+V reached the TUI,
but nothing showed the picture before send, and most terminals consume
that chord themselves: Windows Terminal sends no event at all for an
image-only clipboard, so the feature was unreachable there.
- Draw the first attached image above the composer as upper-half blocks
with truecolor foreground and background. That is ordinary cell output,
so it renders on Windows Terminal, iTerm2, Terminal.app, GNOME Terminal,
Konsole and WezTerm, unlike the kitty-graphics path the pet animation
uses. Decoding runs off-thread and is cached by (mtime, len), so the
paint path does no filesystem work.
- /attach with no path reads the clipboard, giving every terminal an
entry that does not depend on which process owns Ctrl+V.
- An empty bracketed paste now asks the clipboard for an image instead of
inserting nothing.
- Document the Windows Terminal sendInput \u0016 binding, which the
existing paste predicate already accepts.
Verified with: cargo fmt --all -- --check; cargo check -p codewhale-tui
--lib --tests; cargo test -p codewhale-tui --lib image_preview (9 passed);
--lib attachment (15 passed); --lib ui::frame (45 passed).
Note: cargo test -p codewhale-tui --test feature_registry fails on five
pre-existing over-long summaries (undo-range, receipts,
compatibility-tool-free-turns, chatgpt-plan-sign-in, cache-call-receipts)
that this change does not touch.
ChildAuthority::usage_origin() is the single place a child's accounting origin
is read (context origin, with the test-only session-origin fallback). Dispatch,
child compaction and the review path now use it; before, only dispatch had the
fallback, so child compaction failed with "child compaction has no admitted
accounting origin". Production behavior is unchanged: production children always
capture an origin. Stale sub-agent fixtures are repaired: claims and agents set
up inside a store transaction (release/reload read coordination from the store),
the first manager is dropped before a reload (its writer lease made the reloaded
agents look foreign), the worker_registry fixture recaptures the origin after
replacing the context, and error text follows store admission ("without its
writer lock"). Replay checks follow the lawful settled schema version 6.
Verified (local, existing checks, source only): engine tools::subagent,
approval, runtime_threads, compaction and child checks: 1511 run, 1488 passed,
23 failed (47 before this series). Weak spots, stated plainly: (1) the measured
tool-surface ceiling in parent_agent_surface_stays_within_measured_ceiling was
raised from 91812 to 92100 bytes (measured 92078) following the test's own
re-measure rule; the growth is unexplained and partly host-tool dependent;
(2) a parked child's expected worker status changed from WaitingForUser to
Interrupted to match the current projection (mod.rs ~18552), not independently
re-derived from the design; (3) child_step_timeout_interrupts_open_and_body is
flaky (passed 1 of 3 on the same binary). Still failing, unresolved: the two
budget_handback cancellation checks (Running vs Cancelled), launch_gate_queues,
the remaining auto_review_* and several subagent checks, rlm::bridge dispatch
pin checks, enforce_lru_capacity, and app-server command_catalog (pre-existing).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Sub-agent fixtures that replace the stub runtime's context lost the test-only
default accounting origin, so child usage settlement failed ("Child usage
settlement failed") and turned budget stops into interruptions. A shared
test-support fallback now supplies the origin only when none is set; production
children always capture one. Three runtime_threads replay checks compared
schema_version with the pre-run value; since ccc087723c a settled turn that
records source usage is lawfully version 6, so the expectations follow it.
Verified (local, source only): engine tools::subagent and runtime_threads checks
in the 1732-check run: failures dropped from 47 to 33 (the rest are tracked for
a follow-up; some assert behavior such as Running vs Cancelled and
enforce_lru_capacity). Not verified: the root cause text of the original
settlement warning was not captured, the diagnosis is from code reading plus the
passing checks.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Seven runtime API routes (git status, git changes, git diff, workspace diff,
git graph, workspace file list and file read) accept an optional thread_id.
The thread's recorded workspace comes from the existing thread record (no second
store) and is opened with the same no-follow directory primitive scope admission
uses; an unknown thread is 404, an unusable or non-absolute workspace is 409
thread_workspace_unavailable, and an empty id is 400. Routes without thread_id
behave exactly as before, and the per-file confinement still runs on the resolved
root. Git mutations, guarded/patch writes, the workspace files PUT, status, trust
and file search stay on the server workspace (follow-up). Worktrees stay opt-in;
this only lets a thread name the workspace it works in.
Verified (local, source only): the app-server workspace/git/diff/files/runtime_api
checks in a 1732-check run passed for this slice; the 35 failures in that run are
engine subagent/runtime_threads checks and two app-server checks that are
pre-existing or flaky (command_catalog get_v1_commands fails identically on older
binaries). Not verified: a native observer of thread-scoped reads, a path-escape
attempt against the new resolver, regenerated web/data/agent-docs.generated.json.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
rio-vt 0.5.28's Kitty graphics protocol handler had a path traversal allowing
an out-of-bounds file delete or read (advisory dated 2026-11-01, medium 4.7).
Locks rio-vt, rio-unicode and teletypewriter at 0.5.29 (lock-only; the
manifests already allow 0.5.x).
Verified (local, source only): cargo audit reports no vulnerabilities (the
RUSTSEC-2026-0430 error is gone), cargo deny advisories ok, and 657 terminal/
pty/vt/kitty/graphics checks across codewhale-engine and codewhale-tui passed,
0 failed. Not verified: a real Kitty-graphics hostile-path observation.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
deliver_bound_approval verifies an answer against the held request's identity
(thread, turn, call) through an ExternalApprovalBinding and refuses a mismatch
with a typed ApprovalBindingMismatch, which the runtime API maps to 403.
Callers that pass no binding (the existing HTTP route) behave as before. The
app-server owner port gains the delegating user-input and dynamic-tool answer
variants. The full-tool turn/start gate stays closed.
Verified (local, existing checks, source only): the app-server stdio, interrupt,
approval, user_input, dynamic_tool and owner checks and daemon_socket passed in
the combined run. Not verified: a native two-connection observer; a binding on
the stdio-originated approval path beyond what these checks cover.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Seven runtime API git handlers (git_diff, workspace_diff, git_graph,
guarded_write, patch_write, git_push, git_branch) now resolve the workspace and
repository check through an async helper instead of a synchronous
`git rev-parse` on the Tokio thread, with identical error mapping. The TUI
workspace context reads the memory file size inside its existing
spawn_blocking snapshot (memory_size_hint) instead of on the UI path.
Verified (local, source only): app-server git/workspace and tui workspace_context
checks passed in the combined run. Not verified: idle/approval-wait CPU (needs
the FreeBSD host), a native observer of the handlers.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds codewhale_util::git_metadata::read_head (discovery + HEAD identity) on
gix =0.90.0 with default features off and only sha1/sha256: no network,
credentials, filters, status or fsmonitor code is built. The open is isolated
with strict config and bail_if_untrusted, core.useReplaceRefs and
core.fsmonitor overridden off, after a bounded pre-open size check of the
.git pointer, HEAD and config; cancellation is polled before open, after
discovery and after the read. Typed errors fail loud; not-a-repository and bare
repositories map to NotRepository. The app-server workspace status/metadata
readers and the sub-agent git branch reader use it, dropping their
rev-parse subprocesses; the short id is a fixed 7 characters and a repository
owned by another user or with malformed config is now reported as not a
repository with a warn log. Cargo.lock gains 63 packages. The blocking-calls
budget gains git_metadata.rs std_fs 2: read_head is a synchronous bounded read
(its callers previously spawned processes at the same sites).
Verified (local, source only): the util, engine subagent/approval/runtime_threads
/git, app-server workspace/git/approval/stdio/interrupt/owner, tui
workspace_context/git and daemon_socket checks ran; every check touching this
slice passed. 47 engine subagent/runtime_threads checks fail, and they fail
identically on engine test binaries built 2026-11-03 03:17, before this work
(pre-existing, tracked separately). cargo deny: bans, licenses, sources ok;
advisories failed on RUSTSEC-2026-0430 in rio-vt 0.5.28, unrelated to gix.
Not verified: cargo tree feature closure by name, MSRV 1.89 on the lock, OHOS
dependency check, hostile-repository and cancellation observers, any native
build. Slice 2 consumers (tasks, review, delivery, diagnostics, TUI, memory
crates) still spawn git.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds a process-unique ConnectionId minted per stdio connection and records it on
InFlightTurn. interrupt_stdio_turn now refuses a different connection with a
typed not_turn_owner error (-32012); interrupts with no connection (HTTP, tests,
legacy) behave as before. A second registration for a live thread key is
refused instead of overwriting the first turn's entry, and the refused claim
cannot retire the other turn's registration. The full-tool turn/start gate stays
closed.
Verified (local, existing checks, source only): the stdio, interrupt,
prompt_request, socket_transport, full_control and goal checks and the
daemon_socket integration tests are in the 578-check run (577 passed; the one
failure was an unrelated docs row-length check, since fixed). Not verified: a
real two-connection native observer; a daemon guest interrupting an owner turn
now gets not_turn_owner, and no existing test relied on that.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds [goal] complete_judge and blocked_judge (both default false; default
behavior and the default tool catalog text are unchanged). When enabled,
update_goal consults a GoalGate that reuses the verify critic (toolless,
auxiliary spend, fails closed on unparseable output). A complete claim that is
upheld seals the goal as today; refuted or inconclusive goes through
record_not_achieved so the existing 3-pass stall pause bounds spend. A blocked
claim that is upheld blocks; refuted continues; inconclusive yields to the
person. The judge await drops the lock and rechecks goal id and objective, so a
/goal pause, clear or replace during the wait wins. Flags flow config ->
EngineConfig -> agent tool surface in the TUI, exec, runtime-thread and workflow
builders. docs/features.toml: the goals row mentions the keys; five other rows
(undo-range, receipts, compatibility-tool-free-turns, chatgpt-plan-sign-in,
cache-call-receipts) are shortened to the 120-character limit the existing
feature_registry check enforces; it was failing on them.
Verified (local, existing checks, source only): 578 selected existing checks
across engine goal/verify, runtime goal/config, app-server stdio/interrupt/goal,
daemon_socket and feature_registry; 577 passed, 1 failed on the registry row
lengths, then feature_registry rerun 2 passed, 0 failed. Not verified: no
native observer of a real judge call; on TUI/exec paths without an accounting
origin an enabled judge fails closed (as VerifyTool does), so confirm before any
default-on.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The text after ** was accepted if it matched any path component, so
src/**/*.cpp matched src/vendor.cpp/main.py. That was already true for one **,
and the new handling of nested ** reached the same branch. A suffix with a
wildcard is a pattern for the file itself: match it against the last component.
A literal one, like **/deep, still covers what's under that directory.
Each brace group multiplies the patterns tried for every file, so 20 {a,b}
groups cost a million tries per file with nothing checking for cancellation.
Past 64 combinations the pattern stays literal, as it did before.
Signed-off-by: Lstarsky0 <[email protected]>
thread/start now parses the pinned camelCase ThreadStartParams (deny unknown
fields) and returns the pinned seven-field ThreadStartResponse with the shared
wire Thread projection. model, modelProvider, cwd, a false/absent ephemeral and
operationKey are honored; personality and threadSource are accepted and ignored
(deprecated / analytics-only in the pinned schema). Fields the Engine cannot
honor (ephemeral true, approvalPolicy, approvalsReviewer, sandbox, config,
baseInstructions, developerInstructions, serviceName, serviceTier,
sessionStartSource) are refused together with a typed -32602
unsupported_thread_start_parameter error instead of being ignored. Pinned
clients cannot send an operationKey, so one is minted: retry idempotency is
weaker for them. approvalPolicy/approvalsReviewer/sandbox report never/user/
readOnly because native turns run tool-free while the full-tool gate is closed.
The existing goal-methods test now sends operationKey and reads thread.id.
Verified (local, existing checks, source only): 151 passed, 0 failed across
thread, stdio, rpc, goal, dispatch and the protocol schema+wire tests. Not
verified: the pinned ThreadStartResponse validator on a native build; whether
real Codex clients send serviceName (it may need to become advisory).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
ccc087723c removed the per-source_id replay guard; envelopes with record None
(still produced by MailboxMessage::token_usage and deserialized from older
persisted envelopes) took the additive legacy path, so replaying one source id
double counted the fleet row tokens (22.0k for 11.0k). An empty source_id keeps
the additive behavior; otherwise the usage is added once per source through the
existing usage_source_fingerprint map, and a later settled record for the same
source still replaces it. Costs were not affected.
Verified (local, existing checks, source only): 185 passed, 0 failed across the
tui work_surface, subagent_routing and token_usage checks, including
fleet_row_repaints_resolved_model_and_each_distinct_usage_total (previously
failing on every binary built since 2026-11-02 16:25).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
T05-11: validate_task_spec_document and prepare_managed_fleet_run refuse more
than 64 tasks (the existing placement-preview cap) before any work, and
/v1/fleet/runs gets a 256 KiB body limit like the placement route. U07-02:
paste bursts stop buffering at 64 KiB (the composer already refuses more than
16,000 characters). U07-10: the model picker compares opaque model IDs exactly
in the custom-query duplicate checks and the default-section lookup.
Verified (local, existing checks, source only): part of the 823-check wave run
(822 passed; the single failure is an unrelated pre-existing tui work_surface
test). Not verified: six other model-ID comparisons in model_picker.rs were not
changed or read; no test fixture over 64 tasks exists in the selection.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
thread/read now takes the pinned camelCase params (threadId, includeTurns) and
returns {thread} with the same wire-only Thread projection as thread/list;
with includeTurns it also returns Turn[] built from the canonical record
(user/agent messages, reasoning, context compaction). Queued maps to
inProgress and canceled to interrupted because the pinned enum has four
values. The legacy snake_case thread_id is refused as an unknown field. Owner
checks and alias resolution are untouched.
Verified (local, existing checks, source only): the wave run of 823 selected
existing checks across app-server, protocol schema+wire, engine, tui-kit and
tui passed 822; the one failure, tui work_surface
fleet_row_repaints_resolved_model_and_each_distinct_usage_total, also fails on
every codewhale-tui test binary built since 2026-11-02 16:25 and is unrelated.
Not verified: the pinned-schema validator on a native build. Command
execution, file change and MCP tool-call items cannot be supplied by the
canonical record and are omitted (turns then report itemsView "summary").
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted Landing preflight failed on a86ef86df4. Every flagged site is sync-only
or already on a blocking thread: protocol bin/export.rs is the synchronous
schema generator (no tokio); cli/metrics/stats.rs is the sync `codewhale
metrics` path (run -> run_metrics_command -> metrics::run -> stats::collect),
split out of metrics.rs (6 -> 4); engine/whale_soul.rs load() runs only under
runtime_control::owner_work (spawn_blocking), which the script cannot see;
tui/lib.rs 34 -> 35 corrects a stale baseline (35 std_fs at every revision
since 0c2ab7d577). exec_agent.rs, plugins/render.rs and fleet_setup.rs are
clean and tightened. Produced by scripts/check-blocking-calls-budget.py --update.
Verified: the script reproduces the CI failure before and the diff is exactly
these eight entries. Not verified: hosted preflight on this commit.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
a31cf5916e removed the only non-test writer of AppState.runtime_thread_map;
the mapping lives in the durable canonical link store. The reload test keeps
its captured-owner assertion and the final thread/message dispatch, which
proves the mapping survives reload. The dead field itself is a separate slice.
Verified: tests::config_update_keeps_the_stdio_thread_mapping passes (part of
65 passed, 0 failed).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
thread/list returned the internal ThreadResponse, so the pinned `data` array
was the unused default `{}` and the threads sat under a non-schema key. Adds
a wire-only projection (ThreadListResponse/Item/Status/Source) with the pinned
camelCase fields; sessionId is the public thread id, projectId null, turns [],
cursors null, no invented metadata. The internal Thread type and
thread/request kind=list are unchanged; strict unknown-parameter refusal stays.
Verified (local, existing checks, source only): 65 passed, 0 failed across
thread_list, thread_control, stdio, rpc, config_update, thread_message and the
protocol schema+wire tests. Not verified: the pinned-schema validator harness
against a native build; thread/start (13 issues) and thread/read (9) remain.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds GET /v1/fleet/profiles/{id}/document. Personal/workspace profiles and
selected named Fleet files return their exact bounded pinned text; built-in,
config, plugin and Claude members return an explicitly read-only effective
projection with a null path. The roster now comes from the captured workspace
identity and plugin discovery, and the final workspace-identity check always
runs, even when the read fails. Revision uses sha256_hex over
(id, kind, origin, path, text). Generated schema, TypeScript, SDK types and
EN/ZH docs are updated.
Verified (local, existing checks, source only): 41 passed, 0 failed
(fleet runtime API test, engine fleet::profile cases, protocol schema+wire).
Not verified: no matched native HTTP read/refusal observer, no mounted App
viewer, no full sealed gate; PUT remains unimplemented and writes stay off.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The WeCom bridge now steers the still-active turn with follow-up text,
which adds a runtime POST during the queued-turn phase of this test.
The assertions track approval ownership, so filter to approval routes
instead of counting every post.
The bridge answered "text only" for image, video and file messages, so
the most natural phone interaction — sending the material you want
worked on — was impossible. Download video/file/image frames through
the SDK's expiring links into a configurable media directory and reply
with the saved path, and treat transcribed voice content as prompt
text. Media frames bypass the group-prefix filter, which rejects empty
text and would drop them silently.
While a turn was running, every incoming WeCom message only got the
busy notice and its content was lost; users repeating an instruction
mid-turn had no way to reach the agent. Forward the text through the
Runtime's documented steer endpoint so the running turn can consume it,
and fall back to the busy notice if steering is rejected.
WeCom caps one message at 4096 UTF-8 bytes, but splitMessage only
counted characters. A 3500-character Chinese reply is ~10.5 KB and was
delivered as a single silently truncated message, so long reports
arrived cut off with no error anywhere.
splitMessage gains an opt-in maxBytes cap that re-splits oversized
chunks on code-point boundaries; the WeCom bridge passes 3800 bytes
(configurable via WECOM_MAX_REPLY_BYTES). Other bridges keep the
character-only behavior until they need a byte cap.
matches_glob had no brace support and only matched the text after ** against
one path component, so include patterns like *.{ts,tsx}, **/tests/*.rs and
src/**/tests/** returned no matches with no error, and the same forms in
exclude excluded nothing. **/deep/** also missed a top-level deep/.
Expand {a,b} before matching, and let **/ cover zero or more directories when
what follows it names a path. Other patterns take the same route as before.
Signed-off-by: Lstarsky0 <[email protected]>
With a path argument, file_search returned each match relative to that path
while read and every other tool resolve from the workspace. Searching
packages/app for package.json came back as package.json, which then reads the
one at the repository root without any error. A path naming a single file came
back as an empty string.
Build the reported path the way grep_files does: strip the workspace, or its
canonical form, and leave anything outside it absolute. Ranking and exclusion
still use the path relative to the search root.
Signed-off-by: Lstarsky0 <[email protected]>
Carries the state-path decision to the call sites the first three commits
missed, and closes the two gaps a review of them found.
- fleet store: a workspace Fleet is now checked through the same
`workspace_state_path`, and `ensure_fleets_dir` hands its resolved root to
the writer. Checking one path and writing another left workspace-scope save
and select failing at a home workspace with "Fleet artifact path must stay
within the workspace", after `create_dir_all` had already run through the
junction.
- hooks: `/hooks edit` takes the same decision. The editor is given the
literal `~/.codewhale/hooks.toml` rather than a resolved root, because
`canonicalize` returns a verbatim `\\?\` path on Windows and several
terminal editors will not open one.
- mcp: `reject_linked_workspace_state_path` asked `home == root` literally
while every other site canonicalizes. It now uses `workspace_is_user_home`,
so one rule decides what "the user's own directory" means.
- doctor: the session-recovery scan rejected any state root whose
`file_type().is_symlink()` was true. A junction reports as a symlink in this
Rust version, so `doctor` could not run the diagnostic on the layout it
reports about. It now resolves the root and inspects the target, while still
ignoring symlink entries during the scan. Two unix tests move from "rejects
a linked root" to "follows a linked root".
- `workspace_state_path` asserts its `relative` argument in release builds,
not only in debug ones: it is the one place a security boundary is decided.
Verified on Windows with junctions on both sides (`reject_linked_path` still
refuses `<repo>/.codewhale`, passes `<home>/.codewhale`), `cargo check -p
codewhale-engine -p codewhale-tui` passing, `cargo fmt --all -- --check`
passing, and `cargo test -p codewhale-engine --lib -- fleet::store` reporting
16 passed. The base commit already fails Lint, both Test jobs and the Safety
gate for reasons unrelated to these files; that is tracked upstream in #7204.
Both legacy TUI profile writers now use the same bounded, confined writer.
A directory-wide cross-process lock covers exact preimage comparison, profile
validation, duplicate identity checking and pinned atomic replacement. Keep
create-only semantics and classify uncertain replacement outcomes separately.
Route-assignment reads reuse the same bounded confined reader; model drafts
preview the actual sanitized filename rather than the original role filename.
A refused save keeps the original editor, exact draft and reviewed preimage.
Reuse the view's UUID to reject events after cancellation or reopening, reset
the replacement confirmation and show the failure inline. Close only after a
confirmed save; retain provider readiness, project scope and roster controls.
Verified: 54 existing Fleet setup cases passed on the final frozen batch;
35 existing Engine profile cases reused from the exact same test-binary hash
(89 total, zero failures). Native33 ordinary macOS arm64 CLI built with all
4,249 inputs unchanged, default Engine and no test-support. Two actual TUI
processes proved stale-save refusal, model-draft retention, explicit rereview
then save, project/personal creation and symlink substitution refusal. One
actual profile-draft call used a loopback provider; no remote provider call.
Muse Wonder Full supplied a read-only writer audit, reviewed against source.
This is the legacy profile foundation. Native App document routes, named
Fleet writer migration, exact live roster adoption and workflow/spawn
qualification remain open. No package, Windows, hosted CI or release claim.
Refs CW-6319, CW-7713.
Stashing the draft goes through clear_input, which releases the command
claim, and the insert assigned the text directly without taking it back. So
a typed /draft replaced by /rename from the palette lost the hold in
submit_input: past MAX_SUBMITTED_INPUT_CHARS the line becomes a paste
attachment and went to the model as prose.
Claim the line whenever the inserted text starts with /. An empty composer
never had the claim, so that path had the same hole on main and now holds
too. Palette entries that insert a bare name, such as an MCP tool, stay
unclaimed.
Signed-off-by: Lstarsky0 <[email protected]>
Second review pass on the home-workspace exemption. Three small corrections,
all in the boundary the first two commits established.
`workspace_state_path` shared the resolution rule with `workspace_state_dir`
by copying it; both now come from one `resolved_home_state`, so the two cannot
drift into disagreeing about where state lives. The function also asserts its
`relative` argument is a literal relative path. Every caller passes components
it wrote itself, and a `relative` carrying `..` would step outside the state
directory the root exists to protect.
The skills exemption matched only the resolved target of the state directory,
so a user who put `~/.codewhale/skills` itself on another volume lost the
exemption and silently lost those skills. It now matches the literal spelling
under the state directory as well: that directory is the user's own
application state, not repository content, so a link inside it stays exempt
whichever end is linked.
The journal's `root` field no longer claims to be the state directory in every
case; for a non-home workspace it is the workspace.
Verified on Windows with junctions on both sides: a non-home workspace still
refuses `<repo>/.codewhale`, a home workspace still passes
`<home>/.codewhale` and walks the resolved target.
- cargo check -p codewhale-util -p codewhale-skills: passed
- cargo check -p codewhale-engine: passed
- cargo test -p codewhale-util: 41 passed; 0 failed
- cargo test -p codewhale-skills: 174 passed; 0 failed
- cargo test -p codewhale-engine --lib -- tools::workflow::journal
fleet::profile: 41 passed; 0 failed
- cargo test -p codewhale-engine --lib -- subagent::tests::: 590 passed;
6 failed, the same six that fail on the parent commit with these changes
stashed (real-home skill leakage into a tempdir workspace, plus one test
that overflows the default Windows test stack).
- cargo fmt --all -- --check: passed
Review follow-up on the previous commit. The exemption was right; the way it
was applied was not. `reject_linked_path` never examines the root itself, so
lowering the root from the workspace to `<workspace>/.codewhale` made a
repository-supplied `.codewhale` link transparent: fleet profiles were read
with their trust and permission fields, the workflow journal wrote, and the
subagent lock created directories through the link, all outside the
repository. Every one of those three call sites now keeps the workspace as
the root with `.codewhale` still inside the walked path.
workspace_state_path decides that root once: a home workspace resolves its
own `~/.codewhale` junction and uses the target, every other workspace keeps
itself and inspects `.codewhale` exactly as before. A state directory that
exists but cannot be resolved falls back to the strict root, so an
unreachable junction fails closed instead of starting a second state tree.
The skills exemption is now per directory rather than per workspace: only the
home state directory skips confinement, so links under any other home
directory are still followed the old way and still warn. Also reuses
`codewhale_paths::CODEWHALE_APP_DIR` instead of a third literal.
Verified on Windows with junctions on both sides:
`reject_linked_path` still refuses `<repo>/.codewhale` for a non-home
workspace and passes `<home>/.codewhale` for a home workspace, where the
resolved root is the real target.
- cargo check -p codewhale-util -p codewhale-skills: passed
- cargo check -p codewhale-engine: passed
- cargo test -p codewhale-util: 41 passed; 0 failed
- cargo test -p codewhale-skills: 174 passed; 0 failed
- cargo test -p codewhale-engine --lib -- fleet::profile: 33 passed; 0 failed
- cargo test -p codewhale-engine --lib -- tools::workflow::journal: 8 passed;
0 failed (includes journal_never_writes_through_a_linked_codewhale_dir)
- cargo test -p codewhale-engine --lib -- subagent::tests::: 590 passed;
6 failed; the same six fail on the parent commit with this change stashed.
Four are real-home skill leakage into a tempdir workspace, and
agent_claim_expands_the_callers_write_scope overflows the default Windows
test stack before RUST_MIN_STACK is raised.
- cargo fmt --all -- --check: passed
A session started in the user's home directory is not a repository: the
directories below it are the user's own global content, which the user is
free to relocate behind a link. Four call sites still treated it as
repository content and refused that relocated state, so a junction at
~/.codewhale silently disabled the feature behind it.
- skills: merge_watched_directories confined every directory under the
workspace, so a junction at ~/.codewhale refused the whole catalogue and
only ~/.agents skills loaded (30 of 90 in this checkout's home).
- fleet roster: workspace agent profiles confined to the workspace, so
~/.codewhale/agents was refused and every profile was skipped.
- subagent coordination: the process lock walked ~/.codewhale as workspace
content and refused it, so the shared ledger never appended.
- workflow journal: the ledger root was the workspace, so the journal
could be neither read nor appended through the same junction.
workspace_is_user_home and workspace_state_dir put that decision in one
place: a home workspace is exempt from confinement, and its ~/.codewhale
is resolved once so later link walks start at the real directory. Links
below the state directory are still refused, and every non-home workspace
keeps the previous behaviour exactly.
Verified: cargo check -p codewhale-util -p codewhale-skills (passed);
cargo check -p codewhale-engine (passed); cargo test -p codewhale-util
(41 passed; 0 failed); cargo test -p codewhale-skills (174 passed;
0 failed); cargo fmt --all -- --check (passed). A release build of the
skills discovery probe reports 90 skills with C:\Users\asus as the
workspace, where the same probe reported 30 and logged "Refusing
symlinked path C:\Users\asus\.codewhale" before the change.
Legacy list/read DTOs silently discarded workspace, cursor, archive and
includeTurns fields from callers expecting newer contracts. Deny unknown
fields before owner I/O in direct and tagged compatibility requests; retain
supported legacy list/read and protected full-history behavior. Document
these limits in English and Chinese without claiming Codex wire parity.
Verified five existing focused list/read/archive/identity/shared-owner cases;
the shared-owner case now checks six parser refusals before any owner call.
Actual ordinary native28 baseline accepted all six unknown fields, including
an ineffective workspace filter. Native29 rejects all six with -32602, keeps
normal list/read and closed execution gates, and makes zero model POSTs.
Both builds' 4,249 inputs stayed unchanged. The first library build failed
two test-only DispatchError field accesses; corrected v2 passed. Native29
production postimages match; only those cfg(test) assertions changed later.
Muse Wonder Full assisted the read-only contract audit; root verified source
and native behavior. Receipt: CW/artifacts/takeover-20261103/
RPC-PARAMETERS-QUALIFICATION.json. No new test functions/code comments,
remote-provider, package, platform, CI or release qualification. Refs CW-7704.
Use the generated DynamicToolCallParams and DynamicToolCallResult contracts
for exact thread/turn/call delivery through the existing authenticated API.
Resolve only after its empty HTTP 202 acknowledgement; preserve actual error
statuses and uncertainty without automatic mutation retries. Reject path
segments that URL normalization would erase, and refuse mutation redirects.
Verified: 19 existing SDK checks, JS syntax, both strict TypeScript modes.
Ordinary native28 HTTP observer: three wrong-target 404s leave the waiter,
one accepted result completes the turn, repeated delivery returns 404, and
restart retains the outcome with exactly two loopback model POSTs. Actual
HTTP transport controls cover encoded identifiers, 24 invalid IDs, errors,
pre-aborted cancellation and auth/no-auth redirect refusal with zero escapes.
Receipt: CW/artifacts/takeover-20261103/SDK-DYNAMIC-QUALIFICATION.json.
No new test functions or code comments. No full RPC, remote-provider, device,
package, CI, release or deployment qualification. Refs CW-7704.
Refs CW-7704. Compatibility goal execution stays closed, so do not advertise thread/goal/set as available in either global or thread discovery. Keep the typed refusal for older clients calling the known method and keep goal read/clear discovery. Update both language docs and existing capability expectations. Correct the existing goal-read fixture to seed its fake owner through the captured Runtime API: its former direct compatibility setter is deliberately refused after the native owner migration. Production still uses no self-HTTP.
Verified 4 focused existing checks, 0 failed, after the fixture repair. The first three passed in v1; the fourth exposed that stale seeding path (runtime_unavailable: goal execution requires the canonical Runtime interaction API). All 4,249 inputs matched the guarded native28 build. Actual native stdio initialize/capability/closed-gate probe passed with 0 model POSTs and clean shutdown; its capability payloads differ from native26 only by removal of goal/set. No new repository tests or code comments.
Separately compared actual native responses with the immutable Codex rust-v0.166.0 exports: initialize and loaded/list match; thread/start/list/read do not yet match. This discovery cleanup is not full App Server parity, full-tool execution, an optimized package, platform qualification, CI or release/deployment.
Refs CW-7670, CW-6966. patch-undo ignored turn_id and undid the latest turn. Reuse the selected-user-turn preparer already used by conversation undo, retain restore admission through file changes and fork publication, and advertise thread_patch_undo_turn_id. GET previews share the physical restore planner; POST can require the exact dropped turn IDs and affected paths so changed selections fail before writes. Existing trust, owned-snapshot attribution, safety backup and later-edit refusal stay authoritative. Default depth and public restore helper behavior remain compatible. Generated protocol/SDK contracts and feature docs are updated.
Verified 22 distinct focused existing checks, 0 failed: 14 AppServer/protocol after the file-plan amendment; 8 Engine fork/restore cases reused against the exact same built binary. All 4,249 inputs matched the guarded native26 build and frozen source. Actual native macOS development CLI: five tool-write turns plus stale/foreign/range/path/later-edit/active-work refusals, named selection overriding depth, exact restoration/deletion, retained source and restart passed. Mounted Electron paired with native26 passed preview/cancel, separately confirmed conversation-only fallback, double-click guard, restore, composer and restart; no restore-triggered model request. Codewhale DeepSeek Flash supplied a read-only design review; root checked its suggestions against source and adopted exact path consent.
Scoped evidence only: no optimized package or Windows acceptance, no release/deployment. Restore and fork publication are not a single crash-atomic cross-store transaction; partial operational failures preserve the safety snapshot/source and are not reported as successful rewinds. This endpoint does not promise operation-key idempotency.
Picking a command that needs an argument from the palette, such as /rename,
replaced the composer with no way back: the draft wasn't stashed, so history
search couldn't find it. The hotbar does the same insert and stashes first;
do that here too.
Signed-off-by: Lstarsky0 <[email protected]>
Use the existing models/tool_projection owner for typed Exact/Relaxed/Omitted per-tool outcomes. Select strict shape and flag together, relax route compatibility with the existing sanitizers, share constraint-note rendering, and refuse forced choice of an omitted tool before transport. Keep logical catalogs and runtime argument validation independent of wire relaxation. Non-beta DeepSeek/local DS4 no longer receive strict-shaped parameters while strict is disabled; Responses keeps strict=false. Normalize cloned MCP API schemas like native registry schemas without changing original server records.
Dispatch, streaming, preview and deferred/search measurements consume the prepared projection. Blocking warnings and preview manifests retain exact omission counts with the existing 8x64 sanitized name sample, without schemas/refs/endpoints. Keep logical prefix fingerprints unchanged and explicitly separate from prepared wire hashes; consolidate the three default tool-choice callers.
Muse Wonder Full supplied the initial worker batch; its quota exhausted mid-edit. Root reviewed and completed the migration, bounded diagnostics, strict-route guards and existing consumer/assertion updates. No new repository tests or code comments. One unrelated pre-existing approval fixture formatting defect found by cargo fmt was corrected; review and comparison allowing whitespace/trailing commas confirm the same call and arguments, with no assertion or production change.
Verified: frozen 4,249-input native library build, 125 focused existing Engine cases, 56 schema sanitizer cases, 8 canonicalization cases and 30 logical-prefix cases: 219 passed, 0 failed. Source hashes stayed unchanged through build/checks. The later approval-fixture formatting/trailing-comma delta has its own receipt. cargo fmt --all -- --check and git diff --check pass. Existing checks cover all three dialects, prepared/preview identity, mixed strict catalogs, Kimi omission/forced-choice/warnings/deferred schemas and MCP authorization/catalog isolation.
Source and loopback fixture evidence; ordinary native CLI/product witness follows this commit. No real-provider acceptance/cache-savings, full-tool JSON-RPC admission, package, release or deployment claim.
Refs: #5633, CW-6256
Add format=md to the authenticated thread/turn receipt routes using the
existing shared Engine formatter. The default JSON response and access
boundary remain unchanged; unsupported format values fail with 400.
Desktop can display the same audit facts and coverage notes as the terminal
without deriving a second record from its activity labels.
Verified: existing authenticated receipt route case passed, including JSON,
Markdown content type/body, anonymous refusal, unknown format and foreign
turn refusal. Five existing SIWC cases also passed in the same frozen
batch. Ordinary native24 CLI compiled with all 4,249 inputs unchanged.
Mounted Electron/native24 displayed thread and selected-turn receipts with
exact one-run/one-approved/one-denied totals, and exercised grant revoke
and next-call approval. No final candidate, publication or deployment.
Refs CW-7679. Founder selected Engine audit receipt authority 2026-11-03.
Replace the generic JWT decode rejection with static signature, issuer,
audience, expiry, not-before and required-claim diagnostics. Claim names
are restricted to a fixed list; raw library errors and token values are
never interpolated. Preserve all signature/time/issuer/audience/nonce and
account checks, registration activation and plan-scope admission.
Update the existing signed identity case to pin the diagnostics, including
future not-before rejection. English/Chinese provider guidance separates
device-clock advice from plan permission and asks only for safe error text.
Verified: five existing SIWC cases passed; the same frozen batch's receipt
API case passed (six total, zero failures). Ordinary native24 macOS ARM64
CLI built with all 4,249 inputs unchanged and no test-support feature.
Windows report's exact rejected check remains unknown; no Windows fix,
package/release or live ChatGPT account acceptance is claimed.
Refs #7203, CW-7800.
Preserve Lstarsky0's contributor commits. Local macOS ARM64 review applied the exact three PR postimages on d7ff89d16c: 11 existing test-support cases passed, plus 1 existing audit isolation case passed. No Windows or exhaustive final-candidate validation is claimed. Normal-exit cleanup does not establish crash/SIGKILL cleanup. No dependent open PRs; source branch is preserved.
Canonicalize the selected plugin workspace before pool comparison, storage
and fork construction. Equivalent symlink paths retain the existing caller
and attachment guards instead of rejecting a real session.
Adapt the merged PR #7138 existing shutdown test to the extracted app-server
and runtime crate paths; production shutdown behavior is unchanged.
Verified on native23 ordinary macOS ARM64 debug build with all 4,249 source
inputs unchanged: sealed selected checks 389 passed, 0 failed; merged shutdown
completion cases 11 passed, 0 failed. Native22 real DeepSeek Flash symlink
workspace read completed successfully; production MCP postimage is identical.
Native23 P04 v4 and actual PostgreSQL pg7 joined observers passed. Actual
Stats observer passed on native22. These are local/source/provider receipts,
not Windows/package, release, or deployment qualification.
Refs CW-7764. Evidence: CW/artifacts/takeover-20261103/ and
CW/artifacts/engine-0103-execution-20261102/coherent-native23-existing-v1/.
AGENTS.md puts the reasoning in the commit message: the call is sound because
atexit only records the callback, which takes no arguments and stays valid for
the life of the process.
Signed-off-by: Lstarsky0 <[email protected]>
Updates CHANGELOG.md and crates/tui/CHANGELOG.md identically. Two new bullets carry a doubled blank line that was left as is because source edits were out of scope for this commit run.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Pins the first-party marketplace revision and the Computer Use plugin 0.16.0 archive. Release v0.16.0 of codewhale-hq/codewhale-cu-plugin was confirmed to exist and not be a draft; the sha256 was not independently recomputed.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Updates moved-file paths in the CI path filters, scripts, vitest config and editor/bridge sources; documents the Runtime API stdio/websocket controls and usage statistics (en and zh_hans); adds the usage-statistics and cache-call-receipts features to features.toml with regenerated web data; updates coarse-split design docs and crate maps, split scripts, the blocking-calls budget and release smoke scripts.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Moves the Runtime API, ACP and MCP servers, exec agent, eval, remote control/setup, chat relay and embedded web client from crates/tui/src into crates/app-server/src (git records the 57 moves as renames/deletes plus adds); adds initialized JSONL stdio, websocket, connection, owner_calls, daemon socket/client, turns and thread_control; TUI and CLI call sites switch to codewhale_app_server; bare codewhale app-server becomes stdio; LegacyHttp becomes Http. Also carries the command-contract cache-call facets, /cache calls, and codewhale metrics/stats rewrite. G4 (contract/cache/metrics) was folded into this commit because crates/cli/src/lib.rs, Cargo.toml and Cargo.lock interleave both slices and could not be split cleanly non-interactively. Includes rustfmt-only change in crates/mcp/src/config.rs and all Cargo.lock changes for the batch.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Routes NativeApprovalPublication through approval, handle, events, child_host and subagent paths; keeps accounting alive past the 64th model response and excludes usage-partition turns from receipts; exposes UsageSourceRevision accessors and a fleet ledger diagnostic reader; adds loaded-thread listing and canonical rename in the runtime_threads manager; includes related Engine tests and rustfmt-only changes in tool_preparation.rs.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the JSON-RPC envelope and initialize lifecycle contracts (rpc.rs, lifecycle.rs) with pinned wire fixtures and tests, regenerates the runtime JSON schema, TypeScript and SDK typings, and ships the upstream license, NOTICE and UPSTREAM.md files alongside the derived code. Cargo.lock changes for this crate land with the host-move commit.
Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A tombstone retires the origin before physical cleanup. Expect snapshot reads to reject the retired session, keep checking that bytes remain intact until cleanup, and verify a deletion retry removes the snapshot while retaining the shared legacy checkpoint. The existing test previously expected retired data to remain loadable.
Validation: three focused session deletion tests passed (0 failed). Eleven run-completion tests and six other former CI failures passed on Windows MSVC Rust 1.98.0 using the repository CI stack setting. Workspace formatting and patch whitespace checks passed.
Signed-off-by: Codex <[email protected]>
Preserve the observed background run across the engine crate extraction and asynchronous spawn factory. Keep the current MCP auth context, shared exec event consumer, and test-support boundary. Focused validation is in progress before push.
Signed-off-by: Codex <[email protected]>
The escape arm consumed \{, \}, \$, \%, \#, \& and \_ and printed nothing, so
$50\%$ rendered as 50 and $\{1, 2\}$ as 1, 2. It prints the character now.
\left, \right and \big took the next character as the delimiter even when it
was a backslash, so \left\{ printed a bare backslash and \left\langle printed
as written. Leave a backslash for the main loop, which knows those commands.
That includes the spaced form, \left \langle, which lost its bracket when the
offset was fixed.
Signed-off-by: Lstarsky0 <[email protected]>
Integrate original PRs7193,7196,7195 and7200, preserving their original
merges and authors. Each exact head passed the configured required checks
before its normal public-main merge. Review auto-merged command save/load
paths and tab-selection expectations.
Resolve only the generated agent-docs conflict with the actual canonical
Node derive-facts producer, retaining the raw docs from both parents. The
existing check-facts validates facts, features and all derived documentation
against the merged source. Full git diff checks pass. No manual JSON merge
or side's source docs were discarded.
The combined Rust tree will be compiled and checked with the next coherent
accounting batch; this merge is local and held from push until that proof.
No new hosted CI, full release, provider or package qualification is claimed.
Signed-off-by: CodeWhale Bot <[email protected]>
Add authenticated typed watch ingress/recovery on the existing Runtime owner,
revision-guarded private Soul editing and per-turn personality capture, and
per-tool MCP Always/Ask/Off settings with signed retained-browser replacement.
Refresh the existing Core catalog after replacement. Refuse disabled tool
calls before preparation or approval while retaining eligible route precedence
and synthetic OAuth recovery. Keep consent, ACP, captured ceilings and nested
call gates. Update the existing fixtures and generate protocol/website outputs
with their actual producers.
Validation: ordinary native12 CLI built in 442.617s over 3028 unchanged inputs,
normal default Engine features. Actual Runtime same-Core rebind, zero-approval
Off and stale-Always refusal controls pass 3/3 on immutable 4cb7607d; owned
cleanup and all source/binary guards pass. Ten other scoped MCP controls retain
unchanged-function evidence from native11; these are not 13 fresh runs. Native11
watch admission/terminal/refusal/restart passes 4 phases with full-store equality.
Original batch coverage of 46 unique checks uses 38 retained plus 8 fresh passes, not 46 fresh.
Rust schema/SDK write/check and Node facts/docs derive/check pass.
Existing MCP/namespace/OAuth/nested/Computer Use checks: 14 passed, 0 failed,
0 ignored; actual execution 3.109s. Compile/list wall time 877.297s includes
waiting for the ordinary build. All source and executable guards pass.
Limits: local development source, not release qualification. Source65 and valid
pure-tool receipt completion defects are reproduced and remain next-slice work.
Soul HTTP/preview/first-wire controls do not establish the failed full TUI
context observation. No real provider, joined Platform/PostgreSQL, required
native-platform, installed package or full release CI claim. All original
failures and fixture corrections are retained in the external execution ledger.
No installed CLI replacement, signing, deployment or publication.
Resolve explicit save and load paths against the workspace using the existing tilde expansion helper. Absolute paths retain platform Path::join behavior; existing snapshot, publication and overwrite protection remain. Exact-head source review complete; all three required checks, Safety, DCO and Version drift pass. Contributor PTY observations remain separate from Root source review; broader Ubuntu still running, not claimed green. Preserve contributor source branch.
Clarify native and subsystem installation routes while retaining device qualification limits, unsupported-lock behavior and explicit source-stamp requirements in English and Chinese. Maintain the original contributor rewrite and subsequent repair history. Actual incumbent documentation producer regenerated 25 topics from committed public sources and PR docs, including seven inherited stale sources. All three required checks, Safety, DCO and Version drift pass; broader Ubuntu still running. No device run or native support qualification claimed. Preserve contributor source branch.
Keep currency amounts from consuming surrounding text as single-dollar math. Exact updated-head review preserves the separate Unicode crash fix and display-math paths; single-dollar multiline/leading-space cases now remain literal. All three required checks, Safety, DCO and Version drift pass. Broader Ubuntu is still running; no full-suite-green claim. Preserve contributor source branch.
Expand tabs in rendered replies and sent messages using existing grapheme widths. Whole-message copy/export keeps stored source; partial selections copy painted spaces. Exact-head source review complete; all three required checks, Safety, DCO and Version drift pass after normal main update. Broader Ubuntu still running, so no full-suite-green claim. Preserve contributor source branch.
Preserve the contributor rewrite while separating existing device probes from unverified TUI/editor/model workflows. Keep the unsupported-lock exception and describe explicit build stamps correctly in both languages.
Verified: nine sections in each language, source review, and actual incumbent deriveAgentDocs over 25 topics with every public input hash checked. Regeneration also refreshes seven inherited stale public doc inputs. No device run or native qualification claim.
Signed-off-by: CodeWhale Bot <[email protected]>
Size terminal table columns from parsed content and share remaining room among wider columns. Root reviewed allocation, cell/link offsets and border consumers. All three required checks, Safety, and MSRV pass. Broader Ubuntu: 19036 passed, 46 failed, 33 skipped; the 46 failure names exactly match the retained PR7192 baseline. Existing very-narrow-terminal overflow remains a disclosed limitation. Contributor source branch is preserved.
Read BM-prefixed text without misclassifying it as BMP. Root reviewed the image sniffer and changed fallback. All three required checks, Safety, and MSRV pass. Broader Ubuntu: 19037 passed, 45 failed, 33 skipped; all 45 failures also occur in the retained PR7192 baseline, with no whole-suite-green claim. Contributor source branch is preserved.
Fix non-ASCII LaTeX rendering and saved-session reopen crashes. Root reviewed UTF-8 traversal and whitespace offsets. All three required checks, Safety, and MSRV pass. Broader Ubuntu: 19037 passed, 45 failed, 33 skipped; all 45 failures also occur in the retained PR7192 baseline (46 failures), so no whole-suite-green claim. Exact review and failure comparison retained in the Engine 0.10.3 execution receipts. Preserve contributor source branch.
Keep the active transcript, draft and queue owner until the Engine confirms the requested session/control identity. Compare the expected snapshot in the existing mailbox, preserve refused or uncertain transitions, and retain edited input plus scoped Stop controls while pending. Reuse the existing event/persistence owners.
Migrate existing fixtures to real acknowledgment, persisted source capture and fixed-thread test-environment enrollment. The sampled queue-fixture deadlock and its failed run are retained.
Verified: ordinary CLI build; 25 unique existing checks (6 affected rerun, 19 unchanged passes reused); 10 fresh production Core/MCP/session groups; native plugin 46 assertions and 20 renderer comparisons; real TUI delayed acknowledgment 16 assertions and refusal/explicit retry 22 assertions, genuine child ownership and control-socket lifecycle. No external provider calls.
Evidence: CW/artifacts/engine-0103-execution-20261102/session-ack-landing-v1/QUALIFICATION.json. Production binary b57afe0d remains uninstalled while the founder records. Full 0.10.3/native/client/final gates remain open; no release-readiness claim.
The root lives in a static OnceLock, so Drop never runs, and nextest gives
every test its own process. Each run of the suite leaves thousands of
codewhale-tui-test-state-* directories in the system temp dir.
Register an atexit hook when the root is created. libtest reports a failed
test through exit, so the hook runs then too; an abort or a kill still leaves
that one process's directory. Staged plugin trees are non-writable on unix, so
a failed removal makes the directories writable and retries.
Move the unsealed audit log into the root so it goes with it, and check the
files in the engine's probe before it exits, since they no longer outlive it.
Signed-off-by: Lstarsky0 <[email protected]>
Preserve the original contributor history. Required Lint, Windows and npm-wrapper checks plus Safety passed. All23 selected checks passed; ordinary renderer20comparisons and the integrated macOS native plugin journey46checks passed with separately carried reload/stack corrections in release branch97e073ac795. Broader Ubuntu46failures and full0.10.3 native/final release gates remain recorded and open. No source branch deletion.
Keep required credential failures explicit before connection, propagate stored
OAuth initialization failures, and keep transient desktop browser servers
with their admitted workspace. Forward the shared runtime map to the existing
Core and child adapters, schedule late registrations through the existing
supervisor, and include them in the live manager snapshot. Preserve static
precedence, private-network admission, redaction and credential authority.
Avoid an unnecessary coordination transaction when a validated session owns
no agent or worker records. Preserve owned/read-only/failed-admission fences.
Supply the plugin reload workspace translation argument. Heap-pin eight
existing interactive awaits: the real plugin confirmation overflowed the
32 MiB owner stack; measured heavy frames shrink by 7,339,536 bytes without
changing the stack limit, confirmation or execution ownership.
Prepare consistent 0.10.3 development metadata with the incumbent release
preparer: 49 local lock records updated, all 698 external registry records
and the latest-published-release fact unchanged. This does not publish a
release or freeze a final candidate.
Verification: ordinary production CLI build PASS (56.31s, 3025 frozen inputs);
actual --version codewhale 0.10.3 (dev), binary e5fc64ca47e3. Nine scoped
Engine/MCP observations PASS through seven retained and two fresh controls
on the unchanged Engine cohort; all eight ordinary dependency fingerprints
match this TUI-only rebuild. Native plugin journey PASS 46/46 plus 20 public
renderer comparisons: exact two-step trust, literal argv, stale/prefix refusal,
trust remains disabled, no plugin execution, exit 0, actual terminal EOF and
owned cleanup. One owned catalog GET, zero inference POSTs. Earlier failed
runs are preserved. Modified Rust formatting and JSON parsing pass.
Receipts: CW/artifacts/engine-0103-execution-20261102/local-0103-rebuild/
LOCAL-QUALIFICATION-V5.json (4601029555d3) and the retained ordinary Native
receipt (368289757940). Full fresh-session ACK, actual Child/RLM, paired
Desktop, broader Ubuntu and native-platform/final release gates remain open.
/save took its path as written. `/save ~/x.json` created a directory named
`~` under the launch directory and reported success, and `/save backup.json`
with --workspace wrote to the launch directory, where /load, which joins bare
names to the workspace, couldn't find it.
Expand `~` and join to the workspace on both sides, as /config does for its
paths, so they agree and the receipt names the real file.
Signed-off-by: Lstarsky0 <[email protected]>
Retain original contributor history through07967b1f12f809f2356efa63cc29529dac33d1bf.
All10 non-root-changelog postimages match the original head exactly;
CHANGELOG preserves the qualified P04 notes and adds the credited PR note.
The exact parent ordinaryCLI build passed407.81s against2338unchanged
inputs. Public production-renderer baseline is retained separately:
400000periods/400024visible bytes in83307microseconds;12of20candidate
entity assertions fail as expected before this original contribution.
A test-only helper import in the earlier observation harness failedE0432;
v6 uses the exact public production equivalent without changing assertions.
Original head CI has all3required contexts andSafetyPASS. All23direct
selected cases passed inUbuntu, while the broader run has46unique failures.
Actual local candidate build, existing cases, public renderer and native
plugin confirmation qualification remain pending. This local merge does
not merge or close the contributor PR on GitHub and is not a ship claim.
No source deletion, protection bypass or harvested replacement commit.
Bind native usage revisions, frozen route prices and original spend owners
across Engine, child/review/Auto and native client projections. Preserve
unknown usage instead of deriving money from unverified legacy totals.
Keep Source ownership until real publication acknowledgment and retain
failed settlement for later admitted flush/recovery. Copy frozen pricing
audit labels into session snapshots without changing numeric corrections.
Store continuable interrupted workers as terminal Interrupted while keeping
the public waiting-for-follow-up view. This fixes a real workflow-child
HTTP500 completion hang without weakening publication/rollback guards,
replaying a request, discarding its checkpoint or changing live approvals.
Verification: 102 unique existing cases covered by source-scoped reuse:
80 v7, 17 v8, 4 actual v10 Engine passes and 1 actual v11 TUI pass.
V11 TUI-lib compile/list passed in450.30s; exact end-to-end case passed
1/1 against2338unchanged inputs and unchanged executable hash. Existing
Apple __eh_frame compact-unwind linker warning remains. Independent bounded
v9/v11 reviews justify reuse; this is not102fresh executions. Four obsolete
existing tests are renamed/updated; no additional cases or code comments.
Earlier ordinary production-library/CLI/Runtime HTTP observations retain
their exact receipts. V9 ordinaryCLI build passed and actual HTTP500 child
control exited naturally1 with task/run terminal failure,1POST/1fsynced
synthetic effect, retained Missingrev2/checkpoint, real pipe EOF, joined
handlers/closed sockets and no forced cleanup. Known/missingHTTP200 and
13CLI/3RuntimeHTTP controls retain earlier source identities. No external
provider calls or fresh v11 ordinaryCLI claim. All failed generations kept.
Receipt: CW/artifacts/engine-0103-execution-20261102/accounting-native-v11/RECEIPT.json
SHA256:832ecfe1c1548edc9712bc31bb78288b79a375dbc0d2d4ba0cae454e9179a2b9
FullP04 remains open: raw presence, physical-attempt durability, original
workspace, prompt layers, cache economics and finite retirement. Other
release packets, native/installed/final gates and CW7704 remain open.
Exclude the two temporary originalPR7187 web files; preserve their history.
A cell can hold several lines now that <br> breaks the line, and measuring
the whole cell made its column ask for the sum of them.
Signed-off-by: Lstarsky0 <[email protected]>
Keep Prose argv as lossless JSON across Note backslash preprocessing and Markdown. Encode markup and JSON quote/backslash escape tokens without changing the decoded arguments. Plain and InlineCode serialization remain unchanged. Update one existing review case to decode the same expected argument values.
Validation: exact two original-branch preimages; Rustfmt parse/format for both files; temporary-index merge and whitespace check. Existing native checks and ordinary rendering/plugin qualification remain pending; this is a source repair for authentic PR CI, not merge or release qualification.
Refs #7192
Resolve the two changelog insertions with all release notes and original contributor attribution. Preserve main image/badge and line-break handling while decoding the displayed image/link label once. All other paths are the mechanical merge.
Verified exact11-path delta,9artifact Rust format/parse checks and independent source review. Native renderer/plugin observations and actual required PR CI remain pending. No P04 working-tree changes are included.
The Windows all-target PR check reached a dead-code error in the stdio
fixture constructor. All nine test callers are cfg(unix); production uses
spawn_with_auth_context. Match the existing caller platform guard without
warning suppression or changing transport/auth/lifecycle behavior.
Verified all nine caller guards, parser/formatter output and Windows target
cfg. Unix test compilation is identical to the qualified002e053960 source;
its passing all-target Clippy evidence remains applicable. Fresh hosted
Windows validation is required; no Windows pass is claimed locally.
Migrate the remaining protocol parity integration import to its App Server
protocol owner. Box large private publication/Fleet payload variants and
preserve public outcomes. Normalize equivalent bounded clamps, pattern
matches and guarded control flow without suppressing warnings. Remove
orphaned recovery documentation left above the foreign-session importer.
Verified the exact 13-path batch with CI-equivalent workspace Clippy across
all targets/features, 18 existing protocol parity checks and 44 existing
diff-render/Unicode checks. cargo fmt --check, changelog sync check and
git diff --check pass. The compiler input inventory was unchanged during
Clippy and tests. Earlier failed/interrupted diagnostics are preserved.
Hosted Windows/Linux PR checks remain required on each updated original
branch. This is a shared baseline repair, not Engine 0.10.3 readiness.
Required PR CI exposed inherited rustfmt drift in14 Engine/TUI publication and fixture paths. Regenerate with existing cargo fmt; cargo fmt --all -- --check and git diff --check pass. Formatter-only correction; prior behavioral receipts remain scoped to their original source and current hosted CI runs qualify this source. No new tests/comments or native local build.
Preserve original React19.3.1/DOM and types19.3.0 intent, with current Stripe23.1.0 and Node types26.6.6. Structured three-way dependency delta, root/lock consistency, exact dependency pins and diff checks pass; hosted PR CI supplies runtime/build qualification.
Regenerate the existing TUI changelog slice from its root owner. Genuine PR CI exposed missing C5 and shared-protocol entries. Existing sync check, release check-versions --range-audit-advisory and diff check pass. No native build, release or publication claim.
`prev` was the last byte of whatever came before the `$`, so `$α$th` and
`$25°$C` read the `$` as an opener and printed as written. Look at the whole
character instead: a narrow one closes, as an ASCII letter does, and a wide
one still doesn't, because that's what `利率为$r$` needs after `$1000，`.
Signed-off-by: Lstarsky0 <[email protected]>
Refs CW-7704 and CW-7764.
Runtime SDK event/image/dynamic-tool declarations were separate from the
server structs. Move the existing 10-type Runtime family to the serde-only
App Server protocol leaf, migrate all 24 repository Rust consumers and delete
the old module. Keep native Engine/session/pricing/turn authority in place.
Reuse the existing Native host schema renderer for Rust-generated Runtime
JSON/TypeScript exports. Distinguish serialized output required/null fields
from valid input defaults; publish a separate serialized spec view of the
same Rust type. Native host generated output remains byte-identical. Move
the existing UI fixture helper onto App and migrate 23 callers so the
runtime-to-UI boundary ratchet passes without a new allowance.
Validation on 63 logical paths / 2338 frozen input hashes:
- Ordinary CLI build passed 331.682s; five affected lib test builds passed 420.276s.
- 10 moved serialization checks + 2 explicitly authorized schema cases passed.
- Both strict SDK type checks passed, including exactOptionalPropertyTypes.
- Existing focused checks passed: Engine 1, TUI 4, App Server 2; Native host
generated output is exact. Artifact runner's final kind-count was corrected
from 2 to 3 after independently verifying all actual subprocess exits/counts;
no passing test was reexecuted.
- Boundary/config/navigation/session source checks passed; config/navigation
use actual all-target normal Cargo trees. Prior failed invocations retained.
- Authenticated ordinary Runtime history/info + genuine SSE output-schema
control passed: 0 model POSTs, process/pipe/socket cleanup gates passed.
The finite SSE client closes deliberately; no server EOF/resume claim.
Full Codex methods/initialization/WS/tools/subscriptions/interactions,
P04 accounting, installed/native-platform/release evidence remain open.
No hosted CI, paid provider, installation, signing or publication ran.
Source receipt 80afa4de60858786bf67309666aab7447f28095f5a9c6950d91136377b33d015
Patch 0845ad69ed203637e1c7d6059120763b37772fde9481aeef46aab69c89a3d30f
Refs CW-7438, #6011 and #5581.
A refreshed MCP catalog can compare equal while its JSON property insertion
order differs. Returning unchanged after keeping that new Vec can alter wire
bytes without a declared tool-surface change. Restore the captured catalog
when neither values nor the active set changed; real edits still rebuild the
composition entry and declare the change.
Validation on frozen source20f8244a plus exactly2paths, 2319 input hashes:
ordinary CLI build passed336.295s; Engine lib test compile passed354.092s.
Five existing MCP replacement/deferral/schema and byte-stability checks:
test result: ok. 5 passed; 0 failed; 0 ignored.
Ordinary sandboxed CLI/MCP unchanged control passed:2 loopback synthetic
POSTs, identical2566-byte raw tools values, CLI exit0, real stdout/stderr
EOF, joined handlers/sockets, no forced cleanup and no owned MCP PID left.
MCP child self-exit/stdin-EOF lifecycle rows were not captured. This control
does not claim a new adversarial server key-order reproduction.0 paid or
CU calls; no new tests/comments, hosted CI, install or release.
Source receipt b9ab78b6eb25d56a47682c1bc931393acb3c13322338bb32a2a286cb715473b7
Patch182b5d77b67445dd0396342eb7057a82d198d05da841c5217483ec718bc48cd2
Bind automatic writes and conditional checkpoint retirement to the original
physical session/checkpoint pair and an opaque native producer. Keep SDK
checkpoint ACKs ordered through the existing actor and preserve newer
publications on stale, failed or closed producers. Protect history-operation
witness binding with its original reservation and protected re-read.
Keep readable transcripts available as data when optional accounting sidecars
are damaged, without granting a write receipt. Preserve display titles and
lifecycle metadata. Render exact typed compaction carriers as System receipts
on reopen so bare undo retains real request boundaries and model history.
Verification: normal CLI build 49.878s; affected TUI lib compile 81.067s.
59 Engine and121 TUI unique existing checks pass with frozen source-delta
reuse; all originally selected checks now pass. Nine ordinary Cargo-cohort
Manager controls pass. Authenticated local HTTP history/recovery/stale-source,
unknown-delivery and actual Native SDK checkpoint/cancel/next-user pass.
Real tmux TUI SDK/Actor journey passes with3 synthetic model POSTs,1 tool
execution, exact retained prefix, graceful exit and actual EOF. HTTP Native
SDK is separately3 POSTs; unknown-delivery is1. No external provider calls.
Receipts: CW/artifacts/engine-0103-execution-20261102/checkpoint-causal-v7/RECEIPT.json
and CHECK-COVERAGE.json; prior failures retained. This is a bounded local source
slice, not full P03/P04, native platform, installed-package or release readiness.
The read tool treated any file starting with `BM` as a bitmap, so notes that
open with "BM25 is..." came back as "[Image omitted...]" and the model never
saw them, while the read still counted for the freshness check on a later
write.
Also require the BMP header's four reserved bytes to be zero. Text doesn't
have NULs there and a real bitmap still gets the refusal.
Signed-off-by: Lstarsky0 <[email protected]>
try_render_env looks for \end{...} one byte at a time and slices the rest of
the string at each step, so the first multi-byte character in an environment
panics. A reply with \text{如果} or α in \begin{cases} or \begin{aligned} takes
the whole TUI down, and the saved reply does it again on --continue.
Step by whole characters. \left, \right and \big skip the delimiter after
trimming whitespace but add the length to the untrimmed offset, which lands
inside the next character for \left 如 and is why \left ( x renders as ((.
Measure from the untrimmed text.
Signed-off-by: Lstarsky0 <[email protected]>
Every column got an equal share of the terminal, so a column holding a
row number or a short flag took as much room as its neighbour, and the
long cell next to it wrapped with half the row empty.
Give each column the width its longest row needs. When they don't all
fit, the narrower columns keep what they need and the rest split what's
left, so a table that fits never wraps and one that doesn't wraps less.
A table narrower than the terminal now stops at its content.
Signed-off-by: Lstarsky0 <[email protected]>
The page led with what used to go wrong: which check failed on the hmdfs user
directory, what the old refusal said, why the wording was wrong. A reader who
wants to run Codewhale on a HarmonyOS PC had to work out which of those
paragraphs still applied.
It now states the two supported routes, the build and signing steps, how the
VS Code extension reaches the engine in CodeArts, and one table of what works on
a device. The user-directory section keeps only the facts that change a decision
there: where the store lives, how to get strict permission checks, and that a
workspace takes one driver.
The install guide gains a HarmonyOS row in the prerequisites and in the platform
table, so the native arm64 tarball and its signing requirement are visible where
people look for a download.
Verified: both languages carry the same nine sections and the same tables, the
in-document anchors resolve, the README translation and locale checks pass, and
the three new external links answer 200. No Rust or device run: Markdown only.
Signed-off-by: Ben Gao <[email protected]>
Use one capped encoder and writer for control and ACP output. Recover only
ACP typed input refusals after draining through the actual newline; keep
cancellation state and scheduler progress. Preserve physical write failure
through operation cleanup and stop before another frame. Retain exact
owner, permission, Core terminal and checkpoint authority. Compatibility
stdio/event/relay stdout now has the existing ACP 30-second write budget;
owner/readiness keeps five seconds. Reconcile English/Chinese Runtime API
docs and both changelogs, including the current bare listener's full router.
Validation: ordinary CLI build passed in 53.680 seconds; App Server/TUI test
binaries built in 338.734 seconds. All 31 existing checks passed: 15 App
Server + 14 TUI initially; two unchanged-binary TUI fixtures passed after
shortening only TMPDIR below the Unix-socket path limit. Original failures
retained. No new tests or code comments. Formatting and diff checks passed.
All 17 ordinary local CLI controls passed (one reused, 16 new). Actual
boundaries include exact 8 MiB input, cancellation/permission identity,
prewrite response/notification refusal, two physical 64 KiB partial writes
followed by terminal EOF/no second frame, and exact saved checkpoints.
Five local synthetic inference bodies, no external provider calls. Raw
outputs/checkpoints/teardown independently reviewed; no candidate forced
cleanup. Old relay failures and an 8,388,891-byte old output are retained
as baseline failures. All 2,319 guarded source/document inputs were frozen.
Limits: encoded-frame scope only, not global Value/history memory, all P01,
arbitrary-tool cancellation, primary P04, App Server v2 or release/native
platform/install qualification. Receipt and exact identities:
CW/artifacts/engine-0103-execution-20261102/bounded-io-v2/RECEIPT.json.
Report actual composition description/schema mutations through the existing
pending tool-surface reason before C5. Preserve equal schema values/order
and any prior declaration; keep C5 and conservative capability withdrawal.
Tell models nested results omit inline images, requiring direct discovery
and capture calls for visual input. Reconcile both changelogs.
Validation: ordinary CLI build passed283.450s; Engine unit build326.613s;
10existing focused checks passed,0failed/ignored. No new tests/comments.
Two ordinary CLI/MCP cases passed4actual local POSTs: unchanged tool
headers literally byte-equal; mtime-only config change retained bytes but
withdrew the batch onPOST2 under exact change:tool_surface repin, then
completed. Old baseline3POSTs reused, including exact pre-POST2 C5 failure.
Actual reader EOF, HTTP socket/handler joins and owned MCP process absence
settled both cases without forced cleanup; no external provider/CU call.
All2315 compiler inputs held unchanged. rustfmt/diff checks passed.
Limits: no original desktop/CU-error causality, broad schema-order cache
closure, provider-cache economics, native-platform/install or final release
claim. Immutable unsigned macOS ARM64 development CLI SHA256
3664afd40174030b82b033d56e9854052e1cbebf7bdb7a7be355862d11bddcd6.
Receipt: CW/artifacts/engine-0103-execution-20261102/
c5-composition-v1/RECEIPT.json.
A `$` opened inline math and closed at the next `$` that wasn't preceded
by whitespace or followed by a digit, however far away. `$5 a month` met
the closing `$` of a formula paragraphs later: the `$` went missing and
the paragraphs between ran together. `10$ per month and 100$ per year`
and `PATH=$HOME/bin:$PATH` lost theirs the same way.
An opening `$` now has to be followed by something other than whitespace,
and inline math stops at the end of the line. Reaching a `$` that opens
rather than closes gives up on the first `$`: one before `{`, or before a
letter or digit and not right after one or a closing bracket. `$n$th` and
`$(n+1)$th` still close.
Signed-off-by: Lstarsky0 <[email protected]>
Expanding tabs turned `-<TAB>-<TAB>-` into `- - -`, which the
list check took first. Check the rule first, which also makes `- - -` and
`* * *` rules instead of bullets.
Signed-off-by: Lstarsky0 <[email protected]>
A single successful MCP JSON text block now becomes the existing execute_tools result.content value, so composed programs read its fields directly. Normalize only a bare single block/envelope with absent or boolean-false isError. Keep mixed/rich/annotated/malformed envelopes intact. The original raw envelope size, spill decision and byte receipts remain authoritative; oversize results retain the raw prefix and full saved envelope. Describe the exact return shape to the model.
Coordinated source from the CU efficiency owner, root-reviewed at codemode.rs SHA256 c4b2893ce8b9205d1fe573e7f5ac07a5f6a1f3408b6178df6bcc84abf09b6e77. Reused the frozen ordinary CLI/unit builds and 16 passing existing codemode checks from the metadata integration batch; no checks repeated. An actual ordinary CLI + synthetic MCP + local SSE oracle passed 12 payload cases against both baseline and candidate expectations. It observed the two intended shape changes, preserved rich/metadata/malformed data and error handling, and verified the complete oversized spill payload. Each run made two local synthetic model requests, with zero real-provider or desktop calls. No new repository tests/comments.
Both changelogs updated. Native macOS synthetic evidence is distinct from installed CU/global app journeys and final release qualification. Existing macOS linker unwind-size warning remains; no hosted CI or publication.
Bound actual metadata inspection at16MiB with typed resource refusal and guarded regular-file reads. Reuse the parser for checkpoints, retain healthy picker rows with warnings, refuse incomplete strict catalogs, and keep potentially referenced stores/artifacts on uncertain inspection. Top-level key scanning cannot select nested metadata decoys.
Preserve lifecycle/title intent and resolve BOTH saved/checkpoint Runtime bindings under the existing per-session write admission before archival or replacement. Keep explicit rename/archive intent with held read-modify-write. Serialize checkpoint promotion, completion publication/clear and repaired-body writes at that same owner; keep failed-publication history in memory. Move the existing persistence actor's whole owned batch offTokio through bounded owner_work, without a second store/actor/queue. Add the compatible explicit-title marker and migrate existing constructors/fixtures.
Verified frozen18-path integration at aecf3b07d7 plus patch94a723c8d12fbdb3d0340927d1eb7a006eb86ab53af8bce17556738c07a84765;2312inputs unchanged. CLI and unit binaries built.64existing Engine metadata checks +58TUI checks passed;16separate codemode checks also passed; one intentional subprocess helper remained ignored at top level.26ordinary public-API native observations, actual held-IO PTY redraw/save and6ordinary authenticated HTTP observations passed. The baseline had15failing target observations and reproduced theUIstall. Budget632sites/171files, formatting/diff checks passed. Docs now name the observed413code. No new repository tests/comments; prior failed fixtures retained.
The compiled codemode companion is staged separately. macOS retains the __eh_frame size warning. Completed-turn/checkpoint causality before admission is still open; atomic clear is not that proof. Full-history/checkpoint reads, journal retention, aggregate scan growth and first/retried live-lease IO remain separate admitted work. Native controls use synthetic state/localSSE; no Windows, power-loss, live-provider, installed-package or finalCI claim.0.10.3 remains unpublished and NO-SHIP.
Finish inherited guidance changes: point the existing sole prompt, turn-loop and remember references at the extracted Engine. Preserve the Next.js guidance generated by the installed version rather than leaving its ordinary dev-server write dirty.
Verified all three Engine paths exist and the complete generated Next block matches the unescaped template in web/node_modules/next/dist/server/lib/generate-agent-files.js; git diff --check passed. Documentation only; no tests or builds repeated. Root CW operator controls were not copied.
CW-6944 D02-01/D02-10: publish one revisioned format3 worker authority under a short OS transaction lock, preserve foreign records/claims and fence stale per-writer checkpoints. Keep exact legacy recovery bytes and a tombstone against the inspected old publisher.
Retain pending terminal results and live ownership until durable publication; retry the exact winner and report failed delivery explicitly. Fleet reservations retain previous-attempt uncertainty until exact teardown or an authoritative receipt. Final stream tails, usage and the terminal receipt share the existing atomic ledger record; failed sync retries do not duplicate accounting. Carry the same executor and manager lock through bounded owner work, and migrate all callers.
Update existing fixtures for the real transaction/provenance contract; no new repository test cases. Correct architecture and both changelogs. Read-only peer review checked the final source and ownership boundaries.
Verified at base b8c5417927 plus patch 116d80bad7a2bb58d68b6ecda05c5566f9673c14de970d1da623ff86db7f54a7; 2312 source inputs unchanged through builds and observations. Ordinary CLI build and Engine/TUI unit-binary build passed; 77 existing Engine + 4 TUI checks passed. 24 ordinary public-API native macOS process/fault/restart observations passed, plus 2 ordinary CLI RLM/handle_read synthetic-model journeys. Prior failed revisions remain in the local receipts. Existing blocking budget and changed-file formatting/diff checks passed.
The macOS linker retains its __eh_frame size warning. Native observations use synthetic state/fake children with no provider/network; SIGKILL is not power-loss proof. Legacy admitted attempts without actual settlement fail closed. Native Windows, installed packages, hosted final CI, providers and release qualification remain separate. CW-6945 retry/replay policy and the wider 0.10.3 plan stay open; no publication.
ratatui drops control characters when it paints a line, so a tab in a
span takes no cells. Go and Makefile code blocks lost their indentation
and `a<TAB>b` printed as `ab`, while the wrapper counted each tab at the
next 8-column stop.
Expand tabs on each logical line before parsing, and on each line of a
plain message, at the same 8-column stops the wrapper already uses.
A partial mouse selection now copies the spaces on screen. Selecting a
whole message, /copy and /export still give the source. Two copy tests
pinned a tab taking no cell; they now aim at the cells it takes.
Signed-off-by: Lstarsky0 <[email protected]>
Refs #6554; CW-6943. Reuse the existing shared parser and CountingWriter before result clones. Bound 32 raw fields, 4096 path bytes, 128 steps, 1024 intermediate matches and 1 MiB aggregate serialized projected fields including escaped keys and delimiters.
Verification on unchanged 2312 recorded inputs: 27 existing Engine handle/fetch cases; 22 actual ordinary-Engine ToolSpec observations; 2 ordinary CLI journeys using real RLM FINAL handles (exact success and 1025-match refusal); 18 unchanged included-source controls reused. Ordinary CLI build and focused rustfmt pass. Fetch success controls seed the public production cache; no origin HTTP, installed-package or final-release claim. Existing Engine lib-test compact-unwind warning retained. Receipts: CW/artifacts/engine-0103-execution-20261102/jsonpath/RECEIPT.json.
Use the existing owned Engine retrieval boundary for asynchronous 128 KiB
retained-result windows, cancellation, integrity checks and contiguous byte
recovery. Delete the duplicate whole-file TUI readers. Bound output/diff rows
and charged cache allocations; retain exact source copy and decision values.
Reuse the ANSI scanner and bounded grapheme normalizer. Translate 29 typed
notices across all 15 complete language packs. Keep one runtime/store owner.
An ordinary question journey found that request_user_input skipped pre-fanout
output preservation. Its exact long label was lost in a truncated JSON reply
with no artifact. Route that branch through the existing preservation helper;
the inline model view stays bounded while owned retrieval returns exact bytes.
Verified local evidence (not final release/installed/Windows qualification):
- Five-crate existing library compilation; 334 distinct scoped cases passed.
Reuse unchanged source-owner checks after the final question-only correction.
- Fresh affected Engine compilation and 51 existing input/cancel/durability,
child-cap and spillover cases passed with the standard 16 MiB harness stack.
- Four fresh-library cache/LRU, ANSI, exact-scalar and oversized display probes
passed; charged cache peak 4,063,568 of 4,194,304 bytes, max four variants.
- 16 ordinary macOS CLI modes passed: 12 unchanged producer/window/refusal/
cancel/session modes reused plus four fresh affected question modes. Normal
4 MiB and 120,000-line output reconstructed exactly across all byte windows.
Each long-label answer retained 65,709 exact artifact bytes; real tool-search
and 17 retrieval windows recovered its original label/value/kind.
- Fresh ordinary CLI d6c478baec7b8a8f3b57f2d50257acd513ff9c4ab0e0febbfe0da94ca66622b5
compiled on 1,762 unchanged inputs. Formatting/diff checks pass. Blocking
budget ratcheted to 631 sites/171 files; dead-code remains 137.
Retain failed attempts and scope: capture timing/wrapping failures, original
answer-loss reproduction, initial compile corrections, default-stack harness
abort and bundled-changelog-only correction during Engine compilation. The
Engine compile passed; the corrected CLI freeze and compilation were separate.
No new repository test cases or code comments. No native Windows, external
provider, system clipboard, global memory bound or direct open-modal identity
change is implied. Root/packaged changelogs included; no CI/release action.
Receipts: CW/artifacts/engine-0103-qualification-20261101/pager-u04/
CLI-QUALIFICATION-MANIFEST-v2.json and answer-preservation/.
CW-6943; U04-01. Remaining umbrella findings stay open.
Maintainer follow-up on original PR #7192 by @Lstarsky0. Preserve original contributor head as a parent and merge current main; decode character references once in ordinary Markdown while leaving code/link trust/control guards intact. Bound trailing-punctuation entity lookup to the existing ten-byte entity window rather than rescanning the whole URL.
Use explicit Prose/InlineCode/Plain review contexts across every existing caller, preserving literal plugin names, paths and JSON argv through transcript note preprocessing and the approval pager. Remove argv filesystem classification: raw cwd was not canonical plugin authority and could mislabel process-CWD files or race between the two presentations; every argument remains positionally visible as lossless JSON. No new tests/comments. Root and packaged changelogs credit the contributor.
Verification: actual full TUI test-target build passed on1761 unchanged frozen source inputs.97 affected existing cases passed (21 plugin command/guided-review tests +76 command-contract tests). Unchanged corrected Markdown component216existing/55manual and combined pending-images+BR216existing/63comparisons reused with exact source hashes. Fresh actual complete-renderer component passed8Prose/Plain bundle observations across absent/files/directories/symlinks in isolated CWD;16argv values round-tripped32times. Original preserved binary reproduced four wrong plugin-path labels. Original quadratic400k punctuation1.947s vs corrected14.6ms counterexample retained. Nine qualified code postimages are exact; changelog-only additions follow compilation.
Limits: scoped macOS full-caller/component/command checks, not an ordinary mounted review-pane/CLI, platform, fullsuite or release pass. Protected checks at this repaired head remain required; no workflows launched/waited/repaired, no merge/protection change/branch deletion. No signing/deployment/publication.
Evidence: artifacts/engine-0103-qualification-20261101/prs/7192/live-qualification/{OVERLAY,source-before,build-result,existing-results,RESTORED}.json; correction/{MANIFEST,ARGV-IO-BUILD,ARGV-IO-OBSERVATIONS}.json; RECEIPT.json. Original contributor commit45e17fb279fae28e876816c7ce4db52aac7d0bd5 remains in this PR history.
Move the existing305-line avatar contract and its three existing tests intact into Protocol. Kit's existing public path reexports those same types; Engine's two owners and TUI's two data consumers use Protocol. Rendering/artwork/player sources remain unchanged, including their ownership checks; the existing Engine ownership fixture now creates a tiny valid pack rather than native art. Preserve donor MIT notice in packaged LICENSE.avatar. Remove Engine's direct kit dependency, add kit→Protocol, resolve both standalone lock graphs with original pet versions retained. No new tests/code comments/crate/second parser.
Release helper includes the kit's Protocol pin and both standalone Protocol lock records in the same bump/rollback transaction, preserving independent kit0.2.0. Minimum registry Protocol must become0.10.3 at final family preparation, before separate Protocol→kit→dependents publication. Reconcile stale root0.1.3 changelog text; root/packaged and kit changelogs/README/coarse design updated.
Verification: six-crate existing test-target build passed on1761 frozen inputs.7 affected existing cases passed: moved Protocol avatar3, actual Engine avatar ownership2, TUI avatar2. Real standalone kit lib locked/offline check and pet locked check passed with lock hashes unchanged; initial pet offline miss(lru0.18.4) retained and exact package downloaded without version churn. Existing prepare-release, version and45-crate publication-order helpers passed. Two actual maintained-fixture helper observations prove Protocol pin/two-lock bump, independent kit version retention and exact byte rollback on downstream failure (Cargo shim explicitly distinct from real locked checks). Protocol package inventory includes both avatar.rs and LICENSE.avatar. No unchanged artwork/runtime rendering tests rerun.
Limits: Engine retains direct ratatui/crossterm/Palette coupling; host move and StageB open. Local current family0.10.2 pin is implementation state, not an installable registry minimum. No kit/Protocol publication, hostedCI, nativeWindows, final artifacts, signing or deployment.
Evidence: artifacts/engine-0103-qualification-20261101/coarse-prereq-integration/{build-result,lower-existing-results,engine-existing-results,tui-existing-results,standalone-checks,pet-tui-online-check,release-helper-results,avatar-release-helper-observations}.json; protocol-package-list.log and prepare-release-test.log. Refs#5586,#5316; CW-7764.
Move the existing socket inputs/resolver/constants/error data and Unix store-derived sibling layout into Paths; AppServer reexports the same API and retains transport, credentials/leases/ACLs and Windows owner/pipe derivation. Migrate all internal layout consumers. Sandbox read_guard changes import only; remove its sole AppServer normal dependency. Existing comments/docs move with implementation; a narrow fulfilled missing_docs expectation preserves the moved enum's thirteen already-undocumented named fields. No new tests/comments, helper pool or copied policy.
Verification: six-crate library test-target build passed on1761unchanged frozeninputs;48focused existing cases passed (Paths4, Sandbox read_guard25, AppServer daemon_socket13, TUI selected socket6). Source comparison keeps resolver/store hash and both Windows ownership derivations exact. Actual locked48-workspace production graph, including optional/target edges, is acyclic and Engine/Sandbox no longer reach AppServer; Paths has zero internal dependencies. Existing45-crate publish-order and version helpers passed. Existing public aliases are exercised by AppServer tests. Root/packaged changelog and coarse design status updated.
Limits: this removes the cyclic dependency prerequisite; host-band move, avatar/terminal residuals and StageB remain separate. Native macOS proof does not establish Windows transport/reparse or final distribution acceptance. No fullsuite/hostedCI/signing/deployment/publication.
Evidence: artifacts/engine-0103-qualification-20261101/coarse-prereq-integration/{source-before,build-result,lower-existing-results,tui-existing-results,actual-graph,release-helper-results}.json and coarse/socket-layout/{STATIC-REVIEW,graph-receipt}.json. Refs#5586,#5316; CW-7764.
Use existing explicit-root ExtensionHostManager/TestManagerGuard for discovery and selected-retry fixtures; propagate the existing environment ticket through the actual spawn_blocking path in cfg(test) and retain the sealed home. Join/abort/drain the fixture's own manager and server before releasing its root. Request assertions and timers stay intact. No new repository tests/code comments and no production connection/credential-policy change.
Verification: current TUI MCP filter125/125passed, selected control-socket6/6 and avatar2/2passed separately (not counted in125). Engine MCP447passed/2ignored is reused from the prior fixture freeze: its fixture/owning MCP source stayed unchanged; the identical five failures had independently reproduced on the pre-MCP binary and all passed isolated. Current six-crate test-target build passed on1761unchanged frozeninputs. Actual native pagination sample previously caught the blocked worker at skills discovery/env mutex; receipts retain the original counterexample and intermediate TUI124pass/1failure. Root/packaged changelogs synchronized.
Limits: focused existing parallel fixtures, not a full suite, modern-MCP protocol, live OAuth custody, Windows, provider or release claim. The socket/avatar/security batch compiled together is split into coherent commits; no CI/signing/deployment/publication occurred.
Evidence: artifacts/engine-0103-qualification-20261101/coarse-prereq-integration/{source-before,build-result,tui-existing-results}.json; coarse-fixture-existing-results.json; mcp-failure-diagnosis/{RECEIPT,native-pagination/RECEIPT}.json. Refs#5637; CW-6257.
Active-session evidence now opens through the existing Runtime session-relative confined owner before using the same pinned file, stream and hash. Previously canonicalizing a linked session/artifacts directory promoted an outside directory into the authority root; an actual classic-reference ToolSpec request returned a synthetic outside payload. LegacyGlobal retains its existing confined opener and digest/origin checks. No pager feature, new parser, test or code comment.
Verification: all14 existing retrieval cases passed.12 actual current ToolSpec filesystem controls passed: relative/absolute/nested owned reads, deliberately relocated application sessions root and owned legacy sidecar returned exact bytes; session-parent/in-root-session/artifacts/leaf links, outside hardlink, foreign namespace and wrong legacy origin refused. Payload/metadata hashes stayed unchanged; denial output excluded the synthetic payload/outside path. Actual fresh Engine/AppServer dependency fingerprints pin the same Runtime owner. Six-crate existing test-target build passed on1761 unchanged frozen source inputs. Root and packaged changelogs synchronized.
Limits: scoped macOS synthetic filesystem and actual ToolSpec observations, not Windows reparse, kernel syscall interruption, real-user/provider, full-suite, hostedCI or release acceptance. Other coarse/fixture changes in the compiled batch remain separate commits. Signing/deployment/publication not performed.
Evidence: artifacts/engine-0103-qualification-20261101/retrieval/session-parent-fix/{RECEIPT,link-result,PREP}.json and coarse-prereq-integration/{source-before,build-result,engine-existing-results}.json. Historical counterexample: retrieval/pager-parent-symlink-baseline/RECEIPT.json. Refs#6149; CW-6943.
Move the existing owner_work and RuntimeControlFrontend into Runtime and migrate every internal fully qualified caller. Keep the two public App Server paths as aliases to the same function/type, preserving source compatibility and one static four-slot semaphore. Preserve captured closures, handles, permit lifetime and enum variants. Remove the direct Engine→AppServer manifest/lock edge; add the acyclic AppServer→Runtime edge. No new pool/runtime/session authority.
Verification: shared Runtime/AppServer/Engine/TUI existing test compilation passed on1756 unchanged frozen inputs; actual normal CLI --tests typecheck passed. The2 existing AppServer owner admission/bootstrap cases passed.2 actual component operations passed: metadata plus oldAppServeralias occupying4slots while newRuntimeowner and Engine retrieval both queue. Abortedwaiter retains workerpermit, dropped closure neverexecutes,5heartbeats, cancel18us, follow-on exact metadata1.44ms after one old-alias release, max4active and allworkers exited. Independent Cargo fingerprints pin one actual Runtime library across Engine/AppServer. Fullblocking635/172, locked45crate publication-order metadata, formatting and diff checks passed. No new tests/codecomments; existing docs move with implementation.
Limits: this is one coarse prerequisite, not StageA2/B completion. Production Engine→Sandbox→AppServer remains through the shared protected socket-layout owner, which must move intact before AppServer can depend on Engine. Avatar/kit decoupling, host-band move and StageB remain open. Companion existingMCPfixture repairs in the same compiled dirty batch are not staged here; their scoped receipts and remaining baseline failure are separate. No fullsuite/hostedCI/Windows/distribution/provider/publication claim. Debug unwind-table warning retained.
Evidence: artifacts/engine-0103-qualification-20261101/coarse-fixture-{source-before,build-result,cli-check-result,existing-results}.json and retrieval/owner-relocation/QUALIFICATION-RECEIPT.json. Root/packaged changelogs included. Refs#5586,#5316; CW-7764.
Use stable first-occurrence root deduplication once in the existing Fleet owner and a component-sorted covering-subtree scan for cross-task collision refusal. Preserve the existing normalizer/overlap predicate, scope admission and worker limits. Do not add an arbitrary task-count cap to the deliberate uncapped-agent policy. With multiple invalid claims the first reported pair/error can change; HTTP400/refusal and zero execution remain intact.
Verification:78 existing worker-runtime checks passed. Actual ordinary CLI matched all52 frozen HTTP observations (24semantic+28performance) against the preserved baseline: identical payload hashes and response/refusal categories, unchanged Fleet/thread/workspace projections, zero provider operations and zero workers. Largest1,968,597-byte request stayed under existing2MiB HTTP cap. At12,288 disjointtasks median wall1.6371s→0.08664s, processCPU1.64s→0.085s; one task12,288roots1.1924s→0.01940s, CPU1.19s→0.02s. These are scoped macOS preprocessing observations, not executed-agent or provider/task latency claims. Existing shared Engine/TUI/CLI compilation passed; no new repository tests/comments.
The attempted TUI filter parallel_write selected zero existing cases and is excluded. Actual HTTP controls cover punctuation/order/prefix/root/nested/same-owner/traversal/control-character semantics. Inherited concurrent MCP test failures are retained separately and not a Fleet gate claim. Root/packaged changelogs included; final supported-target/distribution qualification remains open.
Evidence: artifacts/engine-0103-qualification-20261101/unbounded-tail/fleet-cpu/{BASELINE-RECEIPT.json,CANDIDATE-RUN-RECEIPT.json,CANDIDATE-COMPARISON.json} and mcp-fleet-io-cli-build-result.json. Actual candidate binary SHA740e3a2a6f1938b44c252b86ba6059b2d46098dc9514780a3d75e530a3ef26d5. Refs#6554; CW-6943.
Reuse the existing AuthContext from Engine/thread-manager construction through pools, connection admission, pending/supervision/retry, reload/fork, child Engines, Rust/SDK stdio and HTTP/SSE, and OAuth discovery/login/retry setup. Missing injected values never consult ambient secrets. Legacy standalone constructors share one immutable zero-state process context; reviewed plugins retain exclusive captured HostEnvironment authority. Mask captured-environment Debug; reject foreign-context connections and warm handoffs, including placeholder-resolved stdio handoffs without a current resolution receipt. Preserve bootstrap allowlist and optional HTTP credential semantics.
Actual qualification:24 ordinary public-API observation groups plus6 separately labelled plugin controls passed, with20 independent run-oracles,118 local HTTP requests and18 stdio launches. Same-PID A/B scopes exclude globalPOISON across Rust/actual HostSDK stdio and HTTP/SSE, missing credentials, foreign admission/handoffs, reload/retry/fork/supervision, two real Engine owners and workspace pool rebuild. Required placeholders refuse before launch; optional HTTP inputs omit credentials and preserve remote401. Host had actual Node children with no fallback; all descendants exited. OAuth setup made no authorization/token exchange. Plugin-only existing test-support constructors seed synthetic captured environments before real discovery/trust/transport; ordinary profile has only default feature, no test-support.
Existing checks:442 EngineMCP +123TUIMCP +2plugin checks passed in concurrent batches; the7 initial failures passed individually. The pre-change retained Engine binary reproduced exactly the same5 concurrent Engine failures (442pass/5fail/2ignored), and all5 pass isolated on both binaries. This establishes inherited batch sensitivity, not a clean concurrent gate;2TUI isolatedpasses are not a baseline batch proof. Source/task-lifetime diagnosis and existing-fixture isolation remain open. No timer softening or new repository tests/comments. Fresh test/ordinaryCLI builds passed on1755 frozeninputs, with debug unwind warnings retained. Initial wrong import and fixture-only failures retained/corrected.
Limits: no durable OAuth token-store custody or live revocation/rotation guarantee; existing OAuth clients snapshot headers. No complete bootstrap/filesystem/tenant isolation, modern-protocol/provider/native-platform/final-release qualification. Source and root/packaged changelogs included. No signing/deploy/publication.
Evidence: artifacts/engine-0103-qualification-20261101/mcp-secrets/ACTUAL-RESULT-v2.json; mcp-failure-diagnosis/RECEIPT.json; mcp-fleet-io-{build-result,cli-build-result,existing-results}.json. Refs#5637; CW-6257.
Replace whole-file reads in all seven retrieval modes with one pinned confined regular-file stream, complete digest/count verification and bounded text/slice retention. Preserve session/legacy ownership, redaction, generation, expiry and corruption refusals; never return a partial success. Limits:512MiB/20s verification scan,1MiB raw text line,8MiB selection,4KiB query and32KiB reference. Byte mode preserves exact recovery for giant/binary lines.
Resolve/authorize/open/initial metadata and final metadata validation reuse the existing four-slot owner_work. Cancellation/drop remains prompt during admission/preparation; real worker retains permit/handles until exit. No new thread pool or evidence authority. Bound the shared legacy sidecar reader to64KiB and reject links/special files for both callers.
Verification:45 existing checks passed (retrieval14+truncate31), fresh shared Engine/TUI/plugin test compilation passed on1755unchanged frozen inputs. Actual current library:20 affected ToolSpec,4 real legacy publisher/ownership,7 shared-reader controls plus1 actual four-slot admission/cancel/drop/recovery operation passed.256MiB tail/bytes RSS about11.1MiB; queued cancellation21us with current-thread heartbeat and permit retention. Earlier91ToolSpec+5reader controls cover unchanged stream/selection logic with their own old-library receipts, not relabelled as current. All7 modes previously observed on32/128/256MiB, exact512MiB metadata/bytes accepted; current representative large controls passed. Full blocking budget635sites/172files, source hashes and diff check passed. No new repository tests/comments or external provider call.
Limits:20s timeout branch source-reviewed, not exercised; kernel filesystem syscalls cannot be forcibly interrupted and keep their permit until return. Existing TUI raw payload pager remains a separate unbounded-read frontier. No installed/native-Windows/final-release evidence. The separately dirty MCP batch has7 initially failing concurrent checks under investigation; this commit claims only its scoped45existing+32actual proof and does not ship those dirty files.
Evidence: artifacts/engine-0103-qualification-20261101/retrieval/{QUALIFICATION-RECEIPT.json,io-offload/RESULT.md,io-offload/observations/QUALIFICATION-RECEIPT.json}, mcp-fleet-io-build-result.json and mcp-fleet-io-existing-results.json. Root/packaged changelogs included. Refs#6554; CW-6943.
Render at most64 placeholder rows for legacy child-count summaries, retain omitted counts in the existing panel serialization, and mark missing outcomes/usage/elapsed Unknown. Preserve u64 totals through the final native workbar without narrowing on32-bit targets. No arbitrary cap on actual agent tasks.
This changes the public independent kit total API from usize to u64. Advance all Engine path pins/locks from unpublished0.1.3 to unpublished0.2.0, document the migration, and keep registry publication/package qualification separate. Published0.1.2 lacks the existing Role::Accent vendor API; a0.1.x upload would also incorrectly promise source compatibility. No package uploaded. Canonical sibling refs preserved in the qualification backup; no blind sibling replacement.
Verification:31 existing workflow-panel and128 existing vendored terminal-kit checks passed. Actual public NativeChrome component retained u64::MAX exactly at widths40/80/140, with empty unknown-outcome bar and no invented time/tokens. Source branch review proves at most64 placeholder rows and lossless persisted omitted counts. Full CLI with0.2metadata compiled against1755 unchanged frozen inputs; linker unwind-table warning retained. Versions/release-note receipts, full blocking budget and diff checks passed. No new repository tests or code comments.
Limits: a normal mounted producer of bare u64::MAX summary has not been established; failed seeded admission is retained and excluded. This is component/source evidence, not an ordinary mounted history or32-bit/native release qualification. Separate approval for kit0.2publication plus registry checksum and normalized Engine/TUI package checks remains required.
Evidence: artifacts/engine-0103-qualification-20261101/{bounded-existing-final.json,bounded-020-build-result.json,unbounded-tail/workflow-replay/QUALIFICATION-RECEIPT.json,unbounded-tail/ratatui-publication/PUBLICATION-PACKET.md}. Refs #6554; CW-6943.
Continuously drain the Python child stderr pipe into a 64 KiB diagnostic capture, counting omitted bytes, instead of waiting until the protocol round finishes. Bound telemetry admission to 512 events with reserved final-control capacity and read only its 256 KiB/512-record disk tail. Preserve opt-out, tombstone and FIFO persistence behavior.
Verification: 89 distinct existing checks passed (REPL36, telemetry53). Nineteen actual component observations passed:9 REPL,7 public buffer/RSS,3 exact actor-owner observations. The old1 MiB stderr deadlock reproduced; candidate2 MiB completed in23ms. A512 MiB sparse telemetry file retained64 records at6.4 MiB RSS. One consent fixture initially failed because the runner forced telemetry off; exact rerun without that override passed. No external network/provider call, new repository test or new code comment. Cargo fmt, staged-source blocking budget and diff check passed. Full-tree budget correctly holds the separate uncommitted saved-result preparation fix.
Evidence: artifacts/engine-0103-qualification-20261101/{bounded-existing-final.json,BOUNDED-RESULT.md,bounded-runtime-qualification.json,bounded-020-build-result.json}. Core source compiled with293 distinct existing checks across the frozen bounded batch; this commit claims only its89 covered checks. Remaining resource frontiers and final native/platform/release gates remain open. Refs #6554; CW-6943.
Ordinary undo could restore an older invocation after conversation-only
backtracking and a repeated request without current snapshots. Actual
terminal file loss was reproduced before this fix.
Route ordinary /undo and the new /undo select picker through one async
owner. Check the matching Engine conversation, persisted host UUIDs,
completed owned request/per-tool windows and live paths before restoring.
Hold managed workspace admission through guarded file rollback and
acknowledged Engine rewind/save; respect active goals, delegated work and
shell completion. Cancellation retains the guard inside the file worker.
Force never waives identity or live-file protection. Reuse the Runtime
transaction/history overlay; compatibility adapters lose physical restore
authority. Read-only and tool-free requests can rewind without Git.
Show Checking, Restoring, Saving and completion through command receipts,
with full refusal/save-failure rows and visible empty notices. Esc-Esc
continues to affect only conversation. Legacy/multipart/missing receipts
and blank-first-line legacy Git subjects refuse with recovery guidance.
Existing test expectations follow deferred ownership and safe refusals;
no new repository tests or code comments.
117 distinct existing checks passed: commands 28, mutation 38, Runtime
patch-undo 19, backtrack 23, toast 16, feature registry 2 (filters overlap;
counts deduplicated). Initial dead-code compile failure and incorrect
blank-first-line fixture expectation are retained; corrected case passed.
Reused locale parity for 15 unchanged 2753-key catalogs. Format, vocabulary,
versions, contributor credit and whitespace checks passed.
Actual default-Ask macOS PTY matrix 14/14: independent file hashes/journal
IDs; hard restart with zero automatic requests and explicit follow-up wire;
repeat prompts, stale single/range, force refusal, later edits, active turn,
cancel, multipart, legacy, no-Git chat/read and save failure. Actual terminal
frame replay proves all 3 progress phases then completion; repeated/empty
undo and empty selector are visible. v7 data-path receipts reused; v8 reran
range/single/display. CLI SHA256:
56d9a34e3df4991a3a825066f40d7750b163245849bb792a138bb0228b664975.
1755 compile inputs frozen; only clearer embedded release notes changed
at landing. Linker warned __eh_frame exceeded 16 MiB. Native Windows/final
artifact checks, full suite, CI and release remain unqualified.
Refs CW-7418/#6970. Thanks @luestr for the report.
Evidence: CW/artifacts/engine-0103-qualification-20261101/windows/
terminal-matrix-final.json, existing-checks-final.json, landing-source.json.
Keep Dependabot's original PR and branch. Official package integrity, 21 existing commerce cases, four zero-egress fake-Fetch requests and a combined project TypeScript overlay passed. Checkout create/retrieve serialization and signature acceptance/refusal remain compatible. The SDK default API version advances from 2026-09-30.endive to 2026-10-28.endive; account/webhook version and live activation remain separately unqualified. Required Lint, Windows tests and npm wrapper contexts passed; no open dependent PRs or substantive review findings. Optional Ubuntu Rust tests were still running at snapshot. No billing, webhook, activation, deployment or release action.
Keep Dependabot's original PR and branch. Exact package integrity and project-wide TypeScript overlay passed with zero diagnostics. Required Lint, Windows tests and npm wrapper contexts passed on this head; no open dependent PRs or substantive review findings. Optional Ubuntu Rust tests were still running at readback; this source-only type-declaration change does not qualify the final Engine release.
Backport upstream minimatch preprocessing and glob abort fixes while keeping
existing glob, ESTree and build-tool APIs. The rejected minimatch 11 override
silently enumerated no files with real glob 9/12 consumers. Preserve versions,
licences, original lock bytes and complete upstream audit findings.
Postinstall verifies exact versions and complete original/patched hashes for
all declared distributions and four bundled runtime copies. The audit checks
all concrete reachable advisory leaves and rejects unknown/missing findings,
changed sources and pure cycles. Legacy minimatch 3 lacks the reported path.
Verified fresh scripts-enabled npm ci (896 packages),7 existing security cases,
targeted ESLint, 54 manual preprocessing/abort/bundle/offline-load controls
and 7 real glob/ESTree/legacy consumer observations on Node 22.20.0. All 12
matching runtime files accounted for; official archives matched lock SRI.
Actual abort controls observed zero reads after rejection. Public NFT tracing
preserved 4 files/0 warnings; its private cancellation remains source/hash proof.
Raw audit retains 18 moderate package findings; verified mitigation wrapper
passes, alert #244 remains OPEN. No registry-fixed, alert-dismissal, full web validation,
hosted CI, provider, deployment or release claim. Refs CW-6949/#6560.
Evidence: CW/artifacts/engine-0103-qualification-20261101/minimatch/RECEIPT.json
Upstream: isaacs/minimatch 77a0f5c and isaacs/node-glob 4682e8c.
Co-authored-by: isaacs <[email protected]>
Keep React and React DOM on 19.3.1 in PR #7187. The Dependabot update
advanced React DOM while retaining React 19.3.0 in the lockfile, which
throws an incompatible-versions error before rendering in both modes.
Verified official npm tarballs against registry SHA-512 integrity and
the PR lockfile. On Node 22.20.0, the original version pair refuses
both development and production rendering; the aligned pair renders
the expected HTML in both modes. A read-only TypeScript 5.9.3 overlay
using @types/react-dom 19.3.0, @types/node 26.6.6 and Stripe 23.1.0
checked 458 web root files with zero diagnostics.
No installed dependency tree, source checkout, API, or webhook setting
was changed during qualification. Full web release gates and protected
checks for this repaired head remain separate.
The inline parser printed <, & and | as written, and a link
kept the & in its target, so the query string it opened was wrong.
Decode them in plain text, link labels and link targets, leaving code
spans alone. Plain text decodes the whole run instead of stopping at each
&, so Vec<u8> stays one word for the wrapper. The result is text, so
<br> prints as <br> and doesn't break the line.
A reference to a control or hidden character stays as written, by the same
hidden_chars check the GitHub report tool uses, so a reply can't put ESC or
a bidi override on screen this way. A reference at the end of a bare URL
stays outside it, as in GFM, so <https://a.test> links to
https://a.test.
escape_review_text now escapes & as well, since & has become markup and
plugin review text has to show what's in the file.
The names match decode_html_entities in the web scraper, which is in the
engine crate; tui-kit doesn't depend on it.
Signed-off-by: Lstarsky0 <[email protected]>
Refs #6554 and CW-6943. Reuse the release HTTP reader for OpenSandbox: reject success bodies over 8 MiB, cap errors at 4 KiB and sanitize remote controls before display. Parse failures expose location without echoing remote bytes. Share the existing 512 KiB skill reader across discovery and audit markers, preserving approved global symlinks and useful refusals. Reject aggregate web.run batches over 64 operations before cache or network effects.
Existing local checks passed: release 57, sandbox 104, skills 182, WebRun 34. Manual public-entry probes passed 11 sandbox wire cases, 11 skill filesystem cases and 10 WebRun cases. The latter independently recorded 72 loopback requests, zero rejected-operation requests, an unchanged turn counter and retained cached pages. No provider inference or deployment.
The shared HTTP extraction also uses saturating overflow accounting. The final release checks reran after that arithmetic guard; the unchanged finite-cap sandbox and skill behavior retains its original receipts. Full CLI compilation passed with all 1740 frozen source inputs unchanged. Native debug links emitted the recorded __eh_frame size warning.
Exact source fingerprints, commands, binary hashes, earlier failed controls and verification limits are retained under CW/artifacts/engine-0103-qualification-20261101/. This lands three bounded-read findings, not the entire audit umbrella or a frozen 0.10.3 release candidate. Remote exec cancellation and other admitted requirements remain open. The separate undo draft and its release note are excluded from this commit.
The stale singleton had no package locale, exceeded the one-installer schema limit and repeated ZIP installer identities. Match the actual portable x64 contract, VC++ dependency and codewhale command. Look up the exact compatibility asset in the release checksum manifest and keep the mirror byte-identical.
Native WinGet 1.29.380 validated the generated 0.10.1 and 0.10.2 manifests against the actual published checksums. Four invalid inputs preserved both outputs. Sixteen ordinary-user checks on Windows 11 ARM64 covered x64 0.10.1 install, upgrade to 0.10.2, payload hashes, candidate owner delegation, removal, and exact user PATH restoration. ShellCheck, bilingual guide rendering and embedded changelog sync passed. Distribution publication and native Windows 10 floor validation remain separate.
Preserve an existing trailing delimiter when appending the install directory. The existing exact-entry removal then reconstructs the original PATH, including its registry type. Remove only the two installer values from the shared product key and remove the parent only when empty.
In an ordinary Windows 11 ARM64 account, the original x64 installer lost the trailing separator and an independent product subkey. The repaired NSIS 3.13 setup passed 30 checks over two install and uninstall cycles with the same frozen x64 development CLI. Both command hashes, Apps registration, shortcut target, owner advice, PATH bytes and type, and unrelated settings and files were checked. All 18 existing PowerShell assertions passed. Native x64 hardware, the supported OS floor and final distribution artifacts remain separate. Refs CW-7542.
The bare-URL scanner consumed the break and the next word before the inline parser saw them. Stop at a recognized break while keeping encoded angle brackets and other existing URL syntax intact.
Verified against the original PR integration tree with 216 existing TUI-kit checks, seven inline-code cases and 13 focused renders, including multilingual URLs and tables at two widths. The submitted head reproduced the incorrect link target.
Signed-off-by: CodeWhale Bot <[email protected]>
Windows PowerShell in a detached process returned success but left the
renamed executable on disk. Use the SDK hidden-console flag for the
existing deferred helper. Keep the parent wait, receipt validation,
guarded rename and exact literal-path deletion.
Reproduced a 189,454,848-byte leftover in ordinary Windows Terminal on
Windows 11 ARM64. A three-mode ordinary-user probe isolated the creation
flag. A second reproduction and the paired corrected replay ran under
the guest agent. Two real archive install/uninstall cycles passed all 19
checks there, including both command names, receipt removal, dry runs,
unrelated files, workspace and user PATH preservation. All 4,200 source
inputs matched before and after the full ARM64 MSVC development build.
Formatting, version consistency, changelog sync and contributor credit
checks passed. Other architectures and final packages remain unqualified.
Refs #7091 (CW-7542).
The contributor PR merged as cfef335d1c. Its integrated renderer passed all 216 existing local kit checks and seven targeted rendering comparisons. All three contributor credit surfaces already include @Lstarsky0. The changelog mirror, credit, version, formatting and whitespace checks pass.
CW-7553: register Tokio's CtrlBreak and CtrlClose streams alongside CtrlC
and route all three through the existing bounded shutdown task. Preserve
its two-second Runtime API and persistence drain and second-signal escape.
Correct the existing claim that CtrlC also receives CtrlBreak.
Native Windows 11 Pro build 26300 ARM64/MSVC receipts: the exact adapter
excerpt handled CtrlC, CtrlBreak and real ConPTY close, 3/3 with exit 130.
The baseline handled CtrlC but default-terminated on the other two events
with 0xC000013A. All 15 receipt-program dependency versions and checksums
match the workspace lock. Rust 1.99.0; unchanged source hashes recorded.
Cargo format and diff checks pass; embedded changelog regenerated.
This proves Windows control-event dispatch, not full Engine persistence,
ordinary Windows Terminal acceptance, or the original Deepin report.
Those platform journeys remain release requirements.
A markdown table row has to fit on one source line, so <br> is how a
cell holds more than one line, and models write it often. The renderer
printed the tag as text: Default: 3<br>Set to 0 to turn retries off.
Parse <br>, <br/> and <br />, in any case, as a line break and end the
row there. A table cell lays out each part that fits straight from its
spans, so inline code keeps its leading spaces, and goes through the
wrapper if a part doesn't fit. This lives in the inline parser, so a tag
inside inline code stays as it is, **one<br>two** stays bold on both
rows, and a paragraph or list item breaks the same way.
Signed-off-by: Lstarsky0 <[email protected]>
When the active keyless local default still has an unverified context window, refresh its existing endpoint catalog before Auto classification and route admission. Use the bounded catalog read. A configured or known window skips the refresh.
Matched Ubuntu ARM64 terminal runs used separate real Ollama 0.40.11 daemons and the same installed models. Prior main sent one chat and refused turn two on an 8192-token fallback while the daemon served 32768. The candidate saved answers 16, 17 and 18 with windows 8192, 32768 and 32768. The third turn made no catalog call. A separate process retained its configured 24576-token window, and its offline Auto preview made zero requests. Rechecked 2208 frozen source inputs, format, changelog and the existing 636-site blocking-call budget. Refs #5848.
Reuse the ticketed startup probe for an explicit retry on the selected unresolved keyless local route. Recheck route and picker state on completion and keep explicit credentialed switches on their existing path.
On Ubuntu 24.04 ARM64, the prior terminal showed no composer echo during a 1,250 ms observation of a held catalog response. The candidate displayed the marker in 45 ms, kept the model unresolved on failure and accepted qwen3:4b on retry. An interacted picker retained its selection across a late success. Both binaries passed the authenticated catalog control. Rechecked 2,208 frozen source inputs, format, changelog and existing blocking/dead-code budgets. Refs #5848 and #7116.
Record the original #7184 follow-up from Lstarsky0. Matched native renderer observations at 80 and 100 columns covered two- and four-space indents, an isolated styled space, link hitboxes and unchanged narrow wrapping. All 216 existing TUI-kit cases passed on the submitted renderer. The contributor check found all 12 people across three surfaces. Version checks covered 39 linked references, the TUI changelog is synchronized and the generated contributor bytes match the authored source.
Credit Sh1Zuku's original PR #7183 and record the bare model's context and output limits. On the merged asset the offline catalog seed rendered exactly, matching the eight-spelling resolver input. Both owning cases passed on the original contributor Linux job. Verified all 12 contributors on three surfaces, 39 release-note references, workspace versions, web facts and the terminal changelog. The generated contributor document matches its authored bytes and digest.
CW-7640. The old fixture presented only a last model name, then expected that unverified name to change the budget. Main reproduced the same failure as contributor #7183. The existing case now checks the fallback for a partial receipt and the exact model and million-token window for a matched live receipt under a sealed home. The compaction case, the model-budget update and the Auto inspector case all passed in the native Cargo run. Runtime route validation is unchanged.
CW-7701, CW-7640. Move the existing read-only ambient-home tripwire back to the test binary containing its 11 terminal cases, including the renamed durable rewind. Report the extracted Engine as the owner of the relay template and use its base-prompt provenance in the manifest fixture. Refresh the three source-backed diagnostics baselines, public reference and generated docs. Regenerating the docs also synchronized the existing provider and contributor sources.
The deliberate context/compaction line accounts for all 18 additions across six existing turn-event fixtures. Stripping only those additions reproduces their previous bytes. The metadata block measured 396 bytes on native macOS. Its new 436-byte ceiling preserves the existing 10% tolerance. The 19 native TUI checks passed, including the sentinel and all six scripted turns, along with 22 Engine checks for manifests and the size ceiling. The ordinary incremental build reached its SSD guard after producing the TUI test executable. A serial Cargo run with incremental caching disabled for the test executables finished. Formatting, version, changelog, docs, contributor credit, dead-code and blocking-call checks passed.
Inline code opens with a run of backticks and closes at the next run of
the same length, which is how it carries a backtick: `` `Hello, ${name}` ``
is a JavaScript template literal. The renderer closed every span at the
next single backtick, so that one showed as Hello, ${name} without its
backticks, and `` ` `` turned the text after it into code up to the
next backtick.
Close a span at the next run as long as its opener, drop one space from
each end when both are there and the span isn't only spaces, and print
an opener that never closes as text. /receipts already writes a command
holding a backtick this way, through code_span.
Signed-off-by: Lstarsky0 <[email protected]>
CW-7640. A model switch from Sonnet to Haiku left the passive request manifest hashing generic enabled text while dispatch sent the 134,976-token auto-compaction threshold. Resolve the window and output cap in Engine preview and pass the validated route’s compaction configuration through its existing turn metadata path. Live dispatch retains its installed-route checks.
Five Ubuntu ARM64 terminal cases compared the complete preview hash with a captured loopback HTTP request. Both protocol controls and switches with default, custom 90,000-token and disabled compaction matched. Each made zero requests during preview and one after submit. The old switch case mismatched on macOS and Ubuntu. All 36 existing Engine preview cases passed in separate native macOS test processes, including all nine preview failures from the earlier Linux job. The dedicated native test executable reused locked dependencies with incremental output and debug symbols disabled after the normal build reached its storage guard. The version, changelog, contributor-credit, formatting, blocking-call and dead-code checks passed. The original Windows compaction report remains open.
Review feedback on the previous commits found two statements that claimed more
than the data supports.
- The test comment said a caller "cannot get two different windows from two
spellings". That holds for the two spellings the test compares, but the
`deepseek-ai/deepseek-v4.1-flash` twin is curated at 1048576 with no output
ceiling, so the absolute form is false. The comment now names that twin and
calls reconciling it a separate data question.
- The row's `source` said the bare spelling "resolves to the same facts". It
mirrors context, output, modalities and reasoning, but not `tool_call` or
`attachment`, and `family` differs from the canonical row. The string now
lists exactly what was carried over.
No behaviour change: values are unchanged and `python3
scripts/catalog_models_dev.py seed render --check` still reproduces the
committed bundle byte-for-byte apart from the OS path separator in
`_meta.generated_by`.
`deepseek-v4.1-flash` sat in `deepseek_v4_output_caps_require_exact_catalog_metadata`
among the spellings that must NOT resolve, because it had no model-only row and
took its ceiling from a provider offering instead. With the curated row added in
the previous commit the exact lookup succeeds, so the assertion moves to the
resolved list next to `deepseek-v4-flash` and `deepseek-v4-pro`.
The near-miss spellings stay unresolved: `deepseek-v4.1-flash-expires-on-0910`,
`deepseek-v4.1-pro`, `vendor/deepseek-v4.1-flash` and `deepseek-v4-flash-vendor`
still assert `None` on both lookups, which is what the test is actually about —
an exact row documents one identifier, never a family.
Gates: `cargo test -p codewhale-models` 108 passed. `cargo clippy -p
codewhale-models --all-targets -- -D warnings` clean. `cargo test -p
codewhale-config` and `-p codewhale-agent` still pass.
A custom `openai-compatible` endpoint names the model the way the endpoint
does — `model = "deepseek-v4.1-flash"`, no vendor prefix. The curated table
had rows for `deepseek-ai/deepseek-v4.1-flash` and a canonical Models.dev row
under `deepseek/deepseek-v4.1-flash`, but no row under the bare spelling, so
the lookup matched nothing and the route fell through the whole resolution
ladder to the static 128K window with an unknown output ceiling. The model
itself is catalogued as 1M context / 384K output.
Add the bare row, taking the facts from the canonical Models.dev row
(`context 1000000`, `output 384000`, reasoning, text+image). This follows the
existing pattern: `deepseek-v4-pro`, `deepseek-v4-flash` and `deepseek-flash`
already carry a bare row next to their namespaced spellings.
An earlier revision of this branch instead taught `intrinsic_model_in` to
adopt a namespaced row when exactly one carried the bare tail. That was
dropped: `deepseek-v4.1-flash` is already claimed by the `opencode-go` and
`opencode-zen` transport rows, so the shared-spelling rule stated by #6032
would have kept it unknown, and the fallback only appeared to work because
its guard did not read the transport table. Curating the row keeps the lookup
exact and leaves the resolver alone.
Gates: `cargo fmt --all -- --check` clean. `cargo test -p codewhale-config`
795 passed, 0 failed, 1 ignored (1 added). `cargo clippy -p codewhale-config
--all-targets -- -D warnings` clean. The new test asserts on the bundled
catalogue, not a fixture, and fails without the row.
Bring in the shared Engine move repairs for the provider registry and Windows test import. The submitted Markdown renderer is byte-identical. Its 216 existing TUI-kit checks and renderer observations cover the contributor change. The release still has separate preview, conformance and platform work.
Refs #7182
CW-7701. The Engine move left session_files imported by the Windows test module although only its Unix permission probe calls it. Reference the function inside that probe. Using the actual doctor test module, production formatter and real Windows dependency metadata, rustc --test --emit=metadata -Dwarnings on x86_64-pc-windows-gnu reproduced the exact unused import before the edit and passed after. The existing macOS permission probe passed on the prior build. Formatting passed. A complete Windows test-target cross-check stopped in the unrelated simdutf C++ dependency before checking the TUI. Native Windows remains a final qualification.
The documented local registry checker stopped with FileNotFoundError after the Engine extraction. Inspect readiness in the Engine and retain the TUI doctor source for presentation. The registry passed on current main and the config example retained all eight root keys. Removing each guard independently in memory produced its own expected failure. Refs CW-7701.
Confirm the idle Engine snapshot and selected prompt occurrence before rewinding. The picker now shares the acknowledged rewind, completed checkpoint, flush and Work projection used by /undo. Keep files in place and return the chosen prompt to the composer. Refuse an ambiguous boundary or a stale conversation.
CW-7418 / #6970. A five-turn Ubuntu ARM64 terminal previously reopened dropped turns after SIGKILL. An intermediate candidate also retained the selected turn when tool and generated context messages shifted the raw depth.
On the final frozen Rust sources four terminal journeys passed. A unique selection and both positions of an identical prompt survived SIGKILL with the expected A/B or A-D history on the next actual request. The journal retained the original entries and every workspace file kept its bytes. A forced save failure surfaced a visible error and made no request. Ordinary file-plus-conversation undo and picker cancellation passed on the preceding build. Cargo fmt, the blocking and dead-code budgets, version consistency and the embedded changelog passed.
The Runtime API's multi-turn file restore has separate Ubuntu evidence. Combined file-range progress in the terminal and native Windows package acceptance remain open.
Correct two unreleased notes against de99f0530a and 5fd52e87c8. Keep the original signal-handling credit and distinguish a periodic durable checkpoint from an immediate hard kill. The embedded changelog matches the generated 15-release window. Both web derivations, 12-contributor attribution and the version consistency gate passed.
CW-7553 and #7095. The recovery interval wrote only fully committed API messages, so a SIGKILL after the checkpoint advanced still lost the visible answer. For the active turn with the matching runtime ID and a user-message tail, append streaming assistant prose to the checkpoint journal copy using the existing interrupted-assistant role. The live journal stays with the Engine. Its normal completion replaces the checkpoint. Suppressed stream events, stale turns and completed messages cannot produce an extra tail.
On real Ubuntu ARM64 the baseline lost the visible reply immediately and after a 43.44-second checkpoint advance. The candidate recovered it after the checkpoint, resumed without a provider call and sent exactly one marked copy on explicit follow-up. A normally finished stream reopened as one completed message. SIGTERM retained the partial, /copy retained the completed answer, and the immediate SIGKILL still had only previously durable content. Four recovery journeys and five adjacent Auto-window journeys passed on afb29f01be10. One code block changed only by rustfmt after the binary freeze. Original Deepin and native Windows are separate qualifications.
CW-7640 and #7133. Keep the plan and the completed turn on the same resolved wire model. Store the matched provider identity, model, token window and provenance. A session projection carries the Auto selector, so only admitted and completed routes establish the actual model. Show a restored receipt separately from the prospective budget. Older, unknown and zero historical windows remain readable.
The baseline discarded the last window on restart. On the frozen Ubuntu ARM64 CLI five fresh-process journeys passed for provider-wide and exact-model overrides and for absent, unknown and zero historical metadata. The saved 135791-token window stayed historical. The next real turn used 75319 and resume issued no model request. The existing round-trip assertion checked all 53 released provider representations on the preceding wire-identical serde implementation. Workspace rustfmt and version gates passed. The separately reported Windows 40% compaction trigger remains open.
CW-6944. An array in a JSON object slot discarded version fields when serialized, and primitive mirror fields could be spread into a misleading release record. Refuse malformed matrix, mirror and cloud release shapes before staging any replacement. Continue rebuilding an absent derived release field on a valid matrix.
Four of eight process cases incorrectly reported success before this change. All eight pass now with byte-identical inputs on refusal. The earlier 13 consistency and repair cases still pass. The two public-surface and cloud-facts suites passed 41 checks together.
CW-6944 W02-09. Validate version, tag, date and URL on both checked-in release records and the version and URL of cloud facts. Permit the 24-hour grace only when all records describe the actual preceding published release. A retry also repairs a wrong URL or version on records with a current tag.
Eight of 13 local process cases failed before this repair. All 13 passed afterward including current data, mismatched URLs or versions, the legitimate post-publication grace, drift during grace, write repairs and GitHub failure. The two existing web suites passed 14/14. A read-only check against GitHub matched published v0.10.2 and the cloud-facts gate passed.
CW-7553. On a shutdown signal, cancel the admitted turn and bound the interactive snapshot and existing persistence flush by the shutdown deadline. Accept recovery messages only for the matching session, workspace and existing message prefix. Preserve the typed InterruptedAssistant tail through Escape and restoration without making it eligible for /copy.
Ubuntu ARM64 before: SIGTERM lost visible partial output on disk and resume. Four frozen source-built terminal runs passed: SIGTERM, SIGHUP, Escape followed by restart, and an explicit provider follow-up. Each resumed the marked reply exactly once, copied only the completed response and made no automatic request. The loopback peer observed one marked assistant copy on explicit follow-up. Signals completed in 80–171 ms. Formatting, blocking and dead-code budgets passed. The separate native libtest build stopped at the storage guard before running tests. Deepin, Windows and SIGKILL are outside this qualification.
CW-6943 R02-03. Stream release metadata within 8 MiB and read at most 4 KiB of error detail before sanitizing it. Successful assets retain their own 512 MiB ceiling. Parse failures report a location without echoing the input. Keep HTTP status retries, redirect host checks and signed asset verification on their existing paths. Publish the sanitizer before its new consumer.
81 focused existing release/CLI checks passed. All 26 real loopback cases passed for async discovery, CLI metadata, asset reads and malformed JSON. Before the change both declared and chunked 8 MiB-plus-one bodies were accepted, and both long 404s exposed a remote OSC sequence and tail. The 45-crate release order, formatting and diff checks passed. No candidate package or installation was published.
Since #7181 every table cell goes through the paragraph wrapper, which
drops spaces at the start and end of a row. A cell always starts a row,
so inline code that leads with spaces lost them, ` port: 8080` showed
as `port: 8080`, and a cell holding only a space, `` ` ` ``, came out
empty, even when the cell fit its column.
Lay out a cell that fits its column straight from its parsed spans, as
cells were laid out before #7181, recording its links the same way, and
wrap only the cells that don't fit.
Signed-off-by: Lstarsky0 <[email protected]>
Distinguish logical placeholders from concrete pending children. Apply each envelope through one slot update, claim an unknown child only into an available placeholder, and ignore late spawn notifications once the child is running or settled.
CW-6945 U05-04. A replay compiled from the owning source initially failed three of four ordering scenarios. All four passed after the fix, including exact logical-key priority. All 21 focused native mailbox, reconciliation, fanout, terminal-card and worker-view checks passed. No new tests or dependencies.
Route file-backed undo through the same acknowledged Engine rewind as conversation-only undo. Hold the TUI transcript until the Engine accepts the expected prefix. Distinguish a restored workspace from a refused conversation rewind and a failed durable save. Preserve the surviving journal branch and retry guards.
CW-7418, refs #6970. A fresh Ubuntu PTY reproduced eight stale active entries after file rollback. The repaired CLI restored an edit, removed a created file, preserved an unrelated file and retained eight recoverable journal entries with zero active messages across restart. Five portable command cases passed. The first native run passed 47 of 50 TUI checks. Three stale checks expected a soft sync or early truncation and passed after updating only those assertions. Native Windows and selected-range undo remain separate.
Both fresh channel packages completed npm installation and failed their first bridge-core import. Stage the adapter and shared package as siblings in the same atomic replacement. Preserve the previous service and npm paths and load the installed library before promotion.
CW-6950. ShellCheck and bash syntax passed. All 58 existing installed adapter cases passed on macOS and Ubuntu ARM64. Both real Node entry points reached credential validation without channel credentials. Broken core and lockfile upgrades left the prior package and neighboring channel intact. No service was deployed.
CW-6943 / #6554 X01-09. All five bridges use the same byte-bounded SSE reader. Handle LF, CRLF, CR, split UTF-8 and multiline data. Reject oversized, malformed or truncated frames and check thread identity and sequence before saving cursors or acting on approvals. A transport end preserves the observed turn. Feishu and WeCom retire only the matching completed turn, including when a newer one arrived during final delivery. Bound Runtime JSON and errors while preserving legacy empty and plain-text handling.
Reproduced zero events on CRLF, an accepted oversized frame and silent truncated EOF in the former reader. 168 existing channel/core checks passed, with one Windows-only skip. DingTalk syntax passed. 70,000 coalesced frames, adversarial framing, 11 response-bound cases and ten restart/readback channel cases passed. The frozen macOS Engine produced thread.started over authenticated loopback SSE and an observer with the wrong thread failed closed. No real channel credentials, delivery or inference used.
CW-6943 / #6554 W01-05. Read up to 32 recent digest keys from one bounded listing in groups of four. Reuse the signed-facts KV stream reader for strict UTF-8 and at most 128 KiB per record. Skip failed, mismatched, malformed or oversized entries independently. Verify reviewed language and cap sections and items before rendering. The weekly producer retains records for 90 days.
The former page issued 100 simultaneous text reads and one failed read blanked the archive. With 100 seeded records the renderer issued 32 streamed reads, at most four concurrent, canceled the oversized stream and rejected seven invalid record classes. Google Chrome displayed the 25 eligible articles in reviewed-language order. With one additional failed read, the other 24 still rendered. 80 existing signed-facts and review-state checks plus TypeScript passed. Verified locally.
CW-6945 / #6556 W02-05. A pending generator could put a discarded draft back on the review list. Save under the per-identity claim and retain the old decision until replacement writes succeed. Stage both weekly digest records together under that claim. Check the exact reviewed revision under the same claim before acting, including when a worker reads stale KV. Legacy records without a stored revision keep their reviewed-text check.
82 focused web checks and TypeScript passed. Replayed overlapping discard and failed reopen, then stale copies at both admin actions. Both stale actions returned 409 with zero outbound calls. Local workerd granted 1 of 8 concurrent claims and retained the revision after restart. Rechecked all 51 review-state cases after reusing the existing digest TTL. No hosted release validation or deployment.
An image, , went through the link arm with its `!` left in
the plain text before it, so it showed as "!alt". A linked image, the
badge form [](href), split at the image's `]`: the label
became "" printed as
text after it.
Show an image as its alt text linked to its source, and a linked image
as its alt text linked to the outer destination. The link arm now
takes an optional leading `!`, `![` ends a plain-text run, and the
label and destination parsing moved into split_markdown_link and
split_link_destination. Only one level is read, without recursion, so
a long run of `[![` in a reply can't grow the stack.
Signed-off-by: Lstarsky0 <[email protected]>
Keep the existing model, output limits, temperature, JSON and usage contracts for each caller. Read UTF-8 JSON through the existing 2 MiB outbound budget and cap provider error text at 4 KiB before diagnostics. Reject overflow while streaming even when the peer understates Content-Length.
CW-6943, audit W01-08, refs #6554. Five focused Vitest suites passed 71 cases. Twelve local checks through both entry points exercised successful usage, 429 diagnostics, declared and streamed overflow and cancellation of an understated body. Web TypeScript passed. No live inference or deployment.
Reuse the same durable lease as the six existing generation tasks. The manual facts route passes its binding and a missing lease refuses before fetching. Overlapping refreshes share one named writer through the existing hold period.
CW-6945, audit W02-05, refs #6556. Four focused Vitest suites passed 70 cases. A strengthened existing case confirmed two concurrent callers performed one revision fetch, wrote one drift log entry, and a missing binding made no request. Web TypeScript passed. Local fixtures only.
Keep Lstarsky0’s original change. Track the running display column without rescanning preceding spans. The existing wrapped-row case checks every one of 120 linked cells beside a wide character, using the inclusive column contract. The combined TUI-kit run passed 215 cases; the corrected assertion then passed separately. Ubuntu ARM64 PTY widths 80 and 120 each displayed both real OSC 8 targets.
Co-authored-by: Lstarsky0 <[email protected]>
Refs #7085 (CW-7532). The bundled descriptor marks this exact catalog base URL public. Clear configured headers and use anonymous auth only on the catalog client. Managed account, plugin, session-only credential, endpoint-scope and inferred key-health guards stay in place. The normal inference path still uses the configured credentials.
Existing descriptor and public-endpoint health checks passed. Clean macOS and Ubuntu ARM64 CLI installs each listed 127 models without credentials. The Linux set matched every ID from a simultaneous public endpoint read. An egress-denied macOS inference attempt failed at the missing configured key. No paid inference was attempted.
Refs #5848 and #7116 (CW-7584). The startup catalog can adopt an installed chat model on an explicitly selected, idle Ollama route. Re-selecting an already-resolved provider keeps the existing behavior. An unresolved local selection can retry discovery after its daemon starts.
Two affected existing checks passed. In an actual macOS terminal the startup-selected qwen3:4b answered 9+7 with 16 and persisted the turn. The separate candidate with a real late-starting private Ollama daemon stayed unknown for empty and embedding-only rosters, selected the chat tag when added, and restored it after restart. Desktop and Windows were not exercised.
Refs #7172 (CW-7651). Admit a continuation through the existing fresh-turn gates with typed runtime provenance. Keep the objective available again after a checkpoint, preserve explicit goal budgets and distinguish estimated conversation input from lifetime usage. An ordinary human message cannot suppress the authoritative objective.
14 goal-continuation and nine context-pressure cases passed. Actual macOS and Ubuntu ARM64 TUI requests to a scripted loopback provider sent a 1,238-byte objective on the first pass only. Repeated messages including turn metadata measured 3,076 and 3,055 bytes respectively. No provider billing was inferred. Combined validation also exposed an independent assertion in the separate #7181 overlay.
Preserve the original lockfile change and its registry checksum. Local frozen source verification: the descriptor contract passed and three actual CLI sessions loaded their nested TOML routes. The production CLI also built and ran on Ubuntu 24.04 ARM64. The combined run had an independent inclusive-column assertion failure in the separately overlaid #7181 test. No hosted release run.
Preserve the original lockfile change and its registry checksum. Local frozen source verification: HTML conversion and two clipboard Markdown cases passed. The production CLI also built and ran on Ubuntu 24.04 ARM64. The combined run had an independent inclusive-column assertion failure in the separately overlaid #7181 test. No hosted release run.
Preserve the original lockfile change and its registry checksum. Local frozen source verification: 14 session archive/export cases passed. The production CLI also built and ran on Ubuntu 24.04 ARM64. The combined run had an independent inclusive-column assertion failure in the separately overlaid #7181 test. No hosted release run.
Preserve the original lockfile change and its registry checksum. Local frozen source verification: 14 goal continuation cases passed and three real CLI sessions persisted distinct UUID v4 identifiers. The production CLI also built and ran on Ubuntu 24.04 ARM64. The combined run had an independent inclusive-column assertion failure in the separately overlaid #7181 test. No hosted release run.
For #5587, remove seven now-unfulfilled lint expectations, tighten the Windows-only test allocation and path import to their actual consumers, and read emitted web event types from their current Engine owner. Four open dependency PRs had recorded the same failures.
The frozen source built the macOS CLI and passed an all-features Engine cross-check for x86_64-pc-windows-gnu. The Rust workspace denies warnings. The existing web vocabulary case passed. Dead-code suppressions fell from 144 to 137 and the blocking-call budget passed. No native Windows execution.
Resolve release-note ordering and preserve both contributors. The code patch has the same stable patch ID as the qualified c80c16c14a candidate, including the Windows Console feature. Ordinary protected-branch checks and platform acceptance remain separate.
For #6555, persist each inbound claim before its side effect, join concurrent duplicates, and retain unfinished deliveries until the interruption notice succeeds. Keep live claims independent of the completed-message retention window. Reject Feishu messages without a stable ID before acting.
Verified the three bridge suites together: 112 passed and one skipped. A local SDK double through the shipping Feishu entry observed zero replayed effects, one action for concurrent deliveries, a retried failed notice, and retained in-flight claims under eviction. No live Feishu or Weixin call.
The locked registry archive matches its SHA-256 and declares Rust 1.88. The original head passed Linux, Windows, lint and Rust 1.89 checks. The Linux log records the signed identity signature, issuer, audience, expiry, nonce and account case passing. The consuming OAuth implementation is unchanged since that revision.
Gabriel-Degret reported #7179. A hosted output ceiling cannot establish the serving ceiling of a different endpoint. Preserve model generation defaults, declared route restrictions, context headroom and per-turn limits.
Verified 43 of 44 focused Engine, models and TUI checks on the first run. Updated the existing provenance assertion and its isolated rerun passed. Six real CLI requests over an operator-owned loopback transport sent 65536 automatic or 131072 explicit across three Qwen spellings on a declared 262144 window. The catalog spelling previously sent 32768. This does not qualify the reporter’s FreeBSD vLLM host. Formatting, version state and contributor credits passed.
Refs #7179
The shared turn driver already pins recorded host tools before building each request. Capture every definition on the wire. Remove the optional projection that classified deferred tools as missing binaries and could accept a missing fixture. All three existing cases passed on the populated developer PATH and the same three passed with an empty executable PATH. Thanks @SparkofSpike for the missing-fixture report. Refs #7174.
A table cell was wrapped as raw markdown and each wrapped row was then
parsed on its own, so a code span, bold run or link that crossed a row
break lost its pair: the backticks and asterisks showed, and a link
printed as its source with the URL split over two rows. Table rows
also carried no hyperlinks, even for a link that fit on one row.
Wrap each cell with render_line_with_links_tagged, the paragraph
wrapper, which parses first and records link columns, and shift those
columns to the cell's place in the row. wrap_cell_text and the
grapheme helper only it used are gone, along with the test that called
wrap_cell_text directly; the table tests still cover an overlong cell.
Signed-off-by: Lstarsky0 <[email protected]>
Keep the contributor's original commits and their Windows Console feature fix.
A stamp enriches an unshared user entry. Preserve authored payload, cache
markers, runtime ownership, conflicting stamps and preexisting branch history.
Use the same prefix semantics for saved outcomes and TUI refresh. Record
the strictly changed byte offset separately for token accounting.
42 focused tests passed. The macOS PTY sent the same text twice on purpose,
one Enter at a time. The loopback provider saw exactly two requests, the two
answers stayed on the active path, and it matched the persisted transcript.
The linked Windows incident has not been reproduced. Refs #7178.
Expose a compact named-step form on the already-eager execute_tools when one
ready server offers it. Use real same-server member schemas, current turn
visibility and declared bounds; name and count are checked after hooks.
Keep script and consent decisions direct, and route the batch through the
existing cancellable VM gate and bounded receipts. Exact-name regex discovery
now works. Bound ambient skill descriptions without changing authored
instructions or on-demand discovery.
Measure startup, turn setup, request preparation, gate planning and terminal
processing on demand. Compute stream executable identity in the background
from an opened file and keep its hash on the receipt.
CW-7649: the optimized candidate used the installed plugin and real DeepSeek.
Two ordinary goals chose the VM batch first and completed independently
verified background hover/drag: 4 calls/5 requests and 7 calls/8 requests.
A separate controlled recipe completed in one call/two requests. These are
device-specific observations, not a matched speedup or a one-call planning
guarantee. Initial attempts include a 14-call success and an incomplete run.
276 existing focused checks passed before the two-file bounds amendment.
27 affected checks passed on the measured source. Four existing provider-free
cases matched all 55 contract metrics; five-library Clippy, formatting,
documentation, version and blocking-budget checks passed. Both deferred and
pinned wire probes refused out-of-offer members, post-hook rewrites and a
three-step call to a two-step server before MCP dispatch. No hosted CI.
Raise the existing parent-surface ceiling by the same 256 bytes already measured and budgeted for #7177. The isolated canonical-main parent_agent_surface_stays_within_measured_ceiling check passed (1/1); all 1,947 frozen native inputs remained unchanged. Formatting and diff checks passed. No runtime change or release qualification.
The PR #7180 conflict was purely upstream churn: main moved
crates/tui/src/session_manager.rs to crates/engine/src/session_manager.rs and
bumped the windows crate to 0.62. Git's rename detection carried all three of
our edits onto the new paths, so the merge is content-identical to the
pre-merge branch plus upstream/main.
Verified: cargo check -p codewhale-runtime -p codewhale-engine --lib (13m07s,
no errors); cargo test -p codewhale-runtime --lib -- session_tree
(25 passed; 0 failed; 886 filtered out).
PR #7176 merged as be492e8767 with 66/66 focused Markdown checks and all-targets tui-kit Clippy passing on its exact approved source. Record the parser scope and unqualified Windows Terminal behavior. Existing contributor-credit guard passes across all three surfaces. Restore the 13 historical/index lines accidentally given the #7177 note by a27d80d96f9; keep #7176 and #7177 only in the Unreleased contributor entry, verified against the pre-edit source. No native inputs changed after passing checks.
Merge SparkofSpike's approved original PR. On canonical main 4b85ac2cc4 with the exact approved file applied: 66/66 existing markdown_render tests passed; tui-kit all-targets Clippy with -D warnings passed; cargo fmt and version checks passed. Frozen 1947 native source inputs were unchanged. This qualifies the parser fix locally; it does not qualify Windows Terminal font fallback or a release. No dependent PRs and no unresolved review threads; source branch deletion remains disabled. Contributor credit follows immediately.
Review follow-up on the rebranch rewrite. Behaviour is unchanged; every
point here is one the reviewer graded non-blocking but wrong.
- normalized_blocks returned a collected Vec, so the relaxed comparison
allocated twice per call while its doc claimed it allocated nothing. It
now yields a borrowing iterator and the doc says what the code does:
nothing is cloned, nothing is allocated.
- rebranch_active_messages still promised "the existing active branch stays
as evidence". The in-place refresh replaces that payload, so the doc now
states what is kept (entry id, created_at, parent link) and what is not
(the previous shape, which is not kept as a sibling).
- A missing id during the rewrite dropped a refresh silently. It now warns
with the entry id, so a divergence the caller cannot see becomes one it
can.
cargo test -p codewhale-runtime --lib -- session_tree
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 886 filtered out
Complete inherited public copy for provider routes, compaction recall, goal guidance, structured app metadata and llms.txt install/release facts. Move all English/Chinese FAQ answers into shared content so the page remains a single locale-aware renderer; update the existing source assertions to that owner.
Existing focused web checks: 39/40 initially passed after the move; the sole stale source-path assertion was corrected and passes on targeted replay (40 distinct passing checks). TypeScript and touched-file ESLint pass. Local browser preview opens all three new English FAQ answers and remains unchanged after the shared-content move. No deployment or published-release claim.
projects_to masked the <turn_meta> envelope for every entry kind. That
is only sound where the entry stores a message the engine may have
stamped. Compaction and BranchSummary project to text this crate
synthesizes, so a relaxed match could accept a live shape those entries
can never be rewritten into: the prefix would match, the refresh vector
would skip them for having no exact message, and the journal would keep a
payload the live transcript no longer has, with every later save forking
the same turn again.
Keep the mask on Message entries, which is the only kind the envelope
is written into, and compare the other kinds against their projection.
Use founder-selected DSH 0.2.1-rc.5 and Cordis 4.0.5. Refresh vendored
loader/include/group and pure hook helpers, npm pins, provenance and license
notices. Retain reviewed imports, non-writing composition and the explicitly
older preset adapter; Engine remains the only execution/prompt authority.
Compatibility v3 groups the same 17 injectable names into DSH, Cordis and
Codewhale sources. Boolean deferLoading is a no-op hint; non-booleans and when
are refused. A direct probe caught the inherited when acceptance gap and
verified its repair. The changed compatibility digest requires fresh Native
plugin review/trust; no live trust state was edited.
Local checks: typecheck/build pass; Node 413 pass, 7 skip; Bun 414 pass,
6 skip. Four direct admission/execution probes pass on each runtime. Twenty-five
vendored source/candidate hash pairs verified, plus unchanged built-in hashes
and the copied Rust compatibility asset. Native batch: 354/357 initially pass;
two goal goldens and stale notice headings repaired, then 3/3 affected checks
pass using the same binaries. Four metric tests pass; 55 budgets match exactly.
Engine/TUI/plugins clippy --tests passes, fmt and blocking/dead-code budgets
pass. Frozen native inputs remained unchanged. Six JS compiled-image cases
and two Rust compiled-image cases remain unqualified; native test-link unwind
warnings remain. No hosted CI, live-provider call or release qualification.
CW-7054. Receipts: artifacts/dsh-upgrade-takeover-20261031/REPORT.md.
Existing prompt metrics now use the recorded-environment guard with linux and /bin/bash on every platform. Correct the moved base-prompt provenance label. Re-record only the derived hashes, counts and bounded descriptions omitted from PR 7177; source descriptions and tool sets are unchanged.
Four existing metrics pass and all 55 ceilings match exactly. Prompt and event golden cases each pass on replay (the latter covers six scenarios). Engine/TUI/plugins clippy --tests passes with the existing allow-list; fmt passes. Evidence shares the frozen DSH source batch; no provider or Windows-runtime qualification is claimed.
Autosave compares the live transcript with the journal through
projects_to, which masks the engine-owned <turn_meta> envelope. The
comparison was right but the write-back was not: entries whose stored
form differs only by that envelope were neither refreshed nor reported,
so every autosave appended a fresh set of entries and orphaned the
assistant turn that belonged to the old ones.
Splitting the two jobs fixes it. projects_to keeps deciding identity,
rebranch_active_messages_stamped now refreshes a matched entry in place
when its exact message differs, and same_message_ignoring_turn_metadata
replaces same_content_ignoring_turn_metadata because ignoring the
envelope ignores exactly one part of the turn, not its content.
Also:
- is_complete_turn_metadata_block delegates to the same leading strip,
so a block that only starts and ends with the tags keeps its trailing
text instead of being dropped as metadata.
- normalized_blocks compares borrowed slices, one allocation per
comparison instead of two deep clones of the whole message.
- the refreshed filter requires an existing exact_message, so
Compaction and BranchSummary entries are no longer selected for a
rewrite they cannot receive, and the rewrite no longer promotes
User/Assistant into Message.
- journal_branch_to treats a turn-metadata-only difference as unchanged
so the strict-prefix walk stops at the same turn the journal does.
Correct the preceding merge message: its preparation script failed before applying credit or budget changes, so those are in this commit. Existing contributor-credit guard passes; all three surfaces credit SparkofSpike. Source-attributed schema delta is exactly 256 serialized bytes per tool surface. Native conformance and metric replay follow with the DSH batch.
Preserve the contributor PR and add its Unreleased entry and credit. Static review confirms all six golden description fields match source. Exact serialized descriptions add 256 bytes to each tool surface; update only those six schema ceilings, preserving counts and identities. Native conformance and metric replay follow with the DSH batch. No live-model qualification or hosted CI.
Clarify update_goal schema guidance for yielding while waiting for a user answer. Runtime semantics were already integrated; this PR changes two description strings and three conformance prompt goldens. Reviewed exact approved head 938b157a9f0c18891021d9d066b1f81051487cda; six golden fields match the source descriptions. No open dependent PRs or unresolved review threads. Full native conformance verification and exact schema-budget update are in the immediately following local batch.
A user message reaches the journal in two shapes: bare text, and text
carrying an engine `<turn_meta>` block. `update_session` matched the live
transcript against the persisted branch with relaxed equality, but
`rebranch_active_messages_stamped` only appended the relaxed suffix, so
every save forked a second copy of the same turn and the journal kept the
older shape.
Match the prefix on relaxed equality, then rewrite those entries in place
through `SessionEntryKind::replace_message`. Only messages past the prefix
are appended, so the entry count stays flat, the stored shape follows the
live transcript, and the `<turn_meta>` marker that decides runtime
ownership survives. `update_session` now delegates the whole branch to
`rebranch_active_messages` instead of hand-rolling branch_to plus skip.
Verified: cargo check -p codewhale-runtime, cargo check -p codewhale-tui
--lib, and cargo test -p codewhale-runtime --lib -- session_tree
(22 passed).
projects_to and the update_session common-prefix scan compared messages with structural equality. The same user message is persisted both bare and with a trailing <turn_meta> block, so one mismatch collapsed the shared prefix to zero: rebranch_active_messages_stamped cleared leaf_id, rebuilt the tree from the root, and left every earlier assistant entry on an orphaned branch. A session's active path could then hold 45 consecutive user messages and no assistant reply at all.
Compare content after stripping the turn-metadata block, keeping structural equality as the fast path.
Refs #7178
runtime_log.rs imports Win32::System::Console under cfg(windows), but the windows crate dependency never enabled that feature, so codewhale-runtime does not compile on Windows. CI is Linux-only, which is why this never surfaced.
The update_goal description and its status prose route a needed user
answer to yield instead of blocked. Nothing re-recorded the conformance
fixtures that pin the tool catalog, so they still carried the old text.
- prompt: tools_bytes 16349->16605 for the 13-tool catalog and
13849->14105 for the 11-tool one; tools_sha256 and prefix_sha256
recomputed from the new fixture text and cross-checked against the
pre-change values before writing.
- events: active_tool_catalog_sha256 d53e18df->84f64a5c and
payload_json_bytes 16349->16605 in all six fixtures. The digest is
recomputed independently as sha256 over name/description/canonical
input schema per tool, and it reproduces the recorded value exactly.
- events: update_goal's description now runs past the 512-character
capture bound, so it is recorded truncated at a true prefix.
`update_goal`'s description said "Mark blocked when progress requires user
input", which sends a question to the exit that needs an explicit `/goal
resume`. The continuation prompts added in #7175 name `yield` as the exit for
exactly that case, so the tool description was pointing the other way at the
cheapest moment to read it.
Blocked now means progress cannot continue at all. The yield trigger picks up
"you need the user's answer before the next pass can do anything useful",
matching the header wording.
The three prompt conformance goldens are hand-edited rather than re-recorded:
`CODEWHALE_CONFORMANCE_UPDATE=1` on a host with node or python writes that
host's probed tool definitions into a pin file that has never existed in the
repository (#7174). The description is byte-identical to `description()` in
all three.
StartReviewRequest is a RuntimeThreadManager request record, like
StartTurnRequest beside it; it lived in runtime_api/review.rs, the Axum
handler, so the engine-band manager depended on an app-server-band module.
It moves into runtime_threads/manager.rs; the handler and the chat relay
name it there. crate-map-coarse.toml assigns runtime_api/review to
app-server and the two units #7173 added (compaction_archive,
tools/context_archive) to the engine, so every top-level module of
crates/tui now sits wholly in one stage A crate.
Checks: crate_map.py check crate-map-coarse.toml: cycles=0 upward_edges=0
upward_refs=0 unassigned=0; dev-cargo check -p codewhale-tui --tests: ok, no
warnings; cargo test -p codewhale-tui --lib -- review: 528 passed;
runtime_chat_relay / start_review filters: 18 passed; fmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7173 (merged as 8f8d4632b3, review fixes in 7d5464e3cb): changelog line
under Added with its bounds and stated limits (a /fork cannot read the
inherited archive; a bare secret absent from current configuration is not
masked), and the SparkofSpike credit entries extended. Web facts are
regenerated for the two new tools (79 -> 81) and the new features.toml row.
Checks: sync-changelog.sh; check-contributor-credit.py: 12 contributors,
all credited on all three surfaces; derive-facts + check-facts OK;
check-versions OK; cargo fmt --check clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder, 2026-10-31: Tideline is retired as a design direction (docs
only, keep code). Removes docs/design/TIDELINE_RATATUI_TRANSLATION.md
and docs/design/tideline-redesign.html, and drops the doc comment's
pointer to the deleted HTML. Copies are kept outside the repository.
tideline.rs and the settings shell code are unchanged.
Doc-comment and docs change only; no build or test affected.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Review of #7173 (independent read-only review, Codex CLI gpt-6.1-sol, then
confirmed in source) found the archive could hand the model a credential
that `codewhale sessions scrub-secrets` was meant to remove:
- session_secret_scrub never visited <session>/artifacts/, where compaction
writes context-transfer-*.json. session_files now includes each session's
artifacts directory (transfer snapshots only), and scrub_files rewrites a
snapshot atomically without a session lock: compaction writes each one
once under a fresh name, and its stem is a checkpoint, not a session id,
so the existing lock path would have reported it clean and left it.
- Request-time masking sees only pages and snippets, where a page boundary
or the << >> marker can split a credential past the mask. compaction_archive
::load now masks each whole message with redact_model_bound_text (shapes
plus the configured secrets scrub-secrets uses) before search or paging.
- context_archive_search accepted an unbounded query that every snippet
repeats; queries are now limited to 200 characters.
- ACP registered both tools but its dispatch allowlist rejected them; the
allowlist now admits these two read-only tools.
Known limits, stated in compaction_archive's header: a bare secret absent
from current configuration is not masked, and a /fork cannot read the
archive its handoff note refers to.
Checks: codewhale-tui --lib filters conformance::, compaction,
session_secret_scrub, context_archive, tools::registry, hooks::executor,
tool_catalog: 440 passed, 0 failed, 1 ignored; tools::subagent::tests 601
passed, 1 failed (late_launch_permit_still_gets_the_full_work_budget, a
4s wall-clock test that made 0 model requests under the parallel run; it
passes alone, 1 passed); core::engine test_cases_10 and host_profile
included above; feature_registry 2 passed; check-blocking-calls-budget
578 sites within budget; cargo fmt --check clean. No new tests.
Refs #7173
Co-Authored-By: Claude Opus 5.5 <[email protected]>
feat(tui): let the model read the transcript compaction replaced
Maintainer additions in the merge, both forced by the two new model-visible
tools and approved by the founder (2026-10-31):
- The six event conformance goldens are re-recorded: only the frozen-prefix
hash in prefix_cache_change and the tool_request_snapshot catalog facts
change (21 lines), the one-time cached-prefix effect of adding tools.
- PARENT_SURFACE_BYTE_CEILING rises by the measured 751B (91,543B + the 13B
Linux margin = 91,556B).
The security and bounds fixes from review follow in the next commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7175 (@SparkofSpike, merged as 711075a941): goal continuation prompts
name the yield exit for a question only the user can answer. Changelog
line under Changed, with its stated limit (prompt steering, not
enforcement), and the existing SparkofSpike credit entries extended.
#7131 (@Felixkw12, merged as aafbf5f0ed): Opper as a bundled provider
row. Changelog line under Added; the contributor is new, so they join the
CHANGELOG Contributors block, docs/CONTRIBUTORS.md, UNRELEASED_CONTRIBUTORS
and .github/AUTHOR_MAP (their commit identity is [email protected]; the PR is
from the vendor's own engineer, and billing stays Unknown).
web/data/features.generated.json is regenerated: #7151 changed
docs/features.toml (HarmonyOS native row) without regenerating it.
Checks: sync-changelog.sh wrote crates/tui/CHANGELOG.md;
check-contributor-credit.py: 12 contributors since v0.10.2, all credited
on all three surfaces; derive-facts + check-facts OK; check-versions OK;
cargo fmt --check clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
feat(providers): add Opper as a bundled descriptor row
Maintainer conflict resolution: main had added Runcrate in the same places
since the PR's base. Both rows are kept in provider_descriptors.json,
PROVIDERS.md (EN and zh-Hans) and the unpriced coverage ledger (Opper is
recorded as the twelfth non-Baseten compatible default, routes sorted).
The bundled-descriptor count becomes 13 and the compatible-default count 13.
web/data/agent-docs.generated.json is regenerated with derive-facts.mjs from
the merged sources rather than hand-merged.
Checks on the merge: codewhale-config descriptor tests 14 passed;
pricing::default_coverage 1 passed; provider_picker 152 passed;
check-facts OK; cargo fmt --check clean. No live Opper call was made;
billing stays Unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An impl-block scan across the stage A boundary found one split inherent
impl: core/protocol_parity.rs implements Event and Op, which the engine
band defines. Keeping the file with the engine keeps those impls legal.
crate_map.py check crate-map-coarse.toml: cycles=0 upward_edges=0
upward_refs=0 oversize=0 unassigned=0 duplicates=0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Stage A of docs/design/COARSE_SPLIT.md (engine / app-server / tui) now
measures zero upward refs, so the engine band can move as one crate.
Checker (scripts/split/crate_map.py):
- PATH_RE matched `super` as a prefix of `supervisor`, so
`super::supervisor::X` resolved as `super::super` and was charged to the
crate root. Fixed with `super\b`.
- Grouped imports (`use crate::a::{b::C, d}`) are now expanded into one
path per leaf; before, only the prefix was counted. This exposed
task_manager -> RuntimeThreadManager and remote_control -> chat relay.
Band placement (crate-map-coarse*.toml): runtime_threads/manager and
tools/registry go with the engine, which constructs and drives them (as
Codex's ThreadManager lives in codex-core); remote_control with app-server;
doctor and doctor_fix with the TUI, where the doctor command lives.
Code:
- runtime_account_api_base and its validator move from runtime_api to
profile_constitution, the engine-side caller; runtime_api, its secrets
routes and its test call the new owner.
- client.rs names codewhale_runtime::config instead of the lib.rs re-export.
Checks:
- crate_map.py check crate-map-coarse.toml: cycles=0 upward_edges=0
upward_refs=0 oversize=0 unassigned=0 duplicates=0
- crate-map-coarse-split.toml: upward_edges=1 upward_refs=73
- crate-map.toml: upward_edges=120 upward_refs=411
- scripts/dev-cargo.sh check -p codewhale-tui --tests --locked: ok, 0 warnings
- cargo test -p codewhale-tui --lib -- account_api_base profile_constitution
secrets: 42 passed; -- runtime_account_api: 1 passed
- cargo fmt --all -- --check: clean
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A table cell holding the `*` keycap (U+002A U+FE0F U+20E3) rendered its row out
of place, and the row's trailing `|` landed outside the table. A keycap with a
digit base (`1` + U+FE0F + U+20E3) was fine, so only the `*` form broke.
Three places in `parse_inline_spans` cut a span in the middle of that cluster:
- The plain-text arm advances to the next inline marker. `*` is a marker but
does not open emphasis here (no closing `*` follows), so it stopped right
after the `*` and left the two zero-width marks in a span of their own.
- The backslash arm emitted the escaped character alone, so `\*` + marks split
the same way.
- The `*italic*` and `_italic_` arms accepted any `*`/`_` as a delimiter, so a
keycap `*` could open emphasis and eat the marks.
Each arm now works on grapheme boundaries: plain text steps to the end of the
grapheme that contains the marker offset, the escape arm carries the whole
cluster, and both emphasis arms require the delimiter to be a lone character.
This is the rule `ui_text::grapheme_display_width` already states for keycaps.
The regression test renders the table into a ratatui buffer and compares the
column of every `|`. That alone is not a useful assertion here: the split and
joined forms advance the buffer by the same number of columns, because the
zero-width marks are dropped either way. The test therefore also asserts that
the cell's symbol still contains U+20E3. Removing the plain-text fix turns that
assertion red with `the cell holds ["|", "*", "|", ...]`, which is the state the
reported bug shipped in.
Gates: `cargo fmt --all -- --check` clean. `cargo test -p codewhale-tui-kit`
216 passed, 0 failed, 1 ignored (3 added). `cargo clippy -p codewhale-tui-kit
--all-targets -- -D warnings` clean.
scripts/split/crate_map.py builds the crates/tui unit graph (module_graph +
count_lines strict production lines) and checks a unit->crate TOML for
unassigned/duplicate units, oversize crates, crate cycles and upward edges.
docs/design/crate-map.toml + CRATE_MAP.md: a 66-crate fine map from a
judge-panel workflow (4 architects iterating against the checker, 3 judges,
1 synthesizer), plus an independent read-only review (Codex CLI,
gpt-6.1-sol) listing 14 problems the checker cannot see. runtime-wire is
renamed app-server-protocol per the founder's App Server v2 decision.
docs/design/COARSE_SPLIT.md + crate-map-coarse*.toml: the founder's
2026-10-31 direction to make the top line of crates ~400-500k lines like
Codex (162 packages, core/tui ~463k) and Grok Build (104, up to 551k).
Stage A, engine / app-server / tui: 35 upward refs over 3 edges. Stage B
splits the engine band (225k + 69k production lines): 96 refs.
TUI_DECONSTRUCTION.md points its Target map at CRATE_MAP.md, applies the
rename, and corrects the billing/catalog size (11,091 strict production
lines; 24,352 was partition_report's file-level figure).
Checks run on f510a59d94: crate_map.py check reports
crate-map.toml: upward_edges=118 upward_refs=324 oversize=0 unassigned=0 duplicates=0
crate-map-coarse.toml: upward_edges=3 upward_refs=35 oversize=0 unassigned=0 duplicates=0
crate-map-coarse-split.toml: upward_edges=6 upward_refs=96 oversize=0 unassigned=0 duplicates=0
No Rust source changed; no cargo build run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7168 (@gaord, merged as f36e46ddf9) shipped without a changelog line or
credit. Adds both, and regenerates the blocking-call budget for the merged
tree: external_credentials.rs 1 -> 2 (the credential-file open is a
synchronous helper; its std::fs sites are unchanged text but the counter
now sees one outside a blocking scope), remote_control.rs 7 -> 6 and
pet_watch/owner.rs 3 -> 2. Net 577 sites, one fewer than before.
Verified on origin/main 8202875251 + #7168 before merging: fmt clean;
clippy -D warnings (CI allow-list) clean on secrets, util, config, runtime,
memory, plugins, app-server and tui; cargo test on secrets, util, config,
runtime, memory, plugins and app-server 2,369 passed / 0 failed / 6
ignored; tui filters session_manager 137, control_socket 21,
remote_control 90, pet_watch 35, owner_bootstrap 7, acp_server 38,
runtime_chat_relay 18, github::report 9, all passing; dead-code, locale
and crate-boundary gates pass; contributor credit passes;
sync-changelog.sh reproduces crates/tui/CHANGELOG.md. Not verified: a real
HarmonyOS device or a Windows host (CI's Test (windows-latest) passed on
the PR head).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: CodeWhale Bot <[email protected]>
Review feedback: the trailing sentence in render_continuation_prompt was
wider than GOAL_CONTINUATION_PROMPT's ("needs an answer" vs "before the next
pass can do anything useful"), and being later in the same message it won.
Align the two, and swap "do not answer it yourself" for "do not invent an
answer" so deciding with a stated assumption stays allowed.
A continuation pass that needed an answer from the user asked in prose and
kept the goal Active: neither GOAL_CONTINUATION_PROMPT nor
render_continuation_prompt listed "I need the user's answer" among the exits,
and the trailing "Otherwise continue making progress" left self-answering as
the default. The next pass then started with the question still unanswered.
Widen the yield trigger to cover that case, and state on both surfaces that
asking without calling update_goal does not pause the goal.
No state-machine change: GoalPauseReason::Yielded already exists and the user's
reply already resumes the goal.
The "B billing" row said "not confirmed" and that the crate must not depend
on the runtime tier. Re-measured on 1b0e51005b with module_graph.load_graph
and partition_report --json:
- cost_status, pricing, route_billing, provider_catalog_live, provider_lake,
models_dev_live, codex_model_cache and reasoning_preference total 24,352
production lines inside the 59-module cycle.
- Their only production edges back into the cycle are 6 refs into `client`
(CodewhaleClient::for_catalog_refresh, client::ollama_catalog::load_model,
client::AvailableModel) and 1 into provider_readiness. cost_status alone
had 15 inbound modules and 3 outbound, which is what led here.
- 590 inbound production refs follow the move; tests reach out 176 times,
149 to test_support.
- All eight use codewhale_runtime::config, so the crate sits above
codewhale-runtime; the old constraint predates Config moving there.
It is not rename-only: catalog refresh must stay beside `client`, so
provider_lake and codex_model_cache split into a store and a refresh driver.
Open PRs that touch pricing/cost_status callers (session_manager.rs among
them) should merge first. Docs-only; lexicon check passes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: CodeWhale Bot <[email protected]>
Three @Lstarsky0 fixes merged as PRs (merges dc4870117b, 9986831e95,
b2db2c0467). #7171 carried its own changelog edit; #7169 and #7170 did not.
They join the existing @Lstarsky0 Markdown and footer-status entries rather
than adding new bullets, and the CONTRIBUTORS.md and Contributors section
lines name all three.
Verified before merging, on origin/main ecd256c904 with all three PRs merged
together locally: cargo fmt --check clean; cargo test -p codewhale-tui-kit
--lib 214 passed; cargo test -p codewhale-tui --lib (history:: markdown
stream_chunk) 186 passed; dead-code, blocking-calls and locale-parity gates
pass (run by hand, since CI's ratchet steps are advisory on fork PRs). No
test or fixture asserted on the removed "Stream chunk timeout set to" status.
After this edit: check-contributor-credit.py passes (11 contributors since
v0.10.2, all three surfaces) and scripts/sync-changelog.sh reproduces
crates/tui/CHANGELOG.md byte for byte.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: CodeWhale Bot <[email protected]>
`session.resumed` made `SessionRecovery`'s `repaired_call_count`,
`duplicate_result_count` and `orphan_result_count` live outside tests, so the
three `#[cfg_attr(not(test), expect(dead_code))]` attributes went with it. The
measured count is now 158 (allow 105, expect 53) against a ceiling of 162.
The gate may go down freely; lowering it locks the win in so a later change
cannot quietly re-add a suppression. Regenerated with `--update`.
Verified: `python3 scripts/check-dead-code-budget.py` reports
"158 suppressions (allow=105, expect=53), budget 158 (0 under)".
Signed-off-by: CodeWhale Bot <[email protected]>
The two archive tools add 2492 bytes and two tool names to the
model-visible catalog, so the pinned prompt goldens no longer matched.
Re-recorded with the host pins in force. system_sha256, system_bytes and
system_blocks are unchanged, so the system prompt itself is untouched;
only tools_sha256, tools_bytes, tool_count, tool_names and prefix_sha256
moved. Scanned the new goldens for host-specific text (powershell, pwsh,
user or drive paths, platform names) and found none.
Also drops the temporary conformance-refresh workflow.
Bold, italic and strikethrough spans pushed their inner text as one
plain run, so markup inside them reached the screen as written:
**`--force`** showed its backticks, and **[the guide](https://...)**
showed the brackets and the URL, with no hyperlink.
Parse the inner text with the emphasis style as its base, so code,
links, bare URLs and escapes inside it render as they do outside. Each
arm's inner text ends at the first closing delimiter of its own kind,
so a delimiter can't nest inside itself and the recursion stays a few
levels deep.
A note doubles its backslashes before it is rendered, but skipped any
line with `*` or `~~` because emphasis printed its text as written.
With escapes read inside emphasis, a note line like
**C:\Users\asus\.codewhale** would lose the backslash before the dot,
so the note escaper now skips only lines with inline code and table
rows. A line that mixes bold and a path, like
**Saved** to C:\Users\asus\.codewhale, keeps its backslash too.
Signed-off-by: Lstarsky0 <[email protected]>
#7117 merged with three blocking-call sites over budget:
crates/config/src/persistence.rs: thread_sleep 1 > budget 0
crates/runtime/src/settings.rs: thread_sleep 1 > budget 0
crates/runtime/src/settings.rs: std_fs 5 > budget 4
It merged because the CI step that runs this ratchet is
`continue-on-error` for pull requests from untrusted forks, so the failure
was advisory there and closed red on `main` instead — and a push to `main`
starts no workflow.
All three are genuinely synchronous. `atomic_write` is `pub fn atomic_write`
in `crates/config/src/persistence.rs:42`, and the settings one sits in a
Windows-only replace helper; both are reached from ordinary settings saves,
not from a runtime worker. The sleeps are the bounded retry that lets a write
succeed while another Codewhale instance holds the destination open for a
read, which is the whole point of the branch. `spawn_blocking` has no runtime
to yield to in a synchronous function, so this is the ratchet's documented
debt path.
Regenerated with `--update`: 578 sites across 170 files.
Verified: `python3 scripts/check-blocking-calls-budget.py` reports
"578 sites across 170 files, within budget".
Signed-off-by: CodeWhale Bot <[email protected]>
#7142 asked for a dated, attributable record of what happens to a
conversation, and #7095 is a report of history that vanished with nothing
written down. A resume is where a crash-repaired history becomes durable, and
`SessionRecovery` already carries the evidence: whether the document changed,
and how many calls were repaired, results deduplicated and results left
orphaned.
`resume_session` now writes one `session.resumed` audit event carrying those
counts plus the message count. It records counts and the session id, never
message bodies, so it stays a sensitive-safe event like
`session.window.rerooted`. The event covers every resume that goes through
this owner — `codewhale resume`, ACP's prefix resume and the Runtime API's
thread resume all land here.
This also makes the three counters live outside tests, so their
`expect(dead_code)` attributes are removed rather than left unfulfilled under
the workspace's `-D warnings`.
Verified on the debug build in an isolated `CODEWHALE_HOME` with a real saved
session (workspace retargeted to the fixture): the audit log gained
{"event":"session.resumed","details":{"session_id":"0061a59b-…",
"repaired":false,"repaired_call_count":0,"duplicate_result_count":0,
"orphan_result_count":0,"messages":90}}
`cargo check -p codewhale-tui --lib` clean, `cargo fmt --all --check` clean.
Not verified: a resume that actually repairs a damaged document, which needs a
corrupt fixture; the payload shape is proven, the non-zero counts are not.
Signed-off-by: CodeWhale Bot <[email protected]>
`rewrite_settings_in_place` is the last-resort `settings.toml` delivery when
every replacing call is refused, which only happens on Windows. The helper
itself was not gated, so on macOS and Linux it had no caller and the crate
denies dead code:
error: function `rewrite_settings_in_place` is never used
--> crates/runtime/src/settings.rs:2462:4
It now carries the same `#[cfg(windows)]` as its only caller. Nothing about the
Windows behaviour changes.
Verified: `cargo check -p codewhale-config -p codewhale-runtime -p
codewhale-tui` clean; `cargo test -p codewhale-runtime --lib settings` 100
passed / 1 ignored; `cargo test -p codewhale-config --lib persistence` 31
passed; `cargo fmt --all --check` clean.
Signed-off-by: CodeWhale Bot <[email protected]>
Conflict resolution for #7117 after rebasing onto current `main`. The branch's
five commits each rewrote the same two changelog files from an older base, so
this lands the three entries that are genuinely new to `main` under `### Fixed`
and leaves both files otherwise byte-identical to `main`:
- transcript notes no longer lose a backslash to CommonMark escaping, which
broke the one copyable path in a Windows setup failure;
- setup state survives a second running instance whose read handle makes
Windows refuse the replacing rename;
- `doctor` no longer reports a user's own `.tmp`-named scratch file as a
half-applied setup.
Entries for the branch's other two changes were already in `main` and are not
duplicated. The contributor's five commits keep their authorship.
Verified: `diff` against `origin/main` for both files shows three added lines
and no deletions; no conflict markers remain.
Signed-off-by: CodeWhale Bot <[email protected]>
`/config pet_mode --save` answered "无法删除要被替换的文件。(os error 1175)", and the
same refusal hit every other settings toggle — "无法保存确认。脱敏仍然开启。".
A retry does not help: on this machine the home directory refuses every
directory-entry rename for as long as it is held, and the refusal does not
expire. Measured directly, with the same file and the same ACLs:
D:\CodeWhaleData ReplaceFileW 1175, MoveFileExW 32, rename 失败
D:\ same
D:\CodeWhaleData\<any sub> OK
C:\Users\asus\Documents OK
`DeleteFileW` succeeds in the refused directories, and rewriting the file in
place succeeds, so the bytes can be delivered without a rename. Both writers now
do that as a last resort, because a setting that never saves is worse than one
whose write is briefly non-atomic.
- `crates/config/src/persistence.rs`: `atomic_write` keeps the retry over the
contention codes, then calls `rewrite_in_place` when the refusal is one of
them.
- `crates/runtime/src/settings.rs`: `atomically_replace_settings_file` keeps the
`ReplaceFileW` retry, then calls `rewrite_settings_in_place`.
The fallback is narrow on purpose. Only the contention codes fall back — 5, 32,
33, 1175 — so a full disk or a real permission bit still reports its own error
instead of being retried into an in-place attempt that would fail the same way.
`ReplaceFileW`'s 1176 and 1177 stay out of the list: they can leave the
replacement consumed or altered, which a retry cannot undo.
The in-place write truncates and rewrites, so an interruption can leave a
partial file; `Settings::load_persisted` already tolerates a corrupt document by
falling back to defaults with `load_error` set, which bounds the damage.
Verified on Windows against the affected directory:
- Before: `config set pet_mode false` -> exit 1, `settings.toml` mtime unchanged.
- After: `config set pet_mode false` -> `set pet_mode in
C:\Users\asus\.codewhale\settings.toml`, mtime advanced, value read back.
- `cargo test -p codewhale-config --lib -- persistence` -> 30 passed, including
the new `an_in_place_rewrite_replaces_a_longer_document`, which proves the
rewrite drops a longer document's tail.
`/config pet_mode --save` answered "无法删除要被替换的文件。(os error 1175)":
`ReplaceFileW` must delete the destination before it can publish the
replacement, and a handle that holds that destination without
`FILE_SHARE_DELETE` refuses the deletion. The previous fix covered
`atomic_write`'s `MoveFileExW` and its three contention codes; `settings.toml`
goes through `ReplaceFileW`, which reports its own fourth.
Retry the same way, over one allow-list now shared by both calls:
- 5 `ERROR_ACCESS_DENIED`
- 32 `ERROR_SHARING_VIOLATION`
- 33 `ERROR_LOCK_VIOLATION`
- 1175 `ERROR_UNABLE_TO_REMOVE_REPLACED`
Six attempts, `n * 50ms`, 750ms in total — up from 225ms, which a reviewer
called short for the scanned or slow filesystem this exists for.
Why 1175 belongs on the list and 1176/1177 do not: `ReplaceFileW` documents
1175 as "the destination file is not modified, and the replacement file still
exists under its original name", so a retry starts from the state it just read.
1176 and 1177 can leave the replacement renamed away, or holding the old file's
streams with its contents no longer guaranteed, so those surface at once.
Also: `SetFileAttributesW` failing is about the *source*, not a held
destination, so it is never retried; and the failure path still restores
`FILE_ATTRIBUTE_TEMPORARY` before each retry, so `TempPath` keeps its cleanup
behavior if the last attempt loses too.
Verified locally on Windows:
- `cargo test -p codewhale-runtime --lib -- only_a_held_destination` -> 1 passed
- `cargo test -p codewhale-config --lib -- only_a_contended` -> 1 passed
What I could reproduce of the mechanism: a destination held by an ordinary
reader makes `ReplaceFileW` fail with 32, and the same call succeeds once the
handle is closed, which is what the retry buys. A handle opened *with*
`FILE_SHARE_DELETE` plus a read-only mapped view did not reproduce 1175 — the
replace simply succeeded — so 1175's presence on this list rests on the
documented post-failure state rather than on a local repro.
At 120 columns the wrapper soft-wraps inside the path, so the string the case
asserts on is split across two lines and the assertion fails on the wrapper
rather than on the escape. The case is about the backslash, not the wrapper:
400 columns puts the whole note on one line.
A note is machine-generated and names paths, but it went through the markdown
renderer, which honours CommonMark §2.4: a backslash before ASCII punctuation
is an escape, so `\.` yields `.`. A note naming
`C:\Users\asus\.codewhale\setup_state.json` therefore printed as
`C:\Users\asus.codewhale\setup_state.json` — a directory that does not exist,
in the one line a user would copy to find the real one.
The renderer is right; a producer that wants a literal backslash escapes it.
The escape happens where notes are rendered, so every note is covered:
`escape_note_backslashes` doubles a bare backslash in note prose.
Three regions are left exactly as written, because the renderer already copies
them verbatim and doubling inside one would *print* the extra backslash:
- a fenced block, closed only by a run at least as long as its opener;
- a line carrying a delimiter the renderer treats as a passthrough (backtick,
`*`, `~~`) — inline code, bold, italic and strikethrough are the shapes a
note's third-party text (MCP guidance, extension prompts) brings with it;
- a table row.
`_`-delimited emphasis is deliberately not a passthrough trigger: `_` is
everywhere in identifiers (`setup_state.json`), and a false positive would
leave the paths this pass exists to protect untouched.
Five cases pinned: a plain Windows path survives intact; a fenced path is not
doubled; a fence shorter than its opener does not close it; inline code, bold,
strikethrough and a table row are passed through; and a prose path that also
carries an underscore is still doubled.
Two Codewhale windows share one home and both rewrite `setup_state.json` when
the provider or model changes. `atomic_write` staged the write correctly and
then failed at the replacing rename, because the loser of that race finds the
destination held open for a read and Windows refuses the rename outright while
the reader's handle lives (no `FILE_SHARE_DELETE`). The user saw
"Setup provider/model state was not saved" for a write that was momentary.
Retry only that condition, briefly: six attempts, `n * 15ms`, giving up after
75ms. A missing directory or a full disk still surfaces at once. On Windows the
retryable codes are 5 (access denied), 32 (sharing violation) and 33 (lock
violation); elsewhere it is `PermissionDenied`.
Two related defects found in the same report:
- The message used `{err}`, which prints only the outermost context and drops
the cause, so the path was the only thing left to look at. It now uses
`{err:#}`.
- `doctor`'s `stale_setup_temp_files` check matched any name starting with
`.tmp`, so a user's own scratch logs (`.tmp-build-release.log`) made a clean
home report as half-applied. It now matches what a staged write leaves behind
when it never lands: `.tmpXXXXXX` with no extension.
Gating the lease predicate test to Unix left `LeaseUnavailability::new` with no
caller on Windows, and the crate denies dead code:
error: associated function `new` is never used
--> crates\runtime\src\workspace_lease.rs:148:8
Its only caller builds `LeaseAttempt::Unsupported` on the "this mount has no
advisory locks" branch, which is `#[cfg(unix)]` because Windows takes real
`LockFileEx` locks. The constructor now carries the same gate. The type and its
`Display` stay available on every target, so callers that only match on an
`Unsupported` lease are unaffected.
Verified: `cargo clippy -p codewhale-runtime --lib -- -D warnings` clean with the
CI allow-list; `cargo fmt --all --check` clean. Not verified locally: the Windows
compile, which needs a Windows toolchain for `ring`; CI's
`Test (windows-latest)` is the check.
Signed-off-by: CodeWhale Bot <[email protected]>
`only_a_held_lock_is_contention_and_only_a_lockless_mount_is_unsupported`
asserts Unix errno semantics through `libc`, which this crate takes only under
`[target.'cfg(unix)'.dependencies]`:
error[E0433]: cannot find module or crate `libc` in this scope
error[E0425]: cannot find function `advisory_locking_unavailable`
--> crates\runtime\src\workspace_lease.rs:733:36
The predicate it calls is `#[cfg(unix)]` in `codewhale-util`, and production only
reaches it inside a `#[cfg(unix)] if` because Windows takes real `LockFileEx`
locks through `fd-lock`, so a failed lock there is contention rather than a
mount without locks. The test is Unix-only for the same reason, so it now says
so. Nothing about the Unix behaviour changes.
Verified: `cargo check -p codewhale-runtime -p codewhale-util` clean;
`cargo fmt --all --check` clean. Not verified locally: the Windows test build,
which needs a Windows toolchain for `ring`; CI's `Test (windows-latest)` is the
check.
Signed-off-by: CodeWhale Bot <[email protected]>
`check-blocking-calls-budget.py` failed on `main`:
crates/cli/src/update/uninstall.rs: std_fs sites 11 > budget 6
The five new sites are the shell-integration half of uninstall: reading a
profile, staging its replacement, adopting the profile's mode, and unlinking
the completion files. They are genuinely synchronous.
`update::uninstall::run` is reached from `fn run() -> Result<()>`
(`crates/cli/src/lib.rs:2353`), the synchronous CLI entry point, before any
Tokio runtime exists — the same reason the existing six sites in this file are
unbudgeted. `spawn_blocking` has no runtime to yield to here, and `tokio::fs`
is not available to a synchronous function, so the ratchet's documented
alternative applies: raise the file's budget and say why. None of the five
sites runs on a runtime worker.
Regenerated with `--update`; the diff touches only this one entry (6 -> 11).
`path_canonicalize` stays at 8.
Verified: `python3 scripts/check-blocking-calls-budget.py` reports
"575 sites across 169 files, within budget".
Signed-off-by: CodeWhale Bot <[email protected]>
Two call sites in the Windows owner-only test still used the old two-argument
`validate_owned_file_handle`, which now takes the private guard on every
platform:
error[E0061]: this function takes 3 arguments but 2 arguments were supplied
--> crates\config\src\xai_credentials.rs:930:9
--> crates\config\src\xai_credentials.rs:941:9
Both pass `store.private.guard()`, the same value the production path at
`xai_credentials.rs:257` already passes, so on Windows the guard is
`PrivateGuard::Required` and the ownership proof is unchanged.
Verified: `cargo clippy -p codewhale-config --lib -- -D warnings` clean on the
host with the CI allow-list; `cargo fmt --all --check` clean. Not verified
locally: the Windows compile itself, which needs a Windows toolchain for
`ring`; CI's `Test (windows-latest)` is the check.
Signed-off-by: CodeWhale Bot <[email protected]>
`stage_profile` ended its `#[cfg(unix)]` block with `return`, which is a
`needless_return` once that block is the last thing in the function on Unix —
the block's value is already the return value, and the `#[cfg(not(unix))]`
arm removes itself. The workspace lints with `-D warnings`, so the release
Lint gate failed:
error: unneeded `return` statement
--> crates/cli/src/update/uninstall.rs:655:9
This was not caught when it landed. Pushes to `main` deliberately start no
GitHub workflow, and GitHub lints a pull request's *merge* commit, so the
error surfaced only on an unrelated contributor PR whose CI checked out
`main` plus its own changes.
No behavior change: on Unix the block still yields the reopened staged file,
and on other targets `Ok(staged)` is still the tail.
Verified: `cargo clippy -p codewhale-cli --lib -- -D warnings
-A clippy::uninlined_format_args -A clippy::too_many_arguments
-A clippy::unnecessary_map_or` clean (the exact allow-list the CI Lint job
uses); `cargo test -p codewhale-cli --lib update::` 109 passed / 0 failed;
`cargo fmt --all --check` clean.
Signed-off-by: CodeWhale Bot <[email protected]>
`codewhale exec` with no cloud key adopts a local Ollama model and printed
`... nothing was saved.` That line means the adoption did not write a config
change, but read on its own it says the run was not saved — and in the same
output the run does save a session, which `codewhale sessions list` then shows.
A message that contradicts the session id printed beside it is worse than no
message, especially in a release whose open bugs include lost conversation
history.
Both sites now say `no configuration was changed`, which is exactly what the
adoption path does: `adopt_live_local_ollama_for_run(.., false)` mutates the
in-memory config for the run and persists nothing. `codewhale doctor --probe-local`
carries the same correction.
The unrelated `nothing was saved` in `crates/runtime/src/config_keys.rs` is
correct there — a rejected `config set` really does persist nothing — and is
left alone, including its assertion.
Verified: `cargo fmt --all --check` clean; `cargo check -p codewhale-tui --lib`
clean. Observed before the change on the installed binary: an interrupted
`codewhale exec` printed `nothing was saved` and still listed session
`5a37341f` as resumable. Not verified after: the reworded line on a rebuilt
binary, which lands with the next release build.
Signed-off-by: CodeWhale Bot <[email protected]>
The HarmonyOS change added Windows arms but left the Unix originals
ungated, so `codewhale-config` did not build for Windows, and one call site
still passed the pre-change arity:
error[E0592]: duplicate definitions with name `open_trusting_mount`
--> crates/config/src/private_directory.rs:95:5
error[E0592]: duplicate definitions with name `admit_trusting_mount`
error[E0592]: duplicate definitions with name `inspect_trusting_mount`
error[E0599]: no associated function `with_mount_tolerance`
error[E0061]: this function takes 2 arguments but 3 were supplied
--> crates/config/src/xai_credentials.rs:257:13
`open_trusting_mount`, `admit_trusting_mount` and `inspect_trusting_mount` now
carry `#[cfg(unix)]` on the bodies that call `with_mount_tolerance`, leaving the
existing `#[cfg(not(unix))]` arms as the only definitions there.
`validate_owned_file_handle` keeps its three-argument shape on every platform:
Windows and the remaining fallback take the guard and ignore it, because the
Windows ownership guard is the security descriptor rather than the mount
footing. The Windows-only callers that never had a guard to pass use a
two-argument internal helper instead.
Also replaces `u32::from(metadata.st_mode)` with a cast behind a scoped
`#[allow(clippy::unnecessary_cast)]`: `mode_t` is `u16` on Apple and `u32` on
Linux, so `as` is the widening there and a no-op here, and no single conversion
is lint-clean on both — `u32::from` failed Linux with
`clippy::useless_conversion` after `as` had failed it with
`clippy::unnecessary_cast`.
Verified on 36c038a28e plus this change: `cargo clippy -p codewhale-config
--lib -- -D warnings` clean on the host, `cargo check -p codewhale-secrets
--target x86_64-pc-windows-msvc` passing from the previous commit, `cargo test
-p codewhale-secrets` 55 passed / 1 ignored / 1 passed, `cargo fmt --all
--check` clean. Not verified locally: `codewhale-config` for Windows, whose
dependency graph reaches `ring`, and `ring`'s build script needs a Windows
toolchain this machine does not have. The Windows compile is left to CI.
Signed-off-by: CodeWhale Bot <[email protected]>
Plan active 13 -> 15, Plan full 30 -> 32, Act/Operate active 15 -> 17,
Act/Operate full 51 -> 53. The two new schemas are the only source
change; no tool left a surface.
--update also absorbed drift from the prompt and tool commits merged
after the 2026-10-26 lock (4cf2d2cff ran with [skip ci]), which is why
the representative stages and system-prompt byte counts move by 3-5
bytes with no matching change in this slice. The growth note in the
file records both.
Every Dependabot PR carries one permanently red check. `installation` mints a
GitHub App token from `vars.CODEWHALE_APP_ID` and
`secrets.CODEWHALE_APP_PRIVATE_KEY`, and GitHub withholds repository secrets
from workflows triggered by Dependabot, so the step fails before it starts:
Error: The 'private-key' input must be set to a non-empty string.
Both the variable and the secret are configured on this repository; the value
is simply not delivered to a `dependabot[bot]` run. The same job is skipped on
fork PRs and passes on same-repository human PRs, which is why the condition
below only needed to exclude the bot.
`installation` and `review` now skip when the actor is `dependabot[bot]`. Those
PRs have nothing for this reviewer to install a token for, and a check that can
never pass trains people to ignore a red X — it was the only failing check on
all nine open dependency PRs, which is exactly how a real failure would hide.
Verified: `actionlint .github/workflows/codewhale-review.yml` clean; the parsed
conditions keep `workflow_dispatch`, same-repository non-draft `pull_request`
and the `@codewhale` comment path unchanged. Not verified: the skip itself,
which needs a Dependabot run to observe — the next bump will show `skipping`
where it currently shows `fail`.
Signed-off-by: CodeWhale Bot <[email protected]>
Two build breaks in the previous commit, both invisible on macOS.
`StoreFile` and `advisory_locking_unavailable` were `#[cfg(unix)]`, but
`open_private` takes the role on every target and the write path calls the
predicate everywhere, so `codewhale-secrets` did not compile for Windows:
error[E0433]: cannot find `StoreFile` in `file_lock`
--> crates/secrets/src/lib.rs:627:73
error[E0425]: cannot find type `StoreFile` in this scope
--> crates/secrets/src/file_lock.rs:10:11
error[E0433]: cannot find type `StoreFile` in this scope
--> crates/secrets/src/file_lock.rs:242:72
error[E0425]: cannot find function `advisory_locking_unavailable`
--> crates/secrets/src/file_lock.rs:252:23
The role is a plain enum and is meaningful wherever it is passed, so it is no
longer gated. Windows takes real `LockFileEx` locks through `fd-lock`, so a
failed write lock there is genuine contention and the predicate answers false
rather than falling back to the in-process guard. `require_private_mode` stays
Unix-only, with a `let _ = role` on the other targets where nothing reads it.
`libc::stat.st_mode` is `mode_t`, which is `u16` on Apple and `u32` on Linux, so
`as u32` was a widening cast on macOS and a no-op on Linux that clippy rejects
under the workspace's `-D warnings`:
error: casting to the same type is unnecessary (`u32` -> `u32`)
--> crates/config/src/private_directory.rs
`u32::from` is total for both widths, and for the 32-bit Android target that is
`u16` too.
Verified on refs/pull/7168/head 95783672bf with both changes applied:
`cargo check -p codewhale-secrets --lib --target x86_64-pc-windows-msvc` fails
with the four errors above without them and passes with them;
`cargo clippy -p codewhale-secrets -p codewhale-config --lib -- -D warnings`
passes on the host; `cargo test -p codewhale-secrets` 55 passed, 1 ignored, 1
passed; `cargo fmt --all --check` clean. The Linux clippy run itself was not
executed here — cross-compiling this workspace needs a Linux `libdbus-sys`
build script — so the cast fix rests on `mode_t`'s declared width in libc
0.2.191 (`bsd/apple: u16`, `linux_like/linux: u32`) rather than a Linux run.
Signed-off-by: CodeWhale Bot <[email protected]>
- length-prefix JSON numbers in the archive hash so one field's text
cannot be absorbed by the field before it
- state that the closing paragraph of the compacted block is a host
instruction, not the previous model's summary
- describe the read tools' per-call and per-turn bounds honestly
- register the archive tools in the ACP host profile as well
- sync the tool-surface docs and public-surface facts
The number-framing test is a data-loss regression lock for the 304-byte
and 295-byte values the reviewer constructed; it is the only new test in
this slice.
A `[text](url)` link ended at the first `)`, so a destination with
parentheses of its own, like a Wikipedia article ending in
`_(programming_language)` or an old Microsoft Learn page ending in
`(v=vs.85)`, lost its last `)`. The hyperlink pointed at a page that
doesn't exist and the `)` showed after the label. Bare URLs already keep
balanced parentheses (bare_http_links_preserve_balanced_parentheses_in_target).
End the destination at the first `)` without a matching `(`, using the
has_unmatched_closing_delimiter check the bare URL path trims with. A
destination whose parentheses don't balance is no longer a link, as in
CommonMark, and shows as written.
Signed-off-by: Lstarsky0 <[email protected]>
`/config stream_chunk_timeout_secs <n>` answers in the transcript with
the new value and whether it was saved, then sends
Op::SetStreamChunkTimeout. The engine answered the op with "Stream
chunk timeout set to <n>s", which repeated that note in the footer and
stayed there; at 80 columns it also pushed the Shift+Tab hint off the
row. It is the same kind of ack that #7152 removed for SetFleetRoster
and 04de8eb67 for SetCompaction.
Store the timeout without sending a status. Nothing reads that message,
and a runtime thread's config reload, the other sender, already skips
status events that arrive before a turn starts.
Signed-off-by: Lstarsky0 <[email protected]>
A receipted release copy of `codewhale uninstall --yes` removed its program
files but left the user to hand-delete the PATH lines and completion files the
installer had told them to create. #7091 asks for a complete, verifiable
uninstall; this completes the shell half of it.
Uninstall now plans and applies two extra removals, both scoped to this
install and gated on the same receipted copy that owns the program files:
- This install's exact three-line `# >>> codewhale PATH >>>` block, in the
same profile list the old report walked. The block is only matched when its
middle line names this install directory, so another copy's block and a bare
`export PATH=…` line the user wrote are never touched. The profile is edited
by staging replacement bytes and renaming the original aside, so a failure
installing the replacement restores the user's own file by name; a symlinked,
unreadable or non-UTF-8 profile is reported and skipped. The profile's mode
is adopted before the guard captures it, since `GuardedFile` pins ctime.
- The Codewhale-generated completion files at their documented paths, honouring
`XDG_DATA_HOME` and `XDG_CONFIG_HOME`. They are kept while another Codewhale
copy remains on PATH, because a second install still wants them.
Cleanup failures after the program is already gone are reported individually
and exit non-zero rather than being silently swallowed. `--help`/dry-run
prints `Would remove` and changes nothing.
The installers still never edit shell profiles themselves; they now print the
PATH line as that marked block, so there is something provably ours to remove.
A bare `export PATH=…` line from an older install remains the user's.
Verified: `cargo test -p codewhale-cli --lib update::` 109 passed / 0 failed
(269 filtered); `vitest run lib/public-installer-contract.test.ts` 25 passed,
covering the printed marker block for zsh/bash/dash and the
unrecognised-shell case. Release build of `codewhale-cli` clean, no warnings.
Not verified: no real Windows host, no installed release artifact, and no run
against a profile this repository does not own. Refs #7091
The second review round reported five gaps in the compaction archive
tools; four held up and one did not survive measurement.
- Archive ids now hash a length-prefixed key. Hashing `id="ab" name="c"`
and `id="a" name="bc"` produced the same digest, so two distinct turns
could collide onto one archive id. `hash_json` stays for single values.
- `SUMMARY_HEADER` orders provenance before instruction: host facts and
the host's own directives render first, and everything below is
labelled as the model's summary rather than the host's claim.
- `bounded()` records the measured ceiling instead of implying one that
does not bind: `read_budget_bytes` exempts these two tools from the
route layer's three-percent rule, so `MAX_GET_CHARS` is the only real
bound (12000 chars, about 36 KB of CJK).
- The hook tool classifier learns both names. It gates shell and file
tools by path; these consume a hash id or a phrase and open no new
gate surface, which is why they land in `other`.
- Seven exact-surface assertions learn the two tools. Five were real
regressions I introduced: every named role, both small surfaces, the
machine-readonly evidence catalog and the machine-verifier catalog now
list them. Reading the archive is what any child that compacts needs,
so the surface grew rather than the tool being excluded.
This contradicts the review's N4 finding, which claimed child role
surfaces lack the tools and the summary header therefore issues a dead
instruction. Measurement shows all eight named roles and both small
surfaces expose them.
Verification: `cargo fmt --all -- --check` clean; the five surface tests
and the compaction/hooks/telemetry sets pass. `cargo test -p
codewhale-tui --lib` reports 12840 passed and 131 failed on this Windows
box; 5 of those were the surface assertions above and are now fixed. The
remaining 126 break down as 85 runtime_api (this checkout's `.codewhale`
is a reparse point, which the xAI OAuth path check refuses), 7
runtime_threads (deadline), 6 where a POSIX tool the test shells out to
is absent, 10 needing live MCP/network children, 6 platform sandbox and
encoding limits, and 12 that pass when run alone. None touch the archive
code.
`ApprovalRequest::impacts_for_locale` returned the English impact lines for every
locale except Simplified Chinese, which had its own parallel builder
(`build_impact_summary_zh_hans`) with hardcoded prefixes. The per-category
sentence was already a typed message (ApprovalImpactSafe ... ApprovalImpactUnknown)
with a value in all 15 packs; only the dispatch was zh-only.
One locale-aware `build_impact_summary(locale, ...)` now builds the lines for all
locales and replaces both builders (English and zh-Hans outputs are unchanged:
the English messages equal the old literals, and zh-Hans keeps its prefixes
verbatim). The six prefixed rows are new typed messages with a `{value}` slot in
all 15 packs: ApprovalImpactReads, Writes, Target, ConnectedApp, AgentType and
PrimaryInput. English still builds the stored `impacts` with the elevated
workflow-plan sentences; other locales get the generic agent line for a workflow
plan, as Simplified Chinese already did.
Observed with a temporary probe (removed): English and zh-Hans lines identical
to the old builders for read, write, fetch, shell, MCP and agent calls; German,
Japanese and French now show the translated sentence plus the prefixed row.
Verified (macOS arm64): `check-tui-locale-parity.py` PASS; codewhale-localization
54 passed, 0 failed; codewhale-tui approval/widgets/workflow/destructive/
decision_band/save_preview/ask_rule/impact filters 863 passed, 0 failed, 2
ignored (including the live-vs-legacy paint parity test over every shipped
locale); `preflight.sh --check` OK.
Observed once and not diagnosed: in the first batch run
`core::engine::approval::tests::full_access_fixture_uses_advance_authority_without_fabricated_approval_receipts`
failed with "fixture turn deadline: Elapsed" (its 5 s turn timeout). It passed 5/5
in isolation, 863/863 on two identical reruns, and 64/64 as 12 parallel
processes, so it did not reproduce; treat it as a load-sensitive timing flake
until it recurs with a captured iteration label.
Not covered: the 14 non-English translations were written without native-speaker
review; a workflow plan's own impact lines and detail labels
(`localize_detail_label`) and the delegated-authority rows are still English
outside Simplified Chinese.
Refs #7071
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Approval cards showed English, or Simplified Chinese only, for the "Do you want
to proceed?" question, the Why and Stop explanations on destructive actions,
the Approve / Edit plan / Cancel choices on workflow plans, the Save row (label,
"always allow / always ask first / never allow", "+N more") and the details
pager's "Tool Params:" title. Those were renderer-local `match locale` branches
and string literals. They are now 15 typed MessageIds (ApprovalProceedQuestion,
ApprovalFieldWhy/Stop/Save, ApprovalWhyBody, ApprovalStopBody,
ApprovalWhyCompactBody, ApprovalWorkflowApprove/EditPlan/Cancel,
ApprovalSaveSummaryAllow/Ask/Deny, ApprovalSaveMore, ApprovalToolParamsTitle)
with a value in every pack. Simplified Chinese keeps its existing wording
verbatim; English output is byte-identical. `PermissionRuleSavePreview::summary`
now takes the locale.
The frozen legacy approval painter (test counterpart only) keeps its own save-row
code, so it now reads the same localized label and "more" text, and its compact
entry budget uses the kit's `2 + label + summary + separator + more` formula
instead of a hardcoded 10; its duplicate proceed/semantics/workflow helpers are
deleted so it reuses the live ones. `tiny_localized_approval_keeps_every_action_and_hitbox`
asserted the literal English "Save:" in every locale; it now looks for the
locale's own label.
Known limits: the 14 non-English translations were written without native-speaker
review. Both painters budget the compact Save row by characters, not display
columns, so a CJK label can wrap it onto a second line (layout accounts for the
extra row). Still English outside Simplified Chinese: the card's impact summary
(`impacts_for_locale`) and the workflow plan's detail labels
(`localize_detail_label`).
Verified (macOS arm64): `check-tui-locale-parity.py` 2747/2747 keys in all 15
packs; codewhale-localization 54 passed, 0 failed; codewhale-tui approval,
widgets, workflow, destructive, decision_band, save_preview and ask_rule filters
863 passed, 0 failed, 2 ignored, including the live-vs-legacy paint parity test
across every shipped locale; `preflight.sh --check` OK.
Refs #7071
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A GUI start on HarmonyOS hmdfs failed one feature at a time: the workspace drive
lease, then the owner control socket as `failed to build daemon state`, then the
OAuth credential directory as `Codewhale credentials directory must be owned by
the current user`. Each of those admitted a directory by proving it was
current-user-owned and closed to group and other, and on that mount no directory
can: it reports the logged-in user's uid and a group-writable mode for every
object, whatever uid created it, so the calling process is never the reported
owner and `chmod` answers EPERM. Each fix revealed the next, because the same
mechanism sits under every private directory Codewhale keeps.
The mechanism now names the condition once. `private_footing` creates one `0o700`
directory under the target, reads back what the mount made of it, and — when that
is not the private owner and mode it asked for — asks the mount to narrow it and
looks again. Only a mount that refuses, or that keeps its own values after being
asked, is synthesising; a filesystem that applies an unexpected mode at creation
but honours the correction stores modes and keeps the full guard, so a default
ACL cannot silently relax a check. The probe runs only after a strict check has
already failed, and its answer (with its one warning) is remembered per
directory, so no write path probes a healthy filesystem.
Where the mount is synthesising, the private object is admitted with the
ownership guard recorded as unverifiable. The no-follow component walk, the
single-link check, atomic publication and the retained handle all still apply,
and the mount's own access control governs the rest.
Two capabilities are kept apart, because conflating them is what made the
original failure look like a missing feature. Exclusivity is the kernel lock, not
the ownership proof: the workspace lease is still taken, and a second driver is
still refused with the holder's pid, client, store and age. Only a filesystem
that refuses advisory locks themselves (`EPERM`, `EACCES`, `ENOTSUP`, `EINVAL`,
`ENOSYS`, and never `EWOULDBLOCK`) is reported as unable to provide exclusivity,
once per admitted workspace scope. The owner control socket has nothing else to
fall back on for discovery, so it degrades to HTTP only and says so; a
daemon-only run and ACP publication still require it and name the reason.
Narrowing a file or directory after writing it goes through one helper that
attempts the `chmod`, keeps the error on a filesystem that stores modes, and
excuses only a mount that cannot apply them — applied to the handle that was
opened where one exists, so a substituted path cannot be the object narrowed.
Checks that repeated the ownership proof on an object already admitted (the
retained-directory identity comparison, an owner receipt's mode, a published
socket's owner) now follow the guard it was admitted with.
`scripts/ohos-sign-binary.sh` cross-builds, strips and self-signs the Engine and
verifies the signature before handing the file back;
`scripts/ohos-lease-footing-probe.sh` reports what a directory on a device does
with ownership, mode and advisory locks; `scripts/ohos-secrets-store-smoke.sh`
exercises the secret store's degraded path against a real mount.
A file-backed secret store could not be written on HarmonyOS hmdfs, the 2in1
user directory. Every object there is reported as belonging to the logged-in
user whatever uid created it, so a process is never the owner of what it
creates: `chmod` answers EPERM, and the base mode is `0660` for every file.
Three checks assumed otherwise — the `0600` gate on `secrets.json` and its
`.lock`, the narrowing before the atomic rename, and the cross-process write
lock itself.
The mode gate now decides from evidence rather than from the mode alone: it
creates one probe file at `0600` in the store's directory, asks the mount to
narrow it, and reads the mode back. Only a mount that refuses, or that keeps
its own mode after being asked, is treated as one where the mode says nothing
about who may read the file; such a mount is accepted with a warning, because
the alternative is a plaintext key in `config.toml` — a wider exposure. A
filesystem that stores mode bits keeps the strict refusal, so a store left
readable by group or other is still refused rather than silently repaired:
those bytes may no longer be ours, and re-narrowing the file would hide the
question. The `.lock` sibling holds no secret and is repaired in place instead.
When the filesystem reports no advisory locks (EPERM, EACCES, ENOTSUP, EINVAL,
ENOSYS), secret-store writes are serialised within the process and the
fallback is logged. A lock that is genuinely held (EWOULDBLOCK) is unaffected.
Two Codewhale processes whose snapshots overlap can lose one write on such a
mount, which needs both to rewrite the store in the same instant.
The memory database's mode check takes the same evidence-based rule, so a
default ACL on a mode-storing filesystem no longer counts as a mount that
cannot hold a permission.
The credential and lease sections described the 2in1 user directory as a mount
that "refuses `chmod` on files the caller owns" and "refuses `flock` and
`fcntl(F_SETLK)`". Measurement on a HarmonyOS PC (`HPR-W72`, API 26) says
otherwise in a way that matters:
touch ~/.codewhale/x -> mode=0640 uid=20001006
chmod 600 ~/.codewhale/x -> EPERM, mode unchanged
mkdir -m 700 ~/.codewhale/d -> mode=2771 uid=20001006
Every object is reported as belonging to the logged-in user whatever uid created
it, so the calling process is never the reported owner — and `chmod` fails for
that reason, not because the mount has no mode support. This also separates two
capabilities the old text ran together: the ownership *proof* can never hold
there, while the kernel lock is a different thing and the lease is still taken.
Exclusivity is therefore not lost; only a filesystem that refuses advisory locks
themselves makes the Engine run without it.
The "can this directory hold a private file" recipe is corrected the same way: a
mode read back in a shell does not answer it, because the `chmod` that would
narrow the probe is refused on exactly the mounts the recipe was meant to catch.
It now points at the warning the store itself logs.
The store-side evidence probe this text describes lands in a separate change,
which is why the wording states the behaviour rather than the mechanism.
Changelog line and @gannp credit on CHANGELOG `### Contributors`,
docs/CONTRIBUTORS.md and UNRELEASED_CONTRIBUTORS. Regenerates
web/data/features.generated.json (the `local-model-reasoning` registry row from
#7125 and the shifted registry lines) and web/data/agent-docs.generated.json
(the earlier credit commit left CONTRIBUTORS.md stale in it).
Verified: `node web/scripts/check-facts.mjs` OK, `scripts/check-contributor-credit.py`
reports every contributor credited on all three surfaces, `scripts/preflight.sh
--check` passes.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
PR #7125 added the reviewed vLLM template registry and shapes the wire body from
it, but two earlier stages still treated every vLLM model as low/medium/high:
- `ReasoningEffort::normalize_for_route_identity` fell through to
`Low | Medium => High` for any provider without catalog metadata, and
`plan_turn_route` runs it before the shaper, so a saved `low` or `medium`
reached `apply_local_reasoning_controls` already collapsed to `high`.
- `route_picker_efforts` returned the generic Auto/Off/High/Max list, so the
picker could not offer a model's own tiers.
Both now consult `local_reasoning_spec(wire_model)` for `ProviderKind::Vllm`:
normalization uses the registry's `normalize` (tiers plus legacy aliases), and
the picker offers Auto plus the registry's tiers. Models without a registry
entry, and every other provider, take the existing paths unchanged. Both review
threads on #7125 (Copilot) named these two sites.
Observed with temporary probes (removed): on the merged tree before this change
every vLLM model mapped low->high and medium->high. After it, Qwen3.8-27B keeps
low and medium (picker: auto, off, low, medium, max), GLM-5.3-Flash and
DeepSeek-V4-Flash-Vision-Exp show their reviewed ladders, and an unreviewed
model is unchanged. Existing checks: codewhale-config `local_reasoning`
6 passed, 0 failed; codewhale-tui filtered reasoning/picker/route-plan/vllm
98 passed, 0 failed.
Not observed: a real vLLM or SGLang server.
Refs #7124
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Changelog lines for #7147, #7146, #7156, #7157, #7158, #7152 and #7150, and
credit for the contributors across CHANGELOG `### Contributors`,
docs/CONTRIBUTORS.md and UNRELEASED_CONTRIBUTORS (adds @luochen211, whose #7150
and #7149 landed). #7149 is a dead-code chore and has no changelog line.
Verified: `python3 scripts/check-contributor-credit.py` reports every contributor
in the window credited on all three surfaces; `scripts/preflight.sh --check`
passes; `sh scripts/sync-changelog.sh` regenerated crates/tui/CHANGELOG.md.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The Simplified Chinese guide's "upgrade / uninstall" bullets still told users to
`rm` the two binaries, while docs/INSTALL.md and the zh-Hans section 12 describe
the receipt-owned `codewhale uninstall` preview and `--yes`. The upgrade bullet
now matches the English text too (automatic for this install, or run
`codewhale update` now).
Verified: `node web/scripts/derive-install.mjs` renders both guides with no
broken internal link. Docs only; no installed-artifact or Windows evidence.
Refs #7091
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
fix(tui): render ~~~ fences as code blocks
Conflict with #7146 resolved in the ParseState doc comment only: the carry is
now `open_fence`, `code_language`, `code_block_id`, `in_list`. All code hunks
merged cleanly.
- feishu-bridge, wecom-bridge: follow-redirects 1.16.1 -> 1.16.2
(GHSA-mrwp-f3q8-3g9p, high, patched in 1.16.2). Lockfile-only; `npm audit`
reports 0 vulnerabilities in both; their node tests pass (19 and 17).
- vscode extension: override minimatch to ^11.0.1 (GHSA-g3hv-75wg-m249, DoS,
fixed in 11.0.1). Only @vscode/vsce, a build-time packager, depends on it and
calls the standard minimatch() export. `npm run audit:dependencies` reports 0
findings, `vsce ls` still enumerates the package, and the extension tests
pass (47).
web/ is intentionally untouched: its 18 moderate findings are the same minimatch
advisory plus glob (GHSA-3g3m-2fjr-6pw4) in the eslint and OpenNext build
toolchain, with no non-breaking fix, and web/docs/DEPENDENCY_SECURITY.md forbids
broadening the admitted advisory list. Its production tree audits clean.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The previous commit's one-line `let narrow = if ... { 40 } else { 80 };`
failed `cargo fmt --check` in the main landing preflight and the hosted Lint job.
Whitespace only; `cargo fmt --all -- --check` is clean.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
- remote-control footer test: a host with no sandbox backend (all Windows)
paints `files: workspace (unenforced)` in the posture chip, which at width 40
leaves the right slot no budget, so `/rc status` is shed by design. The test
now uses width 80 when no backend is present. Reproduced on macOS by pinning
sandbox_backend = None.
- extension-host disabling-mid-call test: a 150 ms wait for the call to be in
flight lost the race on a slow Windows runner, yielding NotAvailable instead
of Cancelled. Wait 1500 ms (the slow_wait tool runs far longer).
- native runtime library inspection (otool -l) deadline 3 s -> 10 s so a loaded
macOS runner does not trip the fail-closed probe.
Verified locally on macOS: the three tests pass (3 passed, 0 failed). Windows
legs not re-run; hosted CI not re-run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The first attempt at the compaction archive left 22 findings from an
adversarial review. This addresses them.
Archived ids now hash the message structure -- role plus each block's kind,
provider id and canonicalised input -- instead of the rendered text. Two
separate tool calls that happened to render identically used to collapse into
one entry and orphan the second call's result; a message written to several
cumulative snapshots still resolves to one id. `hash_json` sorts keys and
length-prefixes strings itself, because `serde_json` here has `preserve_order`
on and `Value::to_string()` therefore does not give a stable key order.
The tools now bound themselves. `context_archive_get` pages by character with
`offset` / `max_chars` (default 4000, hard cap 12000) and refuses an offset past
the end instead of silently returning nothing; `context_archive_search` pages
with `skip` and returns, per hit, the archive id, the character offset of the
match and a short snippet window (80 characters each side). Both declare their
own output size through `read_budget_bytes`, because the routing layer truncates
anything larger than the declared budget and a cut JSON document would arrive
with a `next_offset` that already pointed past the page. Every load, search and
slice runs inside `spawn_blocking`; the previous version read and parsed
snapshots inline on the runtime.
Reachability: the two tools are registered for Plan as well as Work, and both
names are in `DEFAULT_ACTIVE_NATIVE_TOOLS` so the pinned catalog carries their
schemas. The handoff note names them, and a model cannot call a tool whose
schema it has never seen.
Smaller fixes from the same pass: `snapshot_dir` refuses a session id that
`is_valid_session_id` rejects; `render_message` tags tool calls as
`[tool_use name#id]` and images as `[image] <url>` rather than dropping them
silently; the summary header no longer claims the note is unverified without
saying which claims that covers, and names the
`artifacts/context-transfer-*.json` path it had dropped.
Three findings are documented as known limits in the module header instead of
being fixed, because fixing them changes behaviour beyond this change: a
sub-agent shares its caller's namespace, so one archive can hold snapshots from
several engines of the same session tree; a tool result that a later pruning
pass rewrote to a stub is archived a second time under a new id; and a snippet's
`<<` / `>>` markers read ambiguously when the original text already contains
them, which is why `match_offset` is the precise locator.
Verified: `cargo fmt --all -- --check`; `cargo check --locked -p codewhale-tui
-p codewhale-telemetry`; `cargo test --locked -p codewhale-tui --test
feature_registry` -> 2 passed; `RUST_MIN_STACK=16777216 cargo test --locked
-p codewhale-tui --lib compaction` -> 183 passed, 0 failed. The stack variable
is the CI one (ci.yml exports 16777216 for test threads).
Compaction already persisted the full pre-compaction history to
artifacts/context-transfer-<checkpoint>.json before swapping in the
summary, and nothing could read it back. A detail the summary dropped
was gone for the rest of the session.
Two read-only tools close that gap:
- context_archive_search finds a phrase across every reachable
snapshot, case-insensitively, and returns short snippets carrying the
archive id of each hit plus the total match count.
- context_archive_get reads one message by id, with unique-prefix
matching and char-offset paging for long messages.
Entry ids derive from content: sha256 over role, a NUL separator and the
rendered text, first 12 hex characters. Snapshots are cumulative, so the
same message appears in many of them; the content-derived id is what
collapses those duplicates into one addressable entry.
Case folding is ASCII-only on both sides of the search. Unicode
lowercasing can change byte length, which would desynchronize the hit
offset from the text and could slice outside a char boundary.
The summary header now names both tools instead of pointing at a file
the model has no tool to open.
Known limits, recorded in the module header: thinking blocks are not
archived, only the newest 64 MiB of snapshots load, and every call
reloads and re-parses the snapshots, so paging through one large entry
repeats that work.
A bare URL ran to the next whitespace, and Chinese and Japanese text
doesn't put a space after one. In
`项目地址：https://github.com/codewhale-hq/Codewhale。克隆后运行 cargo build`
the link took in `。克隆后运行` as well, so the rest of the clause was
styled as a link and the hyperlink target pointed at a page that
doesn't exist. A URL in full-width parentheses kept the closing `）`
the same way, and one in curly quotes kept the closing `”`.
A bare URL now also ends at full-width sentence and clause punctuation
and brackets (。，、；：！？（）「」『』【】《》〈〉) and at curly quotes
(“”‘’). Ideographs and kana still belong to the URL, so
`https://zh.wikipedia.org/wiki/北京` links whole, and trailing ASCII
punctuation is trimmed as before.
Signed-off-by: Lstarsky0 <[email protected]>
`*` and `**` opened emphasis wherever a matching run came later on the
line, so prose with spaced asterisks lost them: `*args and **kwargs`
rendered as "args and *kwargs" with "args and " in italics,
`5 * 60 * 60` as "5 60 60", `*.rs and *.toml` as ".rs and .toml", and
`x ** 2 + y ** 2` as "x 2 + y 2".
An emphasis run now needs text right inside both delimiters, so it
can't start or end with whitespace. That is the whitespace half of
CommonMark's flanking rule; the `_` arm already checks it on the
opening side (#6042). `*real*` and `**this**` render as before.
Signed-off-by: Lstarsky0 <[email protected]>
`an_undeliverable_user_input_request_fails_fast` asserts that a pending
user-input wait has not completed by probing it with a 2 ms timeout while the
user-input timer is set to 10 ms. That leaves 8 ms of headroom, which Windows'
default ~15.6 ms timer granularity exceeds: the user-input timer wins, the wait
resolves, and the "still waiting" assertion inverts. It failed on the Windows
leg of the release validation while passing on Linux and macOS.
The timer is now 200 ms and the probe 50 ms. The intent — the wait has not
finished immediately — is unchanged; only the margin is now larger than any
scheduler granularity.
Verified: the case passes locally. Windows itself is verified only by the CI job
that reported it.
Not established: whether this is the only timer-margin assertion of its kind;
a scan for similarly tight probes was not run.
Three cases failed in the full `Test (ubuntu-latest)` leg of the release
validation. Two are the fixture class da026a2436 introduced; one is mine.
- `route::export::tests::golden_providers_export_matches_registry`
(codewhale-config): regenerated with `WRITE_GOLDEN=1`. The golden now lists
exactly the four routes the catalog refresh added — `kimi-k3.1-pro`,
`kimi-k3.1-pro-highspeed`, `MiniMax-M3.1-Flash` (twice: direct and
Anthropic-compatible) and `gpt-6.1-terra`. This is the one that was mine: the
catalog change landed without its golden because
`scripts/preflight.sh --check` does not run the version-stamped fixtures
(`--full` does).
- `tui::app::tests::test_update_model_compaction_budget`: pinned
`active_route_limits = None` but kept the window `App::new` had resolved, so
`deepseek-v4-pro` was budgeted from the wrong model's window and came out
*below* the unknown-model fallback (61440 vs 62976). The fixture now clears
`active_context_window` too, which is what production does through
`set_model_selection`.
- `commands::config_policy_status_tests::tests::status_report_localizes_the_complete_japanese_surface`:
set `active_context_window_source = ProviderReported` without the paired
window, so the installed window's own source won and the Japanese
"provider reported" string never rendered. The fixture now installs both.
Verified: all three pass locally under RUSTFLAGS="-D warnings"; `scripts/
preflight.sh --full` passes its version-stamped fixture step (the other
`--full` ratchet then aborted only because it refuses to measure a dirty tree,
which is resolved by this commit).
Native HarmonyOS users had to install a Rust toolchain and an OpenHarmony
SDK to get a working `codewhale`; a release could not serve them, and npm
handed them the static Linux build, which a device refuses to start.
Releases now build `aarch64-unknown-linux-ohos` as an eighth target and
publish `codewhale-ohos-arm64` with its `codew` alias and archive. The leg
signs the binary with the SDK's own signer and refuses to stage it unless
the signature reads back, because an unsigned ELF is refused at execve and
would be a dead download. `npm i -g codewhale` on that platform now picks
the native asset instead of the Linux one.
The asset inventory stays exact and enforced: 38 files across eight
targets, with the workflow, packaging and runbooks updated together so a
candidate that misses the HarmonyOS leg fails instead of shipping quietly.
Signed-off-by: Ben Gao <[email protected]>
Following the HarmonyOS page from a clean checkout failed before it produced
anything: the documented `cargo check` for the OpenHarmony target died inside
`aws-lc-sys`' build script with `Required build dependency is missing. Halting
build.` — a message that names neither cmake nor the target. `ohos-env.sh` now
puts the SDK's own `build-tools/cmake/bin` on `PATH` and exports `CMAKE`, so the
build no longer depends on what the host happens to have installed.
With that fixed, the check reached a second, unrelated failure (an ungated
`mod hashing`); that one is already fixed on main by fd9f06d87, so this commit
does not repeat it.
The page also gained what it was missing, verified on hardware (HPR-W72,
HarmonyOS 7.0.0.111, API 26, 2in1): only signed code runs at all, so `chmod +x`
is irrelevant; `hdc shell` cannot execute a binary under /data/local/tmp
because of its security label, which means a correctly signed binary still
reports `Permission denied` there and must be started from HiShell; and an
emulator is more permissive than a retail device. Signing with the SDK's own
`binary-sign-tool` is now part of the instructions, along with the two things a
self-signature does not grant (permissions and JIT) and the credential-storage
behaviour of the 2in1 user directory.
The capability table separates what was observed from what the target's cfg
gates make unreachable, and says plainly that the interactive TUI has not been
drawn on a device yet. The Chinese mirror matches it section for section.
Signed-off-by: Ben Gao <[email protected]>
`crates/cli/src/lib.rs` declares `mod update` as
`#[cfg(not(target_env = "ohos"))]`, but `mod hashing` — whose only consumer in
the crate is `update.rs` — was not gated. On the OpenHarmony target `update` is
not compiled, so `sha256_hex` has no users there and the OHOS
`cargo check` job fails under `-D warnings` with
`function sha256_hex is never used`.
Gating `hashing` exactly as its only user removes the dead item on that target
and changes nothing on any other, where both modules still compile.
Verified: `cargo check -p codewhale-cli --lib` under RUSTFLAGS="-D warnings"
passes. The OHOS target toolchain is not installed here, so the OHOS build
itself is verified only by the CI job that reported the failure.
Not established: whether this failure is older than this session's changes; the
module split that produced it predates them (`9a88b2fd88`), and the signature
is a target-gating omission rather than anything the S2 moves touched.
The markdown renderer only knew backtick fences, so a block opened with
~~~ rendered as prose: a `# comment` line became a heading with a rule
under it, indentation was dropped, and `*x*` turned italic. The rest of
the codebase already treats ~~~ as a fence (memory import, the agent
roster, the plan handoff title).
The fence carry now records the character along with the length. A
fence closes only on the same character and at least the opener's
length, so a ``` line inside a ~~~ block is code, and the other way
round. Backtick fences parse as before. The streaming thinking preview
mirrors the parser's fence rule to find a safe cut, so it follows.
Signed-off-by: Lstarsky0 <[email protected]>
`ci.yml`'s Documentation job runs `cargo doc --workspace --no-deps` under
`RUSTDOCFLAGS="-D warnings"`, which makes `rustdoc::private-intra-doc-links` and
`unresolved link` errors fatal. It has been failing on every recent run, across
eight crates, none of which this session's work touched:
- `tui-kit` referenced private `MAX_QUOTE_DEPTH` and `TAIL_SENTINEL`.
- `skills` referenced private `SUPERSEDED_BODIES`.
- `plugins` referenced private `stage`/`tarball`/`place` and an unimported
`PluginInstallSource`.
- `snapshot` referenced private `WorkspaceGate::describe`,
`MAX_SNAPSHOT_SIZE_MB` and several `Self::` methods that only resolve inside
their own item.
- `skill-install` referenced private `CacheMeta` and `candidate_urls`.
- `runtime` referenced private `InMemoryCredentialStore`, `Workspace::
follow_links`, `apply_env_overrides`, `parse_config_file` and a
`codewhale_tui::` path that does not resolve from this crate.
- `models` referenced private `SUMMARY_HEADER`.
- `config` referenced private `SetupTransaction`, `ConfigStore`,
`DEFAULT_TELEMETRY_ENDPOINT` and a `ConfigToml::` method from outside its impl.
A public doc comment cannot link to a private item, and none of these links were
load-bearing: they name implementation details, so they become plain code spans
rather than being made public. One link (`PluginInstallSource`) was a real
missing import in the link, so it gained an explicit path.
Verified: `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps` passes;
`scripts/preflight.sh --check` passes.
`ci.yml`'s Version drift job runs `scripts/release/crates.sh`'s order through
`validate-crate-publish-order.test.sh` and it has been failing on every run —
all five recent CI runs, covering both pull requests and dispatch — with:
codewhale-runtime (position 28) depends on codewhale-util (position 34)
`codewhale-util` moved earlier in the dependency graph when `runtime` began
using it for the shared test-environment barrier (6dd9af54c6), and again for
nothing else: `dependencies`, `lsp`, `plugins`, `skills`, `skill-install`,
`snapshot` and `tui` already depended on it while sitting after it in the list.
Publishing in that order would have made `cargo publish` fail on the first
dependent crate, so this was a release blocker, not a lint.
`codewhale-util` now publishes right after `codewhale-memory` and before
`codewhale-runtime`, which is the first of its dependents.
Verified: `scripts/release/validate-crate-publish-order.test.sh` passes;
`scripts/release/prepare-release.test.sh` still passes;
`scripts/preflight.sh --check` passes.
Refs CW-6129
`workspace_lease` (the cross-process drive-holder record and shared lease)
moves to `codewhale-runtime`. It depended on `codewhale_snapshot::paths` for
`strip_worktree_suffix` and `stable_hex`, and `codewhale-snapshot` depends on
`codewhale-runtime`, so moving the module first would have created
`snapshot -> runtime -> snapshot`.
Those two helpers are pure `std` and are the shared project/worktree split both
crates derive their on-disk layout from — `stable_hex`'s own doc said two copies
"would be two things to keep in step". They move down to `codewhale-paths`, which
sits below both, and `snapshot::paths` re-exports them so its callers and its
`paths::` tests are unchanged.
Verified: `cargo check -p codewhale-paths -p codewhale-snapshot
-p codewhale-runtime -p codewhale-tui --lib` and `--tests` pass under
RUSTFLAGS="-D warnings"; `codewhale-runtime --lib workspace_lease` runs 9 cases,
9 pass, including `lease_path_is_stable_and_worktree_aware` — the case that
exercises the relocated helpers through a real lease path; `codewhale-snapshot
--lib paths::` runs 4 cases, 4 pass through the re-export;
`scripts/preflight.sh --check` passes (the path-keyed blocking-calls budget is
unchanged at 570 sites).
Measured: tui 570,786 -> 570,347 [M] production lines, runtime 35,167 ->
35,608. Cumulative across the three S2 moves: tui 571,736 -> 570,347
(-1,389), runtime 32,101 -> 35,608.
Not established: no cross-process lease contention was exercised beyond the
module's own cases.
Refs CW-6129
Three more TUI modules that are Engine state rather than presentation move to
`codewhale-runtime`:
- `workspace_trust`: the per-workspace list of trusted paths, persisted beside
the config. A headless Engine needs to answer "may this be read" without a
terminal.
- `delivery_files`: the guarded open/write path used when Codewhale delivers a
file, including the symlink/hardlink/ownership checks. `crates/cli` reaches it
for update and uninstall, so it was already an API two crates needed.
- `session_diagnostics`: the redacted summary of a session's failure signals.
`delivery_files` referenced `codewhale_runtime::hashing` from the outside and now
calls `crate::hashing`; the TUI and `crates/cli` call sites were rewritten by
path. `codewhale-error-taxonomy` is added to runtime's dependencies for
`session_diagnostics`; that crate depends only on `codewhale-tools`, which
depends only on `codewhale-protocol`, which has no workspace dependencies, so no
cycle is introduced. Five `session_diagnostics` items became `pub` because
`pub(crate)` does not cross a crate boundary. One `expect(dead_code)` on
`WorkspaceTrust::permits` was removed: a `pub` item in a private module is
dead-code-checked, but the same item in a public module is not, so the lint
expectation became unfulfilled.
Verified: `cargo check -p codewhale-runtime -p codewhale-tui -p codewhale-cli
--lib` and `--tests` pass under RUSTFLAGS="-D warnings";
`codewhale-runtime --lib workspace_trust delivery_files session_diagnostics` runs
22 cases, 22 pass; `scripts/preflight.sh --check` passes, which is what catches
the path-keyed blocking-calls budget the previous module move silently broke
(`delivery_files` and `workspace_trust` entries moved crates with identical
counts).
Measured: tui 571,427 -> 570,786 [M] production lines, runtime 34,158 -> 35,167.
As with the first S2 move this is a small slice justified by ownership, not by
the line count.
Not established: no end-to-end delivery or trust decision was exercised through
a real turn after the move, only the modules' own cases and the crate checks.
Refs CW-6129
GitHub does not evaluate a workflow on the push that introduces it, so the
first run would otherwise wait for the next landing and the gate itself would
go unproven. workflow_dispatch also lets a maintainer re-run it after an
infrastructure failure without an empty commit.
`ci.yml` triggers only on `pull_request` and `workflow_dispatch`, so nothing
validated a landing. On 2026-10-30 four commits landed red behind `[skip ci]`
and all nine open PRs then inherited the failure: a dead enum variant that only
fails under `-D warnings`, a clippy error in `codewhale-skills` fixed later, and
a blocking-calls budget left stale for a file that had moved crates.
`scripts/preflight.sh --check` already encodes exactly that class of breakage —
rustfmt, the TUI changelog slice, README locale stamps and links, the dead-code
and blocking-calls budgets, generated-asset drift and the feature receipts. It
is the script the repo already documents for "run it before you push", measures
45 s locally, and needed no new tooling here.
Deliberately narrow: no test suite, no clippy, no multi-OS matrix. Those stay
pull-request and release gates. This job exists to catch a red landing in
minutes, not to re-run the release gate on every push — `ci.yml` remains the
place full validation happens, via `workflow_dispatch -f expected_sha=<sha>`.
Verified: the YAML parses and resolves to one `push` job with three steps.
`scripts/preflight.sh --check` passes locally on this commit (exit 0).
`release-workflows.test.js` and `test_ci_migration_wiring.py` read only
`ci.yml`, which is unchanged; the latter already fails one case on main before
this workflow exists (recorded in PAINPOINTS).
Not established: the job has not run on GitHub yet.
Two checks that only `scripts/preflight.sh` runs caught fallout from the module
moves, after the crate checks were already green — the crate checks were not
enough evidence and the earlier commit said "verified" without them.
- `cargo fmt`: the longer `codewhale_runtime::artifacts::…` paths pushed 27 TUI
rewrite sites past the line width. Mechanical; `cargo fmt --all`.
- `scripts/check-blocking-calls-budget.py`: the budget is keyed by file path, so
moving `artifacts.rs` into `codewhale-runtime` left a stale `tui` entry and an
unaccounted `runtime` one. The counts are identical (`std_fs: 2`) — a
relocation, not a new blocking call.
The same run also surfaced `crates/runtime/src/working_set.rs` (`std_fs: 1`,
`path_canonicalize: 1`), which arrived in e5fa43aa82 and never had its budget
entry updated because that commit carried `[skip ci]`. It is recorded here
rather than left to fail the next PR.
Verified: `scripts/preflight.sh --check` is the check that failed before this
commit; the blocking-calls and rustfmt checks are re-run in the next step.
Every fleet change sends Op::SetFleetRoster, and the engine answered
each one with "Fleet roster refreshed for subsequent turns". Each of
those changes already writes its own receipt: the /fleet add|remove
note in the transcript, the toasts from the route editors, the
"Team ... profile saved" status. The engine's line arrived after it and
took over the footer, and in a Chinese UI it left an English sentence
there. 04de8eb67 fixed the same kind of ack replacing a host receipt for
SetCompaction.
Store the roster without sending a status. Nothing else reads that
message.
Signed-off-by: Lstarsky0 <[email protected]>
`artifacts` (the session artifact store: immutable writes, relative-path
resolution, the tool-call id that names each record) and
`tool_output_receipts` (the `/status` reading of raw tool-output pressure over
those records) were TUI modules that a headless Engine also needs. They move to
`codewhale-runtime`, which now sits above `codewhale-util` after 6dd9af54c6.
`artifacts` depended on the TUI only through `crate::test_support::
unsealed_state_dir`, which `codewhale-runtime` already provides, so the module
moves with no behavioural change. Its test seams (`TEST_ARTIFACT_SESSIONS_ROOT`,
`TEST_ARTIFACT_SESSIONS_GUARD`, `set_test_artifact_sessions_root`) are gated
`any(test, feature = "test-support")` so the TUI's own tests keep reaching them
across the crate boundary — the same pattern `codewhale-runtime` already uses
for `audit` and `config`. Three functions and two statics became `pub` because
`pub(crate)` is visible only within one crate; nothing new is re-exported.
182 references across 44 TUI files were rewritten mechanically by path.
Verified: `cargo check -p codewhale-tui -p codewhale-runtime --lib` and
`--tests` pass under RUSTFLAGS="-D warnings"; `codewhale-runtime --lib
artifacts` runs 9 cases, 9 pass.
Measured, not assumed: this moves 309 production lines out of `tui`
(571,736 -> 571,427 [M] strict) and into `runtime` (34,158, up from 32,101).
That is far below the ~10k-per-crate target and does not on its own justify
the slice; the reason to take it is that these two modules are Engine state
that a client without a terminal needs, not TUI presentation.
Not established: no end-to-end artifact write/read was exercised through a
real turn after the move, only the module's own cases and the crate checks.
Refs CW-6129
A chat turn stopped dead after a tool returned and produced nothing for 56
minutes: no assistant reply, no status line, no stall record, no cancellation.
The user interrupted it by hand.
Two owners each believed the other held that wait:
- `tool_batch.rs` entered `TurnPhase::Tools` with `None` as the bound, on the
comment that "per-tool timeouts, approvals, and the UI tool-hang watchdog own
a tool batch's bound". Those own a *running* tool. The engine's own work
after a result comes back — result processing, scheduling, the next request —
runs in the same phase and no per-tool timeout sees it.
- With no bound, `TurnHeartbeat::engine_owns_live_wait()` still returned true
(phase not Idle, `stall` empty), so `tui/ui/session_state.rs` declined to
fire its own watchdog. And `spawn_turn_stall_watchdog` could not fire either,
because `detect_stall_at` returns `None` when `bound` is `None`. Nothing was
watching.
`TOOLS_PHASE_BOUND` (1800s) gives that phase an owner, generous enough that a
legitimate long build stays far below it. The watchdog now also takes the
engine's cancellation token and cancels on the same report it used to only
describe: a status line that scrolls away while the turn still never ends is
the failure this watchdog exists to prevent.
Verified: `cargo check -p codewhale-tui --lib` under RUSTFLAGS="-D warnings"
passes; the four `turn_heartbeat` cases pass, including the new assertion that
a reported stall leaves the token cancelled. The existing
`stall_parked_phase_is_never_reported` case still passes, so a genuinely parked
phase is unaffected.
Not established: the original wedge is not reproduced (its cause was never
logged), so this bounds the class rather than proving that specific incident
fixed; 1800s is a judgement, not a measurement.
Refs #6184
The zh-Hans pack addressed the user as 你 in 43 strings and 您 in 6,
mixing both inside TelemetryNoticeBody. It also translated "provider"
as 服务商 in 4 strings against 提供商 in 90, and wrote usage tokens as
"Token" in 3 strings against "token" in 40.
Align the outliers with the dominant forms, and drop two stray spaces
after full-width punctuation in the telemetry notices. 令牌 is kept
where it means a credential (OAuth/access token).
Refs #6804
Signed-off-by: luochen211 <[email protected]>
Remove the file-level #![allow(dead_code)] from fleet/alerts.rs and
tui/pet_watch/worker.rs and let -D warnings adjudicate:
- pet_watch/worker.rs is already declared #[cfg(test)] in its parent,
so the allow suppressed nothing; removing it needs no other change.
- FleetAlertEvent::stale_from_worker_event and ::verifier_failed have
no production caller; only the module's tests build events with
them, so they move into the tests module with their imports.
- FleetAlertEvent::run_completed has no caller in any build and is
deleted.
Lower scripts/dead-code-budget.json with --update: total 164 -> 162.
Checks: cargo check -p codewhale-tui --lib --tests (warnings denied),
clippy -p codewhale-tui --lib --tests -D warnings clean, and
cargo test -p codewhale-tui --lib -- fleet::alerts pet_watch::worker:
10 passed; 0 failed.
Refs #5587
Signed-off-by: luochen211 <[email protected]>
The compatibility asset lists 17 `provided_services` and 22
`refused_services`, and 14 names appear in both. Read as two verdicts on the
same service that looks like a contradiction, and it cost a review pass to
establish that it is not.
They answer different questions. `provided_services` is what a plugin may
inject (`root.ts:715` fails activation on anything else); `refused_services` is
what a plugin may not provide (`root.ts:225` refuses `provide` for those names,
except the host's own shim). `tools` is both injectable and unprovidable by
design — a plugin uses the Engine's registry through the host shim and cannot
install a second one. The same section names `events`, `logger`, `reflect` and
`registry` as Cordis built-ins rather than Codewhale shims, and `loader` as
injectable without being advertised.
Documentation only; no behaviour, no asset change (the asset is trust-pinned, so
editing it would invalidate every installed DSH plugin's trust for no gain).
Verified by reading both enforcement sites and the `shimClasses` registrations.
Refs CW-6129
`codewhale-util` carried an optional `codewhale-runtime` dependency behind its
`test-support` feature, purely so `util::utils` could enroll a spawned blocking
thread in the caller's sealed test environment. That prospective edge is what
blocked the S2 module moves: those modules need `codewhale-runtime` to depend on
`codewhale-util`, and util depending back on runtime is a cycle.
`test_env_lock` is 295 lines of `std` only — a `Mutex`, a `OnceLock` and thread
ids — so it moves down to `codewhale-util` unchanged and keeps one static for
every crate that uses it. `runtime::test_support` re-exports the same names, so
no caller outside `crates/util` changes. `util` loses the optional dependency;
its `test-support` feature remains as an empty switch, because the `cfg` in
`utils.rs` must still be enabled when another crate builds util as a dependency
(tui, plugins and skills all enable it). Each of those three already turns on
`codewhale-runtime/test-support` itself, so nothing relied on the transitive
edge being removed.
Verified: the workspace normal-dependency graph now has `runtime -> util` and no
path from `util` back to `runtime` (checked by walking every `[dependencies]`
table). `cargo check -p codewhale-util -p codewhale-runtime -p codewhale-snapshot
-p codewhale-notify --lib` and `--tests` for util and runtime pass under
RUSTFLAGS="-D warnings"; `codewhale-util --lib` runs 51 cases, 51 pass;
`codewhale-snapshot --lib first_init_waits_for_the_side_repo_write_lock`, which
uses `env_scope_ticket`/`join_env_scope` from the new location, passes, which is
what proves the static is shared rather than duplicated. The `Cargo.lock` diff is
one added line (`codewhale-util` under runtime).
Refs CW-6129
`save_and_resume_keep_ownership_honest` failed deterministically, on clean
main as well as with this session's work: `/undo` on a thread resumed from a
saved document answered 400 "Cannot identify an exact saved-history boundary
for this backtrack" where the case expects 409 `restore_point_unavailable`.
Cause, measured rather than inferred. `projected_user_text` splits a message
into its text blocks and runs `extract_user_prompt` on each. That helper strips
a *leading* `<turn_meta>…</turn_meta>`, which is the shape a saved document
stores. A thread rebuilt from turn records via
`reconstruct_messages_from_turns_with` keeps its metadata in the *trailing*
shape, so nothing was stripped there. The same prompt therefore projected to
272 bytes from the document and 609 from the records (measured), and
`saved_history_boundary` — which walks one and compares against the other —
could never match. The first comparison already failed, so every backtrack of a
resumed thread refused.
`strip_turn_metadata_envelope` now removes one complete envelope from either
end after the per-block pass. The envelope is engine metadata, never prompt
text, so neither side may carry it into the comparison; the guard itself is
unchanged and still refuses when the prompts genuinely disagree.
Verified on 0d8b664a7a + this path: the failing case passes; the
`runtime_threads`, `saved_history_boundary`, `undo`, `restore_point` and `fork`
selection runs 393 cases with 3 failures, all three "Timed out waiting for
turn" under full parallel load, and all three pass when run alone (the same
robustness gap recorded in PAINPOINTS P7). `cargo check -p codewhale-tui --lib
--locked` under RUSTFLAGS="-D warnings" and rustfmt pass.
Not established: no end-to-end restore of a real multi-turn session was
exercised beyond the existing cases, and the two `sse_turn_recovery` cases that
fail in that selection also fail on clean HEAD.
A server that does not speak the 2026-07-28 revision can answer the
`server/discover` probe in two shapes: a bare transport status, or a
well-formed JSON-RPC error. Codewhale only recognised the first. Its modern
refusal gate accepted 404/405/406/415 and treated everything else as a hard
failure, so a server replying `400` with `{"error":{"code":-32600,
"message":"Unsupported protocol version"}}` stopped the connection instead of
negotiating the legacy `initialize` handshake it was plainly offering. The
same narrow test sat on the legacy side and on the extension host's two
allow-lists, so the refusal never reached the transport either.
`mcp::wire::is_json_rpc_error_body` parses the excerpt for an `error.code` and
both the modern and legacy refusal gates now accept `400` carrying one. The
vendored builtin module's two status lists gain `400` to match, since Rust is
the authority that issues the grant.
Verified on 0e3677b50d + this change: `mcp.deepwiki.com`, which answers the
probe with exactly that 400, now connects and lists its three tools, where
before it failed with `MCP Streamable HTTP rejected ... status=400`. Linear is
unchanged (`mcp tools linear` lists 77). `mcp_http`, `mcp::tests::` and
`table_matches_the_host_build` run 300 cases, 300 pass. The two
`sse_turn_recovery` cases in the same filter selection fail with and without
this change on clean HEAD, so they are not part of this slice.
Not established: no server that returns 400 for a reason other than a probe
refusal was exercised; the excerpt bound and the parse keep a non-JSON or
error-free body on the hard-failure path.
Removing a selected attachment, vim `x` and vim `dd` edited the composer
without clearing the recalled history entry, so the next Up/Down went on
from the stale index and silently brought the original entry back. The
other deletes already clear it (see the note on insert_str).
Signed-off-by: Lstarsky0 <[email protected]>
Co-authored-by: Hunter Bown <[email protected]>
Models.dev already lists these rows, so a live refresh shows them; the bundled
seed is what a first run, an offline start and a deep-offline install read, and
it stopped at `kimi-k3`, `MiniMax-M3` and `gpt-6-astra`.
`scripts/catalog/models_dev_seed.toml` now names `kimi-k3.1-pro`,
`kimi-k3.1-pro-highspeed`, `MiniMax-M3.1-Flash` (both the direct and the
Anthropic-compatible MiniMax entry, which share one upstream roster) and
`gpt-6.1-terra`. `seed lock` re-pinned the referenced rows and `seed render`
regenerated the bundled asset.
Verified: `seed render --check` reports the bundled asset matches the spec and
lock; `seed age --max-days 30` passes at 0.0 days; `defaults audit` reports
"0 stale"; `cargo test -p codewhale-config --lib --locked catalog` runs 71
cases, 71 pass. The four pre-existing rows for each provider are still present
in the rendered asset.
Not established: no provider call exercised any of these new ids, and their
limits and prices are whatever Models.dev publishes.
da026a2436 made the resolved `ContextWindowResolution` authoritative for the
effective window: `effective_budget_route` prefers the installed window, then
the route limits, then the catalog. Three fixtures still installed only one
half of the pair, so they exercised the fallback branch instead of the branch
they name:
- `inspector_uses_effective_auto_model_context_window` set
`last_effective_model` with no `last_effective_budget`, so Auto resolved
`deepseek-v4-pro`'s catalog window (128000) rather than the 1,000,000 the
case is about.
- `config_context_window_query_shows_override_and_effective_source` and
`status_report_names_context_window_source_and_override_key` set
`active_route_limits` and the source but not `active_context_window`, so
`/config context_window` reported "effective 128000 from fallback
(unverified)" and `/status` reported the catalog provenance.
Each fixture now installs the window beside its source, which is what the
production writers do. No production behaviour changed.
Verified on e5fa43aa82 + this path: `cargo test -p codewhale-tui --lib
--locked -- context_window inspector_uses_effective_auto` under
RUSTFLAGS="-D warnings" runs 15 cases, 15 pass, including all three repaired
ones.
The extension host forwards the SDK's own framing headers to Rust, and the
Rust send path then added the same two headers again through
`RequestBuilder::header`, which appends rather than replaces. Every POST and
the GET channel open therefore arrived with two `Accept` and two
`Content-Type` values.
A server that validates those headers refuses the duplicate. Linear answers
`415 Unsupported Media Type`, and Codewhale read a transport-shaped refusal
as "this endpoint is not Streamable HTTP", minted a legacy-negotiation grant,
and re-sent `initialize` over the deprecated SSE transport. Linear refuses
`GET` on `/mcp` with `405`, so the connection died as
`SSE error: Non-200 status code (405)` with no hint that the real cause was a
duplicated header. `linear` was unusable in every session that used it.
`send_mcp_request` now collapses each framing header to its first value
immediately before the request is built, so exactly one value reaches the
wire whatever the layers above supplied.
Verified on e5fa43aa82 + this path: reproduced the duplicate first with a
local logging relay and confirmed the 415 -> SSE -> 405 chain, then confirmed
by hand that two `Content-Type` lines alone produce Linear's 415 and one line
produces 200. After the fix, `codewhale mcp connect linear` reports connected
and `codewhale mcp tools linear` lists 77 tools; `mcp_http` (4 cases),
`mcp::tests` auth cases and the `-D warnings` lib check pass.
Known remaining, not fixed here: a server that rejects the modern
`server/discover` probe with 400 and JSON-RPC code -32600 is still not
treated as legacy-negotiation evidence, so such a server fails instead of
falling back (reproduced against mcp.deepwiki.com).
`session.window.rerooted` said only "first_message_changed", so a re-root
caused by restoring a session and one caused by the Engine replacing the
projection looked identical in the audit trail. The snapshot now records a
`cause`: `engine_projection` when the API projection replaced a non-empty
transcript from an empty first message, `session_restore` when a restore
installed the messages, and `unattributed` otherwise. The audit entry also
fires when a journal with entries has no active path, which previously
produced no record at all.
`App` keeps the cause in `window_reroot_cause` until the next snapshot takes
it, so the attribution survives the path from the writer to the snapshot.
Verified on e5fa43aa82 with these five paths applied: `cargo check -p
codewhale-tui --lib --locked` under RUSTFLAGS="-D warnings" passes, and the
reroot/session_state/api_messages/journal filters pass (14 + 3 + 44 across
session_state, api_messages and journal; `reroot` selects no case because no
existing test names it). The `restore` filter is red on one unrelated case
that also fails without this patch (`save_and_resume_keep_ownership_honest`,
covered separately).
Refs #7142
Closes the RS-10 leaf moves for #6937 (CW-6129 decomposition, slices S1 and
S3, built on a Boat VM against a frozen snapshot and reviewed here).
- runtime_log moves to codewhale-runtime (adds tracing-subscriber there);
its four consumers and the docs path are rewritten by
scripts/split/move-modules.py with no re-export facade. The one test that
reached into tui state helpers moves to tui's session_manager test owner.
- working_set moves to codewhale-runtime. summary_block now takes a required
read_allowed predicate with no default, so the credential-path denylist
cannot be skipped; tui passes tools::file::working_set_read_allowed, a
one-line wrapper over the unchanged enforce_read_denylist(path,
"working_set"). The estimate_tokens test moves to compaction's test owner.
Two methods widen to pub and the test-only items become
any(test, feature = "test-support") for tui's tests.
- Generated agent-docs data and the blocking-calls budget json follow.
Checks, frozen 2,190 tracked inputs on 1480e84fd3 plus these paths, unchanged
across the runs: `cargo check -p codewhale-runtime -p codewhale-tui --lib
--tests --locked` with RUSTFLAGS="-D warnings" exit 0; runtime runtime_log and
working_set cases 40 of 40; 312 of 312 focused tui cases (summary_block,
file_mention, mention_completion, runtime_api::workspace, core::engine::preview,
session_manager, compaction, persistence_actor, the two relocated tests);
137 of 137 session_manager cases after restoring one include!d test file to its
unformatted-by-rustfmt original. dead-code budget 164 (at budget), blocking
calls 569 sites / 169 files. Strict production lines (VM count_lines.py):
tui 573,775 -> 572,080, runtime 32,101 -> 33,815.
Not run: clippy, the full suite, the module-graph ratchet, hosted CI.
S2 (artifacts, workspace_trust and friends) is blocked by a runtime<->util
cargo cycle and is not part of this commit.
Main went red for an hour because deleting a last caller left dead code that only fails under CI's -D warnings. cw-gates now tells maintainers to run the CI-flag lib check after removing or rewiring a call site, and notes that changing RUSTFLAGS rebuilds every dependency.
Main failed `cargo check -p codewhale-tui --lib` under -D warnings (the
Lint job): PersistRequest::ClearCheckpoint lost its last production sender
when the reset path started sending one CompletedCommit (c4a4f42e9c,
6a08f03124), and four route-budget wrappers lost their last production
caller when the resolved window replaced them (da026a2436).
- Delete PersistRequest::ClearCheckpoint, its coalescing branch, the
checkpoint_clears set and its flush loop. A completed commit still clears
its own checkpoint only after its snapshot save succeeds. Tests that only
exercised the standalone clear are removed or trimmed in the same slice;
the compound-commit, failed-save and reset-lifecycle cases remain.
- Gate compact_tool_result_for_route, tool_result_context_view,
route_inline_char_budget_for_route and the route_context_budget_for_route
import behind cfg(test); production uses the *_with_window forms.
Refs #7148, #7133, #7095. Frozen 2,192 tracked inputs on b3f1e25ced plus
these 5 paths, unchanged across the runs: `cargo check -p codewhale-tui
--lib --locked` with RUSTFLAGS="-D warnings" exit 0; 112 of 112 focused
existing cases passed on a -D warnings test build (the 113-case CW-7640 set,
less the deleted clear test, plus every persistence_actor test), rustfmt
check clean. Clippy and the full test suite were not run.
Known leftover: PendingSession::Snapshot and ::Completion are now
equivalent at every use and can be collapsed in a follow-up.
cw-orient and cw-handoff drop worktree/branch lanes and the leave-dirt-alone
rule; handoff defaults to verified pushes on main with tag/release/publish/
deploy/merge/cleanup needing approval. cw-gates and cw-dogfood route native
builds through dev-cargo.sh/dev-test.sh and the build lock, and point release
work to RELEASE_CHECKLIST.md. Retire gh-credit-harvest, gh-treasure-hunt and
gh-compile-issues (merged into the read-only gh-find-prs queue skill).
gh-close-issues follows the Refs/Fixes/release-step closure rule.
codew-release-qa-sweep becomes a pointer; cw-dogfood carries the regression
refs. gh-file-issue drops provider-specific wording. RELEASE_CHECKLIST uses
the own-everything wording. Docs only; no product checks run. The frozen
crates/skills copies and the catalog_matrix negative list are untouched.
cw-land step 2 now makes the CHANGELOG [Unreleased] line and the three
credit surfaces part of the same commit as a user-visible fix or feature,
regenerates crates/tui/CHANGELOG.md, and runs a drift command that lists
feat/fix commits since the last CHANGELOG commit (no existing check covers
fixes). A catch-up changelog commit is named as the failure to avoid.
Also corrected in cw-land, per the skills audit: a push is not a CI request
(hosted CI runs once at the release step), the harvest example makes the
contributor the commit author with the maintainer as co-author, step 3 is
the single owner of credit mechanics, and the stale release-branch
mergeability step is removed. cw-handoff gains the same drift command as a
backstop before a handoff is written.
Replaces the uncommitted draft paragraph in cw-land; no new skill stage.
The effective context window (provider facts, operator configuration or
fallback) and its source are now one ContextWindowResolution value kept
beside, never inside, the provider's RouteLimits. Turn planning, the
Engine, compaction (parent, headless, runtime-thread and worker), tool
output sizing, output caps, child agents, the context inspector, the model
picker and the client's alternate-model rebind all read it. Before, an
exact custom model with no context metadata planned compaction against
1,048,576 tokens while its route resolved the 128,000 fallback.
Op::SetModel clears the installed window only when the model or limits
change, so the same-route syncs hosts send on load, reset and re-sync keep
it. Alternate-model rebinding derives its window and limits from the
client's frozen declarations and captured overrides rather than a later
mutable configuration. Accepted-route restoration in the session
projection keeps the paired window across the model canonicalization.
Also: a checkpoint or reset save with no pending Work update now reports an
unavailable persistence actor instead of dropping the request silently.
Refs #7133 (CW-7640), #7095 (CW-7553). Frozen 2,192 tracked inputs on
adcf3f5856 plus 42 dirty source paths, unchanged across the run: 113 of 113
focused existing cases passed (the 94 planner, route install, projection,
picker, budget, tool-output and pressure cases, 18 persistence/backlog/
lifecycle cases, and the two existing SetModel cases), including the
alternate-declared-model frozen-limit case that failed on the previous
candidate. rustfmt, sync-changelog --check and git diff --check pass.
Not established: the original Windows report is not reproduced; a restored
Auto session has no persisted window receipt and uses the fallback until
its next turn selects a route; the out-of-process protocol and provider
rollback paths are reviewed, not exercised end to end; no real-provider,
hosted CI or platform proof.
Nine user-visible fixes landed on main today without an [Unreleased] line.
Adds Fixed entries for:
- #7095 save and recovery-checkpoint coalescing and reset-failure fixes
(4d974f0c6d, b42759ee9b, c4a4f42e9c, 6a08f03124) and interrupted
deletion retry (16d42ab17d), stating the original report is not yet
reproduced;
- #7133 context inspector effective/zero threshold and disabled state
(0bf31581c0, e908528439);
- #7115 read-only doctor --probe-local credential check (14a5723b75);
- #7144 blockquote quote rail on wrapped rows, crediting @Lstarsky0 in the
Fixed entry, the CHANGELOG Contributors block and docs/CONTRIBUTORS.md.
crates/tui/CHANGELOG.md regenerated with scripts/sync-changelog.sh;
sync-changelog --check passes; check-contributor-credit.py: 9 contributors
since v0.10.2 credited on all three surfaces; git diff --check clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A saved session repeats its own conversation while it carries a journal:
`messages` and the journal's active branch hold the same turns, so the file
on disk is up to twice the history it holds. The fork writer measured that
stored shape against the 8 MiB canonical bound, while the reader that opens
the same document judges it by `SavedSession::transport_form`. A
conversation whose file passed 8 MiB could therefore be opened, saved and
continued for turns on end, yet never forked — and `/undo`, retry and
fork-at-turn are all forks, so a client answered "full history exceeds byte
transport bound" and left the turn in place (reported from the VS Code
client on a 9.75 MiB conversation whose carried form was 5.2 MiB).
Both writers now go through one `ensure_history_transport_fits`, so the
writer's rule and the reader's cannot drift apart again.
Forking also stopped finding the saved-history boundary at all in
conversations that had received engine traffic. The boundary walk reads a
saved transcript as "the prompts a person typed", but two kinds of engine
message were counted as prompts: runtime-owned control messages (the
MCP-server notice, shell-completion handoffs, the deferred-toolbox
snapshot) and the `<image path=…>` tags bracketing an attachment. Neither
is recorded on a turn, so no turn could ever account for them and every
such conversation refused to be cut. Both are now skipped, by the same
recognition the session views already use — a runtime provenance line in
the `<turn_meta>` envelope, which a person's own prompt does not carry.
Keep the prior recovery checkpoint if the session store or replacement snapshot cannot be constructed, and surface the localized save failure in the transcript and status. An existing lifecycle case reproduced the lost checkpoint before the fix.
Verified: 18 focused persistence, backlog, and lifecycle checks passed on 2,759 frozen inputs; rustfmt and diff checks passed. Local tests do not establish the original Deepin report or rendered platform acceptance. CW-7553.
Queue a constructed reset snapshot as one save-then-clear commit, and make coalesced snapshot/clear requests use the same conditional clear. This preserves the recovery checkpoint if the document write fails and avoids a race between separate requests.
Existing save-failure case first failed with the checkpoint removed; 17 persistence, backlog and session lifecycle cases passed on frozen b42759ee9b plus these files, with 2,759 inputs unchanged. Snapshot-construction failure still follows the prior fallback. Linker unwind warning was nonfatal.
Keep the origin of a pending snapshot when a completed commit is replaced, so an explicit clear discards the old completion but retains a newer reset snapshot, including when an in-flight checkpoint intervenes.
The existing coalescing case first failed for completed commit, reset snapshot, and clear. On frozen 4d974f0c6d plus these files, 16 persistence and backlog cases passed. Two existing comments were corrected afterward; all other 2,759 inputs matched the freeze. A failed reset-document save followed by checkpoint clear remains a separate unresolved case; linker unwind warning was nonfatal.
When coalescing a completed turn with a newer in-flight checkpoint, save the completed document without clearing the new checkpoint. Preserve explicit-clear ordering and distinguish a newer reset snapshot from a displaced completion.
The existing coalescing case first failed with the completed document absent. On frozen 1014538dde plus these two files, persistence actor cases passed 14/14 and backlog cases passed 2/2; 2,759 inputs were unchanged. A separate completed-commit, reset-snapshot, clear ordering still fails and is recorded for follow-up. The linker emitted a nonfatal unwind-table warning.
The runtime-contract checker invokes Cargo by default, so do not list it as a seconds-long drift check. Describe receipt reuse and the required locked SSD build workflow.
Verified against scripts/check-runtime-contract-budget.py and scripts/measure-runtime-contract.py; diff check passed.
Replace the fake 900k bill on a tiny first prompt with a growing transcript and request-sized billing. Keep the existing assertions for compaction, checkpoint continuation, complete transcript, accounting and a billed request above the former 100k limit.
On frozen e636d71ad8 plus this fixture, the existing worker compaction case passed 1/1; 2,759 inputs remained unchanged. The first compile attempt had a u32/u64 mismatch, corrected before this run. The linker reported a nonfatal unwind-table size warning.
The home card also contains the word resume, so wait for the dialog buttons and for cancellation to dismiss it before the next interaction.
Frozen e908528439 plus this fixture change: three existing long-running terminal cases passed across all five sizes using the explicitly built CLI. The original target failed 0/1 with a missing cancel target before this change.
Use the resolved threshold even when it is zero, keeping the inspector aligned with the effective trigger.
The existing inspector_rows_name_compaction_and_anchors check passed on the frozen mixed source at 57e957f186, including the zero-threshold assertion.
Retain sentinel and consent assertions while expecting schema 4 and notice 6 introduced in e908f3f736.
Frozen mixed source at 57e957f186: TUI telemetry sentinel passed against the explicitly built CLI, and the CLI default-on test passed 1/1. The initial CLI test failed with schema 4 versus 3; the original TUI failure used an older binary. No production telemetry policy changed.
Skip credential inspection when an explicit route rules out Ollama adoption. For diagnostic adoption, resolve credential presence through the existing read-only path; exec keeps its ordinary resolver. Preserve the legacy secret store on both configured and unconfigured routes.
Refs #7115 (CW-7583). Frozen mixed tree at 57e957f186: explicitly built CLI SHA256 35de7b5ec4e7a3f3191fd5770384c2a09fee357aec59ab30bc8f7bb07ca40ad3; the existing diagnostic case passed with configured loopback and unconfigured legacy-key scenarios; 9 local Ollama cases and one route diagnostic case passed. Format and diff checks passed. A previous failing rerun used a stale CLI binary and is not proof against this change; real Ollama and release qualification remain open.
Preserve the admitted 0.10.3 scope and crate-size targets while repairing joined words and dates. Existing documentation check passed for 25 topics; diff check passed.
Offer Runcrate through the existing OpenAI-compatible descriptor, picker and named provider path. Keep billing unclassified until a reviewed price and product are available. The issue reporter disclosed working on Runcrate.
Refs #7085 (CW-7532). Vendor public model listing returned the three documented examples without credentials; no metered call was made. On frozen mixed source, 8 existing descriptor cases, 4 picker cases, 1 pricing coverage case, and 2 feature registry cases passed; web facts 30 passed, provider registry and docs checks passed. Live inference and release qualification remain unverified. Inherited source prepared by Claude Code and independently reviewed.
Use the current route threshold in the context inspector and show automatic compaction as off when disabled. Correct the Work rail guidance to point to manual /compact instead of claiming emergency compaction remains enabled.
Refs #7133 (CW-7640). On frozen f20a0d7144 plus 13 inventoried dirty paths, 18 existing inspector, rendered context rail and route-window cases passed; format and diff checks passed. The reported Windows trigger has not been reproduced.
Preserve the same owned global root classification while satisfying the existing lint.
On the preceding frozen mixed tree, codewhale-skills lib: 182 passed; targeted skills/localization clippy passed. The skills source hash remains unchanged since that run; no workspace clippy or release gate is claimed.
Refresh existing event and prompt goldens for the landed write line-ending schema and update the status and legacy effort expectations for the current auto default. Correct the stale fallback documentation.
The prior frozen mixed-tree conformance verification ran 33 existing cases: 33 passed. Current frozen mixed-tree nextest covered the status and effort baselines: 2 passed. Format and diff checks passed. These fixtures do not establish provider or release qualification.
Allow retry after a deletion tombstone while retaining the legacy single-slot checkpoint, which older binaries can write outside the per-session lock. The existing lifecycle case now checks its bytes remain intact and the retired checkpoint stays hidden.
Refs #7095 (CW-7553). On frozen 896e781fbb plus 29 inventoried dirty paths, 33 existing checkpoint, deletion, retention and late-usage cases passed; rustfmt and diff check passed. This does not reproduce the original Deepin report or qualify older concurrent binaries.
Use the shared locale catalog for grouped activity, tool status and file mutation receipts. Rebuild cached activity summaries when the UI locale changes and retain raw paths and diffs.
Refs #7071 (CW-7527). On frozen main 9fc5c898c7 plus 62 inventoried dirty paths: TUI lib and feature registry compiled; 197 focused nextest cases passed, including locale cache and receipt cases. Localization lib: 54 passed on unchanged localization inputs in the preceding frozen run. All 15 packs have 2732 keys; diff check and changelog sync passed. Earlier broader mixed-tree run had 2118 passed and one unrelated compaction failure. No native-speaker, real-provider, Windows, installed-artifact or release CI qualification is claimed.
Wrapped rows of a blockquote now keep the quote rail on every row and report a zero copy prefix, because the transcript rail scan already strips each leading rail span.
Contributed by @Lstarsky0 in #7144. Reviewed against compute_rail_prefix_width, which accumulates leading rail spans on every row, so selection copy stays correct; the diff applies cleanly to main with no drift in markdown_render.rs. Required checks Lint, Test (windows-latest) and npm wrapper smoke were green on the PR head; they were not re-run on current main and no local test run covers this merge.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Refs CW-6129 / CW-7525. Remove the superseded instruction to freeze or
retire the native App and extract toward the deleted Tauri host. Keep
GPUI/weGPUI native and browser ownership distinct. Replace stale execution
status, the old release ladder and historical RS-14 choices with the
existing Linear owner and current structural dependency order. Recognize
the actual runtime config and skills owners; preserve the full0.10.3
scope,50k ceiling, measurement distinctions and authority boundaries.
Make sandbox isolation a future qualification target rather than a local
checkout/build-cache exception. Preserve the architectural map and dated
reference evidence; link the old goal audit in Git instead of presenting
its old source findings as current.
Verified: changed document local-link scan0missing, docs25topics, generated
facts and git diff checks pass. Derivation produced no metadata drift.
One documentation file only; no Rust/runtime changes or new tests/comments.
No native rebuild, CI, provider, installed-device or release claim.
Refs CW-7038 / #6866. Thanks @asto18089 for identifying the missing
failure and recovery signal. This independently extends the existing
configured-server note rather than harvesting the fork implementation.
Replace the two Engine captures with one nonblocking request-boundary
capture. Project fixed connection states from the pool, retain exact turn
ceilings and reviewed authority, and prioritize auth/failure rows within
the existing bounds. Connected is an observation, not permission or a
promise that tools will work. Raw errors and server-authored reasons do
not reach the status note. Withdraw stale status and guidance after
contention, config/scope changes and restore. Keep existing event kinds,
log deduplication, replay and cached-prefix behavior; no new prompt/store.
Migrate both discovery-policy callers to one captured filter.
Verified on frozen base2231d73df5 plus16paths: MCP owner2/2; current
TUI lib and feature_registry compilation20m28;42distinct affected host
cases resolved (41passed initially, feature description corrected from
132 to90characters, affected registry1/1passed). Website metadata30/30,
docs25topics, format, module/command boundaries, blocking/dead-code
ratchets, facts and diff checks passed. Existing test bodies expanded;
no new test functions. Earlier compile failures and source freezes remain
in artifacts/codex-0103-resume-20261029.
Existing oversized eh_frame test-link warning remains. No full suite,
hosted CI, provider/auth actions, installed/device or release proof.
Implement #7066 with nested auto/all/none, selected, disabled and explicit_only
policy. Canonical aliases share policy; filtering precedes first-wins merge so
compatible/manual alternatives remain available. Reuse invocation and activation
state rather than adding another store. All writes remain in the owned global
root, use confined atomic replacement and preserve edited/managed bodies. None
leaves bundle files/marker untouched. Remove legacy skill-directory deletion;
refuse nonregular markers without deleting their contents.
Carry one scoped SkillsConfig through Engine, App, children, tools, runtime API
and MCP resources; retire mode-only production discovery/render entry points.
Doctor and skills inspection report actual policy, paths and reasons. Escape
configured-name controls; document profile clears and CODEWHALE_HOME behavior.
Migrate the existing manager fixture to shared registered environment guards.
Verification: 182 distinct skills cases resolved across scoped reruns; runtime
config2 and command-contract11 pass. Host selection466 had464 pass/2 fixture
failures; final affected manager/inspect/registry10 pass resolves both, without
repeating unaffected cases. Current TUI lib+registry compilation passed; actual
production CLI build13m40 passed. Sandboxed offline doctor JSON/text observed
none mode, generation17, explicit-only PDF, compatible debug fallback, unknown
and ignored names, and byte-identical bundle files/marker. Website metadata30,
docs, format, boundaries, blocking/dead-code ratchets and diff checks passed.
No new test functions. Existing oversized eh_frame warning retained. No full or
hosted CI, provider/device/Windows/release qualification. Full0.10.3 remains open.
The normal pressure path honored compaction.enabled, but emergency
preflight/provider recovery forcibly enabled summaries. Refuse that path
before a model call, start event or history replacement when automatic
compaction is off. Preserve the original conversation and report an
actionable typed context error through the existing audit/error owners.
Share recovery-failure reporting between preflight and provider-error
handling so a rejected summary request retains its actual cause. Keep
cancellation ahead of failure reporting after the awaited recovery.
Explicit manual compaction is unchanged. Expand/rename the existing
emergency fixture for disabled-but-compactable and enabled-but-unnecessary
history, zero model calls/attempts, unchanged messages and one refusal.
Document the contract, synchronize embedded release notes, and replace
private CW citations in the unreleased public changelog with verified
public refs where available. Published historical sections are unchanged.
Local proof: initial libtest compile2m02 and137 focused compaction/error/
Engine checks passed. After the final model-step cancellation guard,
libtest recompiled in1m30 and69 affected Engine/compaction/recovery/
cancellation checks passed; unchanged pure-check evidence was retained.
Both builds had the existing oversized eh_frame linker warning. No new
test functions or code comments. Format, runtime boundary, blocking569sites
in169files, dead-code164, changelog synchronization, generated facts and
diff checks passed. Exact seven-path freeze remained intact.
This fixes the setting bypass, not every reported Windows journal seam.
Keep CW-7644/#7142 open for attribution and remaining continuity/lifecycle
acceptance. No real-provider, hosted CI, installed/device or release proof.
Refs CW-7644, #7142
Move skill discovery, provenance, mutation and bundled content to
codewhale-skills and migrate every consumer without a legacy facade. Keep
native selection/lifetime checks in the existing host manager and refuse
native authority when no host bridge is installed. Preserve bundled bytes,
reviewed snapshot identity, workspace trust and the Engine decision mint.
Add validated skills.listing_max_description_chars and
skills.listing_budget_fraction with independent profile inheritance. Keep
the 400-character/5-percent defaults and existing total budget bounds. Use
the same renderer for parent and fresh/nested child catalogues, context
loss notices and localized inspect notes. Remove the unbounded child-only
catalogue. Update all 15 locale notes, current en/zh docs, release order,
test selectors and generated facts; correct the old bundled Feishu claim.
Local validation on frozen source: skills182, runtime config2,
localization54 and command-contract11 passed. TUI lib and registry compiled
in21m56s (existing oversized eh_frame warning). The scoped integration had
277 passes and one metadata-summary-length failure; after the docs-only
correction both registry cases passed, covering278 distinct selected
TUI/registry cases. Final generated metadata30 passed. Existing fixtures
now cover configured80/400/1024 caps, fraction/profile validation, localized
notes, authority-bound child catalogues and real host startup for restored
native receipts. No new test functions or code comments were added.
Workspace format, command/runtime boundaries, blocking budget569sites in
169files, dead-code budget164, actual Cargo publication order, package list
(all62 skill assets) and diff checks passed. Only five non-Rust metadata/doc
paths changed after native compilation, recorded separately; native inputs
remain identical. No full-suite, hosted CI, real-provider/device or release
qualification. CW-7521 bundled policy and full decomposition remain open.
Refs CW-6129, CW-7531, #7073
A paragraph indented under a list item, such as a bullet's second
paragraph or the note after a numbered step's code block, rendered
flush left: the word wrapper drops spaces at the start of a row. The
item then looks finished and the paragraph reads as top-level text.
The parser now carries whether a list is open: a list item opens it,
blank lines, code and indented paragraphs keep it open, and anything
else closes it. A paragraph keeps its indent only while a list is open,
so indented rows of command notes such as /status and /cost render as
before. The decision is made at parse time because streaming renders
the text between code blocks separately, so a look-back in the renderer
would not match the final render.
The kept indent is drawn on every row, capped at half the width like a
list item's. As with list items, the first row copies with its indent
and wrapped rows strip it.
Signed-off-by: Lstarsky0 <[email protected]>
CW-6129 / CW-7525: integrate the reconciled S35, S52, N13 and S24p1
cuts. Separate thread storage from manager/history execution, move terminal
rendering helpers into codewhale-tui-kit, move error taxonomy into its own
crate while retaining the LLM adapter, and place hand-priced model metadata
in codewhale-models. Migrate direct consumers and release metadata; preserve
newer Vim/reasoning, delete/parent-thread and plugin-catalog behavior.
Reconcile the existing compaction fixture with the accepted fail-closed
cutover: an invalid summary stops once and preserves the original task,
earlier text and tool results. Allow Core startup in the existing queued
child fixture while keeping its original counterexample (500ms remaining
under the old shared deadline versus a 900ms response). Runtime budgets are
unchanged. Move two existing pure pricing checks; add no tests.
Remove the obsolete multi-release deconstruction deferral, refresh generated
source documentation, and tighten dead-code suppression to 164. The new
uninstall safety sites run synchronously before CLI runtime creation; record
only their measured 6 filesystem/8 canonicalization sites. Thread-manager
canonicalization allowance transfers with a net reduction.
Verification: current TUI lib and feature_registry targets compile; the test
linker retains its existing oversized eh_frame warning. New crates 242 pass;
models 108 pass; runtime API/thread lifecycle 759 pass; compatibility 205 pass
before its obsolete compaction expectation was corrected; final pricing,
catalog, corrected compaction/child fixtures and registry 113 pass. Generated
web facts 30 pass and match source. Format, command/runtime boundaries,
publication order, blocking-call budget and diff checks pass. All 34 named
pricing items and cache-write policy retain their prior implementations.
No full-suite, hosted CI, live-provider or release qualification is claimed.
TUI remains 578280 strict production lines, so full decomposition stays open.
CW-7639: replace vulnerable MSAL Node 6.0.1 with 7.1.2 through an
Azure Identity scoped override. Keep VSCE on its current supported route;
materialize the lockfile and remove the obsolete advisory acceptance from
the audit classifier and dependency-security documentation.
Verification: 47 existing extension checks passed; npm audit reported zero
vulnerabilities; replaying the old advisory is blocked. Credential-free
local VSIX packaging passed (30 files; no development dependencies).
Installed dependency graph resolves MSAL Node 7.1.2. No publishing or live
authentication was performed; no exploit or affected invocation is claimed.
Complete the interrupted coordinator batch: three visible approval choices with default Deny, exact-rule preview gating and Details-gated hidden session/ask shortcuts; separate everyday CLI help, doctor --all, recent-session Up navigation and transcript-free cameos; localize the resume hint and update the existing glossary/feature rows. Add session.window.rerooted diagnostics while retaining the previous journal branch. This event is not a root-cause or seam-summary fix for #7142.
Verification: 398 existing approval cases passed, then the existing obsolete hidden-a expectation was corrected and its replacement passed (399 distinct cases covered). Feature registry 2 passed; UI launch 59 passed/1 intentionally ignored render fixture; cameo 3 passed; doctor-filter checks 142 passed. Prior localization 54 and session_tree 22 passes were reused after verifying their 17 input hashes unchanged. Current CLI build and CLI all-target/all-feature Clippy with the repository CI allowlist passed. Isolated help/advanced-help/uninstall-help and doctor compact/all runs exited 0; doctor showed 219 versus 232 lines. No new tests or hosted CI dispatch.
Remaining: the broader launch filter found late_launch_permit_still_gets_the_full_work_budget failing with BudgetExhausted; it also fails alone. Its runtime path is untouched here and remains the next integrity investigation, not a release pass. Full 0.10.3 implementation, provider/platform qualification and final validation remain open.
Refuse managed/system, symlinked, non-owned/shared-writable and Cargo-owned destinations before mkdir in both Unix installers; inspect receipt metadata through the real parent even when bin does not exist. Align en/zh uninstall guidance with explicit-home and receipt ownership. Finish the inherited uninstall closure/type lint repair. Refs #7091.
Verification: 38 selected existing installer/guide checks passed; the 11 guide checks passed again after the final wording correction. Two old-source controls created forbidden directories; ten disposable refusal cases now create no destination. The applied scripts match those rehearsed bytes. Current CLI passed Clippy for all CLI targets/features with the existing ci.yml allowlist and built successfully. Four sandboxed current-binary uninstall rehearsals passed: ordinary removal, confirmed purge, managed refusal, hard-link protection. The sandbox denied network and real user-home file contents. Windows host behavior and release qualification remain open.
CI's Lint job runs `cargo fmt --all -- --check` before clippy and failed on these two files
(committed unformatted in 2166fc24cb and 1f0c4d0daa). Formatting only, no behavior change.
Verified: `cargo fmt --all -- --check` exits 0 on the full working tree after this change.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Usage reporting adds two aggregate events per session: model_usage (provider,
catalog model or "other", turns by outcome, input/output/cache-read/cache-write
tokens, turn-time buckets) and tool_usage (first-party tool name, or "mcp"/"other",
with calls and errors). Models are named only when in the bundled public
models.dev catalog; tool names come from a closed list. No content, arguments or
paths. CI and GitHub Action runs report the "ci" session source. DO_NOT_TRACK=1
turns reporting off like CODEWHALE_TELEMETRY=0. The notice bump re-shows the
disclosure once in all 15 locales. The ingest accepts v4 and still accepts
v3/notice 5; docs/TELEMETRY.md describes both events.
Re-applied from recovered commit a20702df43 (built on the S57 split) onto main
78580d3d4d without conflicts. Founder approved for 0.10.3 (D14).
DEPLOY ORDER: the live ingest rejects schema 4. Deploy the ingest before any
Engine release that sends v4. Nothing deployed here.
Verified on the frozen tree (artifacts/claude-0103-build-20261029-0418-telemetry/):
codewhale-telemetry 53/53, codewhale-localization 54/54, codewhale-config
telemetry 17/17, codewhale-tui lib telemetry 40/40, setup_state 11/11,
telemetry-ingest vitest 174/174 and tsc --noEmit clean. Not re-run on this tree:
the real-turn exec --auto into wrangler dev and the DO_NOT_TRACK zero-request run
reported on the original commit.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Canonicalizes home/install paths and dot spellings, rejects a purge target that
contains the home or install directory, keeps ownership and symlink guards,
names recovery/snapshot/shared-data consequences, uses a literal
environment-bound PowerShell path for deferred Windows deletion and canonicalizes
both sides of the Windows PATH-block match. INSTALL.md's go-back-further recipe
now moves the working binaries aside and restores them if the install fails.
Verified: macOS sandboxed probe on a stripped copy of the frozen-tree CLI
(sha256 d28274cb...), 4 cases pass (plain, purge, managed, hardlink); receipt in
artifacts/claude-uninstall-probe-0415/probes/receipt.json. NOT verified: Linux and
Windows execution, package-manager receipts, installer refusal rules in
scripts/release/install.sh, zh-Hans section 12 still suggesting rm.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Shortens file tool descriptions and reuses the line_ending schema in WriteTool
(#7070), copies InteractionTarget, scopes test-only imports in app-server, and
updates the /cost [details] diagnostics fixture (requires_argument now true).
Verified: tools::file 191/191, frame:: 37/37, surface_metadata 1/1. app-server
changes are compile-checked only by the in-progress CLI build.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Default for ReasoningEffort and the API-key/config writers moves to auto; docs and
config.example.toml follow. Explicit user effort is untouched.
Verified: reasoning_preference 8/8, model_routing 45/45. Fresh-config first-run
writer path not exercised end to end.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Moves the startup-route test to local_ollama::startup_route_configured (deleting
the copy in tui/app/init.rs) and uses it so exec, and doctor --probe-local, pick
a live local Ollama model when no cloud key or explicit route exists, saving
nothing. doctor reports "Not confirmed" without the probe.
Verified: compiled in the frozen tree; no fresh-state exec/doctor journey run
yet against a real Ollama server (#5848 stays open).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the bounded git child_process shim (UTF-8 default, metadata-only Git,
preserved denial codes, nonzero exit and ABORT_ERR/maxBuffer error shapes),
the git_review_scope canonical action and read-only authority category, policy
v8, and explicit composition-review setup in the four DSH/skill import fixtures
that depended on a process-global reviewer.
Verified on the frozen current tree (Engine 81ae174537 + dirty inputs): Node
host 413 pass/7 skip earlier; tui lib plugins_dsh_tests 30/30, plugins_skill_tests
5/5, composition 8/8, tools::git 76/76, feature_registry 2/2. NOT verified: the
published @michengai/dsh-code-review loopback journey, cancel parity and the
sandbox-escape matrix; those remain open under CW-7055.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Negotiate structured review v2 with complete bounded source files, explicit omissions, prior findings and discussion on the existing Engine review path. Preserve v1 fingerprints. Validate path, revision, text and identity bounds before the model call; bind the result to the exact request and head/base. Keep only traced hosted findings and require a current included head-source trace for each explicit prior-finding resolution.
Advertise structured_review_version=2 and bound requested reasoning to the exact route and visible output budget. The hosted review retains one step with no execution tools; it cannot claim reproduction. No new turn loop, account store or provider fallback is added.
Verification: TUI lib-test binary compiled successfully; all six Review source hashes stayed unchanged. Explicit existing filters passed 9 review-core and 38 review-tool checks. Current protocol crate passed 78 existing checks. The original structured_review filter selected zero tests and is compile proof only. The linker warned that the unwind section exceeded its compact-table limit.
Concurrent compaction/Ollama and fixture edits invalidate a current whole-tree claim; their exact drift and the compile inputs are recorded in artifacts/codewhale-review-build-20261029/engine-review-compile-receipt.json. No full-tree, v2 provider rehearsal, hosted CI, release or deployment qualification is claimed. This commit must stay local until the release coordinator verifies its pending predecessor before pushing main.
Adapts the DSH/Pi compaction shape inside the existing Engine owner: prune bulky
tool output first, keep a token-priced raw tail cut on complete tool exchanges,
summarize the older span plus prior checkpoint, save original history before
commit. The summary validator now strips leaked think/reasoning spans (including
unmatched tags) before the placeholder check, so a bare closing tag no longer
passes as a summary. The lexical number/backtick checker and the duplicate
TypeScript survival validator are removed; one Rust validator remains. Turn
calibration learns only upward from reported usage and a failed automatic
summary stops the turn instead of looping.
Verification: NOT compiled or tested in this tree (uncompiled batch; build owner
is the Review peer's in-flight tui build). Local commit only, not pushed. Known
open: whole-conversation fallback when no older span exists.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Ollama model publication stays with its capability-aware native refresh; generic key verification cannot overwrite it with embedding rows. This prevents new contamination and does not claim repair of a previously persisted bad cache. Refs #7116.
Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
A repeated start during connecting or connected reports a separate toast instead of replacing the current authorization banner. Refs #7127.
Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
Keep the conversation rewind explanation when its persistence or Work update fails, and say a retry was not sent only when one was pending.
Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
Translate the self-serve review-bot setup row in all 18 README packs and refresh their source stamps.
Validation: python3 scripts/check-readme-translations.py on the current-main merge tree: README translation check OK — 18 translations in sync with README.md (sha256:0430d94f3d47). Reviewed current-head changes, review threads and dependent PRs. No hosted CI dispatch or release qualification.
Both analysis and isolated publisher now resolve c2a4872328. Existing CLI v0.10.2/model/reasoning compatibility and selected-repository installation are unchanged. Validation: actionlint and diff whitespace checks passed. Reuses the 8 passing Action checks and actual-PR offline replay recorded in the carrying commit; no new live inference, GitHub review, hosted CI or release. Refs CW-6869 and CW-7503.
c962177c7 rewrote the 'codewhale review' table row in README.md but left
all 18 translations on the old wording, missing link and stale stamps,
so scripts/check-readme-translations.py fails on main. Translate the new
row in every pack (linking the anchor that commit added) and bump the
stamps.
Signed-off-by: Boyce <[email protected]>
The live mention review on PR 7126 published two suspected hypotheses as concerns despite recording that surrounding code was unavailable. The separate publisher now requires reproduced/traced evidence with nonempty detail, requires introduced authorship for inline comments, and collapses pre-existing findings. Model summaries, risk assessments and unlinked suggestions stay in the analysis artifact so they cannot repeat a withheld allegation. An empty result remains advisory and links to analysis/coverage. This is an evidence-record boundary, not independent reproduction or proof of accuracy; the Engine remains the review authority.
Validation: existing Action checks 8 passed, 0 failed; Node syntax checks and diff whitespace check passed. Offline replay of actual run 40835017974 artifact withheld both suspected claims and emitted zero inline comments. Direct local variations covered empty/missing evidence, introduced/preexisting/unknown attribution, escaping and deduplication; a mocked publisher run reported 0 eligible and 2 withheld findings without network/provider calls or GitHub writes. No new tests, Rust build or hosted CI. Legacy post:true retains its pinned CLI policy. Refs CW-7503.
The notices printed for a foreign-workspace checkpoint tell people to run `codewhale sessions`, but the command listed only saved sessions and so never showed a session that an interrupted turn had advanced past its last save. It now uses SessionManager::list_sessions_with_recovery, the call the resume picker already uses: a session with a newer checkpoint, or only a checkpoint, appears with that checkpoint's message count and an `interrupted` mark, and a recovery warning goes to stderr instead of failing the listing. `--search` still searches saved sessions only, and `codewhale resume` without an id still numbers saved sessions only; both are unchanged.
Validation: Linux Boat VM, debug build of a stack of origin/main 4d600eaaee plus the Work Graph change, #7126/#7130/#7127/#7121 and the uninstall slice, then this patch (sha256 d8dbb185…), with a loopback mock model inside an unshare -rn network namespace and a synthetic home. One saved session and one session killed by SIGTERM mid-stream: before, `sessions` showed the interrupted one as "New Session | 0 msgs"; after, "New Session | 1 msgs | interrupted"; `--limit 1` shows the newest row and "1 more session(s)"; `sessions list --limit 5` matches; cargo fmt --all -- --check clean. The row keeps the saved title, so it still reads "New Session". Not run: a session that exists only as a checkpoint (no saved file), the lib test suite (no test covers fn list_sessions in lib.rs), Windows, macOS.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
crates.io codewhale-ratatui 0.1.2 (published 2026-10-13) has no Accent role, but codewhale-tui uses codewhale_ratatui::Role::Accent since the design-tokens 2.3.0 move, and the vendored copy changed after 0.1.2 went out. A registry build of codewhale-tui, and the crates.io dry run that verifies it, cannot compile against 0.1.2. The vendored crate is now 0.1.3 and crates/tui, pet/tui, both workspace locks, the vendored crate's own lock and the check-versions.sh literal pin it. Publishing 0.1.3 from vendor/codewhale-ratatui stays a release-time step that must precede the codewhale-tui dry run; this commit publishes nothing.
Validation: cargo metadata --locked --offline succeeds in the workspace root, pet/tui and vendor/codewhale-ratatui; scripts/release/check-versions.sh and scripts/sync-changelog.sh --check pass. Not run: the crates.io dry run (needs 0.1.3 published first), a compile.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the Unreleased entries for #7126/#7130 (vim Normal mode), #7127 (rc start failures), #7121 (undo localization and its sync guard), #7140 (TSX language id), the Work Graph publication fence (#7118, with its open limit stated) and the #7095 session entries: the status-line hint, retained and listed interrupted checkpoints, and the signal-exit flush (#7122). Credits @Ricardo-M-L on docs/CONTRIBUTORS.md and web/lib/release-credits.ts and extends the @Lstarsky0, @laozidabo and @Aboysky lines. crates/tui/CHANGELOG.md is regenerated by scripts/sync-changelog.sh. The three web/ generated files were stale at HEAD (missing crates account-cli and plugins, two features, and the GUIDE.md digests that #7127 changed); they are regenerated from HEAD plus only these edits in a scratch export, so they carry none of the uncommitted DSH work.
Validation: sync-changelog --check, check-contributor-credit.py v0.10.2 (9 contributors, all credited on all three surfaces), check-versions.sh and check-facts.mjs pass on the scratch export; check-facts.mjs was red at HEAD before this. Not run: web build or hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Follow-up to #7121. /undo restores the files and truncates the App history before the portable handler sees the Restored outcome, and the Engine only learns about it through the SyncSession action that handler returns. The localized summary was built with ? on eight catalog lookups before that action, so a catalog that lacked one key turned a completed restore into a plain error result with no action, leaving the Engine's model context ahead of the files and history. The report is now built by restored_summary, and when it fails restored_fallback writes an English report from the outcome fields alone; is_error stays false and the SyncSession action is always returned. The shipped catalogs contain all 29 keys, so this is a guard, not a fix for a shipped failure.
Validation: codewhale-commands unit tests in a Git-free export on a Mac. The existing undo_reports_the_request_each_file_and_the_conversation, extended with a presentation context that fails one key, fails against the unrepaired code (the result was "Error: catalog lacks cmd_undo_action_restored" with no action) and passes after: 28 passed, 0 failed for the undo and debug filters. cargo fmt --all -- --check clean. Not run: the codewhale-tui lib tests that call the command, hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Follow-up to #7126. The held-key flush runs after the event that triggered it has already drawn, so a Normal-mode key that changes the composer without setting needs_redraw (history recall with k, for one) left the old text on screen until the next terminal event. The flush now marks the frame dirty after dispatching the key.
Validation: Linux tmux PTY replay of a stack build (origin/main 4d600eaaee plus the Work Graph packet, #7126, #7130, #7127, #7121 and this change) with composer_vim_mode = "vim" and a seeded two-entry history, TERM_PROGRAM unset and iTerm.app: after Esc and k the composer showed the second seeded prompt at +150 ms and again after 1.15 s idle, k k showed the first, j the second again; i hello world Esc 0 x w x d d emptied the draft at 120 ms and 30 ms spacing; G moved to the end of the line; v q G Esc A left the draft unchanged. A single-write burst of Normal keys on an untrusted terminal is still inserted as text, as #7126 discloses. Not shown: the stale frame without this line (no #7126-only binary was built; the claim rests on history_up not setting needs_redraw). Not run: Windows, macOS terminals.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Refs #7118. A save, fork, rename, title change or conversation rewind used to publish whichever Work Graph transaction was pending, whatever session it belonged to and whether or not a newer graph had arrived after the snapshot was built. Publication now carries the saved session's owner and graph (SavedWorkProjection) and the Work runtime refuses it, leaving the transaction pending for the next save, when either no longer matches (publish_pending_matching and publish_pending_sync_matching in work_graph/runtime.rs; the unconditional publish remains only under cfg(test)). Fork reports that parent and child were saved but the active session did not change when Work could not be published. A conversation rewind that applied but could not be saved or published now says so ("Conversation was rewound, but its save or Work update needs attention"), puts the replacement or retry prompt back where the user can copy it, and does not send the retry.
Does not close#7118: the reporter's cancelled-turn case and the /task list versus To-do tracker visibility mismatch are neither reproduced nor changed. Known limits from three independent read-only reviews, none a blocker: the Engine SyncSession checkpoint branch still fails the request after the checkpoint was queued when the Work projection errors (its message says so); build_session_snapshot can still fall back to the last known Work state under lock contention, which the refused publish now reports after the write; a busy To-do lock still fails publication even with nothing pending; the partial-success toast says "retry was not sent" for a plain /undo and the new strings are not in the locale catalog.
Validation: Git-free export of origin/main 4d600eaaee plus this change, #7126, #7130, #7127, #7121 and the #7126 redraw follow-up, built and run on a Mac. cargo fmt --all -- --check clean. codewhale-tui lib focused run 281 passed, 0 failed (work_graph:: 43, session_snapshot_ 11, conversation_undo 3, undo_retry_apply_path 1, remote_control 90, phase_strip 43, paste 74, vim 3, composer_history 15) with RUST_MIN_STACK=16 MiB, the value CI and scripts/dev-test.sh export; at the default 2 MiB test stack the isolated undo lifecycle test overflows its stack in a debug build. Not run: the rest of the lib suite, Windows, hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Legal JSX in App.tsx is rejected when typescript-language-server explicitly selects ScriptKind.TS from the existing typescript didOpen languageId. Preserve one transport and configured custom IDs; select typescriptreact only for TSX documents on the built-in TypeScript ID. Verified actual TypeScript 5.9.3 parse behavior; existing LSP suite 64 passed, 0 failed, scoped clippy and workspace fmt passed. No new tests or comments per repository guidance. Developed with Codex assistance.
The five `always_load entry ... matches no tool` rows came from saved config naming the built-in Computer Use bundle removed in 4cf2d2cfff, and the text claimed the plugin-N prefix 'renumbers' when it is the plugin-name length. Entries with the Computer Use prefix now produce one status derived from the existing plugin registry (not installed, needs review, installed but off, enabled but cannot start, or entries the plugin no longer offers, with left_click now click); other misses are one grouped line. Nothing is installed, trusted, enabled or executed. 'MCP server guidance added/withdrawn' statuses are Internal so the app collapses them.
Verified from a frozen git-archive export at 4d600eaaee plus only these two files: cargo check -p codewhale-tui exit 0, 0 warnings; focused tests status_visibility/always_load/should_default_defer 3/3 and always_load/deferral catalog 4/4 passed. Not run: full suite, hosted CI, installed-app replay.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The #7091 uninstall slice (cce6d3a84d) resolves the selected executable and each profile's parent with `canonicalize` and replaced seven `std::fs` calls with guarded no-follow opens, so crates/cli/src/update/uninstall.rs now has 5 path_canonicalize sites (budget 3) and 5 std_fs sites (budget 7). `codewhale uninstall` is a synchronous CLI command that runs before any async runtime exists, so these cannot move into spawn_blocking; the ratchet is regenerated with `python3 scripts/check-blocking-calls-budget.py --update` and changes exactly those two lines.
Validation: `python3 scripts/check-blocking-calls-budget.py` failed before this change (path_canonicalize sites 5 > budget 3) and reports "566 sites across 168 files, within budget" after it; the regenerated JSON differs from main only in the two uninstall.rs counters (diffed on a clean git-archive export).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Use the committed generator for the Codewhale Agent workflow. Installation access is checked before provider inference; missing installation cannot consume model tokens. Provider remains explicit DeepSeek, model deepseek-flash, reasoning off for checksummed v0.10.2 compatibility. Local validation: actionlint and whitespace checks pass. The last provider review completed cleanly on PR 7130; the App installation grant and full publication/mention round trip await the pending founder confirmation.
Live run 40832077629 completed a full DeepSeek review (4387 input, 544 output, zero reasoning tokens), then correctly stopped publication because the existing App was not installed on codewhale-hq/Codewhale. Generated App workflows now validate installation in a separate credential-isolated job before admitting model usage. Reuse one installation-token step template; the analysis job still receives only a read-only GitHub token and its selected provider key. Local verification: actionlint passes for both App and default-token generated workflows; Node syntax and whitespace checks pass. Existing review runtime source/evidence is unchanged. Installation approval is pending; no App permission was granted by this source commit.
Generate the workflow with checksummed CLI v0.10.2, deepseek-flash, reasoning off, and Action source 9032b4f931. The installed released CLI was exercised offline and confirmed that it loads reasoning_effort=off from the isolated run config. actionlint passes. This source pin includes the explicit reasoning input; no candidate source is executed.
The installed v0.10.2 binary identifies source 3400ebb5c9, whose review triage caps small reviews at 4000 output tokens regardless of the environment ceiling. Live runs 40830663408 and 40831324211 exhausted all 4000 tokens as reasoning and correctly published nothing. Current Engine source already removes that fixed cap, but unreleased source is not a substitute for a checksummed release. Add a validated reasoning-effort input, applied through a fresh secret-free isolated Engine configuration. Generated workflows default to off for this released compatibility boundary; users can select an explicit level or auto. Local verification: existing Action tests 8 passed, 0 failed; syntax, generated workflow actionlint and whitespace checks pass. No new tests or code comments; next live acceptance is on the newly pinned source.
Pin analysis and publication to f4c2ce3a6e, including the reasoning-output allowance and explicit incomplete receipts. Workflow is generated from the committed setup tool and passes actionlint. This is the frozen candidate for the authorized live review acceptance.
Live run 40830663408 reached DeepSeek but used all 4000 automatically allowed output tokens and returned no review. Publication was skipped. Generate an explicit 16384-token allowance, configurable with --max-output-tokens, and retain sanitized reasoning counts. Recognize the released CLI infrastructure/not_produced envelope as incomplete without logging raw provider/model errors. Local verification: existing review checks 8 passed, 0 failed; direct failure-envelope classification and actionlint pass. The running workflow still references the prior reviewed Action commit; the next source pin update carries this repair.
Use the existing Codewhale Agent installation and DeepSeek repository secret with deepseek-flash and checksummed CLI v0.10.2. Both Codewhale actions are pinned to c962177c79. The write-capable App token is minted only in the publisher job. Enable same-repository automatic reviews plus current-write-authorized review mentions and default-branch manual fork analysis. Local validation: generated from the committed setup tool; actionlint and whitespace checks pass. Founder authorized completing GitHub activation and live review acceptance in chat on 2026-10-28; live results are recorded separately.
Generate a workflow with immutable Action refs, exact release/model selection,
separate read-only analysis and credential-isolated publication, and optional
existing GitHub App identity. Reuse the Engine review command and installer.
Accept exact review mentions from current write/maintain/admin users; recheck
original and rerunning actors, comment identity/body and current revisions.
Opt-in inert fork diffs only through trusted default-branch manual or issue
comment triggers. Mentions require the separate publisher. No candidate code,
hooks or project configuration is executed. Share provider-key metadata with
the generator and redact every supported key, including OrcaRouter.
Local verification: existing node review tests 8 passed, 0 failed; Node syntax
checks and actionlint pass for default-token and App workflows. Direct offline
execution completed mention -> findings -> inline publisher, refused 10 unsafe
request cases, refused fork analysis without opt-in and cross-attempt findings,
and confirmed provider-key isolation/redaction. No new tests or code comments.
Live GitHub/provider acceptance follows separately; no release or moving tag.
`codewhale uninstall --yes --purge-data` deleted ~/.codewhale even when the run only printed a package manager's removal command and left the program installed. Purge now runs only in a confirmed run that removed a receipted installation. Adopting an older curl-installed copy opens every candidate without following links and refuses symlinks, hard links and files owned by another user before any receipt is written, and uninstall resolves the selected executable path on Unix. Recognizable Codewhale PATH blocks in shell profiles are reported for manual cleanup; uninstall never edits a profile. The website installer now creates new directories privately and refuses system, Homebrew and MacPorts bin directories, the home directory, `/`, and directories other users or groups can write, with the `chmod go-w` remedy in its message. INSTALL.md (English and Chinese), both changelogs and the generated agent docs follow.
Validation: a macOS arm64 release build of this exact uninstall.rs (4,160 build inputs unchanged) and a sandboxed probe of the resulting binary in synthetic directories passed 4/4 cases (plain removal, purge preview and purge, package-managed copy keeps data, hard-link refusal; network and the real home denied). An x86_64-pc-windows-gnu zig build of the same source compiled and linked (21m06s, inputs unchanged). scripts/release/install-safety.test.js passed 33/33 (website and archive installers) on a scratch export of this tree; rustfmt --all, sh -n install.sh and sync-changelog --check pass, and the generated install entry was re-derived with the repository's own generator. Not covered: no run on a Windows host, no MSVC build, no real npm, Cargo, Homebrew, WinGet or Scoop removal, no hosted CI, and no installer-written PATH block exists yet, so the report path only sees blocks written by hand. The PowerShell and NSIS routes and product-owned PATH integration (F2) remain open; #7091 stays open.
Refs #7091
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Select the existing rquickjs bindgen feature only for the Windows GNU LLVM target, which has no bundled bindings. Reuse the existing platform-specific dependency configuration.
Validated on x86_64-pc-windows-gnullvm with Rust 1.98.1 and isolated libclang 18.1.1: default library check passed; existing VM integration tests: 83 passed, 0 failed. Removing the cfg reproduces the missing-target-bindings build failure. ARM64 execution and cross-host builds remain unverified.
Signed-off-by: Codex <[email protected]>
Publish a terminal result after the particular owned run future is dropped.
Keep waits independent and cancel safe, preserve the supervisor/worker API,
and share the exec consumer's existing two-second deadline across Shutdown
and completion. Completion does not certify durable persistence or detached
writer/child termination; early error and broken-pipe exit limits are recorded.
Validation on main 71bc853fe with Windows GNU LLVM Rust 1.98.1:
- Strict TUI product-library check passed with rquickjs/bindgen.
- 11 run-completion regressions passed (0.27s); existing catalog probe: 1 passed (2.11s).
- TUI formatting and diff checks passed.
- Earlier identical helper/test blobs: renewed-budget mutation caused the
intended assertion failure, and the restored positive control passed.
Required CI, external client interoperability, installed artifacts and release
qualification remain separate. No E2E or deployment was performed.
Signed-off-by: Codex <[email protected]>
Keep uncommitted reasoning text out of the translation placeholder when a block closes without its usual completion event; retain the reasoning buffer for the normal session record. Remove a comment that implied an unowned tail would necessarily be delivered.
Validation: 9 focused existing Linux checks passed on the contributor candidate plus this follow-up, including the extended translation fixture; all 4,160 captured inputs stayed unchanged. Final release CI and an actual terminal event replay are separate.
Describe interactive zsh startup as Codewhale guidance instead of a shell-generated error.
Validation: rustfmt and diff checks passed; the extracted current diagnostic compiled and rendered with the existing auth command intact. The Ollama route mismatch in #7115 remains open.
Show the effective threshold for the current route alongside the configured target, and distinguish automatic compaction being off. Route limits and live token estimates can change the actual trigger.
Validation: existing context rail fixture passed 1/1 on the frozen Linux candidate (13,924 filtered); all 4,160 source inputs remained unchanged. The reported Windows compaction event has not been reproduced.
Flush already queued persistence during signal shutdown alongside Runtime API drainage, with a two-second bound and the existing second-signal escape. The flush does not capture state that was never queued or guarantee a write when the timeout expires.
Validation: 14 existing persistence-actor tests passed on the exact current-main plus contributor candidate on Linux; all 4,160 source inputs were unchanged through the check. The contributor also reports simulated signal-handler checks. Actual OS-signal-to-disk behavior and final release CI remain unverified.
Register the painted update segment as a typed mouse target, use the existing /update command, and show the same hover affordance as other actionable metrics. The check only explains the update; it does not install it.
Verification: 1 existing Linux render fixture passed on the clean main-based source export, covering visible hover and clicks in launch and session states. All 4,160 export inputs and canonical inputs stayed unchanged. The notice remains hidden when the metrics row is hidden or shed.
Use the snapshot returned by the validated Work restore instead of capturing it again after the target session has already become active. A contended second capture could previously abort the session switch after changing the Work owner.
Verification: 3 existing Linux restore checks passed on a clean main-based source export with this fix and the separate update-notice slice; all 4,160 export inputs and canonical source inputs stayed unchanged. The inherited Work Graph publish patch remains uncommitted.
Show a quiet available-version notice on the normal and empty-session metrics line, without replacing permission or remote-control status. A staged unsigned update no longer claims it is ready. Existing hidden/mini/pet layouts remain unchanged and the notice is display-only; /update remains the action.
Refs #7136. Verified on the frozen Linux source export: the existing empty-session render and status-item coverage checks passed (2 passed, 0 failed; 13,924 filtered in each). rustfmt and diff checks passed. First VM test attempt was killed at its memory limit; the one-job retry with swap passed. No installed binary, real update check, clickable control, or hosted CI was verified. Read-only design review by Claude.
Review found the previous `MessageStarted` change was dead code:
`App::flush_active_cell` clears `streaming_thinking_active_entry` on every path
(`app.rs:5928`, `:5935`, `:5940`) and only marks the thinking cell finished; it
does not deliver a delta that never reached it. The guard ran after the flush,
so it could never be true, and the reset afterwards still dropped the tail.
The drain now runs before the flush, which is the only point where the entry is
still live.
Two related losses on the same path:
- `flush_pending_text_tail` drained the buffer and then returned when
`streaming_message_index` was `None`, discarding the text. It resolves the
destination first now, and does nothing when the buffer is already empty.
- `finalize_current` took the buffer without a live entry to deliver into, so
the text was dropped. It now leaves the buffer alone in that case.
Tests drive the real handler order (finalize, then flush) and assert the tail
survives both steps, plus the no-entry and text-block cases.
The mirror of the text-to-thinking boundary the previous commit fixed. When
assistant text starts again, `MessageStarted` reset `StreamingState` after only
resetting the display clock. If `ThinkingComplete` never arrived, the reasoning
block still held its uncommitted tail and the reset discarded it, and the
thinking entry kept streaming with no new content ever reaching it.
`MessageStarted` now finalizes the live reasoning entry and stashes its buffer
before the reset, which is what `ThinkingComplete` already does for the normal
path.
Also adds the inverse test for `drain_text_block`: a reasoning block must stay
buffered, a text block must drain, and an empty state must not panic.
Review found two more places where the fix was incomplete.
`start_block` resets `StreamingState` when a reasoning block opens. The display
beat commits at most once per interval, so a block boundary that lands between
beats left the last slice of prose in the buffer, and the reset discarded it:
the tail before a reasoning card never reached the transcript. The tail is now
delivered to the assistant cell before the reset.
The translation branch of `ThinkingComplete` still drained block 0
unconditionally, so a text block that lost its boundary event would be consumed
and dropped instead of reaching the answer. It is guarded like the other
finalize paths.
Both new tests fail without these changes: the first asserts the prose cell
still holds its tail after a reasoning block opens, the second asserts a stray
text block is not appended to the reasoning card.
The finalize paths drained block 0 into whichever cell they were about to
close: a text drain into the assistant cell, a reasoning drain into the
thinking entry. That only stayed correct because the thinking drain happened
to run first. Both drains now check the block's kind, so a lost boundary
event cannot append reasoning to the prose or prose to the reasoning card
(#7123).
A display beat chose its destination cell by whether an assistant cell was
already live, not by the kind of the block the delta belonged to. The engine
keeps an assistant cell live across a finished text block (#7123), so a
response that streamed text and then opened a reasoning block appended the
reasoning to the prose body: one sentence appeared partly inside the thinking
card and partly outside it as ordinary text.
Route the committed delta by StreamingState::block_is_thinking, so reasoning
always lands in the thinking entry and a text delta still gets an assistant
cell when its own was already closed.
Keep the contributor's Vim dollar-motion fix and preserve its original commit. The follow-up keeps deletion and append within an empty line.
Verified locally: two existing grapheme filters passed 1/1 each, the CLI built, and three isolated one-key terminal replays covered dollar motion, repeated deletion and append. Paste-burst detection was disabled for these replays; the separate held-key path remains unqualified. No live provider or release validation was run.
Do not let x delete an empty line break or a move across it. This completes the dollar motion on empty lines.
Verified: two existing grapheme filters passed 1/1, the CLI built, and three sandboxed one-key PTY replays covered dollar, repeated deletion and append. No live provider or release validation.
Signed-off-by: CodeWhale Bot <[email protected]>
Fail the compaction pass without replacing history when the complete summary cannot fit, instead of retrying with older messages silently omitted. The existing image-size retry path remains available.
Verified: four existing focused compaction filters passed 1/1 each and the non-test CLI build passed on the frozen source; 4,160 inputs and HEAD remained unchanged. No live provider call or release validation.
Expose the provider-declared off toggle, clamp DeepSeek reasoning to the official model catalog, and leave automatic Responses effort to the provider. Custom proxies do not inherit first-party capability claims.
Verification: five existing DeepSeek catalog, precedence and wire filters passed 1/1 each in the unchanged combined source snapshot at 687a38c6ed. The later combined CLI build and TUI library lint also passed; the shared source included a separate unstaged Auto-default draft. No live provider calls were made.
Refresh the roster through the admitted built-in Codex route even when another provider is selected, and use a new account-scoped cache filename so older mixed catalogs are not reused. Reject nonofficial routes for this refresh.
Verification: existing own_roster_follows_selected_registration_and_disappears_after_sign_out filter passed 1/1 in the unchanged combined source snapshot at 687a38c6ed. A later combined CLI build and TUI library lint passed with the same catalog files present. No live provider calls were made.
Keep the built-in command available and expose the plugin command under a deterministic plugin-specific name. Preserve registration ownership and replay checks, and require a fresh Native policy review.
Verified focused registry, dispatch and policy checks, plus an isolated published-plugin activation and synthetic-model review flow. Real provider, plugin UI, direct Git and release qualification remain open.
Preserve @gaord's build repair for local Ollama discovery and the checkpoint wrapper. A follow-up removes newly added comments to follow the workspace policy while keeping the contributor's original commit.
Local verification on the combined frozen Engine tree: non-test CLI build passed; the existing Ollama probe and checkpoint round-trip filters passed 1/1 each; TUI library clippy passed. HEAD and all 4,160 captured source inputs stayed unchanged within each verification run. The provider-picker documentation relocation and comment-only follow-up were checked in the second run. No live provider call or final release validation was performed.
Use fixed guidance for recognized service rejection codes and retain the status-only fallback for other responses, so arbitrary server text is not copied into user-visible errors.
Verified on frozen source: the two existing rejection filters passed 1/1 each, the non-test CLI built, and all 4,160 recorded Engine inputs and HEAD were unchanged. The local HTTP fixture used synthetic responses; no live remote-control service was exercised.
Replace derived Debug implementations for Codex token holders with redacted output, including nested auth-file formatting. Extend the existing redaction fixture with synthetic credentials.\n\nVerified: debug_impls_redact_secrets 1/1 on the frozen 687a38c6ed source batch (4,160 inputs unchanged). The separate CLI build failed on the unrelated Ollama future lifetime and is not release evidence. No provider calls.
The engine appends a <turn_meta> block to each user message it saves. The
transcript, the resume picker and session titles leave it out, but /tree
and /export did not: /tree labelled each user entry with the start of the
envelope ("user: say flat things <turn_meta> Current local date:
2026-10-29 C"), and /export wrote the whole block into every user message,
including the absolute workspace path that the export header shortens to
the folder name.
Skip the block at the index turn_metadata_text reports, as prompt_text in
receipts.rs already does, in the /tree journal label, its linear fallback
and the export projection. Only user messages are filtered, like the
transcript's is_turn_metadata_block.
Signed-off-by: Lstarsky0 <[email protected]>
Adds Opper on the existing compatible-host descriptor path: Chat Completions at https://api.opper.ai/v3/compat, OPPER_API_KEY, and claude-sonnet-4-6 as the bootstrap model. Live GET /v3/compat/models stays the model authority. Billing is recorded as Unknown in the pricing omission ledger; no provider enum or price row.
Disclosure: Opper is my startup.
Signed-off-by: Felix Wunderlich <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
`cargo build` and the Lint gate have been failing on main since the local
Ollama discovery and interrupted-session landings, so every pull request
built on current main is red before it is reviewed. This makes main
compile and lint again.
The compile error was a lifetime mismatch in `fetch_tag_profiles`: the
per-tag async block borrowed `&String` from the caller's slice, so the
stream's item type carried a caller lifetime that `tokio::spawn` could
not satisfy. It now owns a `String`, which keeps the bounded-concurrency
probing and its ordering unchanged. Annotating the closure argument, as
the compiler suggests, does not fix it.
The two remaining errors were lints denied by the workspace
`-D warnings`: a redundant `return` and a unit value passed to `Some`.
Both keep their existing behavior.
Verified on macOS with the locked workspace: `cargo fmt --check`,
`clippy --all-targets --all-features` with the CI allowances, a full
`codewhale-cli` build, and the client, local_ollama and session_manager
suites. Two failures that reproduce on unmodified main are left alone:
session_manager's interrupted-deletion test, and intermittently failing
socket-bound tests in the client suite.
Signed-off-by: Ben Gao <[email protected]>
`runtime_api.rs` is the only way the community VS Code extension talks to the
engine, yet nothing in this repository or its tests would notice a changed
route, and the breakage would surface in that release instead of here. Record
the dependency where the next editor of the file will see it, along with the
three wire details it depends on without a probe to fall back on.
Docs only. Verified the claims against the extension's `src/api/engine.ts` and
`src/api/api-client.ts` — the `serve --http` launch, the listener-line and
token checks, the wrong-method feature detection, and the capability flags —
and against `build_router`, `RUNTIME_LISTENING_PREFIX` and the advertised
flags here. No code changed, so no build or test run applies.
Signed-off-by: Ben Gao <[email protected]>
Retain per-model supported levels and defaults from official DeepSeek catalogs while keeping compatible endpoints and unknown levels unclaimed. Reject malformed metadata without replacing the previous catalog.
Verified the existing limits_a_generic_route_keeps_the_limits_its_listing_states test: 1 passed, 0 failed, 13930 filtered; 4160 input hashes unchanged on the shared frozen tree. That tree included other recorded uncommitted workspace changes; the linker emitted a compact-unwind warning. No provider call or inference.
Inspect the copied manifests for selected Native package entries and record unsupported dsh.client components in the exact-content conversion receipt. This makes omitted plugin screens visible before import while keeping them unexecuted.
Verified the plugin crate build, 36 existing install tests and the existing unsupported-enable test with 529 inputs unchanged. A local linked-converter harness checked synthetic and published package fixtures, a no-client control, stable and changed hashes, and the persisted receipt. This does not qualify plugin activation or release behavior.
Keep synchronous start and preflight failures visible through existing Failed state, preserving active and unexpired lease guards. Report failures in redacted TUI logs, current UI history and bounded toasts; retain the /rc status action after toast expiry.
Verified: remote_control::tests 84 passed, 0 failed; existing UI regression 1 passed, 0 failed; phase_strip::tests 11 passed, 0 failed. UI and footer tests use the development wrapper stack setting RUST_MIN_STACK=16777216. cargo fmt --all -- --check and git diff --check passed. No live enrollment or interactive PTY verification.
Signed-off-by: laozidabo <[email protected]>
`$` left the cursor after the last character, on the newline or past the
end of the draft. So `$x` did nothing on the last line and deleted the
newline anywhere else, joining the line to the next one. `$` now steps
back onto the last character, as Esc already does at the end of the
draft, and `x` steps back the same way when it deletes a line's last
character, so `$xx` takes two characters off the end. `o` still opens
its line after the last character, through move_cursor_line_end.
Signed-off-by: Lstarsky0 <[email protected]>
Measure columns across the filtered catalog so offsets remain stable while scrolling. Keep the family heading plain and reserve advanced footer hints for windows with enough width and height; preserve the underlying actions and exact route selection.
Verified five existing TUI checks in the shared frozen Engine batch: wide footer actions, compact/wide header clicks, family-heading hitboxes, full-catalog navigation/sort/refresh/mouse, and locked-row keyboard focus. Each passed 1/1. Current file SHA-256 ac21c77e0e596d8feee9c8cc760889944d3dd75e1540aa68ddf411e473f2f603 and exact diff match the checked frozen patch. git diff --check passed. No new tests or provider calls; no installed-terminal or release qualification claimed.
Probe unknown model capabilities with bounded concurrency and publish a complete catalog only when every tag is resolved. Fence automatic adoption against a newer discovery or changed endpoint, while retaining a confirmed local candidate when the catalog is incomplete.
Verified on the frozen shared Engine source: four focused existing checks passed for local discovery, picker adoption, publication fencing, and runtime catalog routing. These use synthetic local fixtures; a real Ollama and desktop session remain unverified.
Recognize the control-plane rejection status and machine code, and show a fixed actionable message without exposing untrusted response content.
Verified on the frozen shared Engine source: the existing bounded error-field test passed. The focused Platform server rejection test also passed; no hosted remote-control flow was exercised.
Describe subscription billing without asserting that the provider charged nothing, while retaining detailed usage receipts and mixed-route reporting.
Verified on the frozen shared Engine source: the existing TUI cost diagnostic test passed, covering subscription, details, mixed and unknown cases; two focused commands-host checks also passed. No live provider billing was inspected.
Let file writes preserve the existing line-ending style by default or explicitly choose LF or CRLF, applying size checks and receipts to the actual bytes written.
Verified on the frozen shared Engine source: six focused existing checks passed, including CRLF preservation, schemas, byte receipts, and queued cancellation. The broader agent-driven workflow remains unverified.
Retain crash checkpoints, discover recoverable sessions in the picker, and promote only under the session lease with workspace and saved-state checks. Preserve the shared legacy slot and fail closed when damaged recovery could otherwise be overwritten.
Verified on macOS with the locked hermetic TUI checks: checkpoint 78 passed, continue 12 passed, picker rename 1 passed, picker archive 1 passed. The linker reported a compact-unwind size warning. Legacy-slot cleanup and old-writer coordination remain limited.
On a terminal that isn't trusted to deliver bracketed paste, the raw-paste
guard holds each plain character for a few milliseconds and, when nothing
follows, types it into the composer. That happens before the event loop's
Normal-mode arm sees the key, so with vim mode on, i, x, dd and the
motions went into the draft as text until the session's first bracketed
paste. A held character now goes to the Normal-mode keys when no
completion menu is open, the condition that arm checks; it is absorbed in
Visual mode, as the arm after it does, and typed otherwise.
Signed-off-by: Lstarsky0 <[email protected]>
crossterm reports an uppercase letter with SHIFT, and the Normal-mode arm
only took a key with no modifiers at all, so G (end of the draft) fell
through to the insert arm and was typed into the draft, as was any other
shifted letter. The arm and its Visual-mode twin now take a key that passes
is_plain_char, the test that insert arm already uses: Shift is allowed,
Ctrl, Alt and Super are not.
Signed-off-by: Lstarsky0 <[email protected]>
prepare-release.sh 0.10.3 refuses a release section without a Keep a
Changelog subsection (rehearsed on an export of main: "CHANGELOG.md
section 0.10.3 must contain at least one Keep a Changelog subsection").
The Unreleased bullets are regrouped, unchanged, into Added, Changed,
Fixed, Security and Maintenance as in 0.10.2, with Contributors last;
the freeze then only renames the heading.
check-contributor-credit.py also failed on main: @laozidabo (#7101,
localized /diff feedback, merged) was not credited. Added to the
CHANGELOG Contributors block, docs/CONTRIBUTORS.md and
UNRELEASED_CONTRIBUTORS; agent docs regenerated.
Verified on the edited export of main: the sorted bullet set is
unchanged apart from the new credit line; sync-changelog.sh --check,
check-feature-release-notes.sh v0.10.2 HEAD, check-contributor-credit.py
v0.10.2 (was exit 1), check-bundled-plugin-claims.py and web
check:facts pass.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A DSH plugin tool can now call ctx.subagents.startActivation({provider:
'spawn', childId, request: {parent, prompt}, signal, delivery}) and get back
{childId, messageId, result, dispose}. The bridge is a thin adapter over
SharedSubAgentManager: no second executor or loop, and no provider call
outside the existing child turn.
- Host (root.ts): `subagents` shim (getProvider('spawn') reports
inheritsParentContext:false; startActivation), an empty `agents` shim, and
a `systemPrompt` shim whose methods refuse outside a child's agent/created
context. During startActivation the owner's own agent/created listeners get
a sealed child: systemPrompt.section(PERSONA_PREFIX_SECTION) is an additive,
child-scoped persona (at most 32 KiB) and tools.restrict({deny}) can only
narrow. agent/created is no longer refused as unprojected; global
agent/created listeners are refused instead of never firing. tools.get(name,
agent) reads the calling tool's catalog.
- Engine protocol: subagent/start, subagent/result and subagent/dispose, each
bound to the live root invocation's subagent ticket and the child ids that
invocation started; reviewed in REVIEWED with why each gives the host no core
authority. protocol.generated.ts and dist/ regenerated.
- Approval planning: the start is executed as a typed `agent` call through the
turn loop's nested-call gate (gate_nested_call), so it gets the same
plan_tool_calls, hooks and approval card as the model's own `agent` tool.
Only action=start, fork_context=false with a string prompt is accepted.
- Manager: prepare_background_with_assignment_options / commit_prepared_child
with a frozen child configuration (persona, denied_tools, delivery Parent |
Caller). Cancellation, disposal and the result receipt go through the
manager; an invocation that ends disposes its children. The stale/cancelled
commit check now applies the stop-token test only to activation children,
restoring the ordinary spawn path's earlier behavior under an already
cancelled parent (limits_tests, completion_usage_tests).
- Compatibility table (src/dsh/compatibility.json and the plugins asset copy):
subagents, agents and systemPrompt move to provided. Changing the table
invalidates earlier trust.
- Existing tests updated: host.test.mjs no longer expects systemPrompt, agents
and subagents to be refused (llm still is). CoreMessage::Request (test-only)
boxes its request to keep the enum within clippy's variant-size limit.
- Docs: DSH_PLUGIN_COMPAT.md checklist, child-agent mapping and known limits;
EXTENSIONS.md (en, zh_hans); CHANGELOG (root and crates/tui synced).
Known limits: only the spawn provider; fresh context only; a requested model
must already be usable by the parent; only text output blocks reach the
plugin; the older subagents.start form is refused; @michengai/dsh-code-review
now activates but its direct git use is still denied by the Native profile
(not run).
Verified on Linux Boat VM vm22:
- Live Runtime API probe (fake loopback provider, fixture-sa): install,
review, trust, enable; the dsh_probe tool approval, then a separate
approval card for the nested `agent` start; the child's own model request
carried the persona marker and its tools excluded dsh_probe and write;
delivery 'caller' returned "child completed (denied dsh_probe,write, message
accepted)" to the plugin, and /probe-count read back stopReason completed
and the messageId. The first probe run found agent/created refused as
unprojected; fixed here and rerun green.
- Final tree (origin/main b8afed5f27 + this change):
cargo check --workspace --all-targets --locked ok;
cargo test -p codewhale-tui --lib -- tools::subagent:: extension_host::
tools::codemode:: 988 passed, 0 failed;
typescript_protocol_is_generated_from_the_rust_types 1 passed (no update);
cargo fmt --all -- --check ok after formatting.
- Earlier on the same change (base 1420d35c9f): CI's clippy command
(--workspace --all-targets --all-features -D warnings with CI's three -A
allows) ok; host npm test 413 passed, 0 failed, 6 skipped;
core::engine MCP tests 10/10 when run on their own (under heavy parallel
load 6 timed out, and 2 also fail on pristine main under the same filter).
Not run: Bun host tests, macOS, Windows, desktop App, interactive TUI.
Refs CW-7054
Co-Authored-By: Claude Opus 5.5 <[email protected]>
QA friction audit (codewhale-ops dd2c253d row 9): /mcp add recommended
playwright wrote config, but the first connect failed because the cold
npx @playwright/mcp download overran the 30 s connect budget. The error
read "MCP SDK request failed before an admitted reply: mcp/open timed out
after 30s; the host was told to cancel it".
- A stdio server launched through npx, pnpx, bunx or uvx with no
per-server connect_timeout now gets max(global, 120 s). An explicit
per-server value still wins.
- When initialize fails because the connect budget ran out, the error now
leads with "MCP server '<name>' didn't start within Ns; retry with
/mcp restart, or raise its connect_timeout", with the transport detail
still in the chain.
- docs/MCP.md states the floor.
Verified on the shared tree (same code, pre-S19 layout):
scripts/dev-test.sh tui mcp 584/584 passed. Ported to the S19 layout
(crates/mcp/src/config.rs) by text; rustfmt clean. The live npx cold
start was not re-run here.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
0e9c5beba5 (E5) added one std::fs::create_dir in
SandboxManager::prepare_bwrap to create the workspace's .codewhale/
before bubblewrap starts (bwrap can only protect a path that exists).
`prepare` is synchronous and runs just before the sandboxed process is
spawned, so the call stays synchronous; the budget is raised for that
single site (crates/sandbox/src/lib.rs std_fs 2 -> 3), as the checker
directs for a site that can only run on synchronous code.
Verified on an export of origin/main 3e4ce7d772: before, exit 1
("crates/sandbox/src/lib.rs: std_fs sites 3 > budget 2"); after
`--update`, "within budget", exit 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
INSTALL.md: re-running the installer upgrades; automatic updates
(signing rule, opt-out, organization policy); rollback; cleaning up old
copies; release-signing founder steps. CONFIGURATION.md: [update] mode
and 6 h interval. REBRAND.md: stale deepseek shims. CHANGELOG entries,
crates/tui/CHANGELOG.md synced with scripts/sync-changelog.sh.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
web/public/install.sh and scripts/release/install.sh now upgrade a
destination that is a regular, user-owned Codewhale binary (marker
string present), with or without a receipt, and replace an older
receipt. The old files move to ~/.codewhale/recovery/<stamp>/ with a
manifest that `codewhale doctor --restore <stamp>` reads; nothing is
left as .bak beside the commands. Symlinks, other users' files, foreign
programs and differing companions are still refused (FORCE_REINSTALL
moves a regular file you own to recovery). Both finish with
`codewhale doctor --installs --brief`. install.ps1 keeps the replaced
files in the same recovery folder layout instead of deleting them.
install-safety.test.js: execution sentinel now allows only the new
binary's doctor call; the refusal test names a non-Codewhale file.
Verified: install-safety.test.js 33 passed, 0 failed on this series
tree (macOS). On Linux Boat vm16, the website installer pointed at a
local fake release upgraded an unreceipted ~/.local/bin copy: old
codewhale and codew are in ~/.codewhale/recovery/<stamp>/ with a
manifest, the install dir holds only the commands and a fresh receipt,
and a plain script at the destination is still refused. Re-running the
website installer over a different installed release (QA report):
temp HOME, install release A then release B from a local server; B
replaces A in place, the receipt is rewritten with B's digests, and A's
codewhale, codew and receipt sit in one recovery folder with an undo
command; a foreign file at the destination is still refused
(install-safety). install.ps1 was not run (no Windows or pwsh here).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Items 4 and 6 of the install-cleanup design land together because both
reshape the same replace path in crates/cli/src/update.rs.
Update adoption (item 4): `codewhale update` writes an install receipt
for a pre-receipt directory whose commands it just installed, and a
divergent Codewhale `codew` beside `codewhale` is moved to the recovery
folder and replaced instead of failing the update. Receipt renewal keeps
its retired receipt in recovery, not in the PATH directory.
Automatic updates (item 6):
- [update] mode = auto | notify | off (default auto for release
binaries); CODEWHALE_UPDATE_MODE; a root-owned, not group/world-writable
policy.toml (/Library/Application Support/Codewhale, /etc/codewhale,
%ProgramData%\Codewhale) overrides both; malformed policy means off.
`codewhale config set update.mode` writes it.
- Check interval 6 h (was 1); a failed check keeps the last answer and
retries about an hour later.
- The TUI stages a newer release in the background with
`codewhale update --stage` (child process) into
~/.codewhale/updates/staged/ with its manifest and signature; chip
"↑ vX ready".
- At the start of the next codewhale process (never update/uninstall/
doctor/machine output/inherited listener), the staged binary is
re-verified against the stored manifest and, when a release key is
configured, the Ed25519 signature; staged.json's own flags are not
trusted. Signed: applied silently, then exec. Unsigned: one [y/N]
question on an interactive terminal (default no; declining is
remembered); never applied non-interactively.
- `codewhale update --rollback` swaps back the binary the last update
replaced (kept in ~/.codewhale/updates/previous/) and pins the
rolled-back version so it is not staged again.
Signing: crates/release/src/signing.rs verifies a base64 Ed25519
signature over "codewhale-release-manifest-v1\n<version>\n<manifest>",
reusing the desktop updater's ring-based check. TRUSTED_RELEASE_KEYS is
empty until the founder creates the key; CODEWHALE_RELEASE_PUBLIC_KEY at
build time adds one. With a key configured, a missing, unfetchable or
invalid signature refuses both update and stage. CI: release-artifacts'
assemble job signs with the CODEWHALE_RELEASE_SIGNING_KEY secret
(scripts/release/sign-release-manifest.sh) when present, else says the
release is unsigned; the inventory verifiers accept the optional .sig.
Security review E3/E4 fixes: Missing is no longer accepted when keys
exist; apply-time re-verification; default-no prompt; the checksum
manifest now only ever comes from GitHub on the proactive path, and the
CNB mirror may only serve a binary whose SHA-256 that manifest lists
(replaces the two tests that encoded the old mirror-manifest fallback).
Debug builds only: CODEWHALE_UPDATE_ALLOW_LOOPBACK_HTTP,
CODEWHALE_TEST_RELEASE_PUBLIC_KEY and CODEWHALE_UPDATE_POLICY_PATH let
fixtures run against a local fake release; release builds ignore them.
Verified on Linux Boat vm16 (debug build) against origin/main plus this
series, temp HOMEs and a local fake release only:
- cargo build -p codewhale-cli clean; cargo fmt --all --check clean;
cargo clippy -p codewhale-release -p codewhale-cli -p codewhale-tui
-p codewhale-config -p codewhale-runtime --all-targets --all-features
with CI's -D warnings set: clean, run with -A clippy::needless_return
because main's provider_lake.rs:2033 fails that lint under
--all-features (not touched here); an earlier run on this series code
over an older main gave cargo check --workspace --all-targets 0 errors
and 0 warnings.
- tests: codewhale-release 57 passed; codewhale-cli update 110 passed;
parses_update 1 passed; codewhale-config lib 808 passed (1 ignored);
feature_registry 2 passed. JS: assemble-release-assets 7/7,
verify-release-inventory 7/7, release-workflows 1/1.
- fixtures: unreceipted dir with a divergent codew updates, the old codew
goes to recovery, a receipt is written and `uninstall` previews exactly
codewhale, codew and the receipt; `update --rollback` restores the
original bytes and pins the version; a group-writable dir updates but
declines the receipt. Unsigned stage: a non-interactive start does not
apply, Enter keeps the old version and the answer is remembered, `y`
applies. Key configured: missing .sig refuses update and stage (nothing
staged); a signature from another key is refused; a signed stage
applies silently at a non-interactive start. A tampered staged binary
is refused and discarded; a forged "signed": true in staged.json
without a key is ignored. An offline stage fails cleanly. doctor shows
the mode source for default, CODEWHALE_NO_UPDATE_CHECK and an
organization policy file; `config set update.mode` writes and validates.
Not exercised: the TUI background staging path end to end, Windows,
macOS start-time exec, the CI signing step (no secret exists), tui lib
unit tests (the VM ran out of memory linking them).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Copies the token migration from upstream codewhale-hq/codewhale-ratatui
528a9c4 into vendor/codewhale-ratatui, before the 0.10.3 tag:
- roles.rs regenerated from tokens 2.3.0 (19 roles: `Accent` for links,
focus and selection; `Primary` is filled-action ink; diff tints from
diff_add/diff_remove); vendor/codewhale-design/tokens.rs 1.1.2 -> 2.3.0;
theme.rs, tui_palettes.rs and assets/tui-palettes.json match upstream.
- The kit's Primary-to-Accent call sites are applied to the Engine's own
copy (base snapshot 2ad795b plus its patches); the other upstream
commits since that snapshot are not taken.
- The 16 named TUI palettes map Accent to the same accent_primary slot
the old Primary read, so the built-in themes keep their colours.
- crates/tui: the infoline Info/policy ink and two test fixtures move
from Role::Primary to Role::Accent.
- UPSTREAM.json records a `tokens_update` section (commit, scope, local
changes, sha256 of the 47 changed files); the original snapshot hashes
are left as provenance, as pet_update does.
Verified on a Linux Boat VM from a fresh clone of origin/main 786a0e4b33
plus this patch (the later main commits touch none of these files):
cargo check --workspace --all-targets --locked green (10m21s);
cargo test -p codewhale-tui --lib -- tui:: 4023 passed, 0 failed,
8 ignored (render, snapshot, infoline and phase-strip tests; no snapshot
needed updating). The unfiltered `cargo test -p codewhale-tui` run aborted
in acp_server on a stack overflow before reaching these tests, and its
cucumber/integration failures all report the unbuilt `codewhale` CLI
binary; palette_audit passed. Real TUI screenshots (built CLI in tmux,
truecolor, Underwater and Shoreline Light: home with the command menu
and mode badge, /diff, /provider with focus and link) are under
CW/artifacts/design-20261027/tui-engine/.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New crate crates/account-cli (codewhale-account-cli): cli/src/cloud.rs
becomes its lib.rs, cloud/{work,machine,computer}.rs and their tests
move with it, and cli/src/dispatch.rs becomes account_cli::dispatch.
CloudArgs, DispatchArgs, the login-timeout constants, run,
run_account_login, reject_inline_api_key, machine_review_provider,
dispatch::run and machine::MachineError are now pub. The three
crate::hashing::sha256_hex uses call codewhale_runtime::hashing; the cli
keeps its hashing.rs for update.rs. codewhale-cli drops `mod cloud;
mod dispatch;`, calls codewhale_account_cli::, and no longer depends on
webbrowser. All 124 tests moved; a test-only clap wrapper in the new
crate replaces the private cli Cli type. No behavior change.
Implemented on vm13 by the split session.
Path-keyed: root Cargo.toml and Cargo.lock, scripts/release/crates.sh
(after app-server), scripts/dev-test.sh (area account-cli),
docs/features.toml owners, check-blocking-calls-budget.json keys, and a
path comment in web docs-auth.ts.
Verified on Linux x86_64 Boat VM vm21 (tree 69daf5299f70, on
S19+E2+S57+S49):
- cargo fmt --all -- --check: exit 0
- cargo check --workspace --all-targets --locked: exit 0, 0 warnings
- CI Lint clippy (--all-targets --all-features -D warnings, CI allows):
exit 0
- cargo test -p codewhale-account-cli -p codewhale-cli --lib:
account-cli 124 passed, cli 377 passed, 0 failed
- validate-crate-publish-order.py over release_crates: exit 0
- check-blocking-calls-budget.py: only the pre-existing uninstall.rs and
sandbox overages
Not run: production-profile cli build, cli integration binaries,
macOS/Windows, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
crates/app-server/src/lib.rs goes from 6,962 to 990 lines:
- http.rs: runtime_compatibility_router, app_router, handlers, auth
token and CORS (pub mod)
- stdio.rs: BoundedLines, run_stdio_loop, stdio dispatch, interrupt and
thread-message handling (pub mod)
- turns.rs: thread, prompt and bridged-turn handling
- bridge.rs: runtime bridge acquisition, catalog, impl RuntimeBridge,
SSE parsing, and the cfg(test) bridge helpers
- config_rpc.rs: process_app_request and config persistence
- tests.rs: the former inline test module, moved verbatim
lib.rs keeps the options and public types, run, bind_*, the JSON-RPC
types and helpers, and build_state*. Callers are rewired without
facades (tui acp_server, runtime_api and its tests now import
codewhale_app_server::stdio::BoundedLines and
::http::runtime_compatibility_router); the public thread-type and
thread-control re-exports are preserved. Visibility widened only to
pub(crate). No behavior change. Implemented on vm12 by the split session.
The RUNTIME_API docs' drift-test path now names
crates/app-server/src/tests.rs, and that one entry of
web/data/agent-docs.generated.json is regenerated with
web/scripts/derive-facts.mjs. The rest of that run's output (stale
INSTALL/CONFIGURATION entries and features.generated.json, which
predate this change) is not included.
Verified on Linux x86_64 Boat VM vm21 (tree 32722082b2cb, S19+E2+S57
base):
- cargo fmt --all -- --check: exit 0
- cargo check --workspace --all-targets --locked: exit 0, 0 warnings
- CI Lint clippy (--all-targets --all-features -D warnings, CI allows):
exit 0 (first clippy run for this slice)
- cargo test -p codewhale-app-server --locked: lib 177 passed,
tests/daemon_socket.rs 15 passed, doctests 0; 0 failed
- check-blocking-calls-budget.py: only the pre-existing uninstall.rs
and sandbox overages
Not run: cfg(windows) compile (daemon_windows.rs), app-server-smoke.sh,
macOS, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
configured_codewhale_binary() fell back to the bare name "codewhale",
so Fleet runs started from `codewhale fleet run` or `POST
/v1/fleet/runs` resolved the worker on PATH. With a minimal PATH
(launchd/Finder, `env -i`) every worker failed with "starting worker
…: No such file or directory", and with an older codewhale earlier on
PATH the run silently used it.
Without CODEWHALE_FLEET_CODEWHALE_BINARY, a process whose executable
stem is codewhale/codew or codewhale-*/codew-* now uses
std::env::current_exe(). Other hosts (test harnesses such as
codewhale_tui-<hash>) keep the old "codewhale" default, so they never
spawn themselves as workers. Windows codewhale.exe matches the same
stem. Reported and verified by the QA session.
Verified on Boat vm19 (Linux x86_64) at base 804b7fca89 + this change:
`cargo test -p codewhale-tui --lib --locked fleet::` 452 passed, 0
failed. QA ran the built binary (sha256 513820fa…5558e3) under its own
name `codewhale-7119b` against a mock provider: with PATH=/usr/bin:/bin
and no codewhale on PATH, Fleet completed 2/2 (both workers exit 0);
with a stale `codewhale` first on PATH, 2/2 and the stale binary was
never invoked (CW/artifacts/qa-20261027/fleet/vm19-7119b-ownname.txt).
The previous gate (exact stem only) failed both cases under that name.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
crates/config/src/lib.rs goes from 8,109 to 135 lines. The items move
into 23 modules (provider_toml, permissions, config_toml,
provider_config_keys, provider_chain, hotbar, extension_toml,
stream_timeouts, fleet, service_toml, config_resolve, telemetry,
project_config, model_normalization, base_url_resolution,
runtime_options, config_store, config_backup, state_dirs,
config_migration, display_redaction, path_io, env_overrides); lib.rs
keeps `mod X; pub use X::*;` (pub(crate) for the four modules with no
public items), so every codewhale_config:: path and the tests'
`use super::*` are unchanged. A handful of private fields and methods
widened to pub(crate) for cross-module use. No behavior change.
catalog.rs is untouched. Implemented on vm14 by the split session.
scripts/check-provider-registry.py now reads every crates/config/src/*.rs
(except tests.rs) and finds ProvidersToml in provider_toml.rs. The
blocking-calls budget entry for config/src/lib.rs (std_fs 9,
path_canonicalize 3) is re-keyed to the files the sites moved to:
config_migration.rs std_fs 1, path_io.rs path_canonicalize 2,
state_dirs.rs std_fs 8 and path_canonicalize 1.
Verified on Linux x86_64 Boat VM vm21 (tree 7f443e6164e2, S19+E2 base):
- cargo fmt --all -- --check: exit 0
- cargo check --workspace --all-targets --locked: exit 0, 0 warnings
- CI Lint clippy (--all-targets --all-features -D warnings, CI allows):
exit 0
- cargo test -p codewhale-config --lib: 808 passed, 0 failed, 1 ignored
- python3 scripts/check-provider-registry.py: passed
- check-blocking-calls-budget.py: no config entries; only the
pre-existing uninstall.rs and sandbox overages
Not run: module_graph.py --check, macOS/Windows, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Security finding E2 / 0.10.3 checklist B15: the Codewhale catalog parser
dropped any digest for tarball sources (`sha256: None`), and the Claude
parser recorded `archive.sha256` with an UNVERIFIED_PIN warning but never
checked it, so a catalog could not pin the bytes it installs.
A Codewhale catalog entry may now carry `sha256`; the Claude `archive`
source's `sha256` takes the same path. The pin is folded into the install
spec as a URL fragment (`#sha256=<hex>`, or `&sha256=` after `#path=`),
so it reaches every remote install route (install, InstallExact with
expected_content_hash, update) and the .installed-from marker.
install_remote_bytes compares sha256(bytes) with the pin before staging
and returns PluginArchiveMismatch (Runtime API 409) with nothing written.
A non-string, malformed, or non-archive pin is an INVALID_SHA256 /
INVALID_SOURCE error, so the candidate is not installable (fail closed).
Direct installs accept the same `#sha256=` fragment.
The bundled first-party catalog still names the unpinned
releases/latest Computer Use URL; it is re-pinned once the cu-plugin
release asset exists.
Re-applied onto S19's layout: the patch's crates/tui/src/plugins paths
now live in crates/plugins/src; claude.rs calls
crate::install::PluginInstallSource::pin_archive_spec and
runtime_api/plugins.rs downcasts
codewhale_plugins::install::PluginArchiveMismatch.
Earlier proof (vm13, real binary via `codewhale app-server --http` and a
local Codewhale marketplace pointing at a public codeload archive): wrong
pin -> HTTP 409, nothing installed; malformed pin "abc" -> HTTP 409
INVALID_SHA256, nothing installed; correct pin -> HTTP 201 installed.
Verified on Linux x86_64 Boat VM vm21 (tree a73a3e24cb4a, S19 parent):
- cargo fmt --all -- --check: exit 0
- cargo check --workspace --all-targets --locked: exit 0, 0 warnings
- CI Lint clippy (--all-targets --all-features -D warnings, CI allows):
exit 0
- cargo test -p codewhale-plugins --lib: 201 passed, 0 failed, 1 ignored,
including claude_source_object_matrix_matches_documented_forms (first
run of the updated assertion)
- codewhale-tui lib filtered to runtime_api::plugins plugins: 69 passed,
0 failed
- check-blocking-calls-budget.py: only the pre-existing uninstall.rs and
sandbox overages
Not run: a live install on this exact build, macOS/Windows, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Since Host MCP became the default, text `codewhale doctor` planned the
extension-host sandbox through planned_sandbox, which created
$CODEWHALE_HOME/extension-host/data-builtin (plus data, data/tmp and the
materialized bundle for the plugin tier). That broke doctor's read-only
promise and failed diagnostic_read_only::doctor_text_leaves_a_sealed_home_untouched
and diagnostics_read_home_legacy_settings_without_migrating_them on Linux
(linux-ci-regressions-20261027 group C).
planned_sandbox now creates nothing. It plans only when the tier's data
directory (and, for the plugin tier, data-builtin, data/tmp and the bundle
file) already exist; otherwise doctor prints "host sandbox not determined:
not planned until the host first starts, which would create <path>".
Creation stays on the real launch path (plan_launch / wrap_host). Limit: a
home whose host has never started gets no sandbox verdict from doctor.
The existing launch_plans_carry_their_tier... assertion now expects that
"would create" result instead of a planned Unsandboxed verdict.
Verified on Linux vm22 (origin/main c8e68b9afb + this patch, --all-features,
hermetic test home, CODEWHALE_EXT_HOST_TESTS=1 CODEWHALE_EXT_HOST_BUN_TESTS=1):
- cargo build -p codewhale-cli --bin codewhale: ok
- --test integration diagnostic_read_only::: 14 passed, 0 failed (both
group C tests included)
- --lib extension_host::: 175 passed, 4 failed. The 4 are environmental and
unrelated: two Bun tests need Bun >=1.4.0 (VM has 1.3.14), two compiled
Native tests need CODEWHALE_COMPILED_HOST_TEST_BINARY, which was not set.
- cargo fmt --all -- --check: ok
Not run: clippy, macOS, Windows.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Plugin discovery, review, install, marketplace parsing and the provider
registry move from crates/tui/src/plugins into a new codewhale-plugins
crate (git mv, mod.rs -> lib.rs). The MCP config types (McpConfig,
McpTimeouts, McpServerConfig, McpServerOAuthConfig) move to
codewhale_mcp::config, with reviewed-plugin provenance stored as an
opaque McpProvenance; the skills parse core and recommendations move to
codewhale_skill_install::{skill_parse, recommend}. About 120 tui files
are rewired with no re-export shims. The node composition reviewer stays
in tui behind a OnceLock hook that fails closed ("composition reviewer
is unavailable") if it is not installed. first-party-marketplace.json
and dsh-compatibility.json move to crates/plugins/assets. Tests that
need the extension host stay in tui (plugins_dsh_tests,
plugins_skill_tests, plugins_provider_tests).
Integration onto main: route_preferences.rs conflicted because
0296261823 moved the route-writer block above the test module; the
patch's copy at the old location was dropped and the moved block
repointed at codewhale_plugins (identical otherwise). The
blocking-calls budget entry moved to crates/plugins/src/builtin.rs with
upstream's tightened count. DeclarativePluginFixture gains a Default
impl: as a pub item under --all-features it tripped
clippy::new_without_default.
Verified on Linux x86_64 Boat VM vm21, tree ea13bd15d4a9 on 0d0b2f46af:
- cargo fmt --all -- --check: exit 0
- cargo check --workspace --all-targets --locked: exit 0, 0 warnings
- CI Lint clippy (--workspace --all-targets --all-features -D warnings,
CI's three -A allows): exit 0
- cargo test --lib: codewhale-plugins 201 passed, 1 ignored;
codewhale-skill-install 47; codewhale-mcp 2; 0 failed
- codewhale-tui lib filtered to plugins skills:: mcp:: extension_host::
runtime_threads runtime_api provider_lake provider_picker: 1780 passed,
3 failed, 2 ignored. Failures: runtime_api::tests::mcp_management_
selected_connection_and_retry_preserve_siblings and mcp_tools_endpoint_
is_passive_until_connect_requested (known Linux baseline), and
extension_host::mcp::tests::host_restart_mints_fresh_owner_and_never_
revives_old_grant (bwrap handshake timeout under parallel load; passes
3/3 alone with --exact on the same binary)
- check-blocking-calls-budget.py: only the pre-existing overages in
cli/src/update/uninstall.rs and sandbox/src/{bwrap,lib}.rs
Not run: full tui lib suite, tui integration binaries, macOS/Windows
builds, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Unreleased entry said to install Computer Use from the `codewhale`
marketplace, but no cu-plugin release has the `computer-use.tar.gz` the
marketplace entry points at (it returns 404; release checklist B15), and
codewhale.net/computer-use says the installer is pending. The entry now
says it is a separate experimental macOS plugin whose install steps go
on the Computer Use page once its signed release is published. Restore
the marketplace wording if that release lands before the tag. Spotted
by the marketing session.
Verified on an export of this commit: sync-changelog.sh --check,
check-bundled-plugin-claims.py and check-versions.sh exit 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
c21e0b1e14 left a second `if known().await { return; }` just before a
block that only compiles outside test builds, so under
--all-features (test-thread-scoped-state + debug_assertions) the return
was trailing and clippy::needless_return failed Lint on main (seen on
#7111). Fold the second known() check into the cfg-gated load_model
condition; behavior is unchanged in both configurations.
Verified: cargo clippy -p codewhale-tui -p codewhale-runtime --all-features
--lib --locked -- -D warnings (CI's allow list) finished clean on this tree
(10m13s); rustfmt --edition 2024 reports no diff.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Linux hosted CI (Test ubuntu-latest, `cargo nextest run --workspace
--all-features`) had 11 failures from 4cf2d2cfff (coordinator diagnosis,
CW/artifacts/linux-ci-regressions-20261027/RESULT.md group A). The move
of settings, paths, catalog cache and credential lookup into
codewhale-runtime gates its test redirect on a feature that
`--workspace --all-features` turns on, so the shipped-shape binary and
the cli tests read `/tmp/codewhale-tui-test-state-*` instead of
HOME/CODEWHALE_HOME. `codewhale_runtime::resolve_state_from_environment()`
(a no-op without `test-support`) is called by the binary's main and the
cli test env_lock, so state comes from the real environment again.
Release artifacts build `-p codewhale-cli --profile dist` without
`--all-features`, so they never had the redirect (resolver 2; the
features are dev-dependency only).
Also: c21e0b1e14 left a `return` in provider_lake.rs that clippy's
needless_return flags when the cfg(not(test…)) block after it is
compiled out (CI's all-features debug build). The second known() check
now guards the model load directly; shipped behavior is unchanged.
Patch by the coordinator session (fix.patch); provider_lake by the
release manager. Verified:
- Linux (coordinator, Boat VM): cli lib 501, cucumber 54,
diagnostic_read_only 12 passing (2 group-C tests remain, routed).
- macOS, export of 39c446a164 + this change, under the build lock:
`cargo clippy --workspace --all-targets --all-features --locked --
-D warnings` (CI Lint allowances) exit 0, 0 errors, 1288 s;
`cargo test -p codewhale-cli --all-features --locked` (hermetic home)
exit 0: lib 501/0 and every integration binary 0 failed.
- rustfmt --check clean on all six files.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
c21e0b1e14 ends refresh_unverified_local_context with a block gated on
not(any(test, all(feature = "test-thread-scoped-state", debug_assertions))).
Under CI's Lint command (clippy --workspace --all-targets --all-features)
that block is compiled out, the second early return becomes the function
tail, and clippy::needless_return fails the gate on main. The return is
needed in every other build, so the lint is allowed only under the cfg
that removes the block.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New codewhale_release::installs classifies every codewhale, codew,
codewhale-tui, deepseek and deepseek-tui in PATH, the running binary's
directory, ~/.local/bin and ~/.cargo/bin as receipt-owned, unreceipted
Codewhale, backup leftover (nine backup naming schemes, stale
.codewhale-backup-*/-update-* entries), package-managed (exact manager
command; Cargo bins only when .crates.toml lists them), desktop app, or
not ours (symlinks, other users, other programs such as codewhale-go).
Nothing found is executed: ownership is name grammar plus native magic
plus a compiled-in marker string, read with a bounded scan.
- `codewhale doctor` gains an Installations section; `doctor --installs`
(`--json`, `--brief`) prints only that, before config loads.
- `doctor --fix` adds MoveInstallLeftover, AlignAlias, AdoptInstall and
PruneRecovery to the one existing plan. Moves go to
~/.codewhale/recovery/<UTC stamp>/ with a manifest, each printing its
undo; recovery folders older than 30 days are deleted by a later --fix.
The plan prompt is now [Y/n] (EOF answers no).
- `doctor --restore [STAMP]` moves a folder back; an occupant at the
original path is itself moved into a new recovery folder.
- `uninstall` lists other copies through the inventory; its private
manager_command moved to installs::manager_command (report_path_copies
replaced).
Receipt adoption refuses a group- or world-writable directory, where
`uninstall`'s ownership checks would later reject the receipt.
Verified on Linux Boat vm16 (debug build), temp HOMEs only:
- this commit's tree: cargo check -p codewhale-cli -p codewhale-tui clean;
the full series: cargo build -p codewhale-cli and
cargo check --workspace --all-targets --locked with 0 errors and
0 warnings; codewhale-release tests 57 passed; feature_registry 2 passed.
- fixture mirroring the founder's machine (7 backup schemes plus
.codewhale-old-pid, a stale .codewhale-backup-* dir, a divergent codew,
codewhale-go, a symlink, a Cargo root listing codew/codewhale with a
stray backup, a Homebrew Cellar symlink, a marker-bearing script
sentinel): `doctor --installs` and `--json` classify every entry as
designed; `doctor --fix --yes` moved 9 items (6.2 GB) into one recovery
folder with per-item undo lines, aligned codew and wrote the receipt; a
second --fix plans no installation work; package-managed, foreign and
symlink entries hash-identical before/after; the sentinel never ran;
`doctor --restore` put all 9 back byte-identical.
Not run here: the tui doctor_fix unit tests (the VM ran out of memory
linking the tui test binary).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
e5283cb022 landed an unformatted condition in InstallMethod detection, so
cargo fmt --check (Lint) failed on main and on every PR merged with it
(seen on #7111). Pure rustfmt output; no behavior change.
Verified: rustfmt --edition 2024 on the file yields this exact content; the
CI Lint log reported this as the only fmt diff.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Route /undo outcome messages through the presentation facet and provide
translations in all 15 complete locale packs, following the /diff
localization in 887a3c669. English output stays byte-identical: the
exact-string host tests pass unchanged.
Refs #7071 (undo portion).
Signed-off-by: Boyce <[email protected]>
Picks up the protocol clippy fix and CHANGELOG receipts so required checks run against current main.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7114: /provider counted every known id as configured because
provider_config_table!(@read) is always Some once [providers] exists, so a
fresh home showed a phantom "Antigravity (legacy, disabled)" row. The picker
now asks provider_is_configured, the same resolver the rest of the runtime
uses. A home whose only configured row is a keyless local runtime opens on
the full catalog (DeepSeek etc.) instead of Configured, and Shift+A toggles
the view like a.
#7113: at dispatch an unloaded Ollama model has no /api/ps context, so the
route fell back to 8192 and the second turn was refused with "~5120 tokens
usable". refresh_unverified_local_context now asks the daemon to load the
model (POST /api/generate, no prompt) when the context is still unknown and
refreshes again. The dispatched turn's route limits are carried back into the
App so the footer and compaction budget read the same window (it showed
"context 100%" and the /compact nag before).
#7116: provider_lake::models_for_provider also lists a provider whose own
endpoint has answered a live listing, so a keyless Ollama that is not the
active route shows its installed models in /model and
GET /v1/providers/ollama/models. One resolver: the runtime API and model
inventory both already go through models_for_provider.
No-key default kept as Ollama adoption: a keyless DeepSeek default cannot
answer a turn; with #7114 DeepSeek is now one Enter away in /provider.
Evidence (dev build, isolated env -i CODEWHALE_HOME):
- /provider on a fresh home: opens "Provider · all", no Antigravity row,
Shift+A -> configured view, a -> back.
- qwen3:4b unloaded (/api/ps empty): turn 1 read+patch calc.py, turn 2 wrote
notes.md; both completed, footer context 34% then 52%; /api/ps 32768.
Before: turn 1 failed with "~5120 tokens usable".
- serve --http, DeepSeek active: after /v1/providers/ollama/models/refresh,
GET /v1/providers/ollama/models lists qwen3:4b (context 32768); was [].
- scripts/dev-cargo.sh test -p codewhale-tui --lib -- provider_picker
provider_lake ollama_catalog list_provider_models provider_models dispatch
context_usage: 443 passed; 0 failed.
Paths: crates/tui/src/tui/provider_picker.rs, crates/tui/src/provider_lake.rs,
crates/tui/src/client/ollama_catalog.rs, crates/tui/src/tui/ui/dispatch.rs,
crates/tui/src/tui/ui.rs (UserDispatchOutcome field only), CHANGELOG.md and
crates/tui/CHANGELOG.md (one line each).
Refs #7113, #7114, #7116
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Add InstallMethod::DesktopApp for an Engine inside a macOS
`*.app/Contents/MacOS/` bundle or the desktop app's pinned
`<CODEWHALE_HOME>/gpui/engine/` store. It does not support self-update,
so `codewhale update`, target validation and `uninstall` refuse to write
there, and the CLI, /update and the TUI notice say to use
Codewhale > Check for Updates instead of printing GitHub migration help.
Verified on a Linux Boat VM against origin/main plus this series (debug build): cargo build -p codewhale-cli and cargo check --workspace --all-targets --locked clean (0 errors, 0 warnings); cargo test -p codewhale-release 57 passed; codewhale-cli update:: 109 passed. Fixture in a temp HOME: `update` from X/Codewhale.app/Contents/MacOS/codewhale prints the desktop message and exits 1, `uninstall` names the app, bundle bytes unchanged. Not exercised: a real signed desktop bundle on macOS.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`cargo fmt --all -- --check` failed on main at 0e9c5beba5 with diffs in
crates/tui/src/runtime_api/git.rs (hunk patch parsing, cf10ca1446) and
crates/tui/src/runtime_api/thread_delete.rs (DELETE /v1/threads). The
CI Lint job runs that check first, so the release candidate's CI would
fail on formatting. Formatting only; no code change.
Verified: `cargo fmt --all -- --check` exits 0 on an export of this
commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Security review E5 (codewhale-ops/security/PRE-LAUNCH-REVIEW-20261027.md;
founder-accepted D13, 2026-10-27). In workspace-write mode a sandboxed
command could write .git/hooks/* or .git/config (for example
core.hooksPath), which later runs outside the sandbox on the next git
operation; and .codewhale/ was protected only if it already existed.
- Every writable root now gets `.git/hooks` and `.git/config` as
read-only subpaths when it holds a git dir; a linked worktree's
gitdir/commondir roots get their own `hooks` and `config`.
- Workspace roots (cwd and configured writable roots) always protect
`.codewhale/`, even before it exists. Seatbelt rules work on
nonexistent paths; their parameter now resolves through the
canonical parent so /var vs /private/var cannot slip past.
- bwrap can only bind existing paths: prepare_bwrap creates the
workspace's `.codewhale/` first, and read-only exceptions may now be
files (`.git/config`), not only directories.
- The seatbelt policy test matched the old single-exclusion text
exactly; it now checks the root-plus-first-exclusion prefix.
Verified with an uncommitted probe that runs one sandboxed shell
script against a fresh repo (hook write, config append, .codewhale
creation, ordinary file write, git commit), before vs after:
- macOS Seatbelt (local, build lock): before all WROTE; after hooks,
config and .codewhale DENIED, file write and git commit OK, no hook
left behind. codewhale-sandbox tests: 104 passed, 0 failed.
- Linux bubblewrap (Boat vm20, Ubuntu 24.04): same before/after split.
codewhale-sandbox tests: 100 passed, 0 failed.
Logs: CW/artifacts/release-0103-gates-20261027/e5-mac.log, e5-vm20.log.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
cf10ca1446 (security-review) clamps a server ttlMs to at least 60 s so
ttlMs: 0 no longer revalidates every supervision sweep; the freshness
bullet still said only "capped at 24 hours".
Verified on the shared tree carrying the same mcp.rs: scripts/dev-test.sh
tui mcp extension_host 736/736 passed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pre-launch security review 2026-10-27 (two of its findings, plus hygiene):
- mcp: a server-supplied list ttlMs had no floor, so ttlMs 0 made the
catalog stale on every 5s tick, and revalidation runs discovery while
holding the MCP pool lock. Any configured server could keep every MCP
operation waiting. Catalog TTLs are now clamped to at least 60s.
Still open: running discovery outside the lock, and rate-limiting
list_changed-driven revalidation.
- runtime_api/git: validated_patch sliced the first byte off each @@
range token, which panicked on a multi-byte character and fired the
process panic hook. It now strips the expected -/+ sign and refuses
anything else as a malformed @@ line.
- .gitignore: ignore private key and certificate files, with an
exception for the existing test-only fixture key.
Verified: scripts/dev-test.sh runtime_api/git.rs git_ -> 146 tests run:
146 passed (includes git_routes_drive_a_real_workspace_repo and
git_write_preconditions_reject_stale_state); scripts/dev-test.sh mcp.rs
mcp:: -> 405 tests run: 405 passed. No new tests, per repo policy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The installer deployed at codewhale.net/install.sh predates the receipt
and writes no .codewhale-install.sha256. web/public/install.sh on main
already writes one. As a result, `codewhale uninstall` refused every copy
installed through the main channel ("No command ownership receipt").
When there is no receipt, uninstall now adopts the copy, but only if:
- its directory is an install.sh default (~/.local/bin,
~/.local/codewhale/bin, ~/.local/codewhale-release.*, or
%USERPROFILE%\bin on Windows), and
- each command is a regular file owned by this user and byte-identical
to the running program (the release ships codewhale and codew as one
binary).
The preview lists exactly those files and changes nothing. --yes writes
the receipt with GuardedFile::stage + move_to_vacant (no clobber), then
runs the normal receipted path, which re-verifies each hash before it
unlinks anything. A modified or foreign codew is left out and reported.
Any other unreceipted directory is still preserved.
Verified on macOS arm64, temp HOMEs only, binary 16bb0efa6079:
- Live script, run as `curl -fsSL https://codewhale.net/install.sh | sh`
with CODEWHALE_RELEASE_BASE_URL set to a file:// release of the
candidate binary: 12 passed, 0 failed. Covered: default dir with no
receipt; preview changes nothing; --yes removes both commands and
leaves no receipt or leftovers; data and an unrelated file preserved;
live reinstall then a second removal; ~/.local/codewhale/bin adopted; a
modified codew preserved and reported; a custom CODEWHALE_INSTALL_DIR
refused; a foreign codew preserved byte-identical.
- Receipted installs from web/public/install.sh (preview, --yes, repeat,
reinstall, two copies, tampered alias, manual copy, cargo, npm, brew,
scoop, winget and nsis layouts, purge): 27 passed, 0 failed.
The adoption hunk is applied to main's uninstall.rs as-is. The build
that ran is the shared tree, which also carries another writer's
uncommitted install-cleanup work in the same file. That work is not
included here.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`cargo clippy --workspace --all-targets --all-features -- -D warnings`
(the CI Lint flags) fails on macOS with clippy::collapsible_if at
crates/tui/src/extension_host/supervisor.rs:919. The block is
macOS-only, so the Ubuntu Lint job never sees it, but the release's
macOS lanes and local release gates do. Collapsed into a let-chain;
there is no else branch, so behavior is unchanged.
Verified: rustfmt --check clean. The locked clippy run on an export of
1affdc5fda reported this as its only error (exit 101, 2067 s). The same
hunk on 6793371e4e (091c3e59c0) passed `cargo clippy --workspace
--all-targets --all-features --locked -- -D warnings` with the CI Lint
allowances on macOS: exit 0, 0 errors, 1473 s. Replayed unchanged onto
7bde746261; that commit's own supervisor.rs hunk was not re-linted here.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Linux the Native host probe ran `<runtime> --version` inside bwrap and
treated any failure as "no verified OS sandbox", a hard error raised while
preparing the launch, before runtime = "auto"'s Bun-to-Node fallback (which
only covers spawn failures). A runtime that is a script or shim (asdf's bash
shims; the test's #!/bin/sh fake Bun) cannot execute in the sandbox because
its interpreter is not among the Native read grants, and bwrap reports
`bwrap: execvp <runtime>: No such file or directory`. bwrap has already built
its namespaces at that point, so the sandbox is verified: the probe now
accepts that line, the real host spawn fails as an ordinary runtime start
failure, and auto falls back to Node with its existing diagnostic. Explicit
bun or node still never fall back; genuine bwrap failures (namespaces, uid
map, missing binary, timeout) remain hard errors.
Paths: crates/tui/src/extension_host/supervisor.rs (bwrap_probe_verdict, its
doc comment, one assertion added to the existing
missing_verified_sandbox_refuses_native_but_reports_pinned_builtin_exception body)
Verified by the release manager on Boat vm19 (Ubuntu 24.04 x86_64, bwrap,
Node 24.22, Bun 1.3.14), origin/main d02e14806b + this patch + the
memory_cap message fix: cargo test -p codewhale-tui --lib --locked -- --exact
auto_uses_node_for_the_session_when_the_bun_host_fails_to_start,
supervisor::tests::missing_verified_sandbox_refuses_native_but_reports_pinned_builtin_exception,
memory_cap_stops_a_node_host, memory_cap_stops_a_bun_host: 4 passed, 0 failed
(61.26 s). Log: CW/artifacts/release-0103-gates-20261027/vm19-memcap-bwrap.log.
Before (vm18, 5f59494913): auto_uses_node failed with "Native extensions
require a verified OS sandbox: bwrap unavailable (bwrap: execvp .../bun: No
such file or directory)".
Co-Authored-By: Claude Opus 5.5 <[email protected]>
memory_cap_stops_a_node_host failed on Linux x86_64 (Ubuntu 24.04,
bubblewrap, Node 24.22): the RLIMIT_DATA cap worked, the kernel refused
the 2 GiB allocation and the tool failed cleanly inside a live host,
but Node reports it as "RangeError: Failed to allocate memory", which
the assertion did not accept (it only matched "allocation failed").
The Linux/Windows branch now accepts both messages; enforcement is
unchanged.
Verified on Boat vm19 (Linux x86_64, bwrap) at d02e14806b with this
change and the DSH bwrap-execvp probe patch applied:
`cargo test -p codewhale-tui --lib --locked -- --exact` for
memory_cap_stops_a_node_host, memory_cap_stops_a_bun_host,
auto_uses_node_for_the_session_when_the_bun_host_fails_to_start and
supervisor::tests::missing_verified_sandbox_refuses_native_but_reports_pinned_builtin_exception:
4 passed, 0 failed. Before, on vm18 at 5f59494913: memory_cap failed
with the RangeError message.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
QA observed the 413 recovery on a local mock (six 640x480 images,
CW/artifacts/qa-20261027/b5/): request 1 was 3,484,230 bytes and got a
413; exactly one retry was sent at 53,212 bytes with 0 images and 6
omission notes (receipt image_projection: cause initial_http_413,
omitted 6, retained 0). Saved images were unchanged. The entry implied
the retry dropped only older images; older-first omission is the
separate local byte-budget path. Wording now matches both paths.
Verified on an export of this commit: sync-changelog.sh --check,
check-feature-release-notes.sh v0.10.2 HEAD and check-versions.sh exit 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CONFIGURATION.md (en and zh_hans) said composer_multiline_mode makes
Shift+Enter send and leaves Alt+Enter unchanged. KEYBINDINGS.md and the
binary disagree: Alt+Enter sends, Shift+Enter sends only where the
terminal reports it distinctly, and Ctrl+J inserts a newline.
Observed on Linux (Boat vm18, tmux, debug build of 2a4406a57d, whose
TUI input code matches main) with composer_multiline_mode = true:
Enter and Ctrl+J inserted newlines, zero requests reached a local mock
model while composing, and Alt+Enter sent one user message
"alpha\nbeta\ngamma" (#7093 / CW-7551 release check B6).
Docs only; no checks run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DELETE /v1/threads/{id} (new runtime_api/thread_delete.rs) removes an
idle thread: its turns, items, events file, goal, seed journal and
approval grants, and stops its cached engine, all under the active-
thread lock and the store's thread mutation lock. It refuses with 409
while a turn runs, and while an active automation or a pending or
dispatching trigger delivers into the thread (naming them, so the
client cancels or pauses them first rather than leaving a schedule that
would fail at fire time). The saved session bound to the thread is
deleted too unless another thread is bound to it; if the session store
refuses (an open terminal holds it), the thread is still deleted and
the answer says session_deleted: false with the reason. Tasks and child
threads that name the deleted id keep it (documented).
POST /v1/threads accepts parent_thread_id naming an existing thread
(400-class error otherwise), complementing 0da2b3d704's fork links so a
client can nest a conversation it creates. Registry row thread-delete;
the two Unreleased changelog lines picked up by ccda707286 now describe
the landed `patch` form of hunk writes, not the superseded `hunks` one.
Built on origin/main from the shared checkout's verified edits (the
checkout was 3 ahead/82 behind with other writers' work, so this commit
was assembled in a temporary index and contains only these 9 paths).
Evidence (shared working tree = these edits + others' uncommitted work):
RUST_MIN_STACK=8388608 cargo test -p codewhale-tui --lib --
fork summary create_thread delete runtime_api::git tools::tasks
test result: FAILED. 271 passed; 2 failed; 1 ignored. Both failures are
tools::subagent::{limits_tests::root_fork_of_depth_two_leaf_cannot_regain_a_generation,
completion_usage_tests::completion_usage_counts_real_manifest_only_root_fork},
matched by the "fork" filter, in the DSH session's uncommitted
tools/subagent edits; this change touches nothing there.
cargo check --workspace --all-targets fails only on dead-code in that
same uncommitted tools/subagent/mod.rs and tools/codemode.rs.
feature_registry was queued behind the build lock and had not run when
this was committed. No live Engine run of the delete route.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
fix(catalog): read the token limits a live model listing states. Required checks green on 233f590fe5 (Lint, Test (windows-latest), npm wrapper smoke). CW-7525.
fix(fleet): enable rename_exclusive on Android to prevent SELinux EACCES linkat fallback. Required checks green on eb4539fe30; maintainer merge ported the fleet/files.rs hunks to crates/util/src/files.rs after S14. libc 0.2.191 defines SYS_renameat2 and RENAME_NOREPLACE for every Android arch; author verified on an Android 6.6 device. CW-7525.
Both are thanked inline in Unreleased (#7043, #6992) but were missing
from the release's Contributors block, which the GitHub Release body
reuses. Spotted by the marketing session. crates/tui/CHANGELOG.md
regenerated with scripts/sync-changelog.sh.
Verified on an export of this commit: sync-changelog.sh --check,
check-contributor-credit.py v0.10.2 and check-versions.sh exit 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
DeepSeek retired V4 Flash on 2026-09-10 and is phasing out V4 Pro
(codewhale-ops/engineering/DEEPSEEK-MODELS-20261027.md, from DeepSeek's
own model and changelog pages). The FAQ's OpenRouter example now uses
deepseek/deepseek-v4.1-flash (the slug in provider_descriptors.json)
instead of deepseek/deepseek-v4-pro and deepseek/deepseek-v4-flash, and
the configuration guide's --set example uses deepseek-flash instead of
deepseek-v4-pro, in English, Chinese and the GT catalogs. Test fixtures
and the ratatui capture keep their IDs; they are not copy.
Checks: tsc --noEmit exit 0; eslint on the three source files exit 0;
check-locales PASS; both catalogs parse; /en and /zh faq and
docs/configuration return 200 on the local dev server with the new IDs
present and no deepseek-v4-pro or deepseek-v4-flash in the HTML.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
prepare-release.sh snapshots every file it may rewrite and restores them
if any later gate fails, but web/data/agent-docs.generated.json was not
on that list. derive-facts.mjs regenerates it from docs/INSTALL.md, so a
failed `prepare-release.sh 0.10.3` (for example, before the changelog
section exists) left that tracked file holding the bumped INSTALL.md
content in the shared checkout. Found in a 0.10.3 bump dry run on a
copy of 9f6999f99d.
Verified: scripts/release/prepare-release.test.sh exits 0 on an export
of origin/main with this change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PR #7108 by @ddlw merged as bdf71d6df4 and repaired main's clippy,
rustfmt, extension-host imports, provider-registry check and Windows
DSH receipt bytes. check-contributor-credit.py then failed with
"@ddlw (commit author) -- not in: docs/CONTRIBUTORS.md, CHANGELOG.md,
web/lib/release-credits.ts". ddlw is now credited on all three
surfaces; crates/tui/CHANGELOG.md and web/data/agent-docs.generated.json
are regenerated.
The blocking-calls ratchet also failed on main (crates/tui/src/plugins/
builtin.rs at 0 path_canonicalize sites against a budget of 1; the
crate split moved sites into snapshot, repl, dependencies and the CLI
uninstall module). ratchet-gate.sh blocks push/dispatch runs, so the
frozen candidate's CI would fail. Regenerated with --update.
Verified on an export of 2a4406a57d plus these files:
check-contributor-credit.py v0.10.2 ("Every contributor in the window
is credited on all three surfaces"), check-blocking-calls-budget.py
("557 sites across 166 files, within budget"), sync-changelog.sh
--check, check-versions.sh, check-bundled-plugin-claims.py, and web
check:facts / check:docs all exit 0. Before: credit exit 1, blocking
calls exit 1.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A separate page for Codewhale Enterprise (CURRENT_DECISIONS §57) that
lists what it will deliver, not how: evals that define done, training
data from your team's accepted work, a fine-tuned open-weight model you
own, and RL environments that keep improving it, each tested on your own
holdout. Available today: the open agent for any model (including
self-served vLLM, SGLang and Ollama) and saved sessions with receipts.
Planned: managed eval and training environments, qualification on each
new base model, routing between rented and owned models, private
deployment. It says no customer model has been trained, names no price
or customer, and keeps the method private (founder, 2026-10-27). Calls
to action: a design-partner email to [email protected] and /install.
English and Simplified Chinese; other locales fall back to English
(enterprise.ts is an optional locale file). The type lives beside the
English dictionary so types.ts, which another session is editing, stays
untouched. Added to the sitemap; no nav or footer link yet.
Updates lib/docs-ia.test.ts: the sitemap now has 112 entries (110 + /enterprise in en and zh).
Checks: check-locales PASS; vitest lib/docs-ia.test.ts 19 passed; tsc --noEmit exit 0; eslint on the touched
files exit 0; vitest page-meta + i18n dictionaries + locale-layout
8 files, 72 passed; /en and /zh/enterprise render on the local dev
server (HTTP 200, no console errors, no overflow at 375 px). Full npm
run check and a deploy not run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The site painted with the Moda brand kit (navy grounds, signal-blue actions)
over tokens 1.1.2, while the desktop app, web app and mobile run tokens 2.3.0
(pearl and charcoal grounds, ink filled actions, one slate accent). Founder
direction 2026-10-27: one design system on every surface. This supersedes
the 2026-10-11 Moda-kit color decision (web/docs/BRAND_COLOR_MAPPING.md is
rewritten to say so).
- vendor/codewhale-design is synced to 2.3.0 with codewhale-design's
scripts/sync-to.sh (generate.py --check passes). Only
scripts/export-design-tokens.py reads it in this repository.
- The exporter now emits the 2.x roles (accent distinct from hover,
ocean_depth, diff_add, diff_remove) and the type roles, motion durations
and loops, easing curves, popover and dialog elevation, breakpoints and
the logo ombre as --gpui-* custom properties.
- tokens-roles.css names every site role as a var(--gpui-*): light, pinned
dark and the stage (footer and install band, the dark set in both
appearances). Type, spacing, radius and motion roles bind to the tokens;
the fluid editorial display sizes stay as the site's own layout. The logo
blues remain only on the whale and the mark.
- The home proof strip keeps the release, source marker, licence and live
contributor count; the source-tree tool and provider-route counts are
removed, because a source count is not a released total
(lib/public-copy.test.ts) and marketing asked for no provider count.
- The locale layout comment no longer claims the site follows the OS
appearance; it is light unless dark is pinned.
- Contract tests that pinned the Moda kit inks, the blue sea and tide ramps
and literal easing/prose sizes now assert the token roles instead; the
WCAG AA check over every ink and ground in every scheme is unchanged and
passes.
Verified: check:latest-release, prebuild, check:docs PASS, check:tokens up to
date (158 tokens), eslint clean, tsc --noEmit clean, check:locales PASS,
next build compiled with 1011/1011 static pages. vitest: 770 passed,
1 failed: docs-ia sitemap count (112 vs 110) comes from the unpushed local
/enterprise commit a6b26b5c3e, not from this change. check:facts fails
in this checkout because its tree is behind origin/main's regenerated
feature registry; not touched here. Screenshots (1440 and 390, light and
pinned dark, home, product, docs, install):
artifacts/design-20261027/after-tokens-2.3.0/.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up #7108, which restores main's clippy and rustfmt gate (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
style(tui): apply rustfmt to mcp and restore the lint gate. Required checks green on f8a6346159 (Lint, Test (windows-latest), npm wrapper smoke). Maintainer commits on the branch: feature-gated Ollama dead_code expectation, Windows unused mut, merges of main incl. 715bb2ed02 resolved to the branch's gating. Supersedes #7106 (same mcp.rs rustfmt) and #7109 (.gitattributes line now included). CW-7525.
2b898fb041 and c5d45b48df fixed the same two main failures that
contributor PR #7108 (@ddlw, with maintainer commits) already fixes,
and made that PR conflict in scripts/check-provider-registry.py. Main
now carries #7108's exact version of the script (a regex accepting
`pub` or `pub(crate)`) and its exact "First-party marketplace receipt"
changelog line in the same position, replacing the duplicate bullet,
so #7108 merges cleanly as itself with no rebase on the contributor's
side.
Verified on an export of this commit: check-provider-registry.py,
check-bundled-plugin-claims.py, check-contributor-credit.py v0.10.2,
check-versions.sh and sync-changelog.sh --check all exit 0, and
`git merge-tree` of this commit with origin/pr-7108 (f8a6346159)
reports no conflicts.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
c5d45b48df added an Unreleased band to docs/CONTRIBUTORS.md, which
web/data/agent-docs.generated.json embeds, so check:facts failed with
"generated agent docs are stale". Regenerated with `npm run prebuild`.
Verified on an export of c5d45b48df with this file regenerated:
`npm run check` passed check:facts, check:latest-release, prebuild,
check:docs, check:tokens, eslint and tsc --noEmit; `npm run build`
exit 0 (next build). Only the CONTRIBUTORS source entry changed
(content and sha256).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Fixes the three release-note gates that fail on main:
- check-feature-release-notes / check-versions: commit 4cf2d2cfff
references #7093 (multiline send key on Linux) and #7097 (relocated
state root) with no changelog receipt. Both now have Unreleased entries
describing the shipped source behavior.
- check-bundled-plugin-claims: the first-party marketplace pin
a5f1d21 (CW-6732, Computer Use runtime removed from the marketplace
bundle) was never named in CHANGELOG.md.
- check-contributor-credit: Boyce (@Aboysky, #7104) was uncredited.
AUTHOR_MAP maps the commit email to the GitHub account; the changelog,
docs/CONTRIBUTORS.md (new Unreleased band) and UNRELEASED_CONTRIBUTORS
credit the window's code contributors.
The Unreleased section gains a Contributors block so the 0.10.3 cut
only has to rename the heading. crates/tui/CHANGELOG.md regenerated by
scripts/sync-changelog.sh.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The homepage opened on a headline beside an empty column, then a sponsored
banner, and only then the product. A first-time visitor now sees the
captured Codewhale TUI at the fold, with the live whale resting on its top
edge, then a proof strip read from facts: latest release, licence,
contributor count, built-in tool count and provider-route count. The
OrcaRouter offer moves beside the models section it relates to, and the
0.10.3 highlights move below availability, so first-read sections are the
product and its uses rather than the changelog.
- The hero is tighter (smaller title, less padding) so the terminal shows
at the fold at 1440x900 and on a 390px phone.
- The terminal caption no longer calls the released v0.10.2 capture
"Unreleased"; it says so only when the capture version is unpublished.
- On screens narrower than 30rem the copy button keeps its accessible name
but shows only its icon, so more of the install command is visible.
- Three new proof labels are translated in all 18 locales; the GT catalog
is re-exported.
Verified: tsc --noEmit clean; eslint . clean; check:locales PASS (GT catalog
OK); check:tokens up to date (150 tokens); check:docs and check:latest-release
pass; next build compiled, 993/993 static pages. check:facts fails on main's
working tree because another session's in-progress feature-registry edits
are not regenerated yet; not caused by this change. Before/after
screenshots (desktop 1440 and mobile 390, light and pinned dark, en and zh):
artifacts/design-20261027/{before,after}/.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The 0.10.3 combined batch (4cf2d2cfff) moved the four provider identity
functions into crates/runtime/src/config.rs as `pub fn`, but
scripts/check-provider-registry.py still demanded `pub(crate) fn`, so the
Lint job's provider-registry step failed on main with four "missing
canonical config identity boundary" errors. The check now names the
signatures that exist.
Verified: python3 scripts/check-provider-registry.py exits 0 ("Provider
registry drift check passed.") on a git-archive export of origin/main
9f6999f99d with this one file patched, and on the canonical working tree.
Before the patch the same export exited 1 with the four errors.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/INSTALL.md says Windows removal is compile-checked but not yet
exercised on a Windows host (e66998bec3 also records that nothing ran on
Windows). The homepage uninstall item now says so in en and zh.
Raised by the marketing session.
Path: web/lib/content/release-highlights.ts.
Verified: tsc --noEmit and eslint on the file pass; dev server /zh and
/en render the caveat in the uninstall item. Not deployed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The site's prebuild failed on main since 0da2b3d704: derive-facts only
accepted tui/api/web feature surfaces, while the Engine registry
(crates/tui/tests/feature_registry.rs) also allows desktop, which the new
task-suggestions row uses. The web validator and Feature type now accept
the same four surfaces. The features page showed since = "unreleased" as
"vunreleased"; it now shows the existing Unreleased label.
Docs, from CHANGELOG Unreleased and source on main:
- KEYBINDINGS: Ctrl/Cmd-Enter steers (closes the in-flight request and
continues the turn; a second Enter within 500 ms of queueing also steers,
per App::enter_with_double_tap); Tab and Shift+Tab work mid-turn and apply
at the agent's next step (CW-7552).
- MCP: Connection Lifecycle describes the SDK host backend, server/discover
and the legacy initialize fallback (CW-6713).
- CONFIGURATION: documents [extension_host] mcp_backend ("host" default,
"rust" for one release, no fallback), per crates/config McpBackend.
Homepage "Coming in v0.10.3": adds "Steer mid-turn"; uninstall now covers
Unix and Windows and --purge-data (e66998bec3).
Regenerated web/data/features.generated.json, agent-docs.generated.json and
lib/facts.generated.ts from an export of origin/main 22e341107e plus these
edits (crates=39 after the split), so other writers' uncommitted registry
rows are not included.
Verified: in that export, npm run check passed check:facts,
check:latest-release, prebuild, check:docs, check:tokens, lint and tsc
(next build there hit Turbopack's symlinked node_modules refusal); next
build in the canonical tree: 993/993 pages. Browser (dev server on the
canonical tree): /en and /zh show 9 v0.10.3 items, /en/features shows
task-suggestions "DESKTOP: Preview · Unreleased", no "vunreleased", no
console errors. Not deployed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge to bring the branch onto current main (no conflicts).
Main now carries the Windows/rustfmt CI fixes, #7099 (model facts inherit
across a provider host move) and the crate-split moves.
Verified on main+this branch (Linux x86_64 Boat VM): cargo check -p
codewhale-tui --lib --tests clean; focused tui run (client::, catalog,
provider_lake, route_budget) 933 passed, 3 failed under full-suite load;
those 3 (create_message_scenario, roster_omission_stands_unless_the_
payload_explicitly_attests_the_id, model_added_endpoint_cannot_use_
ambient_proxy_but_operator_can) pass when run alone here and on main.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried, and #7099 (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up 22e341107e, which clears the crates/tui/src/lib.rs rustfmt
drift main carried (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A plain `codewhale` launch deliberately starts fresh. When it found an
in-flight session snapshot (a session whose turn never finished, which
exists only under ~/.codewhale/sessions/checkpoints/), the only pointer to
`codewhale --continue` was an eprintln! printed just before the TUI took
the alternate screen, so a user who closed the terminal mid-task reopened
to an empty session and no visible way back (#7095).
`preserve_interrupted_checkpoint_for_explicit_resume` now returns that
message and the launch passes it as the TUI startup notice; an auto-resume
receipt still takes precedence. Its doc comment no longer claims
checkpoints are persisted as sessions (untrue since #4479).
Also applies rustfmt to the `mod usage_persistence` line 98104b9737
left out of order, the only `cargo fmt --all -- --check` drift on
origin/main at a19f2d8885.
Not changed here (follow-ups): the SIGHUP/SIGTERM path exits without
flushing the persistence actor; the resume picker and `codewhale sessions`
do not list checkpoint-only sessions; the 24h checkpoint prune can remove
them.
Evidence (on an export of #7108's merged head cee2d8ab7c plus these lib.rs
hunks, since origin/main codewhale-tui did not compile at the time):
- scripts/dev-cargo.sh check -p codewhale-tui --lib --locked: rc=0, no
errors or warnings.
- scripts/dev-cargo.sh test -p codewhale-tui --lib --locked -- checkpoint:
test result: ok. 79 passed; 0 failed (includes
plain_launch_preserves_checkpoint_but_starts_fresh,
plain_launch_consumes_legacy_checkpoint_after_preserving_it,
continue_without_interactive_terminal_leaves_checkpoint_for_a_real_launch).
- cargo fmt --all -- --check on origin/main + this commit: clean.
Not run: a live TUI launch with a real interrupted session.
CW-7525.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
main moved crates/tui/src/fleet/files.rs to crates/util/src/files.rs (S14,
CW-6129); the three Android cfg changes are applied to the moved file.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge so the required checks run against current main
(main was red when this branch last ran CI; CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
715bb2ed02 fixed the same Windows and rustfmt breaks on main with
attributes; this branch fixes them by gating, so each conflict keeps the
branch side: `native_snapshot_roots` is `cfg(not(windows))` on HostLaunch
and HostProcess, `load_global_context_file` is `cfg(all(test, unix))`, and
the Ollama probe helpers keep the feature-gated `expect(dead_code)`.
main's `cfg_attr(windows, allow/expect(dead_code))` lines are dropped; the
mcp.rs rustfmt hunks were identical on both sides.
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every PR's required checks were red for reasons on main itself:
- Lint: `cargo fmt --check` diffed two hunks in crates/tui/src/mcp.rs
from e1acc381ab; formatted.
- Test (windows-latest): dead code is denied on Windows, where code that
is Unix-only or compiled out by the debug test-isolation gate leaves
helpers unused. `native_snapshot_roots` (read only under
cfg(not(windows))) and the cfg(test) `load_global_context_file` get
`cfg_attr(windows, expect(dead_code))`; the Ollama probe helpers
(`TAGS_PROBE_TIMEOUT`, `probe_client`, `fetch_text`,
`fetch_tag_profile`, `ollama_v1_base_url`,
`record_ollama_tags_into_lake`, `probe_live_local_ollama_catalog`) and
`acquire_runtime_chat_inference_ownership`, which S23 placed behind the
shared test-isolation predicate, get `cfg_attr(windows,
allow(dead_code))`. The supervisor attribute was written by the #7091
session and left uncommitted; taken over here.
The Windows "dsh-message-compat.js no longer names dsh-brand" failure is
CRLF checkout changing the pinned source hash; contributor PR #7109 fixes
that and lands separately.
Verified: rustfmt --check clean on mcp.rs; the attributes match the exact
items in Test (windows-latest) on PR #7105 (job 122399216069). A local
x86_64-pc-windows-msvc check could not complete (aws-lc-sys needs MSVC
headers), so Windows proof comes from the next PR CI run on this main.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adds "Surfaces walked through live" to docs/DSH_PLUGIN_COMPAT.md, from a
DSH-format probe plugin (tool using sessions.flush + userQuestions.ask, two
commands) against a loopback fixture provider on macOS:
- Runtime API: install/review/trust/enable, first-turn tool, approval,
question answered via POST /v1/user-input, command result.
- codewhale exec --auto: first-turn tool ran, flush true, question refused
NO_PROVIDER (no human present).
- Desktop app (codewhale-app 7e0e0ae7 debug build, codewhale-gpui, Engine
fff5a476f9+ debug build): approval card "Use the dsh_probe tool", native
question card (Blue/Calm, Green, free text, Skip, Send answers), plugin
received selected ["Green"], /probe-count in the palette returned 2 with
"extension:dsh-probe-bundle · Completed".
Interactive TUI not walked through.
Paths: docs/DSH_PLUGIN_COMPAT.md
Verified: docs only; evidence is local (screenshots and receipts kept outside
the repo).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Hunks: POST /v1/git/stage, /unstage and /discard take an optional
`patch` for the single path in `paths`. Its file headers must name that
workspace-relative path on both sides; renames, copies, mode changes,
creations, deletions and binary patches are refused, as are hunks whose
bodies are shorter than their @@ counts. The patch goes through a temp
file to `git apply [--cached] [--reverse]` under the existing write lock
and expect preconditions. It is applied from the repository top with
--directory=<workspace prefix>: run inside a subdirectory, git apply
silently skips paths outside it and reports success having written
nothing. Checked by hand in a scratch repo with a subdirectory
workspace: stage, unstage and discard each change exactly the one hunk,
and re-applying a stale hunk fails with git's message.
Forks: ThreadRecord gains parent_thread_id, set by both fork paths and
returned in /v1/threads/summary, so clients can nest forks under the
thread they came from. Older records have none.
Suggestions: the tasks tool gains a `suggest` action (no approval,
starts nothing) returning {title, prompt}; the logged tool call is the
suggestion, which the desktop shows as a Start/Hide card. Registry row
task-suggestions.
Evidence (RUST_MIN_STACK=8388608):
cargo test -p codewhale-tui --lib -- git_routes_drive git_write_preconditions
runtime_api::git fork thread_summary tools::tasks registry
test result: FAILED. 326 passed; 1 failed; 3 ignored
The failure, runtime_api::git::tests::unreadable_file_only_withholds_affected_row,
chmods a file to 0o000 and expects it unreadable; this container runs as
uid 0, which reads it anyway. cargo fmt clean for the touched files.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018whUMPrn9PSoxXwWwX7dsp
Adds the DSH child-agent call -> Codewhale owner table to
docs/DSH_PLUGIN_COMPAT.md: getProvider, startActivation, legacy start,
agent/created, child-scoped systemPrompt.section persona, tools.restrict /
toolFilter, tools.get, activation.result/dispose and caller delivery all map
onto SharedSubAgentManager prepare/commit, WorkerRuntimeProfile narrowing and
the one turn loop; nothing adds a second executor or prompt authority.
States plainly that subagents stays refused: the rebased manager patch
(8bdffba2) and Core activation hook draft now type-check against main, but
the plugin bridge (host shim, Engine protocol methods, compatibility row)
does not exist, and the remaining approval-planning and `agents` surface
questions are listed. The compiling rebase is kept off main as an artifact
(dead-code lints fire without the bridge consumer).
Paths: docs/DSH_PLUGIN_COMPAT.md
Verified: docs only.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
N12: the ACTIVE_WORKSHOP slot, its install/read helpers and the
ActiveWorkshopTestGuard move verbatim from tools/large_output_router.rs to
`codewhale-runtime::active_workshop`; the test gate becomes the FD-04
predicate any(test, all(feature = "test-thread-scoped-state",
debug_assertions)) with the #6306 lock order unchanged; ~30 callers
repointed, no facade; route_budget no longer depends on tools.
S24a: `AutoRouteDecisionEvidence` moves to
`codewhale_models::auto_route_evidence`; the cost_status persistence
cluster (persistent usage sink registration and interactive-origin
reporting through SessionManager) moves to tui `usage_persistence.rs`, so
production cost_status has no SessionManager or model_routing references.
Unblocks S25 billing together with S24 proper (still open).
Implemented on Boat VM vm10 by the split-s22-provider session; integrated
by the coordinator on d9ccf8f3e4 (Linux x86_64):
- cargo check --workspace --all-targets --locked: clean
- codewhale-runtime 850, codewhale-models 106, feature_registry 2
passed; tui filtered (cost_status, usage_persistence,
large_output_router, route_budget, tools::file, model_routing,
superfast, activity_detail, purge, compaction, subagent) 1449 passed,
0 failed
Not run: full tui suite on this commit, macOS, Windows, clippy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Snapshot: `SessionEntry.kind` is now `Arc<SessionEntryKind>` (serde `rc`
feature on codewhale-runtime; the JSON is unchanged), so the journal clone
that `build_session_snapshot` takes on the UI task for every save copies
ids, timestamps and a pointer per entry instead of every message body.
The persistence actor then serializes the shared bodies. Entry mutation
goes through `Arc::make_mut` (one test fixture).
Resume: `promote_interrupted_checkpoint` compares a crash checkpoint with
the saved document's metadata (the bounded prefix read) instead of parsing
the whole document, and returns whether the checkpoint is stale. attach
then reads the document once in `resume_session` and clears a stale
checkpoint only after that read succeeds; `-r` does the same after its
bounded load. Only when the checkpoint is newer is the old document still
read in full first, so an unreadable document is never replaced (the
existing guard). Before this, `-r` parsed the document twice.
Not done: `usage_source_fingerprints` stays unbounded. It is the money
replay-dedupe set: late-usage ledger records are never removed and every
metadata load re-checks them against it, and the set has no insertion
order, so any cap could evict a live entry and double-count spend. A safe
bound needs an ordered set that always keeps ledger fingerprints. The
snapshot is still built on the UI task (now without deep copies), and the
lifecycle metadata read in it is still UI-task I/O.
Evidence (macOS arm64):
- Clone cost, throwaway release bench (not committed) on a synthetic
journal of 4,500 entries with 4 KB bodies (1,500 active, 3,000
superseded): SessionJournal::clone 0.19 ms vs 1.24 ms with deep bodies.
- Resume of that 25.3 MB session through a loopback provider, `-r`, time
to the first frame showing the last message: installed 0.10.2 19.32 s
(2.82 s CPU); release build of this tree 15.72 s (3.45 s CPU). Per-turn
process CPU was ~0.7 s on both, because it includes the persistence
actor writing the 25 MB document. RSS is not compared: the after binary
carries all of 0.10.3, so it is not an A/B of this change.
- scripts/dev-test.sh runtime session_tree: 22 tests run: 22 passed.
- scripts/dev-test.sh tui idle_poll_tests terminal_input session_manager
persistence_actor thread_history runtime_store_convergence tui::approval
snapshot checkpoint resume motion: 784 tests run: 784 passed, 13351
skipped (session_manager 137, including
attach_promotes_the_sessions_newer_crash_checkpoint, which covers the
newer and stale branches; runtime_store_convergence 14).
Refs #6842
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The event loop only reached its 250 ms quiet poll when nothing at all was
live, so the states an idle user actually sits in kept the 24-48 ms poll:
- an approval, elevation or question card on top (the turn is still
loading, so the active 24 ms poll applied);
- a running background job (durable task) or a once-a-second label, which
counted as "animating" or "busy" even though the frame requester already
wakes the loop at the next frame deadline.
Now a waiting decision prompt takes the idle path and counts as quiescent;
only motion faster than the quiet poll counts as animation (slower motion
is woken by its frame deadline); a live durable task no longer blocks the
quiet poll (the task panel refreshes on its own 2.5 s cadence). The
terminal input thread polls every 200 ms instead of 50 ms after 5 s
without input, which keeps the child-terminal pause ack well inside its
500 ms timeout. `decision_prompt_waiting` replaces the duplicated
ModalKind match in status_animation_interval_ms.
Known limits: the loop is still polled, not woken, so an engine event, a
remote decision or a prompt timeout lands up to 250 ms late once the UI
has been quiet for 5 s. The input pump still wakes 5x/s at rest.
Measured on macOS arm64, release builds, codewhale process only, 60 s
windows (30 s where noted), timer wakeups from proc_pid_rusage
interrupt_wkups, through a loopback OpenAI-compatible provider (no
provider spend). Before: installed 0.10.2 (3400ebb5c9; this poll logic is
unchanged between it and main). After: release build of this tree.
| state | before wakeups/s, CPU | after wakeups/s, CPU |
| launch screen | ~25 (composer), 0.20% | 10.4, 0.22% (30 s) |
| after a finished turn | 25.0, 0.23% (30 s) | 10.8, 0.17% (30 s) |
| approval card waiting | 29.4, 0.35% (30 s) | 12.6, 0.17% |
| background `sleep 900` | 32.4, 0.45% | 15.9, 0.21% |
The approval card still decided normally (`y` ran the command and wrote
its file). Not measured: FreeBSD, where the reporter's ktrace showed the
per-wake clock_gettime cost dominating.
Tests: scripts/dev-test.sh tui idle_poll_tests terminal_input
session_manager persistence_actor thread_history runtime_store_convergence
tui::approval snapshot checkpoint resume motion: 784 tests run: 784
passed, 13351 skipped (idle_poll_tests 5, tui::approval 128). The
idle-poll test row for durable tasks was removed with the field.
Release build: Finished release in 8m 43s, 0 warnings.
Refs #6728, CW-6993
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Brings in #7104's README stamp refresh, which the Lint leg's README
translation check needs. On Windows `plan_launch` never assigns
`native_snapshot_roots` (the field is `cfg(not(windows))`), so
`let mut launch` failed `unused_mut` under -D warnings on Test
(windows-latest); the non-Windows assignment is now a struct update.
Maintainer fix on the contributor branch (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs(i18n): refresh README source stamps after 4cf2d2cff. Verified: scripts/check-readme-translations.py fails on main (18 stale stamps) and reports OK, 18 translations in sync with README.md (sha256:1e61f10f7706), with this PR applied. CW-7525.
The probe functions are dead only in a non-test debug build with
`test-thread-scoped-state` on (the workspace test build), where
`spawn_live_local_ollama_probe` compiles its no-op arm. Without the
feature (`cargo build -p codewhale-cli --all-features`, the MSRV leg) they
are live, so `expect(dead_code)` keyed on `debug_assertions` alone failed
as an unfulfilled expectation on Test (ubuntu-latest) and MSRV.
Maintainer fix on the contributor branch (CW-7525).
Signed-off-by: CodeWhale Bot <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New docs/DSH_PLUGIN_COMPAT.md: feature-by-feature DeepSeek Harness 0.2.1-rc.2
plugin behavior versus Codewhale, with the landing commit for each verified
row (25225ef051 first-turn tools, 17ebeb5f61 sessions.flush + 409 install
conflict, fff5a476f9 userQuestions.ask), what is refused or unimplemented
(subagents, agents, systemPrompt, tools.get/restrict, rich output, plugin UI),
the WebRTC reason plugin UI stays off, and why the published code-review
plugin still cannot activate. Linked from docs/README.md.
Paths: docs/DSH_PLUGIN_COMPAT.md docs/README.md
Verified: relative links resolve (EXTENSIONS.md, INTEGRATIONS_DSH.md). Docs
only; no code or registry change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`custom_catalog_schema_ignores_table_name` pinned the generic branch's old
verdict wholesale, `limit.is_none()` included. The point of that assertion is
the Baseten enrichment -- pricing and `supported_features` -- never reaching a
non-Baseten endpoint, and that still holds. A flat `context_length`, though, is
a field every OpenAI-shaped listing may carry, and reading it is what this
branch now does.
Assert the ceiling that survives and the enrichment that does not, so the test
keeps guarding #6289 instead of the 128K fallback.
Six cases on the generic branch: the OpenAI `limit` block and every flat
field shape are read; `metadata.context_limit` outranks `context_budget`;
an unreadable high-priority field costs only its own candidate instead of
hiding the readable fields below it; a row stating no positive whole token
count is left out; a body with no `data` array yields nothing; and a
generic route keeps the limits its listing states end to end.
Each case is synthetic and offline.
The first version of this pass selected a limit field by presence and then
parsed whatever it had selected. A row that states an unreadable
high-priority field therefore lost every readable field below it:
`{"context_length": 200000, "metadata": {"context_limit": "1M"}}` produced
no context at all, and the route fell back to 128K -- the exact symptom
this pass exists to remove. `metadata.context_budget` was likewise
unreachable whenever `context_limit` was merely present.
Parse the candidates in priority order and take the first that reads as a
positive whole token count. A malformed field now costs its own candidate,
nothing else.
Also key the per-model limit map through the same canonicalization the
OpenCode Go cutline applies, so a rewritten roster id still matches the
row the provider stated.
Verified against a local stub listing, unchanged input, pre-fix binary
versus this one:
row-a metadata.context_limit "1M" + context_length 200000
before: ctx absent (route fell back to 128000), out 32000
after: ctx 200000, out 32000
row-b limit {context 1048000, output 64000} both: unchanged
row-c no limit stated both: absent
Against the relay that reported the defect, `model resolve` now answers
`context_tokens: 1000000, output_tokens: 32000` for claude-haiku-5.5 and
`context_tokens: 1048000` for deepseek-v4-pro, both `used_fallback: false`.
The generic branch of `catalog_delta_from_models_body` built every
`CatalogOffering` with `limit: None`. A provider that publishes per-model
context and output ceilings in its own `/models` response therefore lost
them, and a custom route with no bundled catalog row fell back to
`LEGACY_DEEPSEEK_CONTEXT_WINDOW_TOKENS` (128K). Operators saw 128K for a
model whose listing says 1M, carrying an `unverified ctx` chip that
correctly admitted the number was a guess.
Read the same document a second time, best-effort, and attach the limits
each row states. Recognised shapes are the OpenAI `limit` block, flat
`context_length` / `context_window` / `max_model_len` /
`max_context_length`, `max_output_tokens` / `max_completion_tokens`, and
a relay `metadata` block carrying `context_limit`, `context_budget` and
`output_budget`. `metadata.context_limit` outranks
`metadata.context_budget`: the first states the model capability, the
second the share one deployment will accept. `input` stays empty so no
route is clamped on an inference.
The roster still comes from the provider's typed parser, and this pass is
best-effort: an unreadable metadata row drops only that row's limits.
Nothing here can fail a refresh that used to succeed.
The launch card's context row keeps the last two path components and
then clips from the right, so a pane too narrow for both cut the folder
you are in: under a long parent folder at 50 columns the row read
"…/customer-portal-redesign/…". Drop to the folder alone when two
components don't fit, the order empty_state_caption already uses for
the caption the same screen shows once the card dissolves.
Signed-off-by: Lstarsky0 <[email protected]>
The community-skill installer, package content digest and SKILL.md
frontmatter reader move into `crates/skill-install`. The SSRF DNS pin and
shortened timeouts are relaxed only under its dev-dependency-only
`test-support` feature, so production behavior is unchanged; the
unfulfilled `expect(dead_code)` pairs are gone. Cargo.toml/crates.sh/
ARCHITECTURE conflicts with S15 resolved as unions; Cargo.lock refreshed
by cargo metadata. Implemented on Boat VM vm6 by the split session.
Series verification (S23 + S15 + S16 on e66998bec3, Linux x86_64 Boat VM
vm7 with bubblewrap installed), then rebased onto current main:
- cargo check --workspace --all-targets --locked: exit 0
- codewhale-snapshot 91, lsp 64, repl 36, skill-install 42, util 49,
models 106, runtime 849, feature_registry 2 passed, 0 failed
- codewhale-dependencies 54/55 once, then 55/55 on four reruns: the
untrusted_search_candidates test is intermittently racy (it writes and
executes probe scripts while sibling tests fork) now that it no longer
shares tui's test lock; follow-up to add a crate-local lock.
- codewhale-tui lib: 14098 passed, 11 failed; the same 11 tests fail on
unmodified e66998bec3 on the same VM image (MCP boot/extension-host
tests on Linux), so no new tui failures.
Not run: macOS suite on this series, Windows, clippy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New crates `codewhale-dependencies` (external-tool resolution and bounded
subprocess probes), `codewhale-snapshot` (pre/post-turn side-repo
snapshots), `codewhale-lsp` (language-server client) and `codewhale-repl`
(Python REPL runtime and RLM context files; `write_context_file` lives
here). Callers rewired, no facades; FD-04 forks gated like S14.
Implemented on Boat VM vm3 by the split session; integrated by the
coordinator. Verification in the S16 commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Client wire helpers hoisted out of client.rs (ERROR_BODY_MAX_BYTES, the SSE
constants, the stream buffer pool, bounded_error_text, API tool-name
mapping, system_to_instructions, apply_reasoning_effort) so chat.rs and
responses.rs no longer `use super::` from client.rs; system_one.rs stays
with the client; local_ollama catalog parsers moved into their own module
(N11); test-only provider gates use the shared test-isolation predicate.
No behavior change. Implemented on Boat VM vm4 by the split session;
integrated by the coordinator. Verification in the S16 commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Avoid fetching codew a second time when its manifest digest matches codewhale. Preserve separate download and verification when release assets differ.
Refs #7102
The #7069 fix landed in 2947e4c51d without an Unreleased entry.
Changelog only; crates/tui/CHANGELOG.md regenerated with
scripts/sync-changelog.sh (--check clean).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tools::subagent::tests::root_operate_dispatch_delegates_builtin_verification_but_not_shell
failed under load: Cargo::resolve() (and resolve_executable_path for
git/pandoc) run `<tool> --version` with the 3 s VERSION_PROBE_TIMEOUT,
and on a busy machine the rustup `cargo` shim can take longer. The
timeout was treated as "not installed" and cached in the resolver's
OnceLock for the whole process, so run_tests reported cargo missing for
the rest of the session. That is a product bug, not a test bug.
probe_executable_with_flag and resolve_executable_path now share
probe_found(): a successful exit means present, a failed launch or a
failing exit means absent, and a probe that launched and was still
running at its deadline means present (it is killed with its process
tree as before). The deadline still bounds how long resolution waits;
it no longer decides presence. Banner capture
(probe_executable_capturing) is unchanged and still returns None on
timeout.
Verification: same nextest batch as 8084ead09c (frozen source) ->
142 passed, including 55 dependencies:: tests and the subagent test.
The load-dependent failure itself was not reproduced locally.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
action.yml defaulted `provider` to `codewhale`, the account machine-key
relay, while docs/GITHUB_ACTION.md says to use explicit BYOK unless the
account route has been separately verified. `provider` is now a required
input with no default, and scripts/github-action/review.mjs no longer
falls back to `codewhale`: an empty provider stops with
configuration_missing / provider_required before any release download
or model call. The OrcaRouter and other BYOK key handling from
6f92f0d5e2 is unchanged; `codewhale` remains selectable explicitly.
.github/workflows/codewhale-review.yml (disabled_manually on GitHub)
falls back to CLI v0.10.2, the current release, instead of v0.10.0. It
still names the account provider explicitly. No secret, variable or
workflow state was changed.
Docs: the BYOK section is no longer labelled optional and the bounds
table lists `provider` as required.
Verification: node --test scripts/github-action/review.test.mjs -> 8
pass, 0 fail. Direct settings() call with no CW_PROVIDER stopped with
{"outcome":"configuration_missing","reason":"provider_required"}.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Review v2 slice F1. budget_for() no longer hard-codes 4,000 / 8,000 /
16,000 output tokens for Low / Medium / High risk. It takes the route's
effective output limit (client.effective_max_output_tokens) and every
review pass may use all of it, so a review is never truncated by a tier
cap. Tiers still set steps and tool calls; the money cap, step budget and
tool budget keep stopping a review early as a named partial review
(skip, not truncate).
with_reasoning_floor() is deleted: it only existed to lift the tier cap
to 8,192 for reasoning routes, and the route limit already is at least
that. Both callers (`codewhale review` in lib.rs and the review tool)
delete their `.min(budget.max_output_tokens)`; the allowance they send,
the reserve and the exhausted-pass message all read
budget.max_output_tokens, which is the value actually sent. The
"numbers that were never sent" error was already fixed by 2d158d78b1;
this keeps the reported and sent values the same source.
The review_budget receipt field max_output_tokens now records the real
route allowance instead of the tier cap.
CHANGELOG: rewrote the Unreleased #7067 entry, which described the
removed 8,192 floor.
Verification: scripts/dev-test.sh tui review_triage tools::review
dependencies:: root_operate_dispatch_delegates_builtin_verification_but_not_shell
-> 142 tests run: 142 passed (86 tools::review incl. 6 review_triage,
55 dependencies::, 1 subagent). No live provider review was run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
4cf2d2cff reworded the Computer Use paragraph in README.md and refreshed
the content of all 18 translations, but left every 'source: README.md'
stamp on the previous hash, so scripts/check-readme-translations.py
fails on main with 'stale' for all 18 files. Bump the stamps; no prose
changes.
Signed-off-by: Boyce <[email protected]>
`codewhale uninstall` now covers every supported install route:
- Windows archive install: install.ps1 writes the
.codewhale-install.sha256 receipt, which joins its existing rollback.
Uninstall removes codewhale.exe, codew.exe and codewhale.bat by
receipt. The running exe is renamed through its open handle
(NtSetInformationFile) and marked delete-on-close; if that fails, a
detached powershell deletes it after the process exits. Self-update
re-captures and renews the receipt after replacing the exe, because a
held handle would block the MoveFileExW replace.
- Package-managed copies are never deleted. They print the exact
command: npm (with --prefix), cargo (with --root), the Homebrew
formula from Cellar, scoop, winget, or the NSIS Uninstall.exe.
InstallMethod gains Scoop and WinGet detection.
- Every other codewhale/codew still on PATH is listed as preserved.
- --purge-data previews, then deletes with --yes, only ~/.codewhale
(or an explicit CODEWHALE_HOME named .codewhale) and
~/.deepseek/snapshots. It refuses symlinks, home and its ancestors,
and other users' directories.
Two pre-existing bugs fixed along the way:
- Unix: remove_checked's retirement tempdir inherited the umask (0755),
so unlink_opened refused it and left `codew` stranded in
.codewhale-uninstall-*. It is now created 0700.
- Windows: codewhale-util (from the S14 split) did not build. It lacked
the `windows` dependency and referred to itself as codewhale_util::.
Verified:
- macOS arm64 temp-HOME script against install.sh with a file:// release
(binary bdd94d1bcfbd): 36 passed, 0 failed. It covers preview,
--yes, a repeat no-op, reinstall and re-removal; two receipted copies;
a tampered alias refused; a manual copy preserved; the cargo,
cargo-root, npm, brew, brew-legacy, scoop, winget and nsis layouts
printing their exact command; and purge preview, --yes, a symlink
refusal and a CODEWHALE_HOME=HOME refusal.
- check -p codewhale-cli --target x86_64-pc-windows-msvc passes,
using stand-in CC/AR because there is no Windows SDK; check never
links.
- cargo test -p codewhale-release: 57 passed, 0 failed.
- cargo test -p codewhale-tui --test feature_registry: 2 passed.
Not verified: nothing ran on a Windows host. install.ps1 was not
executed (no pwsh). Scoop, WinGet and NSIS are detection-only checks
against synthetic layouts.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Automations, send_later triggers and tasks gain an optional
destination_thread_id. With one set, a run starts a turn in that thread
(tagged input_provenance=scheduled with its task_id) instead of creating
a new thread; a busy thread is retried every 2 s up to the task wall
time, and a missing or archived destination fails the task naming it,
never falling back to a new thread. send_later from a thread now
defaults to that thread ("" keeps the new-thread behaviour). From a
tool, thread_id may name only the calling thread, so one thread's model
cannot start turns in another under that thread's permissions; other
threads are API-only.
Adds GET/POST /v1/triggers, GET/DELETE /v1/triggers/{id} (Idempotency-Key
honoured as for automations), and automation.created/updated plus
trigger.scheduled/canceled/fired thread events when a destination is set.
Registry row thread-scheduled-turns (experimental, api preview).
Delivery uses the normal turn-start path, not Agent Mail: Agent Mail
requires distinct sender and receiver threads.
Known limits: explicit thread ids from tools are checked only at fire
time; an Engine restart mid-delivery can start the turn twice (today the
same case creates a second thread).
Evidence (RUST_MIN_STACK=8388608 as CI sets it):
cargo test -p codewhale-tui --lib -- automation send_later task_manager trigger
test result: FAILED. 247 passed; 2 failed; 2 ignored
The two failures, task_manager::ownership_tests::failed_running_persistence_*
and failed_event_persistence_*, make a directory read-only (0o500) to force a
write error; this container runs as uid 0, which ignores the mode, so the
write succeeds. Neither test touches the changed code paths.
cargo fmt --all -- --check: clean. feature_registry not run (the separate
lib build exceeds this container's memory); the new row was checked by hand
against its rules. No live Engine run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018whUMPrn9PSoxXwWwX7dsp
CW-7547 — catalog freshness through the existing connection owner.
Each server's tools/resources/templates/prompts/skills stay on its own
McpConnection, so nothing is shared across servers, credentials,
sessions or reconnects (cacheScope public and private both get the
private rule). McpCatalogBudget now records the earliest ttlMs across
pages (capped at 24h). The supervisor sweep calls the new
McpPool::revalidate_catalogs, which rediscovers in place when that TTL
has passed or a tools/resources/prompts list_changed notice arrived,
seen by the host broker's frame observer (Session::observe) or the Rust
backend's recv_reply. A changed catalog bumps a per-connection
catalog_revision that tool routes now carry, so a call resolved against
the old catalog is refused, and the existing tools() membership check
keeps a removed tool from running. Failed revalidation marks the
connection Disconnected and ordinary supervision redials it; the stale
catalog is not served. McpSupervisorUpdate gains `refreshed` so the
engine emits a snapshot; the next turn's refresh_current_mcp_catalog
picks up the tools and declares the prefix change. Not done (stated in
docs/MCP.md): 2026-07-28 subscriptions/listen and resources/subscribe.
CW-7545 (Engine half) — published Skills extension (SEP-2640).
When initialize/discovery advertises
capabilities.extensions["io.modelcontextprotocol/skills"], skills/list
is read with the catalog under the same budget and freshness rules.
Entries are admitted only with a listed SKILL.md root, name and
description, files confined under the root (no ., .., %, ?, #),
sha256 digests and the 512-file/16 MiB limits; "dynamic" entries are
skipped. Skills appear in list_mcp_resources; listing never activates
one. read_mcp_resource on a listed skill file verifies URI, size and
digest and refuses a mismatch. skills/list and skills/get join the
Rust SUPPORTED_METHODS and the host builtin, which passes extension
methods to the SDK with a pass-through result schema so Rust stays the
validator. Native /skills catalog integration remains open (CW-7177).
CU's server half landed as codewhale-cu-plugin 47a7365.
The host bundle and builtin/mcp.mjs were rebuilt with node build.mjs
from HEAD plus only this mcp.ts, in a scratch copy, and staged
index-only. The tier.rs pin is the new builtin digest 50516f55.... The
changelogs and runtime_state.rs were staged the same way, so other
sessions' uncommitted hunks stay out of this commit.
Verified on macOS, against the shared tree at c5cd7c87f0 plus dirty work:
- scripts/dev-cargo.sh check -p codewhale-tui --all-targets: exit 0
- scripts/dev-test.sh tui mcp extension_host conformance::mcp:
736 run, 736 passed, 0 failed (13686 skipped)
- extension-host npm test: 420 tests, 413 pass, 0 fail, 7 skipped;
tsc --noEmit clean
Not run: cargo check --workspace, a live Engine against a TTL or
list_changed server, CU through the Engine end to end.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Exercise Simplified Chinese interpolation, stat header, pager title and
opaque patch preservation through the real diff handler. This regression
check fails against the original English-only handler and passes with the
localization fix. The full commands suite remains 28 passed, 0 failed.
Lands the DSH caller-checkpoint candidate (previously only artifact patches
qualified on a Boat snapshot) on current main. A plugin tool injecting
`sessions` can call ctx.sessions.flush(exec.agent.session) during its own
live invocation; the host sends session/checkpoint with the invocation's
Engine ticket, the Engine captures the committed prefix, and the owning
Runtime / terminal / exec store acknowledges persistence before the call
resolves. Runtime checkpoint turns use schema 5 (older readers refuse);
restore, compaction, fork and crash repair honour the private reference.
Also: install of plugin bytes that changed after review returns a typed 409
(PluginContentMismatch) instead of 500. Compatibility table advertises
`sessions` (flush only), which invalidates earlier trust by design.
Applied, in order: checkpoint-bridge-7e7c2842, digest-hex-repair-7001d139,
terminal-checkpoint-integration-v4 (a80a918c), exec-checkpoint-7c218953,
runtime-prefix-checkpoint-4e8e93d4, runtime-api-checkpoint-fixtures-07a8413f,
sessions-flush-adapter-v2 (2649f2a1), install-content-conflict-c1a9c47d,
checkpoint-generated-protocol, checkpoint-cancel-wait-repair-8980519a
(artifacts under CW/artifacts/dsh-*). Rebase repairs: two hunks hand-merged
(core_call.rs imports, install/mod.rs PluginContentMismatch) and
crate::utils::spawn_supervised -> codewhale_util::utils after S14. dist/
rebuilt from HEAD + these sources (builtin modules unchanged).
Paths: CHANGELOG.md crates/tui/CHANGELOG.md crates/tui/extension-host/dist/agent-presets.mjs crates/tui/extension-host/dist/codewhale-extension-host.mjs crates/tui/extension-host/dist/dsh-compatibility.json crates/tui/extension-host/dist/dsh-composition-review.mjs crates/tui/extension-host/dist/protocol.mjs crates/tui/extension-host/dist/rpc.mjs crates/tui/extension-host/src/dsh/compatibility.json crates/tui/extension-host/src/protocol.generated.ts crates/tui/extension-host/src/root.ts crates/tui/extension-host/test/harness.mjs crates/tui/extension-host/test/host.test.mjs crates/tui/src/core/engine.rs crates/tui/src/core/engine/turn_loop.rs crates/tui/src/core/events.rs crates/tui/src/core/protocol_parity.rs crates/tui/src/exec_agent.rs crates/tui/src/extension_host/core_call.rs crates/tui/src/extension_host/core_call_tests.rs crates/tui/src/extension_host/mod.rs crates/tui/src/extension_host/protocol.rs crates/tui/src/extension_host/protocol/tests.rs crates/tui/src/extension_host/supervisor.rs crates/tui/src/extension_host/tests.rs crates/tui/src/extension_host/tool.rs crates/tui/src/lib.rs crates/tui/src/plugins/install/mod.rs crates/tui/src/plugins/install/tests.rs crates/tui/src/runtime_api/plugins.rs crates/tui/src/runtime_api/tests.rs crates/tui/src/runtime_threads.rs crates/tui/src/runtime_threads/tests.rs crates/tui/src/tools/codemode.rs crates/tui/src/tui/persistence_actor.rs crates/tui/src/tui/ui/event_loop.rs crates/tui/src/tui/ui/frame.rs crates/tui/src/tui/ui/tests.rs docs/EXTENSIONS.md docs/zh_hans/EXTENSIONS.md
Verified (macOS, this tree incl. peers' uncommitted MCP work at test time):
- extension-host typecheck; Node 420 tests: 413 pass, 7 skip, 0 fail;
Bun 420: 414 pass, 6 skip, 0 fail.
- CODEWHALE_EXT_HOST_TESTS=1 + compiled Bun host: scripts/dev-test.sh tui
extension_host:: tools::codemode:: tui::persistence_actor:: runtime_threads::
runtime_api:: plugins::install:: exec_agent:: core::engine::tests::
core::protocol_parity tui::ui::tests:: -> 2493 run, 2493 passed (includes
typescript_protocol_is_generated_from_the_rust_types and compiled Native
containment). CLI build passed.
- Live Engine HTTP (artifacts/dsh-e2e-20261027/logs/c1, loopback provider, no
spend): DSH bundle tool calling ctx.sessions.flush returned true on turn one;
saved turn is schema 5 with prefix_checkpoint; after Engine restart the
checkpointed turn reloads with the plugin result and the killed turn is
interrupted, not replayed.
Not verified: TUI/App UI, Linux/Windows on this source, hosted CI.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Five codewhale-tui tests failed after 7d2308ac81 (reported on Linux at
0cf390f01, confirmed by the same filters on macOS). In each case the
product behaviour is the intended one and the test encoded the old
behaviour:
- pricing::tests::stepfun_billing_surface_keeps_payg_separate_from_step_plan
and unpublished_cache_write_fails_closed_but_documented_same_rate_prices
used DEFAULT_STEPFUN_MODEL as a fixture while asserting Step 3.7 Flash's
PAYG rate (0.735) and its unpublished cache-write policy. The default is
now step-5-preview, whose documented cache-write is the input rate. The
tests now name step-3.7-flash, the model their numbers belong to.
- tui::ui::tests::model_picker_actions: Shift+P / Shift+F are query text
while searching (so `Step-5-Preview` can be typed), and Ctrl+P / Ctrl+F
act on the highlighted row. shift_p/shift_f_after_a_search_* become
ctrl_p/ctrl_f_after_a_search_* driving Ctrl chords, and
pin_and_fleet_hints_hide_when_no_catalog_route_is_highlighted now
expects the Ctrl hints while searching and no shifted hints.
Checks (macOS, on c5cd7c87f0 plus these two files): `scripts/dev-cargo.sh
test -p codewhale-tui --lib -- pricing::tests:: tui::ui::tests::model_picker_actions
tui::model_picker` 123 passed, 0 failed.
Touched paths: crates/tui/src/pricing.rs,
crates/tui/src/tui/ui/tests/model_picker_actions.rs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Into codewhale-models: `schema_sanitize` (production extent re-measured:
old lines 1-448 + 982-1988, incl. `sanitize_for_kimi_parameters`),
`schema_canonicalize`, `turn_classify` (wire-compaction checkpoint and
prompt classifier closure; models, not core, because core cannot name
Message), `image_window` (pure image helpers), `tool_projection`
(S22 owns it, not S33) and `reasoning_effort_tier` (from work_graph).
Into codewhale-runtime: `stall_report`, and `safe_receipt_field` /
`sanitize_persisted_route_label` from cost_status (cuts
provider_catalog_live -> cost_status). `client::redact_url_for_display`
wrapper removed. Not done in this slice: image_attach decode helpers and
the P6-2 back-edge cuts.
Implemented on Boat VM vm4 by the split-s22-provider session.
Series verification (S14 + S29/S30 + S22 integrated on 0cf390f01, Linux
x86_64 Boat VM vm3), then rebased cleanly onto 25225ef051:
- cargo check --workspace --all-targets --locked: exit 0, no warnings
- codewhale-util 49, codewhale-models 106, codewhale-runtime 849,
codewhale-execpolicy 237, codewhale-tools 26, codewhale-protocol 78,
codewhale-agent-contract 14 passed, 0 failed; feature_registry 2 passed
- codewhale-tui lib: 14381 passed, 16 failed, 22 ignored. 15 of the 16
fail identically on unmodified 0cf390f01 on Linux (MCP/extension-host
tests needing bwrap on that VM, StepFun pricing and model-picker tests
from 7d2308ac81); the 16th
(full_access_auto_approves_non_bypassable_registered_tools) passed 5/5
when rerun alone (timing under full load).
Not run: macOS tui suite on this exact series, Windows, clippy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
S30: the `canonical_action` policy table moves to
`codewhale-execpolicy::canonical_action` (serde_json added);
`required_action` to `codewhale_tools`; path-alias folding
(`with_canonical_path_argument`, `PATH_ALIASES`, `apply_param_aliases`) to
`codewhale_tools::param_alias`; the `apply_patch` preflight parser closure
to `codewhale_tools::patch_preflight`, so `core/authority/auto_review.rs`
no longer needs tui tool implementations. Inline tests stay in tui as
`tools/canonical_action_tests.rs`.
S29 (moves only): `DEFAULT_SPAWN_DEPTH`, `PermissionCeiling` and
`ShellCeiling` live in `codewhale_protocol::fleet`, so
`codewhale-agent-contract` no longer depends on codewhale-config or
codewhale-workflow. FD-12-gated deletions are held.
Approval and authority behavior is unchanged. About 60 callers rewired,
no facades.
Implemented on Boat VM vm6 by the split-s29-s30 session; integrated by the
coordinator. Verification in the S22 commit of this series.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New crate `crates/util` (`codewhale-util`): `utils` (+ response_body),
`fs_confined`, `fleet/files` -> `util::files`, `plugins/path_identity` ->
`util::path_identity`, bundle file readers -> `util::bundle_file`,
`runtime_api::open_workspace_directory` -> `util::workspace_dir` (removes
the S42 back-edge, N1), `.git` name rule -> `util::git_metadata`, and the
owner file lock -> `util::lock` (duplicate `is_contention` deleted).
One-way: callers rewired, no re-export facades. The
`spawn_blocking_supervised` env-scope fork is gated
`any(test, feature = "test-support")` with an optional runtime dep.
Workspace members, Cargo.lock, release crate order, dev-test areas,
ARCHITECTURE docs and the blocking-calls budget updated.
Implemented on Boat VM vm3 by the split-s14-util session; integrated with
S29/S30 and S22 and rebased onto main by the coordinator. Verification in
the S22 commit of this series.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The turn tool build started plugin reconciliation in the background, so a
newly enabled DSH/Native plugin's tools were missing from turn one (and from
the deferred catalog tool_search reads). The attachment now records the
plugin snapshot a finished reconcile activated; until the current snapshot is
settled, the tool build waits up to 10 s for a reconcile (run as its own task,
so a timeout never cancels it mid-activation). Settled snapshots keep the
background path. The DSH import receipt now says why `dsh.client` UI stays
off (WebKit restrictions do not stop WebRTC; isolated renderer is CW-7549).
Paths: crates/tui/src/core/engine.rs, crates/tui/src/extension_host/mod.rs,
crates/tui/src/plugins/install/dsh.rs, CHANGELOG.md, crates/tui/CHANGELOG.md
(via scripts/sync-changelog.sh --check: up to date).
Verified:
- scripts/dev-cargo.sh build -p codewhale-cli --bin codewhale: passed.
- scripts/dev-test.sh tui core::engine::tests:: extension_host:: :
712 run, 712 passed. scripts/dev-test.sh tui plugins::install:: :
66 run, 66 passed. Doc-comment removal and rustfmt line join only after.
- Live macOS Engine HTTP probe (artifacts/dsh-e2e-20261027, loopback fixture
provider, no provider spend): DSH bundle preview -> exact-hash install ->
review -> trust -> enable. Installed 3400ebb5c9: turn-one tool_search did
not offer dsh_probe. This build: offered, approval card shown and allowed,
tool ran, /probe-count reported 1.
Not verified: TUI/App UI walkthrough, Windows/Linux, questions, child agents.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Route diff messages and pager titles through the presentation facet and
provide translations in all 15 complete locale packs. Preserve the English
output, action behavior and raw diff payloads.
Refs #7071 (diff portion).
Mode and permission posture can now change while a turn is running. Tab,
Shift+Tab, Alt shortcuts, /mode, the hotbar, /auto and /config mode|approval*
no longer hit the #2982 turn lock; model, thinking and provider stay locked
because they change the route the in-flight request is on.
Decision: a change applies at the engine's next step in the same turn, not at
the next turn and not by restarting the streaming response. The engine already
drains the live authority snapshot before each tool batch, at every approval
gate and at the per-step preparation boundary; a call nobody approved, or one
whose approval is narrowed, is returned to the model to retry. New: the
preparation boundary now records the mode notice (and Operate contract) via
Engine::record_mode_context, so the next model request is told the new mode
and the notice is a session message (model-visible means logged). While a turn
runs, the TUI shows "<Mode> · <permissions> — applies at the agent's next step
in this turn"; the engine's existing "Permissions: … · <mode>" status confirms
the apply.
Reference comparison (CW/refs): Codex steers at the next safe point and applies
/model and /permissions to the next turn; Grok Build queues by default, injects
steers at tool/model safe points and allows Plan/permission toggles mid-turn
with turn-start reminders. Neither preempts the in-flight request.
Steering itself: the preemption source from 4cf2d2cfff was proven, not changed.
Changelog entry added for it (it had none).
Touched paths:
CHANGELOG.md, crates/tui/CHANGELOG.md (sync-changelog.sh output)
crates/tui/src/core/engine.rs (record_mode_context; turn start uses it)
crates/tui/src/core/engine/turn_loop/preparation.rs
crates/tui/src/tui/app.rs, crates/tui/src/tui/app/tests.rs
crates/tui/src/commands/config_main_host.rs
crates/tui/src/tui/ui/provider_routes.rs (sync_mode_update takes &mut App)
docs/MODES.md
Not included: uncommitted extension-host first-sync hunks in engine.rs,
extension_host/mod.rs and plugins/install/dsh.rs belong to another writer.
Evidence (candidate = 3400ebb5c9 + this diff + then-dirty provider files,
debug codewhale sha256 9f6d1934…052e):
- Live TUI (private tmux, sandboxed, loopback provider holding a reasoning
stream): Tab×2 mid-turn moved Work→Plan with the pending notice, no lock
message; double-Enter steer reached the provider 143 ms later before the held
response was released; next request carried the steer once and the Plan
notice once; obsolete text never shown. PASS_SCOPED. Installed 3400ebb5c9
baseline: steer 130 ms OK, mode refused "Mode is locked while a turn is
running". CW/artifacts/cw7552-steer-20261027/tui-runs/{baseline-3400-b,candidate-1}
- Runtime steering-probe.py on candidate: headers, reasoning, text, tool_json
all PASS_SCOPED (also PASS on installed 3400ebb5c9, 28-33 ms).
- Tests (hermetic home, crate dir): tui::app::tests 238 passed 0 failed;
commands::config_main_host 109/0; runtime_handoff 22/0;
core::queued_approval_tests 1/0; tui::ui::tests::plan_handoff 13/0;
core::engine::tests 524 passed 9 failed: 8 MCP extension-host fixtures
("built-in extension host is down"), failing identically before the test
edits and outside touched code, plus recursive_rlm_round_waits_on_the_
code_execution_gate, flaky under load (5/5 alone).
- Updated obsolete lock tests in app/tests.rs and config_main_host.rs; removed
approval_aliases_are_inert_while_a_turn_is_running.
- rustfmt --check clean on touched files. No CI run (release step only).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The changelog parser dropped bullets that sit directly under a release
heading, so /changelog rendered the Unreleased (0.10.3) section empty. Such
bullets now land in an implicit "Changes" section; 0.10.2 output is
unchanged (same section counts before and after).
The home page shows "Coming in v0.10.3" while that version is ahead of the
latest published release (0.10.2): MCP via the official SDK, MCP
compatibility fixes, DeepSeek Harness plugins, Computer Use as an installed
plugin, image-heavy session recovery, per-scope instruction budgets (#7086),
Unix uninstall and /rc. Copy is taken from CHANGELOG.md Unreleased only.
Paths: web/scripts/changelog-lib.mjs, web/lib/content/release-highlights.ts,
web/app/[locale]/page.tsx.
Verified: npm run check (web) exit 0, 993 static pages; vitest changelog,
public-copy, public-surface-contract: 3 files, 24 passed; dev server /en and
/zh show the v0.10.3 block and /en/changelog shows Unreleased 49 entries,
no console errors. Not deployed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder report: `/provider stepfun` silently selected step-3.7-flash, far
older than step-5-preview, and `/model` did not show step-5-preview even
when searching for it.
Root causes:
- StepFun's built-in default was step-3.7-flash in the descriptor and the
seed spec. `catalog_models_dev.py defaults audit` never flagged it
because it treats `-preview` rows as non-replacements. Step 5 Preview is
StepFun's current flagship and is fully wired (reasoning effort map,
1M context, pricing), so the descriptor, seed spec and rendered seed
`default` flag move to step-5-preview. A saved [providers.stepfun].model
is still honoured. The audit's other recorded holds (openai, google,
xai, meta) stay as recorded; meta was briefly moved and reverted to
respect its DEFAULT_AUDIT_REASONS entry.
- The default /model view (#6533) showed only the current model, pins,
recents and one default per provider; the current route's other models
were behind search. The existing custom-relay roster rule now covers the
current route of any provider: up to 20 rows of its own roster (bundled
plus live), newest first, in a new trailing `Roster` section so the
one-default-per-provider invariant holds.
- In the picker search, Shift+P and Shift+F pinned or added the
highlighted row to Fleet instead of typing, so `Step-5-Preview` became
`Step-5-review` and matched nothing (#6500 made them act during search).
While searching they are now query text; Ctrl+P / Ctrl+F act on the
highlighted row at any time and the footer advertises them while
searching. Search also matches ids with separators removed (`step5`).
Known gap, not fixed here: live rows on a non-default official host (e.g.
StepFun Step Plan `/step_plan/v1`) are not completed from bundled facts,
because `CatalogOffering::complete_from` requires the live fingerprint to
match the bundled row's published base; they show "reasoning unknown" and
no context. Widening that needs a per-fact rule (pricing must not cross
PAYG/plan hosts).
Proof (dev build of this tree, founder-shaped CODEWHALE_HOME copy with the
Step Plan route and its cached live roster, saved stepfun model removed):
`/provider stepfun` -> status line `StepFun / StepFlash · step-5-preview`;
`/model` lists step-5-preview, step-3.7-flash, step-3.5-flash-2603,
step-3.5-flash; searches `step5` and `Step-5-Preview` both find
step-5-preview; Ctrl+P during search pins it.
Checks: codewhale-config 805 passed, 1 failed (the StepFun default
assertion in catalog/tests.rs, updated; rerun 1 passed); route::export
golden regenerated with WRITE_GOLDEN=1 (1 passed); codewhale-agent 70
passed; codewhale-tui tui::model_picker 33 passed; commands::groups::core::
provider 37 passed; scripts/catalog_models_dev_test.py 18 passed.
Touched paths: CHANGELOG.md, crates/tui/CHANGELOG.md, crates/agent/src/lib.rs,
crates/config/assets/models_dev.bundled.json,
crates/config/assets/provider_descriptors.json,
crates/config/src/catalog/tests.rs,
crates/config/src/route/providers-export.golden.json,
crates/tui/src/tui/model_picker.rs, docs/PROVIDERS.md,
scripts/catalog/models_dev_seed.toml. No provider_lake/provider_catalog_live
edits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Platform 932b873e/c231a299 replaced the retired 0.9.13 runtime identity
pin, which refused every 0.10.x Engine's `codewhale rc` with
runner_runtime_identity_unavailable. The pin is exact: the 0.10.3 release
must bump Platform's CWC_CODEWHALE_RUNTIME_VERSION (and its provider
export) to 0.10.3 and deploy it with the release commit/image/digest, or
0.10.3 remote control is refused again. Tracked on CW-7525.
Verified: scripts/sync-changelog.sh --check passes. Production rc proof
pending the founder's deploy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Lands the 0.10.3 program work that two Codex sessions left uncommitted on
canonical main (chats 01a176ff "Review latest MCP updates" / 01a176e0 "DSH
plugin compatibility"), on top of contributor PR #7086, which merged as itself (5c3d461d8a)
immediately before this commit. The pieces share compiler inputs
(the crate-split moves touch most of them), so they land as one verified
tree rather than as intermediate commits that would not build.
Contents:
- Crate split slices: `codewhale-net`, `codewhale-notify` and
`codewhale-sandbox` crates; runtime config, config persistence, oauth,
settings, catalog cache and Codex model roster moved from tui to runtime;
hooks, extension host config and instruction budget to config; callers
rewired, re-export facades removed (CW-6129).
- Follow-up repairs to #7086 instruction budgets (per-scope budgets,
canonical source labels, `instruction_assembly` session snapshot).
- MCP: official SDK 2.4 host backend by default with `server/discover`
and legacy fallback, metadata/output schema handling, OAuth issuer
binding, Engine/CU server modernization (CW-6713, CW-7543, CW-7544,
CW-7546).
- DSH plugin compatibility from the authorized exception lane `26ba80b06a`:
shared compatibility table, native command lifecycle, reviewed imports,
Native-only filesystem sandbox (CW-7054).
- Computer Use plugin-only cutover: vendored bundle removed, marketplace
install from the independent release (CW-6732).
- Image-heavy sessions: 256 KiB read budget, outbound image omission with
receipts, one smaller retry on HTTP 413 (CW-7550).
- Typed review operation (`core/engine/review.rs`, `runtime_api/review.rs`)
used by Platform structured reviews.
- Receipt-owned Unix uninstall (Refs #7091).
- Steering (CW-7552) and Linux Shift+Enter (CW-7551, Refs #7093) source
changes; runtime/manual proof still pending.
Fixes made during takeover verification:
- MCP: Rust now admits the legacy handshake whenever the SDK classifies the
discovery probe as legacy (any JSON-RPC error, or a result without the
modern supported version); before, servers answering the probe with a
result were refused after it.
- MCP: an admitted legacy handshake reports initialize's own failure (e.g.
401) instead of the probe's -32601.
- MCP: OAuth reactive refresh covers the side-effect-free probe.
- MCP: broker launch failures keep their diagnostic (missing command).
- Tool images must decode before delivery (truncated PNG was accepted).
- THIRD_PARTY_NOTICES lists MCP SDK 2.4.0 and DSH 0.2.1-rc.2 excerpts.
- Changelog entries for MCP, DSH, Computer Use and image validation.
- `#[cfg(test)]` on three test-only items; `cargo fmt --all`; tests updated
to post-cutover behavior (no built-in CU, `$schema` manifests, canonical
paths, lazy CU tools, SyncSession resets instruction assembly).
Verified on this exact tree (macOS, source sha 4353faf1 before changelog
edits; changelog/generated-doc edits only after):
- cargo check --workspace --all-targets --locked: exit 0, no warnings
- codewhale-config 806 passed; codewhale-runtime 850 passed;
codewhale-net 52 passed; codewhale-notify 31 passed; codewhale-cli 501
passed (nextest, 0 failed)
- codewhale-tui lib: 14515 passed, 0 failed, 21 skipped
- extension host npm test: 420 tests, 413 passed, 0 failed, 7 skipped
- web check-facts OK
Linux x86_64 (Boat VM, same source before the #7097 fold-in):
cargo check --workspace --all-targets --locked exit 0; codewhale-config
808, codewhale-runtime 849, codewhale-net 52, codewhale-notify 31,
codewhale-sandbox 100, codewhale-cli 501 passed, 0 failed. The tui lib
test binary was still compiling on the 16 GB VM at commit time.
#7097 (main) was three-way merged into approval_log.rs and clipboard.rs;
re-check after the fold-in: workspace check exit 0; tui approval_log,
clipboard, session_export, file_mention, pet_watch 213 passed.
Not run: hosted CI, clippy -D warnings, release packaging, live provider
or real MCP servers beyond local fixtures, Deepin run for #7093.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Maintainer merge to make the PR mergeable again. Conflicts were limited to
CHANGELOG.md and crates/tui/CHANGELOG.md (kept both sides: main's entries
and this PR's instruction-budget entry; the two Unreleased sections stay in
sync) and the generated web/data/{agent-docs,features}.generated.json
(main's copy; regenerated from source on main afterwards).
Verified (Linux, Boat VM) on the same merge against main 7fe0cc2b4f:
cargo check --workspace --all-targets --locked exit 0; codewhale-config
808 passed, 0 failed. This merge adds only main's two newer commits
(#7097 and the changelog sync, 7 files).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A conversation could silently stop keeping its saved session up to date: once
a stream died mid-reply — system sleep, a dropped connection — and the request
was retried, every later save of that thread was refused with a 409 about an
"active turn" that had already finished. The thread kept working, but the
session list froze at the last successful save: stale message count, stale
cost, stale timestamp.
The interrupted reasoning segment is now closed at the boundary that ends it,
every item is settled when its turn ends, and the save guard reads the turn
rather than its items. Threads an older build already left in that state are
repaired the first time they are opened.
OpenCode Go's roster still lives at https://opencode.ai/zen/go/v1 while
models.dev now publishes its api as https://opencode.ai/inference/go/openai/v1.
complete_from required the lower row's published base to fingerprint-match
the live roster before copying anything, so the models.dev limit for
deepseek-v4.1-flash (context 1,000,000) was discarded and the window fell
back to LEGACY_DEEPSEEK_CONTEXT_WINDOW_TOKENS (128K).
A context window belongs to the model, not the host serving it. For a live
row completed from a model-describing layer (bundled, models.dev, cloud
facts, Codewhale corrections), the configured base must still match the
live roster, but the published-base match now gates only endpoint-scoped
facts: transport, provider_api, provider_npm, status and cost. Limits,
modalities, reasoning and the other model facts are inherited. Live-to-live
and override arms are unchanged; complete_facts_from (signed cloud patch)
still copies everything.
Not in this slice: moving the opencode-go descriptor to the inference/
host. The new docs split the chat base (/inference/go/openai/v1), the
Anthropic base (/inference/go/anthropic/v1) and the models base
(/inference/go/v1), which the single model-aware base_url cannot express;
zen/go/v1 still answers /models with 200 (checked 2026-10-26).
Verified:
- scripts/dev-test.sh config: 806 run, 806 passed, 1 skipped
- scripts/dev-test.sh tui provider_lake catalog context_window opencode:
365 run, 365 passed
- Throwaway reproduction (not committed): live opencode-go row at zen/go/v1
plus models.dev row with api inference/go/openai/v1 and limit 1M.
Without fix: FAILED (context stays None). With fix: passed; context is
1,000,000, provider_api and cost not inherited, and a mismatched
configured base still returns false.
- cargo fmt -p codewhale-config --check clean
Fixes#7096
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* fix(tui): resolve the state root before opening session-side state
A user who relocates application state to another volume cannot save a
session at all. Every save fails with the red "cannot save session"
notice and the log records
persistence write failed what=session:<id> error_kind=InvalidInput
error=Fleet artifact path must stay within the workspace
`SessionManager::save_session_inner` hydrates approval receipts before it
serializes anything, and `ApprovalReceiptStore::log_file` opened
`<sessions>/<id>/approval_receipts.jsonl` through the strict
`WorkspaceFile::open`. On Windows that opener walks the root component by
component and refuses the junction that is the state root, so the save died
before producing a document.
Storing session receipt data went from plain file I/O (0.10.2) to the
confined opener, which is the right direction, but the state root is a root
the user owns and may relocate. `open_resolved_root` exists for exactly
that (#6947): it resolves the root once and then runs the same link-refusing
walk below it. These call sites now use it:
- approval receipt log (the one that blocked saving)
- session archive artifact reads and the two directory checks
- clipboard image sink, screencapture attachment sink
- pet habitat store, descriptor and lifetime lock
No boundary is widened: a link below the state root is still refused, and
`WorkspaceFile::open` stays the opener for caller-supplied workspace roots.
Verified with cargo check -p codewhale-tui (exit 0) and cargo fmt. The
0.10.2 binary with the same junction layout reproduces the failure, so this
is not a regression from an unreleased branch.
* fix(tui): keep the strict root rule on the workspace fallback
The review of the previous commit found that two of the converted call sites
do not always hold the state root. `clipboard_images_dir_for_home` and
`screenshot_stabilization_dir` fall back to a directory under the workspace
when no home directory resolves, so `dir.parent()` is then a caller-supplied
workspace root — and resolving it would have widened the rule that a link at
the workspace root is refused.
Both sites now pick the opener from the root they actually hold: the resolved
opener only for `<home>/.codewhale`, the strict opener otherwise. The normal
path (a home directory exists) keeps the junction fix; the narrow fallback
keeps the boundary it had.
---------
Co-authored-by: Hunter Bown <[email protected]>
81558024c added three Unreleased entries to CHANGELOG.md without running
scripts/sync-changelog.sh, so the Version drift check fails on every PR
based on main (seen on #7097 and #7094). Regenerated from origin/main's
root CHANGELOG.md; scripts/sync-changelog.sh --check passes on the result.
Built with a temporary index so the shared checkout's uncommitted work is
untouched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Describe the ordinary Computer Use plugin and persistent native host approval across apps, models and tasks. Make the background diagnostic optional by removing it from the default onboarding sequence in all 18 locales. Explain the compact controller, global Stop and saved-access settings; retain the optional live preview.
Validation: release validators 26/26, dictionary checks 20/20 after updating the existing onboarding step-count assertion, locale completeness and GT catalog parity pass. Final headline edits only simplify prose; keys and flow structure are unchanged.
Source preparation only. Deploy this wording with the qualified CU 0.13.0 release and normal-plugin installation route; the current published 0.12.0 helper does not implement this flow. No website deployment or CU publication performed.
CW-6864: document account-owned provider/model selection and missing-configuration refusal. OrcaRouter remains an explicit example, not a hosted default. Standalone Actions still require explicit inputs; no automatic account-settings lookup is claimed. Documentation diff and whitespace reviewed; no runtime, provider, CI or deployment action.
The explicit provider allowlist omitted OrcaRouter. Pass only ORCAROUTER_API_KEY to its existing Engine route and keep no-key failure closed. The setup example uses our existing public referral and orcarouter/free, with required authentication and rate/runner limits disclosed. No provider or credential fallback.
Validation:8 existing Action cases pass, expanded existing assertions cover missing Orca key, exact route, selected-secret isolation and receipt redaction. Actual unauthenticated POST orcarouter/free returned401 Invalid API key on2026-10-26; no authenticated provider completion. Whitespace pass. No workflow enabled or deployed.
GitHub Action exports validated structured findings for a separate trusted publisher with current-head checks and dedupe. Telegram persists prompt identity before cursor advancement, reconciles the same Engine operation and retains uncertain final replies for explicit status recovery. DingTalk internal-app Stream adapter reuses bridge-core admission, approvals and question parsing. Extracted existing Weixin question helpers into shared core; no second turn loop.
Local evidence:168 existing bridge/Telegram/Weixin/Feishu/WeCom checks pass,1existing skip;9 actual local HTTP bridge-process scenarios pass including restart/identity/question/uncertain-final delivery. Action8 existing tests plus30 injected publisher/contract scenarios pass. DingTalk20 injected transport scenarios pass plus syntax/SDK import; no live connection. Feature derivation/whitespace pass. Staged shared registry/changelog/facts exclude concurrent instruction-budget work. No new tests/comments, native build, provider completion, workflow activation or deploy. Refs CW-6864.
/cache renders a turn with no cache telemetry as "—" in its hit, miss
and write cells and keeps it out of the totals, so a route that never
reports cache tokens doesn't read as one that never hits. The totals
still printed those empty sums as numbers: after a turn on such a
route the row said "—" and the footer said "Σ hit: 0 Σ miss: 0" and
"sum_write: 0". Print "—" for the three sums when no listed turn
reported cache telemetry; once one has, they read as before.
Signed-off-by: Lstarsky0 <[email protected]>
Refs #6990. Add default-off reasoning_only.on_output_limit using the
existing max_reprompts counter. Capture settings in exec, Runtime API,
TUI and ordinary Fleet children; keep RLM's separate stop protocol.
Length stops get a request-scoped nudge immediately, empty custom nudges
stay bare, and whitespace-only text is never a successful answer.
Output/context/turn/tool controls remain authoritative; this does not
preserve hidden reasoning, raise caps or guarantee long-proof completion.
Persist owner-bound child nudge receipts before dispatch in the existing
private artifact. V2 validates sequence/anchors and separates display
from conversation/resume; v1 stays readable. Bound receipt waits and keep
the owned guard through cancellation. A busy writer fails loudly with
the previous checkpoint rather than hanging settlement. Critical live
forwarding uses the existing bounded queue pattern.
Actual loopback proof exposed existing child transport replay after a
terminal length frame plus a broken body:2requests,Completed,two reported
usage sources. Generic recovery now requires no meaningful terminal stop.
The same case makes1request and fails after repair, retaining reported
usage. Partial text/tools remain unadmitted.
Verification: CLI build PASS (initial814.896s; guard repair53.083s).
Focused nextest:124tests run,124passed,15232skipped (70TUI/54locale),
4.669s after compilation. Initial test compilation was stopped303.972s
in to repair the reproduced replay; no initial test pass is claimed.
All2396frozen source hashes match;38explicit paths. Existing registry1/1,
locale2616keys x15, dead-code186, blocking543sites/165files, and local
facts/vocabulary/version/changelog/whitespace checks pass.
Manual receipts:11root,11Fleet and1same-boot140x40TUI cases. Exact bounds,
caps, shared exhaustion, empty/custom nudges, v1/v2 worker resume, durable
predispatch records and visible receipts verified. Root and5unaffected
Fleet cases reuse the initial CLI; the sole changed child-error branch
was re-observed on the repair. Recorded request prefixes/catalogs remain
unchanged across retries, without claiming provider cache hits.
All inference was synthetic loopback; the TUI proxy denied background
catalogue/update connections. No paid provider, hosted CI, release or
deploy. Preserve existing prior-boot roster filters and report limits.
Both changelogs credit @M-Maciej; docs/feature row and15packs updated.
Receipts: CW/artifacts/codex-0103-reasoning-limit-20261025.
Co-Authored-By: Codex <[email protected]>
The new provider description was141characters against the registry's120
limit. Shorten it to105 and regenerate the public feature projection.
The existing feature_registry_matches_code check fails before with the
141-character diagnostic, then passes1/1 after the correction.
Compiled the unchanged existing feature_registry.rs independently with the
actual built runtime/serde/toml libraries under the existing build lock;
no new tests, shim or whole TUI rebuild. Node facts and whitespace pass.
The uncompiled reasoning-recovery packet remains unstaged and is excluded.
Refs #7021. Record the existing test-only source fix e7c336d634 and credit
@asto18089 for diagnosing inherited NoNewPrivs. Both changelogs updated.
Local verification now completed against source bytes identical to the
carrying commit: compiled the unchanged canonical process_hardening.rs
as an independent test module with the workspace-pinned real libc/tracing
libraries, edition2024 and the same stable Rust1.99.0 compiler. Static
ARM64 Linux musl ELF has no interpreter or needed shared libraries.
Dependency and module compilation ran under the existing host build lock
and cache; no new manifest, checkout, cache, shim or tests.
The same harness passed3existing tests in each unpinned/pinned local
Bookworm container, parent NoNewPrivs0/1. Two substantive matrices cover
7child rows per state. Pinned run printed exactly2ratchet disclosures;
unpinned printed0. Child/mode/override markers were unset. Source/binary/
dependency/compiler/kernel hashes and logs retained in the receipt.
No full Linux TUI/GNU compilation, startup-order, status UI, sudo, hosted
CI, provider call, release or deployment claim. Changelog-only source
change: whitespace, changelog synchronization and version checks pass;
passing kernel evidence reused without a repeat run.
No-Issue: founder-requested provider/model recommendation for 0.10.3.
Reuse one recommendation row in /provider, /model and OrcaRouter sign-in
choices. F7 or a click opens the existing non-closing pager with the exact
redemption URL, 30% top-up match for DeepSeek V4.1 Flash, current-terms
pointer and public referral disclosure. Keep provider/model/auth choices
explicit. Clear previous click latches before opening the offer. Brand-first
titles retain OrcaRouter at narrow widths. All 15 locale packs, key catalog,
keybindings guide, provider feature row/docs and both changelogs updated;
regenerated public docs/features projections.
Verification: final production CLI build passed14m10s with the retained
large-__eh_frame linker warning. Focused existing batch ran273 tests:
272 passed,1 failed because F7 was missing from the keybindings guide.
Corrected only that documentation and its generated projection, compiled
unchanged keybinding_table.rs with the actual built localization library,
and reran the exact failed existing test:1 passed,0 failed. Reused the272
unchanged passing tests; no new tests or code comments. Original failed
run retained.2394 source hashes were unchanged before this docs repair;
all production Rust/locale inputs remain unchanged afterward.
Actual isolated PTY proof:9 cases, F7 and clicks on provider/model/auth
surfaces, en80x24/fr40x12/zh-Hans140x40. Exact URL survives wrapping and
return preserves the picker. Zero model POSTs, external browser/account or
redemption actions. Observer startup/rail/coordinate corrections retained.
Read-only Codex review clean after title/click-latch corrections.
Locale parity2611keys/15packs, G1 boundary0/0/1/0/0 (121 closure modules),
dead186, blocking543sites/165files, vocabulary/facts/version/changelog
checks pass. No hosted CI, release or provider inference claimed. An initial
own CLI compiler was stopped at435s to correct title truncation before the
final build; its receipt is retained separately.
Refs #7071. Translate question/approval/handoff/waiting chrome, shorten
localized numeric selectors to fit, and carry locale through the existing
portable /color presentation capability. Restore the contextual-handler
assertion and correct the two stale command ownership descriptions. Both
changelogs describe this first slice; remaining untranslated surfaces stay
open. No new tests or code comments.
Final combined source: CLI build passed; 479/479 focused existing tests
passed (425 TUI, 54 localization); locale parity 2607 keys/15 packs. Actual
80x40 PTY single/multi question footers passed in fr/es-419/uk/pt-BR/ru,
10 cases, including more than nine options and visible cancel tail. Actual
Russian /color red traversed the portable bridge and produced localized
feedback. Synthetic loopback fixture only, no real provider calls.
Prebuilt existing metric probes passed all 55 runtime-contract ceilings;
G1 boundary/dead-code/blocking/vocabulary/facts checks passed.
Intermediate commit trees not compiled separately; no hosted CI.
Refs #7068. Use the existing locale catalog for the seeded plan title and
todo_write reminder across all 15 packs; adapt the existing assertions and
record the behavior in both changelogs. The prompt remains a reminder, not
a claim that model tasks have completed.
Final combined four-slice UI source: CLI build passed; 479/479 focused
existing tests passed, including 16 plan-handoff and 54 localization tests
(overlapping groups). Locale parity: 2607 keys in each of 15 packs.
Intermediate trees not compiled separately. No real provider or hosted CI.
Refs #7049. Use the native composer's actual source rows and visible budget
to show a localized F4 hint only for clipped editable drafts, preserving
queue/busy hints. Route F4/Ctrl+Shift+O through the existing binding table
and editor action; keep the full chord catalog authoritative. Credit
@Lstarsky0 in both changelogs.
Final combined UI source: CLI build passed with an existing-style large
__eh_frame linker warning; 479/479 focused existing tests passed, including
composer, mounted-shell and key-routing checks. Initial test compilation
found a missing enum arm in the existing key-probe helper; fixed that arm.
Actual isolated PTY: hint absent when text fits, appears after resizing to
40x12, clears with the draft, and handles CJK/combining/ZWJ and 20,400-char
paste. F4 delivered the whole draft to VISUAL and restored the edited text.
Retained attachment-preview exclusion remains source-reviewed only.
Intermediate commit trees not compiled separately. No real provider/CI.
Refs #7043. Carry the archived-context rendering options through the existing
markdown renderer and retire its last production fallback callers. Keep
render_markdown/render_parsed only for existing test consumers. Credit
@Statter for the black-on-black report; both changelogs record this slice.
Verified the final combined four-slice UI source: CLI build passed; 479/479
focused existing localization/TUI tests passed, including 65 history and
63 markdown tests (overlapping groups). One test-only exhaustive-match
repair followed the initial compile failure; no production rebuild needed.
No exact archived-context terminal reproduction is claimed. Intermediate
commit trees were not compiled separately. No hosted CI or provider calls.
Record PR #7089 by @Lstarsky0 in both Unreleased changelogs. The contributor PR merged as itself in bb5ad1f1824fe0a12d7da624eed68b97461e2853; its GitHub-linked author and original commit remain in history.
The GitHub merge tree equals the locally verified tree138ad9ddea42b7ed17710d958535a84f78dc17ba. Canonical source plus these exact changelog bytes matches all2,177 frozen hashes: TUI library check passed6m58s;147 existing goal tests passed,0failed,15,155skipped,6.299s run after1m44s build. Independent read-only Codex and parent review clean. Never-goal/fallback-only notification branches are source-reviewed, not directly asserted by these tests; no agent PTY/provider/hostedCI evidence. Format, changelog sync, version state0.10.2 and whitespace pass. No test rerun for unchanged source.
No release/tag/publication or provider call. Receipt CW/artifacts/codex-0103-pr7089-20261025/acceptance.json says PASS and retains limits.
Co-Authored-By: OpenAI Codex <[email protected]>
Only report a goal clear when an objective or configured fallback existed. Preserve the canonical empty snapshot, prompt refresh and continuation cancellation.
Human approval verified at exact e11bd43 head. Local acceptance PASS on canonical main478b29eae5 plus the exact merge content: TUI library check passed,147 goal tests passed,0failed. Independent read-only Codex and parent source reviews clean. Existing tests cover positive clear flows; never-goal and fallback-only notification branches are source-reviewed. No agent PTY/provider/hosted CI claim.
Contributor commit and GitHub-linked authorship retained. No dependent PRs; source-branch auto-delete remains disabled. Changelog credit follows separately. Full0.10.3 remains under implementation; this is not a release.
S06/W3 routes consumers directly to codewhale-config, runtime and notification owners, retires config/models.rs and privately imports the settings theme. Its seven locally defined constants/helpers retain exact definitions and active consumers in config.rs. Registry drift guard keeps the same Antigravity exclusion at its direct owner. Update both Unreleased changelogs.
Initial plan: 229 root upstream exports (three test-only), 213 overlapping model-wrapper names, 1,124 direct lines/143 files plus 68 grouped lists/60 files. One repair fixes the missed root-relative ProviderKind reference and its registry literal. Initial E0603 and exit101 retained. Final positive-controlled full-source audit finds zero retired relative refs and zero upstream public facades; seven retained definitions and three separately reordered helpers match old source exactly. Independent read-only Codex review found no actionable issue.
Local verification: workspace all-target check passed in12m44s; 554/554 existing config/readiness/route tests (baseline554 active/1ignored;14,748 skipped), 2.175s execution after20m06s build. skill_cli16/16 (204skipped),0.636s after14m02s build. All2,177 Cargo hashes and both auxiliary script hashes unchanged. Final source compiled, intermediate commits not separately compiled. G1/G2, provider registry and web facts pass; budgets186 suppressions and543 blocking sites/165files unchanged/pass; pre-repair budget evidence remains valid for spelling-only repair. Changelog sync/whitespace pass.
TUI strict[M]634556→634613(+57), file[F]943349→943735(+386); explicit owner imports add lines while preparing extraction. Runtime9526/15121 unchanged. Largest module SCC79→78; tools→core29,client→tools4,mcp→core7 unchanged. Config→core/sandbox0; hooks/plugins1each still await later windows. G1 0/0/1/0/0,121closure modules. No production-line reduction claimed. Eleven pre-existing standalone test fragments retain their old rustfmt-unstable layout; other Rust formatted on stdin.
No new tests/comments, hosted CI, provider call, deploy or release. HumanDecision mint unchanged; FD12 removals held. Full0.10.3 and later split windows remain open. Receipts CW/artifacts/codex-0103-takeover-20261025/w3-final-receipt.json and coordination/CW-0.10.3-CRATE-SPLIT-W3-REPORT-20261025.md.
Co-Authored-By: OpenAI Codex <[email protected]>
Move tool_call_denied, enforce_tool_denial and prepare_tools_for_strict_mode before their existing test modules. Byte-for-byte definition comparison against 995f2a88f9 passes for all three; no helper body or authority change.
Verified in the final W3 batch: workspace all-target check passes after one config import repair, 554 existing config/readiness/route tests and 16 skill_cli integration tests pass. All 2,177 Cargo source hashes unchanged through checks; no new tests/comments. The final W3 source, rather than each intermediate commit, was compiled. Receipt CW/artifacts/codex-0103-takeover-20261025/w3-final-receipt.json.
Co-Authored-By: OpenAI Codex <[email protected]>
Include cfg(test) upstream aliases in re-export discovery and audit root-module relative paths even without an explicit crate::config use. W3 exposed both gaps: one root-local ProviderKind path escaped the tool, and test-only aliases could be left at a retired facade. Preserve cfg attributes on rewritten imports.
Manual before/after artifact fixtures: root report zero to one site; test alias unrewritten to direct owner, guarded by cfg(test). Python syntax passes. Independent read-only Codex W3 review found no actionable issue. No native build or Rust behavior claim for this Python-only commit.
Co-Authored-By: OpenAI Codex <[email protected]>
Delete SavedSession::active_entries, PlanState::steps, StepStatus::symbol,
and the never-issued CancelReason::Preempted. These private-module helpers
have no callers or public root re-export; cancellation reasons are typed,
not serialized or numeric. Keep active mailbox/cancellation builders and
remove their obsolete unused-code suppressions. No supported feature is
retired. Hand-ratchet the budget 192->186 and update both changelogs.
Local evidence covers the combined W2a source snapshot (base 916d3227e8,
2,178 input hashes, canonical map sha256
cd34d125770ebfc7f3ebaa921131c54b82781b469eb1cd27fd7c39350476cad0).
Intermediate commit trees were not separately compiled. A pre-follow-up
all-target check passed in 13m42s; final library tests ran 2,116 and passed
2,116 (13,540 skipped). Original 1,309-test selection is accounted for after
mapping four moved test names. Final skill_cli integration: 16 run/16 passed/204 skipped, 0.643s
execution after its 24m08s test-profile build. All recorded source hashes
stayed unchanged through both final runs.
Final batch metrics: tui strict/file lines 634691/943616 -> 634556/943349;
runtime 9526/15121 unchanged; SCC 79 unchanged; tools->core 46->29,
client->tools 5->4; mcp->core 7 held. Dead-code suppressions/budget 195->186;
blocking 543/165 unchanged. G1, G2, ratchets, web facts, provider registry,
changelog sync and diff whitespace checks passed. First check exposed an
over-broad FleetRole import rewrite, corrected in one repair round. Logs
and frozen-source receipts are retained outside the repository.
No new permanent tests or comments, no CI, provider call, deployment or
release. HumanDecision retains the engine-only mint boundary; published
runtime API removals stay held under FD-12. Engineering defaults follow the
coordinating handoff and remain overridable by the founder.
Co-Authored-By: OpenAI Codex <[email protected]>
S04 moves tool names to their shared leaf owner, denial checks beside the
execution envelope, and strict-tool catalog preparation with its four
existing tests beside the catalog. Drop private FleetRole/tool_parser
facades, unused MCP/sandbox context fields, and the one-variant policy.
Every consumer imports its actual owner. The paired changelogs record the
removals. Human approval attestations remain in their original engine scope.
Local evidence covers the combined W2a source snapshot (base 916d3227e8,
2,178 input hashes, canonical map sha256
cd34d125770ebfc7f3ebaa921131c54b82781b469eb1cd27fd7c39350476cad0).
Intermediate commit trees were not separately compiled. A pre-follow-up
all-target check passed in 13m42s; final library tests ran 2,116 and passed
2,116 (13,540 skipped). Original 1,309-test selection is accounted for after
mapping four moved test names. Final skill_cli integration: 16 run/16 passed/204 skipped, 0.643s
execution after its 24m08s test-profile build. All recorded source hashes
stayed unchanged through both final runs.
Final batch metrics: tui strict/file lines 634691/943616 -> 634556/943349;
runtime 9526/15121 unchanged; SCC 79 unchanged; tools->core 46->29,
client->tools 5->4; mcp->core 7 held. Dead-code suppressions/budget 195->186;
blocking 543/165 unchanged. G1, G2, ratchets, web facts, provider registry,
changelog sync and diff whitespace checks passed. First check exposed an
over-broad FleetRole import rewrite, corrected in one repair round. Logs
and frozen-source receipts are retained outside the repository.
No new permanent tests or comments, no CI, provider call, deployment or
release. HumanDecision retains the engine-only mint boundary; published
runtime API removals stay held under FD-12. Engineering defaults follow the
coordinating handoff and remain overridable by the founder.
Co-Authored-By: OpenAI Codex <[email protected]>
S03 removes the home wrapper and integration stub, routes every free-function
caller to codewhale_paths::user_home, centralizes legacy-bit approval posture
in execpolicy, and moves pure legacy-role migration to protocol::fleet.
The unrelated WorkspaceHost home facet retains its nine Rust occurrences.
Local evidence covers the combined W2a source snapshot (base 916d3227e8,
2,178 input hashes, canonical map sha256
cd34d125770ebfc7f3ebaa921131c54b82781b469eb1cd27fd7c39350476cad0).
Intermediate commit trees were not separately compiled. A pre-follow-up
all-target check passed in 13m42s; final library tests ran 2,116 and passed
2,116 (13,540 skipped). Original 1,309-test selection is accounted for after
mapping four moved test names. Final skill_cli integration: 16 run/16 passed/204 skipped, 0.643s
execution after its 24m08s test-profile build. All recorded source hashes
stayed unchanged through both final runs.
Final batch metrics: tui strict/file lines 634691/943616 -> 634556/943349;
runtime 9526/15121 unchanged; SCC 79 unchanged; tools->core 46->29,
client->tools 5->4; mcp->core 7 held. Dead-code suppressions/budget 195->186;
blocking 543/165 unchanged. G1, G2, ratchets, web facts, provider registry,
changelog sync and diff whitespace checks passed. First check exposed an
over-broad FleetRole import rewrite, corrected in one repair round. Logs
and frozen-source receipts are retained outside the repository.
No new permanent tests or comments, no CI, provider call, deployment or
release. HumanDecision retains the engine-only mint boundary; published
runtime API removals stay held under FD-12. Engineering defaults follow the
coordinating handoff and remain overridable by the founder.
Co-Authored-By: OpenAI Codex <[email protected]>
Retiring a facade can split one cfg(test)-guarded import into several
statements. Both flattening and upstream regrouping previously left the
extra statements unconditional. Reuse the existing mover attribute helper
and repeat the guard on each resulting statement.
Refuse carved output whose existing parent symlinks resolve outside the
canonical repository, matching the source-path containment boundary.
Local evidence: both import shapes lost their second cfg guard before this
change and preserve it after; four extra attribute cases and the existing
mover shape passed. Four Python modules parse; mover help exits 0. The
symlink-output probe accepted before and refuses after, without writing any
outside file. A formatted carve CLI dry-run on a real function exits 0.
No Rust build, module move, CI, provider call, or release claim for this
Python-only change. The active W2a Cargo source remains frozen separately.
Co-Authored-By: OpenAI Codex <[email protected]>
Refs #7067: Low-risk review passes previously capped reasoning and visible
text together at 4,000 output tokens. Raise the tier allowance to 8,192 for
reasoning/unknown routes, retaining the route or explicit output ceiling.
Use the same floor and normalized bounded reasoning effort in ReviewTool;
share incomplete-output wording with the CLI and restore the existing
accept_single_review documentation to its function. This is the intermediate
review repair; removing caps and implementing skip-before-start money control
remain planned Review v2 work.
Refs #7055: preserve balance HTTP/parse failures through Result and show
them in explicit /balance output. Distinguish timeouts and connection errors
without exposing the request URL. Automatic chip refresh keeps its previous
value. The DeepSeek URL fix predates this slice; real-key proof remains open.
Update both changelogs. Based on the stopped issue drafter batch 3, including
its reviewed effort normalization; transport classification fixes review m1.
Verified on a0053edcda plus this seven-file diff:
- Hermetic dev-cargo nextest, codewhale-tui --lib, focused review/triage/core,
reserve and balance filters: 74 tests run, 74 passed, 15,228 skipped.
- All 2,180 recorded source hashes were unchanged during compilation.
- Single-file Rust formatting and lib.rs stdin comparison passed;
git diff --check and sync-changelog.sh --check passed.
- Linker emitted its existing-size warning: __eh_frame exceeds the 16 MB
compact-unwind limit; compilation and all selected tests completed.
No new tests/comments, provider call, CI dispatch, release or deployment.
These existing checks do not exercise a live reasoning route or key.
Full local receipt: CW/artifacts/codex-0103-takeover-20261025/batch3-result.json.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Co-Authored-By: OpenAI Codex <[email protected]>
Complete the stopped lane B carving helper for S51. Derive child imports
from existing use leaves and moved items; widen private definitions only
to the selected visibility and preserve test module attributes. Use the
existing splitlib compare-and-swap journal for writes. Dry runs now parse
and format the proposed Rust too. Refuse outside sources, unsafe or duplicate
module names, invalid visibility, empty/cut ranges and duplicated test items.
Verified against canonical main 035bd86a26: Python syntax passed; 7 manual
invalid-plan checks were refused; carve.py crates/cli/src/lib.rs --plan
/Volumes/VIXinSSD/CW/artifacts/codex-0103-takeover-20261025/carve-live-plan.json
--dry-run --json exited 0, formatting one real CLI function into a child
without writing source. git diff --check passed. This is tooling-only:
no Rust compilation, no full S51 move, no cross-platform or hosted checks.
Token-based import inference still needs compiler validation on a real move.
Refs CW-6129
Co-Authored-By: OpenAI Codex <[email protected]>
Complete stopped lane B widening work for S51. --vis pub(crate) now
widens private items and fields without exporting them outside the crate;
the default remains pub for cross-crate moves. Reject unsupported visibility
values rather than producing malformed Rust.
Verified on canonical main b1fa6193b9: Python syntax parsing for widen.py
and carve.py passed; 8 manual widening cases passed, including unchanged
public and already crate-visible items. widen.py --help exited 0 and
git diff --check passed. No Rust compilation or refactor-output build was
run for this Python-only slice.
Refs CW-6129
Co-Authored-By: OpenAI Codex <[email protected]>
First slice of the crate-split execution brief (S02), run as one window. Tested
at base 7478d51f9c; landed on f0c0bf2665 (two upstream files, tui/diff_render.rs
and tui/pager.rs, are disjoint from this change and were not recompiled with it).
Engineering defaults for the open founder decisions (FD-12: hold published-crate
pub removals) were set by the coordinating session under AGENTS.md source
authority; the founder can overrule them.
Deleted after re-proving zero references with git grep over the whole repo
(crates, web, scripts, docs), not only crates/*.rs:
- session_manager.rs journal_append_message (and its expect(dead_code));
- fleet/alerts.rs FleetAlertEvent::{restart_exhausted, needs_human, budget_exceeded};
- fleet/worker_runtime.rs explicit_fleet_provider (explicit_fleet_provider_id stays);
- sandbox/policy.rs SandboxPolicy::has_full_disk_read_access, and the read_guard.rs
module comment that named it;
- plugins/manifest.rs ResolvedPluginComponents::all_paths (the now-empty impl),
plugins/registry.rs list_enabled and enabled_plugins, plugins/marketplace/types.rs
to_install_source (and its now-unused PluginInstallSource import);
- tui/pet_watch/worker.rs Raster::same_picture (the now-empty impl);
- client.rs OpenRouterModelItem name, created, expiration_date (never read, three
expect(dead_code) gone; serde ignores the extra response keys);
- lib.rs pub use of maybe_load_persisted_cache and all_catalog_models_for_provider;
- ten superfluous allow(dead_code) in core/prefix_cache.rs (5), models/lib.rs (3),
localization/lib.rs (2);
- empty tracked files tui/src/model_registry.rs, tui/src/main.rs (autobins=false)
and models/src/model_catalog.rs, plus the false model_registry entries in
AGENTS.md and docs/skills/cw-slice/SKILL.md and two "model_registry follow-up"
comments in core/engine.rs and core/engine/tool_catalog.rs.
Kept on purpose (brief findings): sandbox/mod.rs PUBLIC_SANDBOX_BACKENDS (the
website facts gate parses it); the pub use ... as pet alias. Removing the alias
makes rustc report seven items in tui/ambient_life/pet_sim.rs as dead, two of
which (braille_text, legacy_whale) the separately built pet/ crates use through
#[path]; it needs a pet/ edit and pet/verify.sh, so it is deferred. FD-12 holds:
session_tree children_of and append_*, goal_loop DEFAULT_GOAL_MAX_STEPS and the
resource_telemetry trim are untouched.
Measured (before at 00be3d2e4f [lane B counter], after on this tree):
- tui strict production lines 634,761 to 634,614 (-147); file-level [F] 943,686
to 943,539 (-147); count_lines.py.
- largest cycle: 79 modules before and after (partition_report.py); no cycle edge
was touched.
- dead-code budget 209 to 195 (allow 132 to 122, expect 77 to 73), hand-edited in
scripts/dead-code-budget.json to the measured number, no --update; blocking-call
budget unchanged at 543 sites in 165 files; module_graph --check PASS (121
closure modules); node web/scripts/check-facts.mjs OK; rustfmt --check of
tui/src/lib.rs (991 files), models, localization and core files clean.
Verified (macOS, local only; no hosted CI, no Linux/Windows compile):
- clippy -p codewhale-tui -p codewhale-core -p codewhale-models -p codewhale-localization
-p codewhale-runtime --all-targets --all-features --locked -D warnings with CI's
allowed lints: exit 0 (wall 954.9 s, user 938.7 s). The first pass found the orphaned
import and the pet_sim exposure; both repaired before the final pass.
- nextest of the same crates, filters core, models, localization and tui alerts,
session_manager, openrouter, plugins::registry, marketplace, sandbox::policy,
read_guard, pet_watch: 485 run, 485 passed, 14975 skipped (core 62, models 42,
localization 54, alerts 9, session_manager 137, openrouter 40, plugins::registry 20,
marketplace 48, sandbox::policy 15, read_guard 26, pet_watch 35). The test-profile tui
build took 2634.9 s wall and 1340.6 s user at load average 27 to 40 from other
sessions' processes, over the brief's 17 to 25 minute cap; user CPU is in line with a
normal build.
- The committed tree differs from the tested tree by one blank line removed in
plugins/marketplace/types.rs (rustfmt, checked by rustfmt only) and by the two
upstream files named above.
Not verified: pet/verify.sh (untouched), web build, runtime-crate tests (no runtime file
changed), the production-feature cli check.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Follow-up to 3b35f098f7 after a note from the issue-drafts session: stdin-mode
`rustfmt --check` exits 0 even over a diff, so no exit status is used anywhere
in scripts/split. format_many now writes the formatted bytes of
`rustfmt --edition 2024 --emit stdout`, treats any rustfmt error as fatal,
requires the formatted text to be a fixed point of a second pass, and returns
the files whose base was not rustfmt-stable (left exactly as rewritten, so no
foreign line is reflowed). move-modules.py reports them as
`rustfmt_unstable_base` (null in a dry run, which does not format) and
`--strict-format` turns them into an error before anything is written.
Proof on a throwaway git repo (artifacts/crate-split-w0-20261025/mini):
`printf 'fn main( ){}' | rustfmt --check` exits 0 (the pitfall);
--strict-format on a tree with an unformatted file exits 2 and writes nothing;
a rewritten file rustfmt cannot parse ("unclosed delimiter") exits 2 and
writes nothing; a normal run formats the formatted-base file and leaves the
unformatted-base file untouched except for the rewritten path, listing both.
The 334/351 stable result of the W0 proof is unchanged in meaning: the 17
others are the include!d test_cases_* fragments whose base is unstable.
Python only; nothing compiled.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Scripts only under scripts/split/. No Rust, no manifest, no budget touched.
Base 00be3d2e4f. tui strict production [M] 634,761 -> 634,761, file level [F]
943,686 -> 943,686, largest SCC 79 -> 79 (partition_report --non-test: [79, 8,
1, 1, 1]). Nothing was compiled: this is python; the rewrites it produces were
checked with rustfmt parse/format, module_graph.py, the path-keyed budget
scripts and counts, on a scratch `git init` export of this base (never the
shared tree). A compile of a rewritten tree is the first Lane A window.
What changed and why (reasoning lives here, not in comments):
move-modules.py (rewritten). R2.5: the old tool exited 0 in a tree without
.git after "moved 6 module(s)" (git failures were check=False), and its
dry-run headline (354 files / 3,487 lines) counted 12 files / 212 lines
inside the moved set that a real run never rewrites.
- --dest-crate/--src-crate replace every hard-coded runtime literal; --json;
--require-clean (dirty set from `git status --porcelain -z` plus files
younger than --quiet-minutes, default 15); --apply-cfg (flips only
`#[cfg(test)]` items that code outside the moved set uses; never touches
cfg(not(test)) forks, which are an FD-04 decision); --restore <journal>.
- No git mv (the shared index is not touched): plain file operations. Every
write is compare-and-swap (stat+sha against the bytes the plan was computed
from, temp file, os.replace) with a pre-image journal under CW/backups/;
a change between plan and write refuses before writing (exit 3); a change or
SIGTERM/SIGHUP/SIGINT during the write phase restores every pre-image and
removes created files and directories (exit 4). git/git grep failures and a
missing or foreign .git are fatal (exit 2). --require-clean refusals exit 5.
- Rewritten Rust goes through `rustfmt --edition 2024 --emit stdout` on stdin
per file; a file whose base text is not rustfmt-stable (the 17 include!d
test_cases_*.rs fragments) is left exactly as rewritten, so no foreign line
is reflowed.
- Coverage: plain and grouped `use crate::{..}` (3 sites), alias, unqualified
`<m>::` in the source lib (5 sites; cfg(test)-only use gets a cfg(test)
import), `<dest>::` -> `crate::` inside moved files (code only), `codewhale_tui::<m>`
in every other Rust file (cli config_keys 15 lines), sweep of path strings
(plain, `tui/src/..`, segmented `"tui" / "src" / "<m>"`: this adds
scripts/check_orcarouter_contract.py, which the old sweep missed) with
vendor/, crates/config/, scripts/split/, CHANGELOG* and web/data/*.generated.json
skipped; --derive-facts regenerates web/data (journalled pre-images).
- Reports (and plans, never applies): residue edges from moved files to
staying modules, super-root residue, manifest needs (deps, features,
consumer crates), cfg sites by class.
reexports.py (--resolve-reexports): resolves `pub use` facade names (globs
through the upstream sources and the build.rs-generated constants via
catalog_corrections.json / provider_descriptors.json) and rewrites
`crate::config::NAME` and grouped lists to the upstream path.
preflight.py (G11): whole-repo include_str!/include_bytes!/include!/#[path]
resolution against the old-to-new map, features.toml owners, path strings the
sweep cannot fix, `../src/<m>` references, CI test identities; exit 1 on residue.
widen.py: --dest-crate/--src-crate/--packages, signal-safe lints restore
(SIGTERM/SIGHUP/SIGINT and atexit; a manifest left capped by a killed run is
restored first), atomic writes, --prepass static widening, unused_imports
removed with the compiler's machine-applicable suggestions.
count_lines.py promoted from the plan's scratch (identical [M]) with the [F]
counter beside it. testsplit.py: function-level move/stay classifier with call
closure. partition_report/closure_report --non-test; module_graph --tui-src/
--runtime-src and a regex-driven lexer (11.0 s -> 2.5 s over 1,585 files,
0 mismatches against the old lex_mask on every tracked .rs).
Acceptance (scratch export of 00be3d2e4f, config settings config_persistence
config_keys oauth codex_model_cache):
- dry run: staying callers 342 files / 3,275 lines + inside the moved set 12 /
212 = the old tool's 354 / 3,487; grouped 3; self paths 105 + 5 in comments
= 110; other crates 2 files / 16 lines (15 cli + 1 runtime doc comment);
sweep 31 files (+15 skipped); 81 cfg sites (53 test items, 11 test
mods, 17 not(test) forks = the brief's 17); 9 s.
- real rewrite: 403 paths, 18.6 s, counts identical to the dry run line for
line; 334 of 351 changed .rs files rustfmt-stable (the 17 others are the
base-unstable fragments); no `crate::<moved>` left in tui, no
`codewhale_tui::<moved>` in cli; module_graph.py --check refuses this
premature move with 43 residue edges (it is the closedness gate working).
- closed module (remote_setup) real move: module_graph --check PASS with the
unchanged baseline, check-blocking-calls-budget PASS (543 sites, 165 files;
the sweep re-keyed the path-keyed JSON), dead-code budget PASS 209,
check-provider-registry PASS, G11 unresolved 0.
- guards on the scratch repo: change between plan and write -> exit 3 nothing
written; change at write 201 of 403 -> exit 4 and `git status` back to only
the concurrent edit; SIGTERM at 201 of 403 -> exit 4, status empty; dirty
file and a file touched < 15 min -> exit 5; no .git -> exit 2.
- widen.py: SIGTERM and SIGHUP while a compile round runs -> exit 130 and
crates/runtime/Cargo.toml back to `[lints] workspace = true`; a capped
manifest from an earlier run is restored at start; with a fake cargo JSON
stream the E0603 widening, --prepass and the unused-import removal applied.
- reexports: 226 config names (213 via models) -> 1,109 direct lines in 142
files and 68 grouped lists in 60 files outside the cluster, 166 files; the
ProviderKind figure matches the plan exactly (339 lines / 95 files); the
plan's 1,189 / 190 and 89 / 75 are not reproduced and likely include the
cluster's own files; module_graph --check unchanged afterwards.
- preflight on the cluster: residue 8 = lib.rs:20230 include_str, tests/
integration/main.rs:16 (path + relative), 5 skip-listed mentions in
crates/config (catalog_corrections.json:4584 and models_dev.bundled.json:11769
key a source receipt `crates/tui/src/config/models.rs`), vendor picker.rs.
- testsplit: config/tests.rs 407 tests (378 move, 29 stay), scope_tests.rs 8
(0 move: needs provider_readiness/fleet), whole cluster 687 tests (649 move,
38 stay); count_lines [M]/[F]: tui 634,761/943,686, cli 20,204/33,761,
runtime 9,526/15,121, config 29,415/35,830, app-server 7,572/13,095.
Not proven: no cargo build of any rewritten tree; widen.py's compile loop ran
only against a fake cargo; --apply-cfg flipping is planned, not applied or
compiled; Windows/FreeBSD cfg code; whether any test reads the source-receipt
keys in crates/config assets as paths; the re-export resolver does not
rewrite relative `config::NAME` uses (none found at this base); SCC/edge
counts were not re-run after a rewrite (the cargo-free G2 stays Lane A's).
Evidence: /Volumes/VIXinSSD/CW/artifacts/crate-split-w0-20261025/proof-w0.log
and guard-demos.log. Dirty work of other writers in the checkout was left
untouched (about 20 tui/core/models files, window W1).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
node web/scripts/check-facts.mjs failed at d4d50f730d and at e6c400e294 with
"generated agent docs are stale". Two committed sources changed without their
generated copies:
- docs/RUNTIME_API.md (the #7074 merge) was newer than its sha256 and embedded
content in web/data/agent-docs.generated.json.
- the cloud-computer-dispatch summary in docs/features.toml, shortened in
46aa86634d for the 120 character limit, was newer than
web/data/features.generated.json.
Regenerated with node web/scripts/derive-facts.mjs only (version=0.10.2 crates=30
providers=50 models=91 tools=79); no hand edit. The diff is those two files, 4
lines each. This clears the one baseline gate failure that the crate-split windows
would otherwise inherit, so a later docs gate can tell its own failure from this one.
Verified: node web/scripts/check-facts.mjs exits OK ("committed facts.generated.ts
matches workspace") after this change; it printed FAIL before it. No cargo, no source
file touched.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Two of the six remaining config-cluster edges to other tui modules, both one-way:
- Config::read_denylist and Config::effective_sandbox_denied_read_paths are deleted.
ReadDenylist::from_config(&Config) in sandbox/read_guard.rs builds the same list
from the same three fields, and its four callers use it directly (exec_agent,
runtime_threads x2, ui/frame) plus lib.rs, which now asks the list for
subtree_paths(). The deny-list doc comment moved with the constructor.
- apply_requirements no longer calls core::authority::sandbox_policy_for_turn just to
name the Agent baseline. ApprovalMode::agent_baseline_sandbox_mode() in
codewhale-execpolicy returns "danger-full-access" for Full Access and
"workspace-write" otherwise, apply_requirements reads it, and
sandbox_policy_for_turn derives its non-Plan default from the same method, so the
baseline is still defined once. The network argument the old call passed never
affected the returned config value. The comment that said "the engine's resolver" now
says where the baseline comes from.
Measured after this change (re-run, not carried over): largest SCC still 79 modules
(this cut does not fragment it); config now has 7 outbound module edges instead of 9.
Remaining non-cluster edges from config/config_persistence: plugins::providers x5,
provider_readiness x2, hooks::HooksConfig x1, codex_model_cache::model_roster_for x1.
tui production lines with inline tests stripped: 640,313 (old metric incl. inline tests:
948,634+); runtime 10,109; the monolith is unchanged in size.
Verified locally (macOS; no hosted CI): CLI build exit 0; nextest -p codewhale-execpolicy
-p codewhale-tui --lib focused set: 992 run, 992 passed, 0 failed, 14546 skipped (read_guard
26, read_denylist 1, sandbox 125, requirements 6, sandbox_policy_for_turn 1, config::tests
423, authority 202, execpolicy 236); workspace clippy with CI's exact flags exits 0 on the
final tree (two needless borrows it found in lib.rs and ui/frame.rs were fixed after the
test run; those are token-only changes, covered by clippy's compile, tests not re-run for
them); fmt clean; dead-code 209, blocking 543/165, boundary 121.
Not verified: a live sandboxed shell under the OS wrapper (only the existing unit tests that
build the deny-list and the policy table), Linux/Windows, hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
`main` has now landed its own versions of every side fix this branch carried:
46aa86634 took the feature-summary and installer-assertion repairs, and
65ef1ea70 renamed `FleetRole::from_str` to `parse` and cleared the five
`crates/tui` lints plus the two `crates/cli` collapsible `if`s. Their versions
win on all five conflicting files; this branch is now the instruction-budget
feature only.
With the should_implement_trait error gone, clippy reached the dependents and
reported six more under CI's flags. One was mine: 7d84d0be6b removed the setter
that followed an early `return;` in apply_engine_error_to_app, which left that
`return;` as the last statement.
- tui/ui/apply.rs: drop the unneeded trailing `return;` (the code after it is
now only comments, so behaviour is unchanged).
- tui/ui/frame.rs: pass `config` instead of `&config` to
AutoReviewPolicy::from_config and UserInputLimits::from_config (needless borrow).
- tui/ui/handlers.rs: trim_start_matches/replace take a char array instead of a
matches! closure.
- tui/work_surface/terminal.rs: sort_by_key with Reverse(finished_at).
- cli/cloud/computer.rs: collapse two nested `if`s into let-chains (introduced with
the cloud key handoff work).
No behaviour changes.
Verified: workspace clippy with the exact CI flags exits 0 (first pass listed
exactly these; the final run has no diagnostics); rustfmt clean; 2082 tests
passed in the shared frozen batch including frame 98, handlers 5, work_surface
164 and cli computer 4 matching tests.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Hosted CI run 40208377293 (PR #7087, base f98cb165a3) failed its Lint job on
clippy::should_implement_trait at crates/agent-contract/src/role.rs:148: an
inherent `from_str(&str) -> Option<Self>` shadows std::str::FromStr's name. It
returns Option, not Result, so implementing FromStr would change every caller.
Renamed to `parse` and migrated all 33 call sites in one pass, no alias:
agent-contract role.rs (definition, the serde Deserialize impl, three internal
calls and their doc links), tools/subagent/mod.rs (7), tools/subagent/tests.rs
(18, unchanged assertions), tools/workflow/mod.rs (1) and tui/views/mod.rs (1).
Behaviour is identical.
Of the three hosted failures from that run: the features.toml summary length and
the stale legacy_tui assertion in release-workflows.test.js were fixed in
46aa86634d; this commit and the next one fix the Lint job. Clippy stops at the
first failing crate, so the rename exposed further lints in dependents; they are
fixed in the following commit.
Verified: workspace clippy with the exact CI flags (--workspace --all-targets
--all-features --locked -D warnings -A uninlined_format_args -A too_many_arguments
-A unnecessary_map_or) exits 0 after both commits; nextest agent-contract 14 passed,
tools::subagent 914 and tools::workflow 248 matching tests passed (2082 passed in the
shared batch, 0 failed).
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Refs #5848 (stays open).
A thread or TUI session created while the local model was unloaded froze the
explicitly unverified 8192-token floor, because the /api/ps context is observed
only at admission and startup. Turn one loaded the model; turn two still used
5120 usable input tokens and failed with "qwen3:4b's context window (~5120
tokens usable) is smaller than Codewhale's working instructions".
refresh_unverified_local_context(config, identity, model) reads the exact route's
catalog row off the Tokio worker and, only when that route has no fresh served
context, awaits the existing refresh_local_ollama_catalog bounded to 3 seconds.
It runs before the per-turn route is resolved in the two places that resolve one:
RuntimeThreadManager::start_turn_with_narrowing (Runtime API, mobile and desktop
threads; non-Auto models) and the TUI's spawned_dispatch_inner (non-Auto). A loaded
model already observed within 60 s costs nothing; an unloaded or expired one costs
one tags+ps round trip. No warmup, no num_ctx change, no polling, and the explicit
8192 floor still applies when the daemon reports nothing.
Verified locally (macOS; no hosted CI; Ollama 0.40.9, qwen3:4b):
- Reproduced before the change on a binary built without it: a Runtime API thread
created while qwen3:4b was unloaded completed turn 1, then turns 2 and 3 each
returned in 0.5 s with item.failed. Same thread flow on the changed binary: turns
1, 2 and 3 all completed with no failed items; /api/ps then showed 32768.
- TUI, same two prompts on an unloaded model: before, the second turn showed the
context-window error immediately; after, no error appeared and the turn was still
running when the capture ended (so completion of turn two in the TUI was not
observed, only the absence of the failure).
- nextest -p codewhale-agent-contract -p codewhale-cli -p codewhale-tui --lib
(frozen batch shared with the next two commits): 2082 run, 2082 passed, 13735
skipped. Matches: provider_lake 38, local_ollama 10, runtime_threads:: 294,
dispatch 268, api_provider_default_and_model_list_follow_exact_local_catalog 1.
Not verified: auto-routed turns (the refresh is skipped for Auto), a stalled
endpoint (bounded to 3 s, not exercised), Windows/Linux, hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The second merge brought main's documentation edits; the generated agent-docs
JSON is regenerated from them so the published page matches the source.
Refs #6526
`main` landed 46aa86634, which fixes the same two gate breaks this branch had
fixed independently: the 143-character `cloud-computer-dispatch` summary and
the stale `legacy_tui` assertion in `release-workflows.test.js`. Their version
wins for both files; this branch keeps its own commits for the clippy lints
(`FleetRole::from_str`, five `crates/tui` lints, two `crates/cli` collapsible
`if`s) that `main` has not taken.
`web/data/features.generated.json` is regenerated from the merged registry.
`node .github/scripts/release-workflows.test.js` exits 0 on the merged tree.
Thirteen findings from the automated review, all addressed.
Reads and bounds:
- The configured `instructions = [...]` loader read the file whole after a
metadata check, so `/dev/zero` (length zero) or a file growing after the
check could exhaust memory. It now reads at most `file_max_bytes + 1` bytes
from the open handle, refuses anything that is not a regular file, and
reports an over-ceiling skip.
- The first-turn notice emitted one line per loss, so a rules directory past
the 50-file cap could produce a message larger than the budget it described.
It is bounded to 12 lines / 2,000 bytes with an "and N more losses" line.
- Budgets now subtract the route's own output reservation
(`max_output_tokens_for_model`) instead of the 2,048-token fallback.
Reporting:
- `/context` counted the raw instructions in the source row and the retained
tokens again in the budget/loss rows. It now assembles once, counts the
assembled block in the source row, and gives the budget/loss rows no token
cost of their own.
Static-prefix guard:
- Rebuilds from the scope's retained usage minus the overage instead of
subtracting from the configured ceiling, which did nothing for a scope that
was already under its ceiling.
- The settled ceiling is kept on the engine, so later compositions cannot put
the trimmed files back.
- The load-and-assemble pass runs on a blocking worker instead of the engine's
async task.
- Its recomposed assembly's per-source losses are published with the
scope-level sentence.
- A newly installed conversation (`Op::SyncSession`) re-arms the guard and
rebuilds the notice from its own assembly.
- The notice is captured from the assembly that installs the header, not only
from the construction-time one.
Startup checks (`exec` and the TUI) run on `spawn_blocking`, and `exec`
includes `--append-system-prompt` in the sources it checks, so the gate and the
engine budget the same list.
Locally on this tree:
cargo test -p codewhale-tui --lib project_context 124 passed
cargo test -p codewhale-tui --lib prompts::tests 99 passed
cargo test -p codewhale-tui --lib debug_diagnostics 87 passed (fixtures re-recorded)
cargo test -p codewhale-tui --lib conformance:: 33 passed
cargo test -p codewhale-tui --test feature_registry 2 passed
Refs #6526
Two of the hosted-red checks seen on main (run 40208377293, PR #7087 at base
f98cb165a3) are repo-side drift, not the PR's:
- docs/features.toml: the cloud-computer-dispatch summary was 143 characters;
the feature_registry test allows 1-120 on one line. Reworded to fit.
- .github/scripts/release-workflows.test.js: e9c9de775f deliberately dropped
the codewhale-tui compatibility-path guard from scripts/release/install.sh
(the installer never writes that name), but this script still demanded a
legacy_tui validation, so the "Version drift" job failed with "archive
installs must validate the retired TUI path". The stale match and its
now-false comment are removed, and the companion doesNotMatch (which tested
a variable that no longer exists, so it could never fail) now asserts the
installer never installs a file to $BIN_DIR/codewhale-tui.
Still red and NOT fixed here: Lint fails on clippy::should_implement_trait for
FleetRole::from_str at crates/agent-contract/src/role.rs:148 (about 15 call
sites in crates/tui). That edit recompiles codewhale-tui and belongs to the
Engine owner's next batch.
Verified (own runs on the current tree):
node .github/scripts/release-workflows.test.js: exit 0 (was: AssertionError
at the legacy_tui assertion on the same tree before the edit).
python tomllib over docs/features.toml: 79 rows, 0 summaries outside 1-120
characters or containing a newline.
Not verified: cargo test -p codewhale-tui --test feature_registry (a tui test
build; the only reported problem was the summary length), hosted CI.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The first hosted test run found four real defects behind the feature. Each was
in this branch, not in `main`.
Configured `instructions = [...]` skips and duplicates were collected into a
local vector and never merged into `ProjectContext::notices`, so a missing or
empty configured entry was dropped silently — the exact failure the notice
contract exists to remove. They are now appended with the trim notices.
A refused candidate only produced a structured notice; the loader's
`warnings` vector — what `/context report` and the Runtime API listing read —
stayed empty, so an empty or symlinked `AGENTS.md` reported nothing. Both
loaders now carry the refusal text into `warnings` again, alongside the notice.
The conformance goldens and the `debug::diagnostics` baselines were re-recorded
for the intended layout change: configured entries moved out of the volatile
world-state "permissions" fragment into the global instruction scope, and
`/context` gained an "Instruction budget" row (source total 2367 -> 2506).
`context_expectations_preserve_counts_for_each_host` now derives the host
difference only from fixtures that actually carry a host-dependent count: the
top-source list can stop naming the environment block, which makes a fixture
identical on both hosts.
`docs/features.toml`: `cloud-computer-dispatch` (on `main`) had a 143-character
summary and failed the registry's 120-character rule; shortened to 120 with the
same meaning.
Verified locally on this tree:
cargo test -p codewhale-tui --lib project_context 124 passed
cargo test -p codewhale-tui --lib prompts::tests 99 passed
cargo test -p codewhale-tui --lib debug_diagnostics 87 passed
CODEWHALE_CONFORMANCE_UPDATE=1 … conformance:: 33 passed
cargo test -p codewhale-tui --lib 15302 passed, 15 failed
The 15 remaining local failures are sandbox, terminal-size and network cases
(`bwrap_*`, `enforced_readonly_*`, `theme_picker_*`, `read_file_home_path_*`,
dsh install, subagent timing). The hosted Ubuntu job, running the same suite,
reported exactly seven failures before this commit and none in those areas, so
these are artifacts of this read-only sandbox rather than of the change; the
hosted run is the authority for that.
Refs #6526
Two landed changes had no [Unreleased] entry.
- #7074 (@gaord): the Runtime API's turn.usage receipts now carry each call's
priced cost and billed prompt size and the mobile control page shows live
usage with a partial cost estimate. The contributor's PR did not touch the
changelog and the merge range has no other mention, so this entry carries the
credit.
- #6561: a generic fatal engine error no longer turns on offline queueing by
itself (7d84d0be6b). The environment-only authentication branch is unchanged.
crates/tui/CHANGELOG.md is regenerated by scripts/sync-changelog.sh.
Verified: scripts/release/check-versions.sh exits 0 after this change
(workspace, npm and lockfile 0.10.2; 26 linked issue references checked in
v0.10.1..HEAD) and sync-changelog reports the mirror up to date. Docs only; no
source file changed.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
scripts/release/check-versions.sh failed its feature-release-note audit on
three commits in v0.10.1..HEAD whose bodies reference #7082, #7084 and #4955
while the matching [Unreleased] entries cited only the tracking issues.
- The multi-line Live card entry (#6436) now also cites #7082, the closed
draft PR it replaced.
- The Ctrl+C composer-clear entry (#6237) now also cites #7084, the closed
draft PR it replaced.
- The --full-access entry (#6992) now also cites #4955 and thanks @eugenicum,
who asked for a zero-sandbox mode.
#7082 and #7084 were opened from the maintainer's own account, so they carry
no outside contributor credit. crates/tui/CHANGELOG.md is regenerated by
scripts/sync-changelog.sh.
Verified: scripts/release/check-versions.sh now exits 0 ("Feature release-note
receipts OK: 26 linked issue reference(s) checked in v0.10.1..HEAD", workspace,
npm and lockfile all 0.10.2) and sync-changelog --check reports up to date.
It exited 1 with three errors before this change. No version bump, tag or
release helper was run; no source file changed.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
CI's clippy gate removed the `collapsible_if` allowance, and
`crates/cli/src/cloud/computer.rs` had two nested `if` statements that the
lint now reports. Both are let-chain collapses with no behaviour change.
Refs #6526
Neither failure came from the instruction-budget change; both reproduce on a
pristine `main` checkout at b4103aa7b. They are fixed here as a separate
commit so a maintainer can drop it without losing the feature.
Clippy (stable 1.99):
- `crates/agent-contract/src/role.rs` — the inherent `FleetRole::from_str`
trips `clippy::should_implement_trait`. Renamed to `parse_label`, which is
what it does (parse a role label/alias, `Option<Self>`), with the 27 call
sites and the doc links updated. No behaviour change.
- `crates/tui/src/tui/ui/handlers.rs` — two `manual_pattern_char_comparison`
closures became char arrays.
- `crates/tui/src/tui/ui/frame.rs` — two `needless_borrow` arguments.
- `crates/tui/src/tui/work_surface/terminal.rs` — `sort_by` on a reversed
key became `sort_by_key(Reverse(..))`.
`cargo clippy -p codewhale-tui --all-targets -- -D warnings` (with the three
project allowances) now exits 0, and `-p codewhale-agent-contract` is clean.
Release workflows:
- `.github/scripts/release-workflows.test.js` pinned `legacy_tui` inside
`scripts/release/install.sh`, but the installer rewrite (e9c9de775) stopped
managing the retired TUI path entirely — `scripts/release/install.sh` no
longer mentions `codewhale-tui` at all. The assertion now pins what is true
and still matters: the archive installer must not mention the retired path,
and every payload is validated against its destination before the first
write. `node .github/scripts/release-workflows.test.js` exits 0.
Refs #6526
Refs #5637 (slice 1 only; the injected-secret-store request stays open).
Four MCP sites each decided where a secret variable comes from: ${NAME}
placeholder expansion, HTTP env_headers, the bearer-token variable, and the
OAuth default-header builder. The first three already read a reviewed plugin's
captured pre-dotenv HostEnvironment; the OAuth header builder read the process
environment for every server, including reviewed plugin servers.
mcp::mcp_secret_var(reviewed_plugin, name) is now the only place that picks
the source: a reviewed plugin reads only its captured host_environment, any
other server keeps the exact std::env::var behaviour. The four sites call it,
and oauth::build_default_headers takes the server config (its four callers
already held one) so the OAuth path gets the same rule. Error context strings
are unchanged and the resolver logs and returns nothing new. Ordinary servers
still share process-environment semantics; no provider credential store or
keyring is consulted and none is added.
Verified locally (macOS; no hosted CI): the same frozen tui lib nextest batch
as the preceding #6561 commit, 426 run, 426 passed, 0 failed, 14876 skipped.
Of those, mcp:: matched 408 tests, expand_env_placeholders 2, mcp_http_auth_ 2,
reviewed_plugin_environment_uses_only_the_pre_dotenv_snapshot,
reviewed_plugin_oauth_is_disabled_without_network_or_token_mutation and
configured_mcp_credentials_refuse_remote_http_before_header_resolution 1 each.
dead-code 209, blocking 543/165 and the runtime boundary check still pass.
Not verified: no existing test passes an env-header value through the OAuth
header builder or the HTTP env_headers path, so those two sites rest on source
audit plus compilation. No running MCP server was observed. The injected store
for embedded hosts is deliberately not part of this slice.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Refs #6561 (U02-01; the audit tracker stays open).
apply_engine_error_to_app set offline_mode for every non-recoverable error.
Three engine paths emit a fatal authentication error without starting or
completing a model turn (a finished background shell that cannot resolve its
route, a goal continuation that cannot resolve its route, and a child
completion that cannot resolve the resume route), so no TurnComplete follows
and neither lifecycle clearer runs. The flag then queued every later submit and
restored every explicitly selected queued message instead of sending it, so the
routing refusal blocked the next healthy attempt from even reaching route
validation.
Only the generic setter is removed. The environment-only authentication branch
still sets offline_mode, reopens provider setup and posts its targeted notice;
explicit offline onboarding, provider setup completion and failed-switch
rollback are untouched. The fatal error still finalizes the same cells, ends
loading, records failed status for an active turn and leaves the categorized
error in history. A still-broken route can fail again and the existing recovery
path keeps the unsent message; there is no automatic retry or provider rotation.
Two existing expectations flip and one existing test is renamed
(non_recoverable_engine_error_enters_offline_mode to ..._stays_online); no new
test was added. The comments that described the old behaviour on the offline
field, the error projection, the renamed test and fatal_auth are corrected.
Verified locally (macOS; no hosted CI): frozen tui lib nextest batch, 426 run,
426 passed, 0 failed, 14876 skipped, shared with the MCP change. Every named
existing test matched: non_recoverable_engine_error_stays_online,
keyless_engine_error_stays_visible_after_a_config_ack,
env_only_auth_failure_reopens_provider_onboarding,
recoverable_engine_error_does_not_enter_offline_mode,
offline_explore_selects_no_provider_and_writes_no_credential, the credential_
rejected_turn_ pair, credential_rejection_after_output_keeps_the_composer_empty,
recoverable_stream_error_keeps_active_turn_for_pending_approval,
provider_switch_auth_error_restores_previous_provider_and_model,
real_engine_client_preflight_failure_leaves_dispatch_state_atomic,
immediate_submit_closed_mailbox_restores_composer_and_skill and
submit_disposition_scenario (1 each), plus 8 engine_error tests.
Not verified: the trap itself was not reproduced in the running product. A TUI
run against a local daemon that answers every chat request with 401 shows the
in-turn authentication error and the existing resend note, which does not take
the no-TurnComplete path, so it cannot tell the old and new behaviour apart. The
three fatal paths above are known from source, not from a live run.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
0c2ab7d577 moved credentials into codewhale-runtime and rewrote crate::credentials
to codewhale_runtime::credentials in config.rs, config/credential_resolve.rs and
provider_readiness.rs. The longer paths made rustfmt want different line breaks
and I pushed that commit without re-running the format check after the move.
This is rustfmt output only: `scripts/dev-cargo.sh fmt --all -- --check` reported
12 differences in exactly these three files before and none after. No token was
added, removed or reordered.
Verified: fmt check clean. The tests for that move (774 passed) ran on the
unformatted text; the formatted tree is rebuilt and re-run in the next batch.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Contributor @gaord's live per-call usage, with maintainer review fixes on the PR branch (e454685f22): compaction no longer blanks the figure, settlement keeps priced-call estimates, the next turn resets instead of accumulating, replayed receipts count once, and money is labeled as a partial estimate. Verified locally: 512 tui runtime_threads/mobile/usage tests passed, and the corrected page was exercised in a browser against a local Engine turn. No hosted CI ran before this merge.
Review fixes on top of the contributor's live-usage change, kept on the
contributor's branch so the PR lands as itself.
- Automatic compaction items no longer blank the conversation's figure, and a
compaction pass is never presented as the conversation's spend. A compaction
that owns a separate Runtime turn resets the figure like any new turn.
- turn.completed replaces the token counts with the authoritative
payload.turn.usage but keeps the priced-call estimates already observed, so
the price no longer disappears at settlement.
- The figure carries its turn id and replay high-water sequence per thread. A
new turn resets it, so the next turn no longer accumulates onto the last
one, and a replayed start, receipt or completion cannot reset or re-add it.
- Money reads "~$0.10 partial" with a tooltip that names what it excludes
(unpriced, child and compaction work); an unpriced call accrues tokens but
never invents free money, and amounts require the matching *_priced flag.
- The four tests that matched the page's source strings and the new code
comments are removed to follow the repository's no-new-tests, no-new-comments
rule for this change; the existing recovery-test receipt assertions stay.
docs/RUNTIME_API.md and its zh_hans mirror describe the final behaviour.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
First placement-independent step of the S7=(c) decision (config, credentials
and OAuth move toward codewhale-runtime). credentials has no dependency on any
other tui module (0 outbound edges) and is the only module the config cluster
was blocked on at module level (23 references), so it moves first and alone.
- scripts/split/move-modules.py credentials rewrote the seven callers
(config, config/credential_resolve, config/tests, provider_readiness,
runtime_api/secrets, tui/provider_picker, client test cases) to
codewhale_runtime::credentials. No shim or re-export stays in tui.
- scripts/split/widen.py widened exactly the 38 items the compiler named
(pub(crate) to pub) and deleted three expect(dead_code) attributes the export
fulfils. Token and key material is unchanged: Credential keeps its
hand-written Debug that prints only the variant tag, and secrets stay behind
the existing store trait.
- MapAuthContext is gated on any(test, feature = "test-support") instead of
cfg(test) so tui tests can still use it across the crate boundary; the tui
dev-dependency on runtime already enables test-support.
- codewhale-runtime gains a codewhale-secrets dependency (Cargo.toml and
Cargo.lock). codewhale-secrets is a leaf; the command-crate-boundaries check
still passes with runtime free of UI packages.
- One module comment that named crate::config::credential_resolve now names
codewhale_tui::config::credential_resolve. THIRD_PARTY_NOTICES and the old
decomposition roadmap carry the path sweep; the roadmap still plans a later
move into codewhale-secrets, which S7=(c) supersedes.
- dead-code budget lowered 212 to 209.
Size: codewhale-runtime production lines 14,699 to 15,416 (closure_report),
tui 965,801 to 965,081. This is NOT progress on the 79-module SCC (credentials
was never in it) and the crate split is not done. Honest headroom note for the
founder: moving the rest of the S7=(c) cluster (config 14,105, settings 5,935,
config_persistence 2,180, oauth 9,896, codex_model_cache 608 = 32,724
production lines) would take runtime to about 48,140, within about 1,900 of
the 50k ceiling and far from the 10k typical target, with no room for the 13
other wave-0 modules (5,988 lines).
Verified (macOS, local only; no hosted CI, Linux/FreeBSD/Windows compile):
- scripts/dev-cargo.sh build -p codewhale-cli --bin codewhale --locked: exit 0
(known ld __eh_frame warning only).
- nextest -p codewhale-runtime -p codewhale-tui --lib, filters runtime
credentials:: and tui credential / secrets / provider_readiness /
provider_picker / config::tests: 774 run, 774 passed, 0 failed, 14792
skipped (10 runtime credentials tests, 755 tui tests).
- module_graph --check 121 closure modules PASS, blocking calls 543/165,
command-crate-boundaries PASS, dead-code 209 (budget updated).
Not verified: a signing-in or key-saving run through the product. The
exercised paths are the existing unit and API tests only.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Resolves the conflict with 10ce9cde ("part 1"). `crates/tui/src/project_context.rs`
keeps this branch's loader: it supersedes the truncating read with per-scope
token budgets, segment-level trimming, and the notice contract. The 100 KiB
truncation that 10ce9cde introduced is *not* in this resolution, which is the
open question raised in the pull request — if truncation is the intended
content policy, the follow-up keeps 8 MiB as the memory guard that skips and
adds the 100 KiB head-truncation on top.
CHANGELOG keeps main's entries and re-adds this branch's bullet;
`crates/tui/CHANGELOG.md` and the generated web data are regenerated from their
owners rather than merged by hand.
Refs #5848 (kept open: see "Not verified").
The alphabetical-first election in the runtime resolver is deleted. The
provider lake stays the single catalog and default authority.
- /api/tags is read natively, carrying completion, tools and thinking
capabilities. Tags that omit capabilities reuse the bounded /api/show pass
with the listing client's authorization and redirect policy. Only rows with
positive completion capability become chat rows; embedding rows never reach
the picker, and choose_chat_tag ranks the filtered roster and marks
default_for_provider. valid_catalog_model_id runs before election, known
secret-bearing tags are rejected before any authenticated profile call, and
the whole profile-future error is redacted before shared logging.
- The first-run probe builds the same delta and returns the elected default,
so there is no second election. A daemon reporting no completion capability
gets no automatic default; an explicit real model still passes through.
- /provider ollama refreshes before resolving. The CLI exec route and the
Runtime API (tasks, threads, stream), including an explicit
model_provider/model_provider_id and blank, auto or placeholder models, await
a targeted refresh. refresh_local_ollama_catalog serializes through one
async mutex whose guard moves into the blocking worker, so a cancelled caller
cannot release it before publication; a queued call reuses only an exact
successful cache entry fetched since it queued, with an elected default and
an authoritative same-endpoint partition (this includes A to B to A). Startup
gets a background refresh; no config read waits on the network.
- Served context is the positive loaded /api/ps context_length, never the
trained /api/show maximum. The observation is current for 60 seconds, then
only that context fact clears; the 24h roster TTL is unchanged. The Ollama
runtime resolver cache is bypassed so an expired fact cannot survive in it.
Unloaded or unknown context stays the explicitly unverified 8192 floor;
configured context overrides keep precedence. Frozen active routes remain
snapshots: no mid-turn revocation, warmup, num_ctx change or polling.
The 60 s window is a proposal, not release qualification.
Verified locally (macOS; Ollama 0.40.9 on localhost, qwen3:4b
completion/tools/thinking and nomic-embed-text embedding; no hosted CI, no
paid route, no Linux/FreeBSD/Windows compile; every check below ran once on
the combined tree of this commit and the preceding browser/OAuth commit, on
base 62bbcebf2b, before the two were split for landing):
- nextest -p codewhale-runtime -p codewhale-tui --lib, focused filters
(local_ollama, route_runtime, model_inventory, provider_catalog_live,
unresolved_ollama_client_waits_for_catalog_but_probe_can_bootstrap,
api_provider_default_and_model_list_follow_exact_local_catalog,
api_config_reports_local_default_availability_without_blocking_config_reads,
oauth::, plugins::providers::, browser::): 251 run, 251 passed, 0 failed,
15315 skipped. Every filter matched nonzero tests (10, 37, 28, 25, 1, 1, 1).
Six existing fixtures now carry default_for_provider because the implicit
election they leaned on no longer exists.
- Built binary, isolated HOME and CODEWHALE_HOME, env -i:
* real daemon, fresh home, exec --provider ollama with no model: wire model
qwen3:4b (not the embedding tag), turn completed with output "OK".
* real daemon, Runtime API ready in 0.23 s, immediate no-model, blank,
explicit model_provider, and model_provider plus id admissions all
resolved qwen3:4b with the model unloaded; /v1/providers/ollama/models
listed only qwen3:4b at the 8192 fallback. With qwen3:4b loaded the same
list showed 32768 (from /api/ps) against a trained 262144. A no-model task
and a no-model stream both ran to completion on qwen3:4b.
* first-run TUI (pty, no config): "Provider switched: deepseek -> ollama,
Model: deepseek-flash -> qwen3:4b"; configured deepseek then /provider
ollama switched to qwen3:4b. Embedding tag never adopted.
* mock daemon with 1 s per request (race forced): first admission waited
2.0 s and succeeded; two concurrent fresh admissions both succeeded with
exactly one /api/tags and one /api/ps fetch; an explicit Ollama target
while deepseek was active did the same. Embedding-only roster: 400
"no fresh model catalog", empty model list, model_available false. Legacy
tags without capabilities used /api/show and still elected the chat tag.
Context 16384 from /api/ps held for the 60 s window, cleared to 8192 at
about 65 s with the default still available, and returned on the next
admission. Endpoint A to B to A within 60 s: B showed 8192, A 16384.
- dead-code 212 (at budget), blocking calls 543 sites / 165 files,
module_graph --check 121 closure modules, reqwest builder, provider registry
and changelog sync checks pass.
Not verified: a baseline binary was not built, so the admission race is shown
passing on this tree rather than failing on the previous one. An unreachable or
stalled local endpoint during /provider ollama (the switch awaits a bounded
refresh) was not exercised. Configured context override precedence was not run
in the product. The embedding-only error text reads "no fresh model catalog",
which is accurate but unhelpful; improving it is left open. Model execution was
shown only for exec, API task and API stream on qwen3:4b; this is not release
qualification.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Two prerequisites for the S7 decision (config, credentials and OAuth move
toward codewhale-runtime, not codewhale-config). They remove the two edges
that would otherwise force oauth.rs to keep a dependency on tui-only modules.
- utils::open_url and browser_open_command move to codewhale_runtime::browser
with their two existing tests. All four production callers migrate
(oauth orcarouter login, runtime_api web bootstrap, overlays open_external_url,
commands/contract browser open). No shim and no re-export remain in utils.
- plugin_oauth_login moves from oauth.rs to plugins/providers.rs, next to the
verify_provider_binding it calls. Both callers migrate (lib.rs TuiAuthCommand::
PluginLogin, event_loop run_plugin_oauth_from_tui). The body is unchanged:
PolicyScope propagation, the three binding checks, PKCE state and issuer
validation, and the secure-store write after the last binding check keep their
order. Six oauth.rs items widen to pub(crate) (wait_for_callback_validated,
PluginOAuthConfig::callback_params and authorize_url, PluginOAuthTokens,
plugin_oauth_slot, plugin_token_response); token fields stay private.
- docs/design/TUI_DECONSTRUCTION.md records the founder's 2026-10-25 S7=(c)
placement, the 10k-typical/50k-ceiling crate target, and the two-slot build
rule. Nothing here is a claim that the crate split is done: the largest SCC
is still 79 modules before and after.
Verified (macOS, local only; no hosted CI, Linux/FreeBSD or Windows compile):
- scripts/dev-cargo.sh build -p codewhale-cli --bin codewhale --locked: exit 0,
only the known ld __eh_frame warning. A first pass failed on one unused
anyhow::Result import in utils.rs, removed in this commit.
- nextest -p codewhale-runtime -p codewhale-tui --lib, focused filter set:
251 run, 251 passed, 0 failed, 15315 skipped. Of those, browser:: 2 (the moved
tests), oauth:: 143, plugins::providers:: 3.
- module_graph.py --check: 121 closure modules, PASS. check-dead-code-budget 212
(exactly at budget). check-blocking-calls-budget 543 sites / 165 files.
Not verified: the interactive browser launch and the plugin OAuth round trip
against a real issuer were not exercised; only the existing unit tests ran.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Three review findings from an independent pass over the first two commits.
The startup instruction notice resolved its budgets for an unknown window
(128k). On a large-window route that can report a trim that will never
happen, and under `policy = "refuse"` it can stop a session whose
instructions would have fitted. Both call sites now pass the route's real
window: `exec` derives it from the validated route, the TUI from
`App::effective_model_for_budget`. `startup_instruction_notice` keeps the
`Option` so a caller without a route still works.
A trimmed notice said "kept N of M bytes and ~K of ~T tokens"; the design
requires the numbers to be labelled as estimates. It now says "estimated
tokens", matching the marker embedded in the prompt.
`unimported_foreign_warnings` stopped naming `CLAUDE.md` as unloaded once
the default fallback started reading it — but it skipped the whole Claude
format, so a workspace with only `.claude/instructions.md` (which is not a
fallback candidate) lost its opt-in hint entirely. The excuse is now scoped
to a directory that actually has a fallback candidate.
Refs #6526
`docs/CONFIGURATION.md` gains an "Instruction budget" section: the two
scopes, the `[instruction_budget]` keys with the effective-budget table for
32k/128k/1M windows, what is trimmed versus skipped, `policy`, the
static-prefix guard, the `claude_fallback` selection rule, and the notice
channels. The `instructions = [...]` rules are corrected to match the new
behaviour (entries are global-scope authority, oversized entries are
skipped with a notice instead of being truncated).
`config.example.toml` replaces the fixed 48 KiB comment with the documented
table. `CHANGELOG.md` and `crates/tui/CHANGELOG.md` (via
scripts/sync-changelog.sh) carry the entry. `docs/zh_hans/CONFIGURATION.md`
gets an explicit deferral note with the sync date plus the one selection
change it must not get wrong. `docs/features.toml` registers
`instruction-budget`, and the generated web data is regenerated with
`web/scripts/derive-facts.mjs`.
Refs #6526
Standing instructions were one 48 KiB byte pool shared by the workspace
chain, the global fallback, the configured `instructions` array and the
rules block, trimmed from an opaque joined string and reported nowhere an
operator would see it.
They are now two independent scopes:
- `global` — the global AGENTS.md/instructions.md chain, `~/.claude/CLAUDE.md`
as a last resort, and the configured `instructions = [...]` entries;
- `project` — the repository-root → workspace chain, a co-read `CLAUDE.md`,
and the rules block.
Each scope is capped at `min(absolute_tokens, percent × usable_window)` in
estimated tokens, where the usable window is the route window minus the
response ceiling and a 10% safety reserve. Defaults are 100k tokens / 25%
per scope, so a huge project can no longer shrink the user's global
preferences and vice versa. Rules are charged to the project scope after
the instruction chain.
Selection follows OpenCode's model with codewhale's sources preserved:
AGENTS.md wins; a directory without one falls back to CLAUDE.md
(`claude_fallback = false` opts out); an explicit `claude` import co-reads.
A candidate that is skipped for size or emptiness counts as absent and the
next one is tried; a file already loaded from a wider scope is reported as
a duplicate and does not trigger the fallback.
Skips are never trims. The per-file ceiling (`file_max_bytes`, 8 MiB), an
empty file, the 50-file rules cap and a symlinked duplicate are all
reported with the limit that produced them, so a single bad file cannot
make a workspace unopenable.
Every loss reaches the user (a system cell at TUI start, stderr in `exec`),
the model (a runtime-provenance message on the first turn, which is part of
the logged transcript) and `/context report` per source, with path, scope,
source, action, bytes, tokens and limit kind. `policy = "refuse"` stops the
session on a trim instead of proceeding; skips stay skips.
A static-prefix guard keeps the stable prefix — base prompt, instructions,
skills index and tool schemas — under `static_prefix_guard_percent` (80%)
of the usable window, trims the largest scope by the overage once, and
re-pins the header under a declared reason.
Config is a new `[instruction_budget]` table: `deny_unknown_fields`, user
config only (the project overlay ignores it and warns, like `instructions`),
validated at load so a broken table fails the launch instead of applying a
nonsensical budget.
The project-context cache still keys on files: raw segments are cached and
trimmed per request, so a context-window change never invalidates the cache
and a content change never reuses trimmed text. `ProjectContext` carries
`instruction_segments` and `notices`, and the joined string is rebuilt
after trimming.
Verification: `cargo check --profile test -p codewhale-tui --lib` exits 0
with `-D warnings`, which typechecks the crate and every new test. Test
execution is still pending in this environment — the shared cargo registry
and target directory are read-only here, so the build runs against an
isolated `/tmp` target where this crate needs roughly an hour of codegen.
Refs #6526
FreeBSD stays a source-only target, with no prebuilt asset and no
release-matrix row (founder decision 2026-10-25, item 14). This change
fixes the claims the issue sweep found to be false or stale:
- packaging/freebsd/README.md said x86_64-unknown-freebsd "is validated in
CI ... on the release/0.9.5 branch". No job does this:
`git grep -i freebsd -- .github scripts` matches only a YAML comment. The
README now says no CI job checks the target and gives the cargo check
command to run on a FreeBSD host.
- The README pointed to crates/tui/build.rs for the rquickjs bindgen fix.
1582ba9653/5eb0385e8f touch only crates/workflow-js/Cargo.toml, which
holds the target_os = "freebsd" bindgen dependency. It now names that
file.
- The README now states the Rust minimum, 1.89 (Cargo.toml rust-version),
and its verification block no longer says ">= 1.88". The matrix list now
says Linux musl arm64, which is the target the matrix builds, not gnu.
- The release-artifacts.yml build-job comment no longer claims a FreeBSD
cargo check. It now says FreeBSD has no prebuilt asset, no npm binary and
no CI check.
- "OpenBSD" is dropped from the support-table row in docs/INSTALL.md and
docs/zh_hans/INSTALL.md. workflow-js has no rquickjs bindgen entry for
openbsd, and no OpenBSD build has been verified.
Ignore the vendor Ratatui target directory produced by its separate-workspace
test command; generated output is preserved in the SSD cache, not committed.
Docs, ignore rules and a YAML comment only; no product behaviour changes, so no CHANGELOG
bullet. Verified by read-only greps against the worktree. No FreeBSD compile was
attempted.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
This does not resolve#1097: the npm prebuilt and pkg port asks remain open.
Refs #1097
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A saved session whose provider table was deleted could not be reopened.
`codewhale resume <id>` runs prepare_mounted_session before the TUI
starts. That function resolved the saved provider identity and refused,
with no recovery hint. exec --resume already had an explicit way out: a
launch --provider keeps the named route (resolve_exec_resume_route).
The TUI resume had none.
The founder chose option A (FOUNDER-DECISIONS-20261025 item 8): an
explicit launch provider moves the session, the same way exec does. When
the launch names a provider (explicit_launch_provider_override, the
signal exec_resume_route_overrides reads), prepare_mounted_session now
resolves the live active_provider_identity() instead of the saved one.
The model is the explicit --model if given, otherwise that route's
default. The explicit launch route is credential-preflighted before any canonical
history operation is reserved. The new route rides the existing
CanonicalHistoryOptions.overrides (model_provider, model_provider_id,
model). decode_history_overrides already validates those fields, and
the history create path now replaces provider kind and exact ID together,
clearing an inherited named ID for a root custom route. The update path
preflights the named provider's credentials. The committed session
document then records the new route, so the post-commit admission and
the event loop's apply_loaded_session_with_goal admit it unchanged.
There is still no silent fallback. Without --provider the resume
refuses as before. The mount path refusal, shared by `resume` and
`fork`, now carries the recovery hint as well. The shared
export_recovery_hint names `codewhale --provider <name> resume <id>`
before `codewhale sessions export <id>`, so the TUI /resume, exec
--resume, Runtime API and mount path refusals all show the way out.
Fork routing is unchanged.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Fixes#6996
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CW-7500 (574dc76e26) removed SUBAGENT_SUSPECT_AFTER, which treated a
Running child past its wall budget as suspect, together with the default
child wall time. Since then, every current-session Running row in
subagent_cache counts in live_running_agent_count. Every recovery
branch of reconcile_turn_liveness_with requires !has_running_agents,
and the engine heartbeat enters TurnPhase::Tools with no bound, leaving
that bound to the UI tool-hang watchdog. So a tool batch waiting on a
wedged child, or on a ghost Running row whose AgentComplete was lost,
could again sit silent forever while follow-up messages queued behind
it.
Founder decision (FOUNDER-DECISIONS-20261025 item 7): a running child
that has reported no progress for 10 minutes counts as suspect again.
"No progress" is measured from AgentProgressMeta.last_progress_at,
which each mailbox envelope and Engine AgentProgress event refreshes. If no envelope has
arrived yet, it is measured from the row's started_at. It is not
measured as elapsed wall time. The bound reuses
max(TOOL_HANG_WATCHDOG_TIMEOUT, child heartbeat_timeout_ms), preserving
legitimate child operations whose configured heartbeat bound exceeds 600s. A row with neither clock is never
suspect. Prior-session rows stay suspect as before. Child wall time
stays unbounded: a child that keeps reporting progress is live however
long it runs. This sits above the engine's own per-child heartbeat
auto-cancel, so in practice it catches rows the manager cannot settle:
ghosts, and children whose executor is wedged.
suspect_running_agents and live_running_agent_count take `now` again,
as they did before CW-7500. The stall-record detail no longer claims
that every suspect was retained from a prior session.
The existing test
stall_prior_session_subagent_is_suspect_but_long_running_child_is_live
now gives the 2h-old current child fresh progress, so it stays live.
The new silent-child scenario was removed under the no-new-tests rule;
only the existing scenario setup and signature updates remain.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Refs #6184
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A long draft or pasted text now grows the composer past its per-density
row cap (Compact 7 / Comfortable 9 / Spacious 12), so it can be read and
edited before sending. The frame sets the bound: composer room is
min(existing frame room, max(density rows, body_height / 2)), so short
terminals never get a smaller composer than before and the transcript
keeps MIN_CHAT_HEIGHT.
native_composer_height (vendored kit) clamps to `available` only when no
menu is open. With a slash, mention or history-search menu open it keeps
the previous clamp, available.min(density.max_rows()). That keeps the
worst-case menu reservation and stable layout from the v0.8.8 jitter fix
exactly as before. ComposerWidget::desired_height passes the frame's
bound unchanged, and frame.rs reuses widgets::composer_max_height (now
pub(crate)) as the density floor of that ceiling.
This builds on PR #7078 and applies its review fixes:
- menus no longer inflate the composer. The PR counted menu rows when
deciding to grow, which broke the mounted/legacy parity test (left 9,
right 7)
- the frame ceiling is max(density cap, body/2), not min(body/2), so
Spacious/Comfortable keep their height on short terminals
- the frozen legacy painter (composer_legacy.rs) passes the same bound
as the mounted widget, so the parity test still compares buffer,
caret, submit rect and height for the intended growth case
- the PR's new `bounded` assertion and added test comments are dropped.
Existing expectations change only where growth is intended
(composer_chrome content_growth test: 9/12 -> 21; widgets
composer_auto_fits test: 40-line draft -> AVAILABLE rows). The
composer_chrome content_growth test takes the PR's name because the
old name became false
apply_external_edit now clears pending_paste_reference and
oversized_paste_full_text the way clear_input does, so a stale paste
attachment can never replace an $EDITOR edit at submit. Those fields are
set only when an oversized draft is consolidated (submit_input, and
launch_submit_held on the startup screen) and are normally taken by the
same submit, so this guards a narrow path rather than fixing an observed
loss.
The standalone starter and README example pass half the terminal height
as composer room, preserving conversation rows when content grows. The
existing density comment now describes its menu-only cap.
vendor/codewhale-ratatui/UPSTREAM.json is intentionally left alone. Its
`files` hashes record the original upstream snapshot (version_note), 11
locally patched files already differ from them, and writing this edit's
hash would falsely claim the file matches upstream 2ad795b.
Not included: the Ctrl+Shift+O / F4 hint for long drafts (CW-7525
section B), so this refs rather than fixes#7049.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Builds on PR #7078 by @Hmbown.
Refs #7049
Refs CW-7525
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reasoning cells parsed their markdown through render_markdown, which
picks the syntect theme from terminal or OS detection. With a dark theme
such as Shoreline in a light-profile terminal, a code fence inside a
thinking block got InspiredGitHub's near-black tokens on the charcoal
reasoning surface.
render_thinking_with_preview_limit now takes a palette_mode, and
HistoryCell::lines_with_options_folded passes the caller's
TranscriptRenderOptions.palette_mode, which
App::transcript_render_options sets from the active ui_theme.mode. Both
the expanded body and the collapsed preview render through the existing
render_markdown_tagged_with_palette, so there is still one palette-aware
entry point and no second wrapper. render_thinking_with_analysis serves
HistoryCell::lines() and transcript_lines(), which have no render
options, so it passes markdown_render::detected_palette_mode(). Pager and
clipboard output therefore behaves as before. The transcript caches
compare the whole TranscriptRenderOptions, so a theme change also
invalidates thinking cells.
The render_markdown doc comment named the Thinking body and the
immediate message body as its callers. Neither is true now, so it names
the archived-context body, its only remaining non-test caller.
Still open for #7043: archived_context.rs, render_message,
TranscriptRenderOptions::default, the background-only overlays and
fills, and the contrast-floor skip for theme-remap presets in
color_compat.rs.
Based on PR #7079 by @Hmbown, with the review fixes applied: no new
render_markdown_with_palette wrapper or doc comment, reuse of
render_markdown_tagged_with_palette, and the cached detected mode on the
path without render options.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Refs #7043
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The DeepSeek descriptor defaults base_url to https://api.deepseek.com/beta.
fetch_deepseek_user_balance appended /user/balance to the configured base
URL, so both /balance and the background balance chip requested
/beta/user/balance. DeepSeek serves its balance endpoint at the API root,
not under the /beta inference prefix. balance_get_json logs the non-2xx
status only at debug level, so the user saw only "Could not fetch DeepSeek
account balance. Check the provider dashboard."
The URL is now built from the base URL with trailing slashes trimmed and
one trailing /beta or /v1 removed. Only ProviderKind::Deepseek reaches
this function (balance_api_for). Custom or proxy hosts without those
suffixes are unchanged. The match is case-sensitive.
Based on PR #7077, with the reviewers' fixes applied. The strip is
inlined into the private fetch_deepseek_user_balance instead of a
pub(crate) helper that would be glob re-exported through
`pub(crate) use provider_routes::*`, and the PR's new unit test is
dropped under the no-new-tests rule. Adds an [Unreleased] CHANGELOG
entry.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Based on PR #7077 by @Hmbown.
Refs #7055
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6526 (part 1: truncate instead of drop).
Before this change, a file over the 100 KiB per-file cap failed with
TooLarge and was skipped. That applied to an AGENTS.md (or an opted-in
foreign file) in the repository-root-to-workspace chain, and to a global
~/.codewhale|.agents|.deepseek AGENTS.md or instructions.md. A sibling
candidate could then load silently in its place, and the global search
moved on to the next path. Such a file now keeps its first 100 KiB. It
ends with the existing sized marker "[...truncated: N of M bytes omitted
- consider splitting AGENTS.md]". The label is the bare file name, so
no absolute path enters the pinned prompt.
Reuse instead of a copy. prompts::read_prompt_file_bounded is split.
The new pub(crate) core, read_prompt_text_bounded(fs::File, cap), takes
a file that is already open. The path wrapper stays for its two
prompts.rs callers. The chain loader keeps fs_confined::open_read and
the global layer keeps open_user_read, so symlink confinement is
unchanged. prompts::cap_prompt_text becomes pub(crate) and builds the
marker. The strict read_context_file and its TooLarge error stay for
the constitution JSON loader and for rules files, which must not be
truncated silently.
Operator visibility. A truncated file pushes a sized warning into the
chain and global-layer warnings: "Context file <path> is too large
(<size> bytes, max 102400); truncated to its first 102400 bytes". That
warning reaches /context report and GET /v1/workspace/instructions.
The instruction source map uses the same truncating loader and carries
the warning on the Loaded entry. The discovery probe for foreign files
that are not imported uses it too, so an oversized CLAUDE.md that has
not been imported still produces the hint. load_dir_instructions' doc
comment now says its warnings include truncated candidates.
Honest aggregate marker. A head-truncated chain file is still
front-trimmed at the 48 KiB aggregate budget. The broader-scope marker
is now chain_truncation_marker(dropped, total), which gives the bytes
dropped and the assembled length before the trim, so the two markers
together describe what the model lost. It is sized before the cut, so
the result stays within the budget. keep_tail_within still keeps the
tail, and the per-file cap is unchanged. The founder's 2026-10-25
decision keeps nearest-scope precedence. docs/CONFIGURATION.md now
documents it, along with the per-file and aggregate limits. The docs
say plainly that instructions claim the budget first and rules are cut
from the end, and that a file larger than the budget keeps only its
end.
The workspace-only loader now assembles unbudgeted content; the parent
and global loader applies the aggregate ceiling exactly once after all
sources are assembled. Its direct existing tests keep a budgeted test-only
wrapper. This preserves truthful aggregate truncation counts.
Regenerate web/data/agent-docs.generated.json from the owning documentation.
The existing test nearest_scope_survives_when_the_budget_forces_a_cut
now matches the sized marker's stable text instead of the removed
const.
Not in this change: part 2 (a session-start notice backed by a session
event), part 3 (the [context] budget keys and their hard maximum), and
the "[...elided]" wording for the `instructions = [...]` loader (#454).
Builds on PR #7081 by @Hmbown (CodeWhale Boat run). Reviewer fixes:
reuse the bounded reader, drop the PR's three new tests and comments,
put sizes in the aggregate marker, restore sized warnings.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The ambient skills index cuts each description at 400 chars (tier 1). It
shortens rows in proportion when the block is over budget (tier 2), and
drops to names only after that (tier 3). Before this change only tier 3
left a model-visible trace, so the model was never told that
`load_skill name="list"` would show it more. When any rendered row was
shortened, the index now ends with:
- ... descriptions shortened for N of M skills; `load_skill` with
`name="list"` returns full text.
M counts only skills the model can invoke, so explicit-only skills are
never counted. The footer's worst-case length is set aside only when
shortening can happen: tier 1 with at least one capped row, or tiers 2
and 3. A pack that fits unshortened, including the bundled pack, keeps
its full budget and renders exactly as before. The budget debug_assert
still holds.
One rule now decides shortening. `IndexRow::exceeds_index_cap` (summary
plus trigger chars over MAX_SKILL_DESCRIPTION_CHARS) matches what
`description_split` does at the cap. `description_exceeds_index_cap`
wraps it for `/skills inspect`, which used to make its own
whitespace-collapsed count of the raw description and could disagree
with the renderer. The inspect note no longer prints a count of its own.
/context report and /context json read the count back through `shortened_skills_note`, which
matches the exact footer prefix the renderer writes (a shared constant).
It puts "descriptions shortened for N of M skills" on the SkillsBlock
entry, instead of searching the block for a phrase. A skill row cannot
collide with the prefix, because skill names must start with [a-z0-9].
PR #7075 also added a discovery warning for over-length descriptions.
That warning is left out. Registry warnings go into the ambient
`### Skill load warnings` section, and any warning reserves up to
about 3.3k chars of the index budget at a 128k window. So one long
imported description would have shortened every other row, and the
same warning would also have reached plugin diagnostics and the skills
audit state. The footer, /context report, /context json and /skills inspect carry
the signal.
The MAX_SKILL_DESCRIPTION_CHARS doc comment said over-length
descriptions were reported as a load warning; none ever were. It now
names where shortening is actually reported.
The founder approved the footer text on 2026-10-25. Config knobs for
the row cap and the budget share, and a per-skill name-only state, are
still open (#7073 pieces 3 and 4, with #7066). Hence Refs, not Fixes.
No tests were added.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Builds on PR #7075 by @Hmbown.
Refs #7073
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6436. The founder chose option (a) on 2026-10-25: no new setting.
ae357d63df fixed the main complaint in #6436: the running card's header
now names the command instead of showing the Ctrl+B hint. But
command_header_summary keeps only the first line. Several cards also
returned before reaching render_command_mode:
- a running foreground shell wait, in both render_with_locale and
render_calm
- a non-calm Live success card, including one whose output spilled over
As a result, the second and later lines of a heredoc, a loop or a
multi-line && chain never appeared on the Live card. A running
command's body was missing from Transcript too.
Changes in ExecCell:
- render_with_locale draws a multi-line command through the existing
render_command_mode before its compact-card returns. This covers a
foreground wait (Live and Transcript) and every Live success, the
spillover case included. Live is capped at TOOL_COMMAND_LINE_LIMIT (6)
wrapped lines with the existing "command" details affordance;
Transcript is uncapped. A Transcript success still draws the command
once, from the existing full body.
- render_calm shows its command block, the one failed cards already use
(calm "$ " prompt), for multi-line Running and Success cards. The
condition is now an exhaustive match on ToolStatus. Failed keeps its
existing rule. Hydrated, Stopped and Warning are unchanged. The calm
dispatch's TOOL_SUMMARY_CARD_LINES cap still bounds the whole card.
- Single-line commands take none of the new paths, so their cards are
unchanged.
There is no new settings key. Draft PR #7082 (an opt-in
running_shell_command enum) is superseded. It was an agent-authored
skeleton that did not compile and never reached the render paths.
The doc comment on a_foreground_shell_wait_names_its_command_without_a_key_hint
said the card does not re-print the command, and that it tells the user
how to take the terminal back. Both are now false, so the comment is
corrected. The test's assertions are unchanged because it uses a
single-line command.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder decision on #6237 (option A, 2026-10-25): plain Ctrl+C on an idle
composer that holds a draft clears it recoverably, and Ctrl+Z restores it
through the existing ClearedInputRestore path. The two-tap exit prompt arms
only once the composer is empty. Cancel still beats clear: a selection
copies first, then an in-flight turn, compaction or goal-continuation wait
is cancelled, and only after that does a non-empty composer clear. This
reverses the #1757 one-meaning-per-key split for Ctrl+C. It matches the
muscle memory from sibling tools that the issue describes.
ctrl_c_disposition gains a ClearInput branch between CancelTurn and
ConfirmExit. The clear body that the Esc ClearInput arm had inline is now
App::clear_composer_draft: it resets backtrack, disarms quit, drops
edit_in_progress, makes the recoverable clear and shows the restore tip.
Esc and the new Ctrl+C arm both call it. Disarming quit on clear means a
cleared draft restarts the order clear, then arm, then exit. Without the
disarm, Ctrl+C on an empty composer, then typing, then Ctrl+C twice would
exit right after the clear. On main, an armed prompt plus a draft exited
on the very next Ctrl+C. Esc-clear now disarms a pending exit too.
PR #7084 also added a ClearInput arm to the launch-screen Ctrl+C block.
That arm is left out because the block cannot be reached:
LaunchState.composer_focus is always true. handle_launch_composer_key
returns ComposerAuthority for Ctrl+C, so the key falls through to the
session-shell arm, which also clears a launch-screen draft.
The PR's three new tests and its added rationale comments are not carried.
The existing doc comments are updated to the new priority order.
docs/KEYBINDINGS.md now lists the global Ctrl-C row in real priority order
and adds an editing-table row. The [Unreleased] CHANGELOG entry is added. In-app key help now names
draft clearing in all 15 locale packs; the install guide agrees. The
pre-existing vocabulary failure is corrected by advertising only the
canonical --full-access flag in the TUI guide; the parser alias remains.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Based on PR #7084 by @Hmbown.
Fixes#6237
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7070.
Since #5909, whole-file `write` restores the existing file's line
endings. That stops accidental CRLF-to-LF flips, but the result still
said only "Successfully wrote N bytes", so after a deliberate LF request
the agent told the user the file was LF while every line stayed CRLF.
When restoring endings actually changes the supplied content and the
existing file has an observable newline style, the success summary now adds "kept the existing file's CRLF (or
LF) line endings (write does not change a file's line-ending style)".
Bytes on disk are unchanged, and new files and same-style overwrites
get the same summary as before. A newline-free old file no longer gets
a false LF attribution, and lone-CR input conversions are reported.
Actually converting endings through `write` would change the
model-visible schema (PR #7076's `line_endings` field) and is deferred
until users ask for it (founder decision 2026-10-25, item 4).
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6728.
git_status.rs documents that the git probe backs off after 30 s with "no
input and no engine event". Both probe consumers (set_probe_backoff and
probe_due) read last_ui_activity instead, which any non-quiescent UI
state also moves. A running background job keeps an exec cell
animating, so that clock was reset on every tick and the probe stayed on
its 2 s cadence for as long as the job lived: the reporter's FreeBSD
ktrace shows 89 git execs in about 10 s, in bursts about 2.1 s apart.
A second clock, last_input_or_engine_event, is moved only by terminal
and engine events, and both probe consumers now read it. The idle poll
and the automation scan stay on last_ui_activity. Showing the Git panel
still forces the fast cadence through git_probe_quiet_for. The two
comments that described the old shared clock are corrected.
The second cause in #6728, the fixed event-loop wake rate during an
approval wait or a background job, needs a design slice and the
reporter's FreeBSD measurement, so the issue stays open.
The dual-refuter batch review also found two already-published #7068
explanations that overstated title selection. Correct the changelog and
existing test comment without rewriting those published commits: the
title uses the first non-heading line outside code fences.
Verified as one frozen batch at 7db526a725 plus consensus patch
sha256 d6418055436eaada55f4cbedc954a0eeeb51d9d922716a3588006cf7932fab45:
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh nextest run
-p codewhale-tui -p codewhale-localization --lib --locked:
15343 run, 15341 passed, 2 failed, 25 skipped; build 3m41s.
The two fixed-width rendered-fixture failures came from the long SSD
TMPDIR wrapping paths mid-needle. Same source/binary, shorter SSD TMPDIR,
only those two tests rerun: 2 passed, 15312 skipped. Distinct passing
coverage across both runs: 15289 TUI + 54 localization tests.
- scripts/with-hermetic-test-home.sh scripts/dev-cargo.sh test
--manifest-path vendor/codewhale-ratatui/Cargo.toml --locked --all-targets:
145 passed, 0 failed (128 library and 17 example tests).
- fmt and diff checks passed; changelog sync passed; runtime boundary PASS
(120 closure modules); dead-code budget 212; blocking-call budget 543
across 165 files; locale parity 2583 keys in all 15 packs.
- The vocabulary guard initially failed on an already-published advertised
legacy alias. Both refuters confirmed the docs-only correction; the
unchanged guard then passed. Web prebuild and check-facts passed.
Before peer reconciliation, only .gitignore, docs/MODES.md and generated web
documentation changed after native tests; frozen compiler inputs were identical.
Published peer commits aa45bf84ef/485382f81d then advanced main. Their exact
diff was integrated, preserving their ancestry and regenerating web docs.
Focused reconciliation nextest (TUI ops/runtime_info/spawn and CLI cloud
callers): 117 passed, 0 failed, 15698 skipped; source remained frozen
(104 TUI, 13 CLI). Command/filter and source SHA256
are retained in coordination/land-0103-20261025/reconciliation-test-run.json.
Final integrated tree f297b67c73 is checked against the regenerated commits.
macOS ld emitted its __eh_frame size warning. No hosted CI, FreeBSD/Linux
compile, paid provider call, install, deploy, or release is claimed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
917e6b2 passed the member's display_name as the child's session name. The
spawn path validates session names as ASCII letters, digits, '-', '_' and
'.', so any whale whose name has a space or non-ASCII text ("Ana Lovelace",
小鲸) failed every member start with "name must not contain whitespace". The
child is now named by member_id (the whale's Agent id), which is always a
valid session name and is unique per whale, so the existing "one live child
per name" rule still refuses a second start for a busy member. The platform's
members inspection maps that id back to the whale's name (platform 6ea8a0f).
docs/RUNTIME_API.md says the session name is the member id.
Also moves the FleetMemberStarted alias above SessionSnapshot's doc comment;
917e6b2 had inserted it between the comment's two lines, so the alias took
SessionSnapshot's first doc line.
Verification: cargo test -p codewhale-tui --lib -- protocol_covers_engine_ops
runtime_info spawn_ plus a throwaway test (not committed) of
parse_spawn_request: 105 passed, 0 failed. The throwaway test showed
"Ana Lovelace" refused ("name must not contain whitespace…"), 小鲸 refused,
and an agent_<uuid> member id accepted as the session name. The run needed
RUST_MIN_STACK=16777216 in this container: with the default test-thread
stack, the unrelated
child_permission_gate::typed_denies_updated_after_spawn_reach_children_grandchildren_and_background
overflows its stack and aborts the binary. No live provider or Boat call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01PsruMwr3b8fWh1sfKL7JTQ
`dispatch --prepare-model --thread` (and a send that uses the local model)
only connected the lead's provider. A group member on another provider then
failed at spawn on the guest. After the lead's `key` operation, the CLI now
reads the conversation's `group` (GET /v1/threads/:id), resolves each active
non-lead member's saved route from /api/agents/:id, and sends one more `key`
operation per distinct provider from the local configuration for it, under the
same portability checks as the lead (HTTPS endpoint, API-key auth, no
device-bound sign-in). Keys stay memory-only on the guest through the existing
session `key` operation. Removed members are ignored; a member whose provider
is the lead's is not sent twice. A member with no saved model, or whose
provider is not configured locally, stops the handoff with that member's name
rather than being skipped. The prepare receipt gains `members` (agentId,
provider) for the connections it added; the desktop already prepares before
every cloud send, so it picks this up with no app change.
Verification: a throwaway test (not committed) drove computer::run with the
existing FakeTransport for a group (lead deepseek; Ana anthropic; Dee
deepseek; Old removed): key operations went to deepseek then anthropic only,
receipt listed Ana/anthropic; 1 passed, 0 failed. cargo test -p codewhale-cli
--lib cloud: 122 passed, 1 failed — the failure,
login_selects_managed_route_when_provider_is_default, fails identically
without this change in this container (pre-existing, environment-dependent).
cargo fmt clean. No live account, Boat computer or provider call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01PsruMwr3b8fWh1sfKL7JTQ
Refs #7021.
PR_SET_NO_NEW_PRIVS is inherited and irreversible. In a container whose
parent already holds it (docker --security-opt no-new-privileges,
hardened Kubernetes pods), every child reports NNP=1, so the two
child-matrix rows that expect NNP=0 failed every time. Those rows now
check the parent's flag first: when it is already set they assert the
kernel contract (the child keeps NNP=1) and print one line naming the
substituted row. Production code is unchanged. The module doc now names
PR_GET_NO_NEW_PRIVS, which is how the child reports the flag.
These tests compile only on Linux. They were not compiled or exercised
on this macOS host, and not inside an NNP container.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #2342.
The right-click "Open in editor" entry was offered only for a
`path:line` reference. A bare path in prose or tool output
(`src/main.rs`) could not be opened. first_file_line_reference and the
context-menu resolver now fall back to the first bare workspace file
path, opened at line 1, after looking for a `path:line`. The token
trimming is shared (reference_tokens). Every candidate still goes
through workspace_file, which refuses `..`, absolute paths outside the
workspace and links, and open_file_in_editor checks again.
The in-TUI file preview the issue also asks for is not built; it needs
a product decision.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6559 (U01-m2 and the empty-workflow half of R06-06).
Composer history treated any read failure as an empty or truncated file:
map_while(Result::ok) stopped at the first bad line, and the append
path then atomically rewrote the file from that partial view, losing
every entry after it. read_history_from now returns the I/O error. The
load path logs it and shows no history; the append path logs it and
leaves the file alone instead of rewriting it. A missing file is still
an empty history.
The workflow validator accepted a declarative workflow with no nodes,
and the execution then reported success with no work done.
validate_workflow_nodes now refuses it with
WorkflowExecutionError::EmptyWorkflow ("workflow must contain at least
one node"). No checked-in workflow or example uses empty nodes.
R01-06, the rest of R06-06 and the partial items keep #6559 open.
Verified: scripts/dev-test.sh workflow: 237 tests run, 237 passed.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6557 (O01-m1).
In --manifest mode (release-republish), verify-release-inventory used
the release's checksum manifest only as a list of names and threw the
SHA-256 column away. A stale or edited manifest that named the right
files therefore passed, and republish then wrote its hashes into
Homebrew and the other channels.
manifestInventory now returns each row's digest (and refuses a name
listed twice). assertInventory refuses an asset whose GitHub `digest`
is missing or differs from the manifest row. This fails closed: an old
tag whose assets predate GitHub's digest field can no longer be
republished from its manifest. The existing republish test now gives
each asset a real SHA-256.
P01-01 needs a design slice and D03-m3 a policy decision; #6557 stays
open for those.
Verified: node --test scripts/release/verify-release-inventory.test.js:
7 tests, 7 passed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6554.
Global skill discovery read SKILL.md with fs::read_to_string whatever
the path was, so a FIFO named SKILL.md in a skills directory stalled
discovery. The global root now refuses a non-regular SKILL.md with a
"not a regular file" load warning (fs::metadata follows symlinks, so a
symlink to a regular file still loads). The audit's bounded parser
reports the same case as Broken. Workspace roots already read through
fs_confined.
The rest of #6554 (a shared ingest-time bounded reader and a guard
against new uncapped reads) needs design and stays open.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6560 (W02-01).
The admin post route already capped the body at 65,536 bytes but
accepted any Content-Type. After auth, it now refuses a request whose
media type is not application/json (compared case-insensitively, as
media types are) with 415. The one real client (admin-client.tsx) and
both test helpers already send application/json.
R05-11 (telemetry limiter keyed on the client-chosen install_id) and
W02-03 (one shared admin-login rate-limit key) wait on a policy call and
keep #6560 open. Not deployed.
Verified: in web/, npx tsc --noEmit -p . clean; npx vitest run
lib/security-boundary-behavior.test.ts lib/community-agent-review-state.test.ts
lib/middleware.test.ts: 3 files, 75 tests passed; lib/admin-login.test.ts
lib/admin-login-integration.test.ts lib/public-api-security.test.ts:
14 tests passed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6558 (R03-05).
message_thread propagated a failed response_start write with `?` after
the runtime had accepted the turn, but before the turn was registered
and before the existing orphan-interrupt branch. A dead stdio writer
therefore left the runtime turn running with nothing able to interrupt
it. The write failure now sends the same best-effort interrupt the
stream-break path uses (InFlightTurn + interrupt_turn_request), logs if
that interrupt fails, and returns the original error. The success path
is unchanged.
R04-09 (process-group kill after the leader is reaped) and R06-05 (an
unrecorded lane worktree after a pre-launch I/O failure) need design and
keep #6558 open.
Verified: scripts/dev-test.sh app-server stdio_runtime_bridge: 3 tests
run, 3 passed, 174 skipped. No existing test makes the response_start
write fail, so the new branch is covered by compiling it and by the
neighbouring stream-break test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #7068.
A Plan-to-Work handoff seeded its To-do with the whole plan response as
the title: headings, fences and newlines included. The work-surface row
puts a title on one line, so the lines ran together
("## GoalAdd ...").
plan_handoff_seed_title now takes the first line that is not a heading
and not inside a code fence, strips list and quote markers and inline
emphasis/code marks, and collapses whitespace. It falls back to the
collapsed whole text, and keeps the 1024-char cap. Seed and rollback
share this one derivation. The two plan_handoff tests that compared
against the raw text now expect the derived title.
What happens to the seed afterwards (nothing completes it if the model
never writes its own checklist) is a product decision and is not in
this change.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refs #6842.
attach_session called promote_interrupted_checkpoint, which fully
loaded the saved document (load_session) only to compare its timestamp
with the checkpoint. resume_session then loaded and repaired the same
document again. On a long session that doubled the attach-time parse
of a document the reporter measured at 98.7 MB.
When the saved document is the newer one, promote_interrupted_checkpoint
now returns the recovery it already computed with
recover_session_for_resume, and attach_session persists any repair from
it (persist_resumed_repair, split out of resume_session) instead of
loading a second time. The other branches are unchanged:
- a newer checkpoint is promoted and saved, and attach reloads it through
resume_session;
- a missing document is replaced by the checkpoint the same way;
- a document that exists but cannot be read is left alone, the
checkpoint stays, and attach reports the error;
- the stale checkpoint is cleared only after a readable newer document.
The rest of #6842 stays open for design: the snapshot is still built and
the journal still cloned on the UI task, and the journal archive and
usage_source_fingerprints still grow without bound.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The TLS bootstrap and platform client builders moved to
codewhale-release in the crate split. lib.rs kept
`use codewhale_release::tls;` so that `crate::tls::*` still resolved for
every caller. That alias is a shim, and the split's migrations are
one-way. All callers now name codewhale_release::tls directly, and the
alias and its comment are deleted. No behavior change.
This also removes oauth.rs's `tls` edge into the tui crate, one of the
four small edges that S7 option (c) cuts before oauth and config move
into codewhale-runtime.
Verified at the tree of the ten sweep commits (9ac47bb0ec): scripts/dev-test.sh
tui session_manager plan_handoff skills composer_history tui::history
mouse_ui process_hardening tools::workflow tools::file large_output_router
oauth tls: 1219 tests run, 1219 passed, 14095 skipped. rustfmt clean.
Refs CW-6382
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Recent commits edited the root CHANGELOG.md without running
scripts/sync-changelog.sh, so the copy that /change embeds had fallen
behind and the Version drift check failed. This regenerates it; no
other change.
Verified: scripts/sync-changelog.sh --check passes on this tree.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder report, 2026-10-25: while the model ran a shell command such as a
cargo test, the dock's Terminal tab said "No live terminals. Start one with
Ctrl+N." That read as broken. The dock listed only interactive PTY shells
(Ctrl+N or the model's terminal tool). Ordinary shell tool calls lived only
in the transcript and the Jobs count.
The dock now also lists the session's tracked shell commands. They come
from the same `ShellManager::list_jobs_for_session` snapshots the Jobs
projection uses, so nothing new is recorded:
- The dock's existing blocking worker thread, which already holds the
shared ShellManager, returns the command snapshots with each refresh, so
the UI thread never takes the manager lock.
- Every running command is shown, plus the five most recently finished.
- Each command is a read-only tab, `$ <command>` (truncated at 32 chars),
with its running or exit status and elapsed seconds.
- Selecting a command shows its stdout tail, then its stderr tail, through
the same SGR-only rendering as PTY output.
- Key input to a command tab is ignored. Next and previous tab cycle across
shells and commands, and mouse selection works on both.
- PTY tabs, input, resize and creation are unchanged.
- The empty state now appears only when there are neither shells nor
commands.
Verified:
- scripts/dev-cargo.sh check --workspace --all-targets --locked: 0
warnings, 0 errors.
- nextest codewhale-tui, filtered to work_surface, terminal_session and
review: 768 passed.
- Not verified: a live render in a running TUI with a model executing a
command. Check this in the next build.
Refs CW-7525
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7072: `codewhale review` printed DeepSeek's leaked DSML tool-call markup
(`<｜｜DSML｜｜ calls>…`) as the whole review and exited 0 with no tally.
This happens on Low-risk diffs, whose budget offers zero tools. The review
path builds its own requests in tools/review_core.rs and never ran the
engine's existing detector.
- run_review_core now classifies a tool-free final reply as
ReviewCoreOutcome::LeakedToolCall when it contains a fake tool-call wrapper.
The detection reuses core::engine::streaming::contains_fake_tool_wrapper
and its marker table; there is no second detector. That module becomes
pub(crate) for this.
- Only text outside fenced code blocks and inline code spans is checked, so
a review that quotes such markup from the diff is still accepted.
- Both consumers treat that outcome as a failed pass: the `codewhale review`
CLI (report_failure, so nothing is posted and there is no tally) and the
agent's review tool (review_error_with_usage). They share one message,
`leaked_tool_call_message`. The tool's metadata reports
`review_outcome: "leaked_tool_call"`.
- ReviewCoreOutcome derives Copy: it is fieldless, and the tool path reads
it after the move.
#7067: a Low-risk review sends max_tokens = min(route allowance, 4000), but
three things still used the uncapped 65,536 allowance:
- the reported allowance and reserve;
- the reasoning-effort cap;
- the failure text, which said "produced no review text" even when about
1k visible tokens came back.
So 3 of 4 DeepSeek runs exhausted the cap reasoning and failed with numbers
that were never sent. The changes:
- The CLI computes triage and budget first, then derives review_allowance
from the min'd cap. It sends exactly that, and the reserve and the message
use it.
- bounded_review_reasoning_effort takes the allowance. A reasoning model
(reserve > 0) with an allowance of 8,192 or less caps at Low. Low is a
real DeepSeek wire tier, while medium rounds up to high there. The doc
comment states the new rule.
- The exhausted-pass message says "was cut off before the review finished
(N visible tokens came back)" when output exceeded reasoning, and
"produced no review text" only when nothing visible came back.
- Existing bound tests pass the 65,536 allowance they always assumed.
Verified:
- scripts/dev-cargo.sh check --workspace --all-targets --locked: 0
warnings, 0 errors.
- nextest codewhale-tui, filtered to review, work_surface, terminal_session
and route_budget: 768 passed.
- That run also included a temporary local check, removed before this
commit and not committed. It confirmed the issue's exact DSML output is
detected, while a review quoting `<tool_call>` inline and an `<invoke>`
block inside a code fence, and a plain JSON review, are not.
- Not run: a live DeepSeek review, clippy, hosted CI.
Refs #7072#7067
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Founder decision, 2026-10-25: at most two native builds per machine.
On this 36 GB M4 Max (14 cores), the single exclusive build lock queued every
agent behind one tui compile. That compile is a ~965k-line crate whose front
end keeps most cores idle; its unit-test rustc peaks near 8 GB
(BUILD_PERFORMANCE.md). Today, sessions waited 15 to 30 minutes behind
each other's tui builds while the machine was mostly idle.
scripts/build-lock.py now holds one of CODEWHALE_BUILD_SLOTS (default 2)
exclusive flocks:
- `build.lock` is slot 0, so an older single-slot copy of the script, or a
CI runner pointed at the same file, still excludes the build in that slot.
- `build.lock.1` and up are the extra slots.
- A build beyond the slot count prints every holder and polls once a second.
- CODEWHALE_BUILD_SLOTS=1 restores the old behaviour, and a non-integer
value exits 2 with an error.
docs/BUILD_PERFORMANCE.md's "One build per machine" section is updated to
match. The workspace AGENTS.md (operator file, outside any repo) and
codewhale-app/AGENTS.md now say "at most two".
Verified with a scratch lock file and three concurrent 3-second commands:
- Jobs 1 and 2 ran together and finished at 3s and 4s.
- Job 3 printed both holders, acquired a slot after 3s, and finished at 7s.
- CODEWHALE_BUILD_SLOTS=1 ran.
- CODEWHALE_BUILD_SLOTS=x exited 2.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
POST /v1/threads/{id}/members {operation_key, member_id, display_name,
prompt, fleet} starts one member of a complete Fleet v2 document as an
ordinary child of the thread's session. It reuses the `agent` tool's spawn
path (spawn_subagent_from_input) with a per-request roster built by
roster_from_fleet, so the member's exact provider/model is bound through the
existing profile pin, its instructions join the child prompt as its Fleet
profile, and session permissions and spawn limits apply unchanged. Provider
fallback is refused for these starts, as for exact Workflow spawns. The
document is used for this start only; the selected Fleet is untouched.
The host sends Op::StartFleetMember (wire twin `start_fleet_member`, reply
channel kept off the wire like GetSubAgentSettlement); the engine handles it
at its idle boundary with the off-turn child runtime used for follow-ups. The
route answers 200 with the child agent_id, or 202 "queued" when the thread is
mid-turn. The manager records operation_key -> (request, agent_id): the same
key and body return the original child, a different body is refused.
Runtime capability `thread_fleet_members` advertises it. Stop stays
POST /v1/agent-runs/{id}/cancel. docs/RUNTIME_API.md "Thread Fleet members".
Consumer: codewhale-platform a09ead01 (group member addressing).
Verification: cargo test -p codewhale-protocol 96 passed, 0 failed;
cargo test -p codewhale-tui --lib -- protocol_covers_engine_ops runtime_info
spawn_ fleet_member: 106 passed, 0 failed (the four existing
spawn_subagent_from_input callers in tests.rs updated for the new parameter).
No live provider or Boat call; the route was not exercised end to end against
a real model.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Continues P3, moving tui's config out of codewhale-tui. The destination is
codewhale-runtime; 8b5baa7a5f explains why. Each move is one-way, with every
caller migrated and no re-export left behind.
Edges cut from config:
- tools:
- WorkshopConfig (the `[workshop]` schema) moves to codewhale-config.
- Its methods become free functions in large_output_router
(install_active_workshop, active_read_result_max_bytes,
active_tool_result_max_bytes, workshop_threshold_for), because the
orphan rule forbids inherent impls on a foreign type.
- Config::user_input_limits becomes UserInputLimits::from_config.
- Two intra-doc links into tools become plain code spans.
- plugins: PluginId (with as_str and Display) and PluginAuthority move to
codewhale-config, and all 30 using files import them from there.
- provider_lake:
- The provider-capability matrix (ProviderCapability, RequestPayloadMode,
provider_capability, provider_capability_with_wire) moves out of
config into provider_lake, its only home of use.
- configured_model_for_route moves into config, which is what it reads.
- deepseek_alias_deprecation becomes pub(crate) for the moved code.
- wire_config_prefers_responses is now unused and is deleted.
- settings/config_keys -> reasoning_preference: the reasoning-effort
spelling table moves to
codewhale_config::settings_schema::canonical_reasoning_effort.
ReasoningEffort::parse_strict delegates to it and maps the canonical name
back through as_setting, so there is one table. settings and config_keys
call the table directly.
- config_keys -> commands: edit_distance and best_suggestion_score move to
codewhale_config::suggest. The duplicate edit_distance in
core/engine/tool_catalog.rs is folded into it.
- credentials -> doctor: structural_url_authority moves to codewhale-config,
which gains a `url` dependency. url is already in the lockfile through
reqwest.
- Four doc links from config and settings into skills and session_resume
become plain code spans; rustdoc can't resolve them once config leaves
tui.
#7069: composer history ignored CODEWHALE_HOME. With an explicit
CODEWHALE_HOME, history now reads and writes
$CODEWHALE_HOME/composer_history.jsonl, with no ~/.deepseek fallback,
through the existing codewhale_paths resolver. Without one, resolution is
unchanged. An invalid CODEWHALE_HOME resolves to no history rather than
the ambient home.
Remaining config edges, all outside this batch:
- oauth (33 refs), apply_startup_providers (5), codex_model_cache (1) and
provider_readiness (2): these wait for founder decision S7.
- read_denylist and HooksConfig.
- The sandbox requirements table.
Verified:
- scripts/dev-cargo.sh check --workspace --all-targets --locked: 0
warnings, 0 errors (11m 38s). That ran on 135319aa1a.
- After rebasing onto 4d2b3fdb1b, `check -p codewhale-cli --all-targets`:
no errors. The later main commits touched only cli/src/update.rs, the
installers, web and docs; none of the moved symbols.
- cargo fmt --check: clean. module_graph --check: PASS. Dead-code budget:
exactly at 212. Blocking-call budget: within 543.
- nextest:
- codewhale-config: 806 passed, 1 skipped.
- codewhale-tui, filtered to large_output_router, user_input, plugins,
provider_lake, config::tests, composer_history, reasoning_preference,
settings, config_keys, doctor, commands::tests, tool_catalog,
extension_host plugin tests, model_profile and route_budget: 1139
passed.
- Not run: clippy, doc, Windows, hosted CI.
Refs #7069 CW-6129 CW-6382 CW-7525
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Web Frontend run (40168744583) for main at b63e5af3ac failed its test
job before deploy, with two stale expectations:
- docs/public-surface-facts.json still listed crates/tui/src/audit.rs as a
fact-matrix source. P3 (8b5baa7a5f) moved that file to
crates/runtime/src/audit.rs.
- public-installer-contract.test.ts still required the installer to refuse
when a leftover `codewhale-tui` sits beside the commands. e9c9de775f
deliberately removed that guard, because the installer never writes that
name. The test now asserts the new contract: codewhale and codew install,
and the legacy file is left byte-for-byte untouched.
`npm run check` also reported the generated agent docs and feature data as
stale, after today's doc edits (INSTALL.md, CLOUD_DISPATCH.md,
features.toml). They were regenerated with `npm run prebuild`.
Verified locally in web/:
- `npm test`: 74 files, 772 tests passed.
- `npm run check`: facts, docs, tokens, lint, tsc and next build all pass;
993 static pages.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Repository rule: no new code comments; the reasoning belongs in commit
messages. e9c9de775f's message already carries it:
- `(dev)` in CODEWHALE_BUILD_VERSION marks an unstamped checkout. A release
artifact carries its short SHA, and a Cargo source package carries the
plain version.
- A forced reinstall that fails puts the moved-aside command back.
This removes the comment added in update.rs and the forced-backup comment
blocks added in both installers. The edited comment that explains when
existing binaries are replaced stays, because it now describes
CODEWHALE_FORCE_REINSTALL.
Comment-only change. Verified: `bash -n scripts/release/install.sh` and
`sh -n web/public/install.sh` pass.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two defects made a local `0.10.2 (dev)` build permanent for the person who
installed it: the website installer refused to replace it, and `codewhale
update` reported "Already up to date" forever because it compared only
CARGO_PKG_VERSION.
install.sh (website and release archive):
- Resolve and validate the install directory before downloading, so a managed
or symlinked directory fails before ~100 MB of release assets.
- CODEWHALE_FORCE_REINSTALL=1 replaces a differing codewhale/codew in the
install directory and keeps each previous file beside it as
<name>.bak-<utc-timestamp>. Symlinks and non-regular files are still never
replaced, and every other guard is unchanged.
- A forced run that fails after moving a file aside puts it back. The
publication state and exit trap now install before the preflight checks, so
a refusal or a failed publish cannot leave a command missing from the
directory while its bytes sit in a .bak file.
- Dropped the codewhale-tui compatibility-path guard. It was not a published
destination: the installer never writes that name, so any stale legacy file
or symlink beside the real commands aborted a correct install.
crates/cli/src/update.rs:
- `(dev)` in CODEWHALE_BUILD_VERSION is the build script's marker for an
unstamped checkout; a release artifact carries its short SHA and a Cargo
source package carries the plain version. When the installed build carries
that marker and its version equals the latest tag, `update` and
`update --check` install the release artifact instead of reporting up to
date. Packaged-source and release builds are untouched.
- `Current version:` prints the build version, so the output names the actual
provenance (`0.10.2 (dev)` vs `0.10.2 (ff466b2ed0)`).
docs/INSTALL.md and docs/zh_hans/INSTALL.md describe the force flag, the
same-version non-release replacement, and the download-before-refusal wording.
Verified on macOS arm64, source 4d2b3fdb1b plus this patch:
- cargo build -p codewhale-cli --locked: exit 0 (16m55s cold, 6s incremental;
one pre-existing __eh_frame linker warning).
- scripts/dev-test.sh cli: 501 passed, 0 failed.
- scripts/dev-test.sh release: 57 passed, 0 failed.
- web node scripts/derive-install.mjs && node scripts/check-docs.mjs: PASS.
- Website installer matrix against a local file:// fixture: fresh install,
identical re-run, differing-without-force (original preserved), force
(backup holds the original bytes), stale codewhale-tui present (untouched),
symlink destination with force (still a symlink), managed directory
(refused with zero downloads). All seven behave as described.
- Interrupted forced run (second destination present as a directory): exits 1
and restores the first command instead of leaving it in .bak. Same case for
the archive installer.
- Real release: installed into a scratch directory from GitHub, reports
0.10.2 (ff466b2ed0), sha256 da022961...590d matches the manifest, for both
codewhale and codew.
- Real self-update: a fresh `0.10.2 (dev)` build ran `update --check` then
`update`, downloaded and verified the release, and ended at
0.10.2 (ff466b2ed0); a second `--check` reports Already up to date.
Not verified: clippy, Windows/NSIS installer, Linux/binary install paths,
concurrent forced runs in the same directory, and the deployed codewhale.net
copy of install.sh (needs a deploy, which stays a separate authorized action).
The packaged-source (`cargo install`) branch of the new predicate is reasoned
from format_build_version, not executed.
`codewhale account agents create NAME --provider P --model M` sends the
exact route as the Agent's `model`; the service pins it in the whale's
account Fleet revision and the CLI refuses an answer whose saved route
differs from the request. `account agents list` prints each whale's saved
provider/model.
`codewhale dispatch --whale AGENT_ID "task"` creates the cloud conversation
with that whale's agentId and no client route, so the service takes the
route from the whale's pinned Fleet member. The memory-only key handoff
resolves the local configuration for the whale's own provider and model
(CliRuntimeOverrides) and applies the existing portability check; later
`--thread` follow-ups on a whale conversation re-read the whale's current
saved route for the key and turn, so a changed whale applies to the next
turn. `--whale` conflicts with --thread/--cloud-provider/--cloud-model.
The non-whale portability check now runs after the conversation is read,
so an existing whale thread is not refused by an unrelated local default.
Desktop drives the same path (`dispatch --prepare-model`).
docs/CLOUD_DISPATCH.md and the cloud-computer-dispatch registry row
describe whale dispatch.
Verification: dev-cargo test -p codewhale-cli --locked --lib cloud:
123 passed, 0 failed (378 filtered). The existing create_agent test call was
updated for the new signature. Compiled together with an unrelated peer's
uncommitted crates/cli/src/update.rs edit, which is not part of this
commit. No live account, provider or Boat call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Probing the installed 0.10.2 binary over ACP showed three things:
- `codewhale serve --acp` runs under Ask;
- `codewhale --yolo serve --acp` runs under Full Access;
- `codewhale serve --acp --yolo` is rejected ("unexpected argument", exit 2).
That last form is the one editors write in their agent config. Founder
decision: Full Access is yolo (ApprovalMode::Bypass). A configured
`sandbox_mode = "danger-full-access"` must not widen Ask or Auto-Review, and
no state may have the sandbox off while the agent still asks.
Changes:
- `--full-access` is the visible flag; `--yolo` stays an alias
(runtime_options.rs).
- The dispatcher lifts `--full-access` and `--yolo` out of the `serve`
passthrough arguments (`capture_serve_full_access`), stopping at a `--`
separator. It sets the same runtime option as the global flag, so the
value still flows through the CODEWHALE_YOLO env layer, and managed
config above that layer still wins. Setting `config.yolo` after load
would have bypassed a managed `yolo = false`.
- `serve --acp` writes one stderr line naming the ACP permission and
sandbox it will run with, computed with `sandbox_policy_for_turn`. When
Full Access is off, the line says how to turn it on.
- The ACP hint and the approval_policy "never" error name `--full-access`.
- `SandboxPolicy::config_value()` replaces a duplicated match in
`apply_requirements`.
- docs/MODES.md, docs/RUNTIME_API.md and CHANGELOG are updated.
Verified:
- `scripts/dev-cargo.sh build -p codewhale-cli --locked`: built, 0
warnings.
- The built binary was probed over ACP. For each launch, a fresh
CODEWHALE_HOME and runtime dir; then `initialize`, `session/new`, and a
read of the `permission` configOption:
- `serve --acp`: ask. stderr: "ACP permission: ask; sandbox:
workspace-write. For Full Access start with `codewhale serve --acp
--full-access` ...".
- `--full-access serve --acp`: full-access, with sandbox
danger-full-access.
- `serve --acp --full-access`: full-access.
- `serve --acp --yolo`: full-access.
- nextest codewhale-cli, filtered: 36 passed, including
`clap_command_definition_is_consistent` and
`yolo_flag_writes_only_the_codewhale_env_var`.
- nextest codewhale-tui, filtered to acp_server, requirements,
sandbox::policy and runtime_options: 61 passed (38 acp_server, 6
requirements).
- Not run: clippy, Windows, hosted CI.
The Seatbelt half of #4955 is not done.
Refs #6992#4955
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A tool that listens to a running turn could only report what it cost after the
turn ended, so long agentic work looked frozen and then jumped at the end. Each
model call now reports the price of that call on the route that served it and
the prompt the provider billed, so a client can follow the work as it happens.
The turn's own totals remain the record once it ends.
The mobile control page shows that reading in its header, keeps each
conversation's figure when you switch away and come back, and never presents a
compaction pass as the conversation's spend.
Hosts send SetModel whenever they resync the engine's model, not only
when it changes: a reasoning-effort change resends the current model,
and so does /clear. The engine acknowledged every one with "Model set
to: <model>", so `/effort high` ended with "Model set to: mock" in the
footer in place of its own "Reasoning effort: high". Send the status
only when the model differs from the one already set, as SetCompaction
does for its switch since 04de8eb67. A real switch still says "Model
set to: <model>".
Signed-off-by: Lstarsky0 <[email protected]>
/status printed the session's own cost through the precise money
formatter whatever the billing state, so a session whose turns have no
authoritative price read "Session cost: $0.0000" while the footer said
"cost: unknown (billing basis unknown)" and /cost and /tokens said
"unknown". Give the status view a label from the same cumulative usage
chip the footer reads: "unknown", the word /cost and /tokens print, when
no turn is priced, and the chip's subtotal text when only some are.
Fully priced sessions keep the precise amount.
Signed-off-by: Lstarsky0 <[email protected]>
/clear and /new always queue a goal clear so the engine's goal state
can't outlive the conversation, and the engine answered every clear
with a "Goal cleared." status. In a session that never had a goal the
footer said so right under "Conversation cleared". Note whether a goal
existed (in the shared goal state, or the configured fallback the clear
also wipes) before clearing, and skip the status when there was none.
The empty goal snapshot is still published, and clearing a goal that
was set, through /goal clear or /clear, still says "Goal cleared.".
Signed-off-by: Lstarsky0 <[email protected]>
The /context inspector shortened the workspace path from the right, so
a narrow pane kept the root and cut the folder that tells you which
workspace this is: at 50 columns a path ending in `…/cw-tools/run/ws`
showed as `…/cw-tools/ru…`. Use workspace_context::truncate_left, which
the status line's workspace chip already uses, so the tail survives and
the cut moves to the front. Paths that fit render as before.
Signed-off-by: Lstarsky0 <[email protected]>
Since the /diff pager renders its diff at the body width, its rows are
numbered by rendered diff line, and that numbering changes with the
width. On a resize the pager remaps the top row and the current search
match through those numbers, so it landed on an earlier line: scrolled
to "Line 31" at 100 columns, shrinking to 60 showed "Line 25", and a
search for "Line 47" came back on "Line 38".
Have the diff renderer record which source row of the diff produced
each row it returns (one per header, hunk header or diff line; the
summary block counts as one), and number the pager's rows with that. A
resize then keeps the same diff line at the top and on the current
match.
Signed-off-by: Lstarsky0 <[email protected]>
2026-10-23 07:04:52 +08:00
2390 changed files with 229671 additions and 140898 deletions
"${greeting} — your contribution landed in [\`${short_sha}\`](${commit_url}) on \`main\`:" \
"" \
"> ${subject}" \
"" \
"Closing this PR now that the code is on \`main\`. Credit lives in the commit message and (where applicable) the \`CHANGELOG.md\` entry for the next release. Apologies for not closing this at the time of the merge — the auto-close workflow is new in v0.8.31." \
"" \
"If you want to land more work and would prefer your future PRs merge cleanly without a harvest step, the [\`CONTRIBUTING.md\`](${contributing_url}) doc has a short note on what makes a contribution mergeable as-is." \
)"
echo "Closing PR #${pr} (harvested in ${short_sha})"
if ! gh pr close "${pr}" \
--repo "${GITHUB_REPOSITORY}" \
--comment "${body_text}"; then
echo "::warning::Failed to close PR #${pr}; continuing"
@@ -7,12 +7,814 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
### Added
- **Runtime API: check a provider key before storing it.**
`POST /v1/providers/{id}/key/check` asks the provider's own `/models`
endpoint once whether it accepts a key, and never stores it. A key the
provider rejects answers `422`; a provider that cannot be reached answers
`502`, so a client can still save the key. The desktop app uses it so a wrong
key is refused with a clear message instead of being saved. See
`docs/RUNTIME_API.md`.
- **Website: the homepage whale comes alive.** It starts as the flat Codewhale
mark, is colored in as the live whale, then becomes a field of breathing
lights made of the same 64 points as the desktop app. Pointing at it or
picking a terminal view brings the whale back. Reduced motion keeps the still
whale. Not yet published to codewhale.net.
### Fixed
- **Website:** recovered warm paper, clear-blue actions and original drawn water accents; added Computer Use and automatically refreshed terminal/plugin release links; shortened copy, clarified contribution paths and checked setup guidance against published versions.
## [0.10.3] - 2026-11-06
This is the Codewhale v0.10.3 source candidate. It is not a published release
until the matching tag, packages, checksums, and release assets exist.
### Work in progress and known limits
- **Terminal lifetime:** deleting a conversation does not end its terminal shells; they run until the Engine exits. Scrollback beyond the 512 KiB ring is not recoverable, and an Engine restart loses live shells (reported as a new terminal `instance`).
- **Codex App Server compatibility:** Codewhale is working toward full Codex
wire parity on the existing Engine. The current HTTP/SSE Runtime remains
clipboard images that no saved session, checkpoint, Runtime thread, draft or
history still names and that are older than 7 days (`--older-than-days`);
`--apply` deletes them. If any file it must scan cannot be read, it deletes
nothing. Run it while no Codewhale session is open. Thanks
[@Asteria1028](https://github.com/Asteria1028) for the report (Refs #7221).
- **Task wall clock pauses for answerable human waits (#5898):** a durable task run by the Runtime API server no longer spends its wall-time budget while a prompt on that run waits for an approval or user-input answer. `[tools] task_human_wait_cap_seconds` (default 1800, maximum 86400) bounds the total wait and fails an unanswered task with `human_wait_timeout`, releasing its worker. Only a Runtime serving its HTTP API pauses the clock; local Stdio, Socket and ACP control frontends keep the wall deadline, and a wall deadline crossed before the prompt still ends the task. The TUI's own tasks are unchanged. Thanks [@asto18089](https://github.com/asto18089).
- **MCP servers say why they are not connected:** the Runtime API's
`GET /v1/apps/mcp/servers` now includes a configured server's last
connection error while it is retrying, so the desktop and other clients can
show the reason instead of only "disconnected".
- **Inspect and repair plugin snapshots:** `codew plugins status [name]
[--json]` reports bundle state and diagnostics without changing plugin
stores. Runtime loading restores a missing snapshot only from bytes matching
its enabled review and policy; `codew plugins restage <name>` or
`/plugin restage <name>` retries explicitly. Recovery preserves review and
generation and refuses an existing changed snapshot. Isolated macOS checks
exercised the published Code Review 1.0.8 Native status lifecycle and official
filesystem MCP reconnect; live review execution and other plugins remain
unqualified.
- **Shared optional account sign-in:**`/connect` offers Codewhale sign-in or
on-computer provider setup. Desktop and terminal use the same profile-scoped
Rust account session; sign-in preserves the selected model and local keys.
Ordinary logout removes the account session, while `logout --all` explicitly
clears saved model credentials. Startup prompts keep missing-model setup
visible instead of covering it with the optional working-agreement checkpoint.
Real sign-in acceptance remains open.
- **Refresh model catalogs during use:** Runtime provider refresh now checks
public Models.dev metadata alongside the exact provider's model list;
`force_catalog=true` bypasses the public cache TTL and retry backoff.
`GET /v1/providers` exposes catalog revision and freshness so clients can
pick up new models without repeatedly loading an unchanged catalog. The
runtime rechecks in the background, retains the last good snapshot on
failure, and preserves explicit model selections and account/route scope.
endpoint and a serverless model or sampler checkpoint ID. Model-list discovery,
key verification through that list, and cost estimates remain unavailable;
live conversations, tools and image input have not been qualified in
Codewhale. See [provider setup](docs/PROVIDERS.md).
- **Worktrees for parallel workspaces:**`GET /v1/worktrees` lists a repository's worktrees, `POST /v1/worktrees` creates a branch and its own checkout under `<repository>/.codewhale/worktrees/` through the existing lane provisioning, and `POST /v1/worktrees/remove` archives a clean managed one without `--force`, keeping the branch. A client starts a thread in the new folder, so several agents can work on one project without sharing files. (codewhale-hq/codewhale-app#3500)
- **Thread-scoped snapshots:**`GET /v1/snapshots` and `POST /v1/snapshots/{id}/restore` accept `?thread_id=` and act on that thread's workspace under the same restore admission rule. (codewhale-hq/codewhale-app#3500)
- **Reviewed plugin UI assets (preview):** native plugin bundles with supported client entries can expose reviewed assets through the Engine's loopback descriptor and asset routes. Runtime and workspace authorization are required; exact asset bytes also require the current opaque grant. Responses keep bounded sizes, confined paths and safe MIME/no-store behavior. The desktop host binds grants to individual plugin frames; real Electron transport and teardown qualification remains open. Imported DSH client halves remain unsupported and refuse UI grants. (#2, #3)
- **Present final files:** the read-only `present` tool takes 1–32 existing
workspace files, streams their SHA-256 and byte counts, and returns an
auditable handoff receipt without copying, moving or uploading them. It is
eager in Act/Operate and Plan; the `present-handoff` feature is experimental,
and there is no dedicated app card yet.
- **Truthful background jobs:** shell job snapshots and completion events now
carry the exact start time, a typed termination cause (`producer`, `killed`,
`timed_out`, `unknown`) and whether the producer reported it. A killed job is
no longer indistinguishable from a failed one, and the bash guidance tells the
model to collect or cancel live jobs before a final answer.
- **`/export` writes HTML and JSON:** `/export file report.html` saves a self-contained page (light and dark, no scripts, a strict content-security policy, tool calls collapsed) and `report.json` a versioned, typed-block envelope. `--format md|html|json` overrides the extension, and `--no-tools` drops tool calls and results from the conversation. `/export file` with no path now writes an auto-named `codewhale-<title>-<timestamp>` file under `<codewhale home>/exports` and reports the format, line count and redactions; `~` expands and quotes keep a path with spaces together. `--force`, `--no-tools` and `--format` are accepted in any position. HTML and JSON are file-only; the clipboard and `/export turn` remain Markdown.
- **Tencent HY4:** the stable `tencent/hy4` model is available through OpenRouter with its published multimodal, tool, reasoning and context metadata. `/provider tencent` adds the direct TokenHub route with `hy4` and `TENCENT_API_KEY`; direct availability and prices remain separate from OpenRouter, and preview/HY3 selections are preserved.
- **WeCom steers a running turn (#7211):** a WeCom message sent while a turn is running is forwarded to the Runtime's steer endpoint instead of being dropped with the busy notice, which remains the fallback when the steer is rejected. Thanks [@gaord](https://github.com/gaord).
- **WeCom accepts media and voice (#7212):** the WeCom bridge downloads image, video and file messages into `WECOM_MEDIA_DIR` (default `<workspace>/media`) under a sanitized name and replies with the saved name, size and path; a failed download tells the sender the link expires after about five minutes. Voice messages use WeCom's transcription as the prompt, and other message types get an explicit answer instead of a blanket refusal. Thanks [@gaord](https://github.com/gaord).
- **Pinned local thread controls (preview):** initialized App Server clients can list retained loaded Engines with cursor paging and rename the canonical thread through `thread/loaded/list` and `thread/name/set`. Saved but unloaded threads stay out of the loaded list; existing aliases remain available. Full-tool turns and subscription parity remain unfinished.
- **Reply style and sub-agent limit over the Runtime API:**`GET /v1/config`
reports and `POST /v1/config` writes `verbosity` (`normal` or `concise`) and
`subagents_max_concurrent` (how many sub-agents may run at once, `0` to
`128`, where `0` turns them off), so the desktop's Settings can show and
change both. An unset limit reads as the one the Engine applies; nothing
writes a default for you.
- **Local whale voice (preview):** the host can edit its private, revision-checked SOUL.md through the Runtime API. The Engine captures it for the next turn within the existing instruction budget and records its source; invalid private files refuse the turn with a terminal failure.
- **MCP tool approval rules (preview):** exact tool names in the global server configuration can use Always, Ask or Off across workspaces. Off wins, server edits invalidate the prior grant, and required Computer Use consent and nested-program approval remain in place.
- **Attested watch-turn ingress (preview):** a configured Runtime master bearer can admit typed schedule or pull-request receipts through the existing thread and turn owner, with exact operation replay and read-only recovery lookup. This supplies the Native ingress prerequisite; it does not qualify the complete continuous-operation workflow.
- Goal continuations send the objective once per live conversation window. Later passes show the current goal state, estimated conversation input and the applicable compaction setting. Full notes stay available through `get_goal`. Thanks [@7jrxt42BxFZo4iAnN4CX](https://github.com/7jrxt42BxFZo4iAnN4CX) for measuring the repeated text and identifying the misleading token figure ([#7172](https://github.com/codewhale-hq/Codewhale/issues/7172)).
- **Composition on the first request:**`execute_tools` accepts a bounded named batch from the current MCP catalog, with argument names from its allowed members and the same nested gate as a JavaScript program. Exact tool-name searches work with regex anchors. Stream receipts hash the executable in the background; `CODEWHALE_TIMING=1` reports phase durations. (CW-7649)
- **The model can read what compaction replaced (#7173):** two read-only tools,
`context_archive_search` and `context_archive_get`, search the session's
saved pre-compaction snapshots and read one archived message by id, with
bounded results (12,000 characters per read, 20 hits and a 200-character
query per search). Each message is masked whole for credential shapes and
currently configured secrets before it is searched or paged, and
`codewhale sessions scrub-secrets` now also rewrites those snapshots. A
`/fork` cannot read the archive its handoff note refers to, and a bare secret
absent from current configuration is not masked. Thanks
[@SparkofSpike](https://github.com/SparkofSpike).
- **Opper as a bundled provider (#7131):**`/provider` offers Opper, an
EU-hosted OpenAI-compatible gateway, with `OPPER_API_KEY`,
`https://api.opper.ai/v3/compat` and the `claude-sonnet-4-6` pool name as the
bootstrap model; `provider/model` ids pin one route. Live
`/v3/compat/models` is the model authority and billing stays Unknown. No live
Opper call was made here. Thanks [@Felixkw12](https://github.com/Felixkw12).
- **Runcrate is a bundled provider:**`runcrate` reaches the OpenAI-compatible host at `https://api.runcrate.ai/v1` with `RUNCRATE_API_KEY`, and `codewhale models --update --provider runcrate` refreshes its public model IDs before a key is configured. Inference requires the route key. Thanks @heydryft for the request and the vendor details. (#7085)
- **MCP connection status reaches the model:** one existing history snapshot now records permitted configured, connecting, failed, authorization-required, unknown and connected servers, with bounded inert names and no raw errors. Stale status and server guidance are withdrawn on contention, configuration/scope changes and restore; observation does not connect servers or promise callable tools. (#6866)
- **Bundled-skill policy:**`[skills.bundled]` separates automatic, authoritative and disabled installation from discovery, with per-name selection, disable and explicit-only controls. Aliases share policy; disabled shipped copies reveal user alternatives. Modified and managed files remain intact, and doctor plus `/skills inspect` show the effective policy. (#7066)
- **Configurable skill routing index:**`[skills] listing_max_description_chars` and `listing_budget_fraction` control the shared parent/child catalogue. Defaults use 120 characters and 0.2% of the route window, within the existing total bounds. Load warnings, localized inspect notes and `/context` explain shortening; full skill loading stays available. (#7073)
- **Compact approvals keep their authority visible:** cards show three choices and default to Deny. An exact saved rule requires its scope preview on screen. Shortcuts for additional actions require opening Details; a hidden saved-rule choice never falls back to granting the session.
- **Quicker everyday navigation:** top-level help separates everyday and advanced commands, `doctor --all` expands path/backend details, and the launch screen labels how to resume recent work. Up selects the newest recent session. Whale cameos stay out of transcript text.
- **Session-window diagnostics:** the audit log records when a saved window starts a new journal root while retaining the previous branch, helping distinguish window replacement from lost durable history. `session.window.rerooted` now names a `cause` (`engine_projection`, `session_restore` or `unattributed`) and also fires when a journal with entries has no active path. (#7142)
- **Usage reporting counts models, tokens and tools:** when usage reporting is on, each session now also reports, per provider and model, its turns by outcome, input, output and prompt-cache tokens, and turn-time buckets, plus how many times each built-in tool ran and failed. A model is named only when it is in Codewhale's bundled public model catalog; custom, local and fine-tuned names are sent as `other`, and MCP and plugin tools as `mcp` or `other`. No prompts, outputs, tool arguments or paths are sent. Runs under CI or the GitHub Action report the `ci` session source. The first-run notice is shown once more to describe this. `DO_NOT_TRACK=1` now turns usage reporting off for that run, like `CODEWHALE_TELEMETRY=0`; `codewhale config set telemetry false` still turns it off for good. See `docs/TELEMETRY.md`.
- **`exec` and `doctor` follow the TUI onto local Ollama:** with no cloud key and no explicit route, `codewhale exec` uses a running local Ollama chat model and says so, and `codewhale doctor --probe-local` checks that route. Nothing is saved. (#7115)
- **Thinking starts at auto:** new configurations and the built-in default use `reasoning_effort = "auto"` instead of `max`; an effort you set is never changed.
- **DSH Git review scopes:** the extension host brokers bounded, read-only Git metadata to reviewed DSH plugins through a new `git_review_scope` action (extension-host policy v8).
- **Safer, more complete uninstall:** for a receipted release copy, `codewhale uninstall --yes` now also removes this install's exact three-line `# >>> codewhale PATH >>>` block from your shell profiles and the Codewhale-generated completion files at their documented paths (bash, zsh and fish, honouring `XDG_DATA_HOME` and `XDG_CONFIG_HOME`). It touches nothing else in a profile, leaves a symlinked or unreadable profile for you to edit, keeps the completion files while another Codewhale copy remains on PATH, and exits non-zero if that cleanup fails after the program is already gone. The `codewhale.net/install.sh` hint and the install guide now print the PATH line as that marked block, so there is something provably yours to remove; a bare `export PATH=…` line you added earlier is never touched. Data purge requires a receipted removal in the same confirmed run. Both Unix installers reject unsafe or managed destinations before creating them and still never edit shell profiles themselves. Uninstall instructions match the explicit-home purge scope in English and Chinese. Not yet observed on a real Windows host or an installed release artifact. (Refs #7091)
- **Nested and deletable threads (Runtime API):** a fork (including a backtrack fork) records `parent_thread_id`, `POST /v1/threads` accepts one naming an existing thread, and `GET /v1/threads/summary` returns it so clients can nest child conversations. `DELETE /v1/threads/{id}` removes an idle thread with its turns, items, events and goal, and its saved session unless another thread shares it or a terminal holds it open; a running thread answers 409.
- **Hunk actions in Review (Runtime API):**`POST /v1/git/stage`, `/v1/git/unstage` and `/v1/git/discard` take a `patch` holding hunks of the one path in `paths` and apply only those hunks through `git apply`, under the same `expect` preconditions as whole-path writes. A patch that no longer applies fails with git's message and writes nothing; renames, mode changes and binary patches are refused. The tasks tool can also `suggest` a task, shown as a Start/Hide card, without starting anything.
- **Live `/models` ceilings reach the route:** a provider that states per-model context and output limits in its own `/models` body now keeps them instead of falling back to the legacy 128K window. OpenAI `limit` blocks, flat `context_length` / `context_window` / `max_model_len` / `max_context_length` fields, `max_output_tokens` / `max_completion_tokens`, and a relay `metadata` block (`context_limit`, `context_budget`, `output_budget`) are read; `metadata.context_limit` outranks `context_budget` because the first is the model capability and the second the share one deployment accepts. Each field is parsed on its own, so an unreadable one costs only its own candidate instead of hiding the readable fields below it.
- **Change mode and permissions while the agent works:** Tab, Shift+Tab, `/mode`, the hotbar and `/config mode` no longer refuse while a turn is running. A response that is already streaming is not restarted; the change applies at the agent's next step in the same turn (before its next tool batch, at every approval gate, and before its next model request, which carries the new mode notice). The status line says so until it applies. A call still waiting for approval goes back to the model under the new posture, and a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends.
- **Steering interrupts thinking:** a steer (Ctrl+Enter, or Enter twice after queueing) now closes the in-flight model request at once, whether the model is waiting on headers, reasoning, writing text or emitting a tool call, and continues the same turn with your message. Text already shown is kept as interrupted output; unfinished reasoning and partial tool calls are discarded, never run.
- **Modern MCP client:** MCP servers now connect through the official MCP SDK (2.4) behind Codewhale's Rust broker by default (`mcp_backend = "host"`; `"rust"` stays available for one release). Servers that speak the 2026-07-28 revision are discovered with `server/discover`; other stdio and HTTP servers fall back to the legacy `initialize` handshake, and configured SSE servers keep theirs. Rust keeps process, network, credential, catalog, approval and cancellation authority.
- **DeepSeek Harness plugins:** reviewed DSH plugins (definition API pinned to DSH 0.2.1-rc.5 in a shared compatibility table) run in the Native extension host. Tool output is validated against its declared schema, unsupported options are refused instead of ignored, and plugin commands can submit a prompt with visible plugin attribution. Terminal command receipts are kept in thread snapshots without entering model history. Changing the compatibility table invalidates earlier trust. A newly enabled plugin's tools are offered on the first turn: the turn waits up to 10 seconds for the plugin host to finish loading instead of adding them only from the next turn. The importer reports that it does not convert `dsh.client` UI; Engine routes and a desktop slot exist, but isolated end-to-end plugin UI remains unqualified, including network containment. A plugin tool can call `ctx.sessions.flush(exec.agent.session)` to have the Engine save the conversation so far before it continues (Runtime, terminal and `exec` sessions); it reports failure instead of claiming a save. Installing a plugin whose bytes changed after review now returns a 409 conflict instead of a server error. A plugin tool can ask you a question with `ctx.userQuestions.ask` and gets back the options you picked, your own text, or a skip; the question shows like any other Codewhale question in the terminal and through the Runtime API. A plugin tool can start a child agent with `ctx.subagents.startActivation` (the `spawn` provider): the child runs through Codewhale's own sub-agent manager, needs the same approval as the model's `agent` tool, can carry an extra persona section and a narrower tool list set in its `agent/created` handler, and returns its result to the plugin.
- **MCP catalogs stay fresh:** a server's tools, resources, prompts and skills are rediscovered on their own connection when an advertised `ttlMs` expires or the server sends a list-changed notice. A tool resolved against the old catalog is refused with "retry the call", a removed tool cannot run, and a failed refresh reconnects instead of serving stale entries. Catalogs are never shared across servers, credentials or reconnects.
- **MCP Skills extension:** servers that advertise the published Skills extension have their skills listed in `list_mcp_resources`. Listing never activates a skill, and reading a skill file is refused unless its size and sha256 digest match the listing. MCP skills do not yet join `/skills`.
- **Updates install themselves:** release-binary installs check for a new release every 6 hours (was 1), download and checksum-verify it in the background, and apply it the next time `codewhale` starts, never during a session. One line says `Updated to v… · What's new: … · Undo: codewhale update --rollback`. Until releases are signed, the download waits for your OK (one `[y/N]` question at the next start, or `/update install`); a release with a valid Ed25519 manifest signature applies on its own. `codewhale update --rollback` puts back the version the last update replaced and keeps the rolled-back version from returning automatically. Turn it down with `codewhale config set update.mode notify` (or `off`, or `CODEWHALE_UPDATE_MODE`); an organization's root-owned `policy.toml` overrides both. Offline and rate-limited checks retry about an hour later instead of on every launch. Package-manager and desktop-app copies only get their manager's command. Builds with the release key refuse a missing or invalid signature, and re-check the staged binary against the signed manifest at start. The checksum manifest now always comes from GitHub Releases; on Linux x64 the CNB mirror can still serve the binary, but only bytes that GitHub's manifest lists.
- **One view of every Codewhale on the machine:**`codewhale doctor` has an Installations section and `codewhale doctor --installs` (`--json`, `--brief`) lists every `codewhale`, `codew`, `codewhale-tui`, `deepseek` and `deepseek-tui` with its owner: install receipt, package manager (with its exact removal command), the desktop app, a backup, or not ours. Nothing found is ever run. `codewhale doctor --fix` adds one plan to tidy them: old backups move to `~/.codewhale/recovery/<stamp>/` (kept 30 days, then deleted by a later `--fix`), an unreceipted `codew` is brought in line with `codewhale`, and the directory gets an install receipt; each move prints its undo and `codewhale doctor --restore <stamp>` reverses the lot. Package-managed, desktop-app, symlinked and foreign files are never touched, and neither is user data. `codewhale uninstall` now lists other copies with the same classification.
- **Uninstall guidance on every install route:**`codewhale uninstall` previews receipt-owned release files and `--yes` removes only checked files, with the running command last. Both Unix installers and the Windows archive installer record command ownership; self-update renews existing receipts on both. On Windows the running `codewhale.exe` is renamed, then a hidden PowerShell process deletes it after the command exits. Package-managed copies are left alone, and the command prints their exact removal command: npm with its prefix, Cargo with its root, the Homebrew formula, `scoop uninstall codewhale`, `winget uninstall --id HunterBown.CodeWhale`, or the Windows setup's `Uninstall.exe`. Every other `codewhale`/`codew` still on PATH is listed. User data is kept unless you add `--purge-data`. With `--yes` it runs only after a receipted installation was removed in that same run, and then deletes only `~/.codewhale` (or a `CODEWHALE_HOME` named `.codewhale`) and `~/.deepseek/snapshots`, refusing symlinks, home ancestors and directories owned by another user. A copy from an older `curl | sh` installer that wrote no receipt is adopted on `--yes` when it sits in a known older curl-installer directory: the commands byte-identical to the running program get a receipt and are removed, anything else is preserved, and a symlink or hard link among them stops adoption before any receipt is written. (Refs #7091)
- **GitHub Action reviews:** analysis can export a structured Engine review for a separate trusted publisher job. The publisher checks the current PR revision and line anchors, deduplicates its findings, and keeps uncertain or preexisting claims out of inline comments.
- **DingTalk bridge:** an optional internal-app Stream adapter reuses the same Engine, shared admission and approval helpers. Tenant/staff allowlists, durable acceptance before acknowledgement and retained uncertain deliveries protect recovery. Managed account linking is separate from this advanced self-hosted bridge.
- **Answerless output-limit recovery:** opt into `[reasoning_only] on_output_limit = true` to request an answer again after a length stop with no answer or tool call, including hidden reasoning and ordinary Fleet workers. Retries share `max_reprompts`, retain existing output and control limits, and record request-scoped nudge receipts without adding them to resumed conversation context. RLM keeps its existing stop protocol. Thanks [@M-Maciej](https://github.com/M-Maciej) for the long-proof Fleet report. (#6990)
- **OrcaRouter recommendation:**`/provider` and `/model` offer a shared partner recommendation with the DeepSeek V4.1 Flash 30% top-up-match link, public referral disclosure and localized offer details. F7 or a click opens the existing pager while retaining the current route.
- **Per-scope instruction budgets:** global and project standing instructions now have separate token budgets (100,000 estimated tokens each, capped at 25% of the usable context window), every trim, skip or refusal reaches the model and `/context report`, and `[instruction_budget] policy = "refuse"` stops a request before dispatch. Other tools' instruction files stay opt-in through `project_instruction_imports` or `claude_fallback`, and the table is user config only. Thanks [@7jrxt42BxFZo4iAnN4CX](https://github.com/7jrxt42BxFZo4iAnN4CX) for the design and implementation. (#6526, #7086)
- The TUI Terminal dock now also shows the model's shell commands for the
session: each running or recent command is a read-only tab with its live
output, beside the interactive shells. "No live terminals" appears only when
there are neither.
- Preview: `dispatch --computer` starts an account cloud conversation that can
also be opened in desktop. `--thread` continues or inspects it; `--stop`,
`--approve` and `--deny` control its current task. Explicit `--key-stdin`
installs provider access in the running computer's memory. Retries retain
one operation key and the account/VM binding. Existing Agent Work dispatch
remains available when no computer conversation is selected.
- A long draft or paste now grows the composer past its density row limit, up
to half the screen (never less than that limit) while leaving room for the
transcript, so the text can be read and edited before sending. While a
slash, mention or history-search menu is open the composer keeps its usual
height (#7049).
- **Scheduled work can post into an existing conversation:** automations,
`send_later` triggers and tasks accept `destination_thread_id`. A run then
starts a turn in that thread instead of a new one, retrying while the thread
is busy up to the task's time limit, and a missing or archived thread fails
the task by name.
- **Audit receipt as Markdown (Runtime API):**`format=md` on the thread and
turn receipt routes returns the same text the terminal shows; other formats
return 400.
- **Native HarmonyOS binary:** releases build `aarch64-unknown-linux-ohos` as an
eighth target and publish a signed `codewhale-ohos-arm64`, so HarmonyOS users
no longer need a Rust toolchain and the OpenHarmony SDK, and
`npm i -g codewhale` there picks the native build.
- **Pinned whale routes (preview):** `codewhale account agents create NAME
--provider P --model M` pins the exact route on the whale's saved Agent, and
`account agents list` shows each whale's provider and model.
- **Cloud dispatch reuses a configured API-key model (preview):** plain
`dispatch` picks your only running account computer and carries a portable
configured model; the key is sent in memory only, bound to the account and
the exact HTTPS endpoint.
- **Mistral Vibe key setup documented:** the Mistral provider docs point to
current Vibe Code key guidance, with its shared-allowance and billing limits.
Live use in Codewhale is not verified.
- **Website:** an Enterprise page at `/enterprise` lists what Enterprise will
deliver, with no pricing or availability claim, and the FAQ is finished.
### Changed
- **Sub-agents and goals by default.** The constitution now tells the agent to start independent parts of a request as parallel sub-agents in one message, keep working while their results arrive on their own, and end the turn when only waiting remains; to give each child a complete prompt and its own files; to inspect a write-capable child's evidence, review the diff and run the checks itself; to have an independent reviewer try to refute a non-trivial change before calling it done; and to start a goal for any request, in any language, whose verifiable end state needs more than one turn. Sub-agents, workflows and goals within the current request are in scope; spending real money (purchases, paid providers, billing) still needs the user's express authorization. Cost alone is not a reason to stop; only limits the user or configuration sets apply. **This changes the session-pinned prompt and tool descriptions, so each session re-pins its prompt cache once after upgrade.**
- **Operate's contract is retired.** The Engine no longer appends the Operate contract to a session; its review, cost and evidence rules now live in the constitution for every session. Saved sessions that contain it still replay.
- **Clearer tool text.** The `agent` description leads with when to delegate, gives one trigger per role and an example child brief, and drops Operate and legacy wording; the start receipt says results arrive automatically. `create_goal` and `update_goal` say when to start a goal and what complete, blocked and yield mean (blocked means the same obstacle persists; difficulty is not blocked). `tool_search` lists the deferred tool groups. The eager tool schemas shrink by 681 bytes.
- **Workflow fan-out default 16 → 64.**`[workflow] max_concurrent` now defaults to 64 live agents per run, matching sub-agents; the per-run ceiling rises from 16 to 128. No spend caps were added.
- **Bundled skill `goals` is now `personal-goals`.** It tracks personal resolutions in `goals.md` and no longer collides with goal mode; `goals` still resolves to it. An untouched installed `goals` copy becomes `personal-goals` on upgrade; an edited one stays as `goals`.
- **Each sub-agent is told its name, its scope and that its final answer is delivered to the parent automatically.**
- **Thread-owned terminals (Runtime API, breaking):** Engine terminal shells now belong to the conversation that started them, so two conversations using `term-1` in one folder get separate shells instead of sharing cwd, running command and output. Clients list a thread's shells at `GET /v1/threads/{id}/terminals` and drive one at `/v1/threads/{id}/terminals/{terminal_id}/output|input|resize|kill`; a reset shell, another thread's or workspace's shell, or one from before an Engine restart answers 404 instead of attaching to a same-named shell. The name-addressed `/v1/terminal/{name}/*` routes now answer 410, and `/v1/runtime/info` advertises `thread_scoped_terminals` in place of the four `terminal_*` flags. Client input meets the thread's shell consent and sandbox-reuse guard, and a lone Ctrl-C uses the dock's confirmed interrupt. In the TUI, a new conversation starts its own `term-1` rather than reusing the previous conversation's shell, which the dock still lists.
- **Ask asks before every edit; new Accept Edits posture (#5185, #5186):** Ask now opens a
card for file edits inside the workspace too, as its name and the Plan
handoff ("Edits and commands ask you first") promise. The in-repository edit
rule moved to a new posture, **Accept Edits** (Claude Code's `acceptEdits`):
an edit whose every target stays inside the workspace git work tree runs
without a card, while `.git`, `.codewhale`, `.env*`, credential and key
files, folders without git, commands, network and connected apps still ask.
Shift+Tab cycles Ask → Accept Edits → Auto-Review → Full Access, so one
press restores the previous Ask behaviour. `/permissions`, `/status`,
`/config` and the Plan handoff offer it; the Runtime wire spells it
`permission_posture: "accept_edits"`, settings and `config.toml`
`accept-edits`. Project config may tighten Accept Edits to Ask but never
loosen Ask to it. ACP sessions run it as Ask.
- **Brighter terminal working states:** the Ocean palette has stronger accents,
and active work uses a restrained left-to-right text sweep. Quiet and
reduced-motion settings keep stable working indicators. The shared
`codewhale-ratatui` kit carries the same palette and motion updates.
- **Managed ACP requirements outrank Full Access:** when organization
requirements manage approval policy, ACP no longer lets `--full-access`
override them. The TUI already locked YOLO this way; ACP now matches.
- **Cleaner, safer Markdown export:** headings no longer carry `Content N:` numbering, a text block that opens a message is bare, tool results show their tool name and appear under a `tool` role instead of `user`, and `Error:` appears only on an error. Tool output is now fenced, so a tool result can no longer forge a heading or a message in the transcript. A trailing `--force` is a flag rather than part of the path. `/share` now publishes the same HTML page as `/export file x.html`, still as a redacted secret gist after confirmation.
- Internal coarse split: Runtime owns bounded owner work, Paths owns the protected socket layout, and Protocol owns shared avatar data. App Server now owns the Runtime host and control transports previously embedded in the TUI. Engine and Sandbox do not depend on App Server; the remaining Stage B boundaries stay open (#5586).
- **Newer DeepSeek Harness plugin compatibility:** the Native host targets
DSH 0.2.1-rc.5 with Cordis 4.0.5 and refreshed reviewed composition
packages. Boolean `deferLoading` hints are accepted while the Engine keeps
tool-loading policy; `when` remains refused. Service metadata distinguishes
DSH, Cordis and Codewhale services. The changed compatibility digest requires
fresh plugin review and trust. The legacy preset adapter keeps its recorded
source pin; this is local compatibility evidence, not release qualification.
- **Goal tool guidance while awaiting an answer (#7177):** the tool schema now
tells the model to yield when it needs the user’s answer and reserves blocked
for stalled progress. Existing runtime semantics are unchanged; no live-model
qualification is claimed. Thanks [@SparkofSpike](https://github.com/SparkofSpike).
- **A goal pauses to ask instead of inventing the answer (#7175):** the goal
continuation prompts now tell the model to call `update_goal` with
`status: "yield"` when the next pass needs an answer only the user can give,
and that asking in prose does not pause the goal. This is prompt steering, not
enforcement: a model that ignores it still keeps the goal active. Thanks
[@SparkofSpike](https://github.com/SparkofSpike).
- **Newer model rows in the offline catalog:** the bundled seed now carries `kimi-k3.1-pro` and `kimi-k3.1-pro-highspeed` (Moonshot), `MiniMax-M3.1-Flash` (MiniMax and its Anthropic-compatible endpoint) and `gpt-6.1-terra` (OpenAI), which Models.dev already listed and Codewhale did not pin. Live refreshes from Models.dev were already showing these online; the seed is what a first run, an offline start and a deep-offline install read, so it is now re-locked at 2026-10-30 and rendered. `seed render --check` matches and `defaults audit` reports no stale default.
- **Skills ownership (internal):** skill discovery, provenance, mutation and bundled skill content move into `codewhale-skills`. Native roots still use the existing host manager's selection and lifetime checks. (S20, #5316)
- **Model pricing ownership (internal):** hand-sourced price metadata and recorded-time rules move into `codewhale-models`; cost auditing and live catalog callers use the same owner. (S24p1, #5316)
- **`codewhale-error-taxonomy` crate (internal):** `error_taxonomy` moves out of `codewhale-tui` into a new crate; the `LlmError` envelope conversion stays in the TUI crate until the model-wire split. No behavior change. (N13, #5316)
- **`codewhale-tui-kit` crate (internal):** terminal rendering helpers (markdown, diff, text width, paste burst, OSC-8, streaming) move out of `codewhale-tui` into a new crate, and `syntect` is no longer a direct `codewhale-tui` dependency. No behavior change. (S52, #5316)
- **Terminal kit on design tokens 5.0.0:** the vendored `codewhale-ratatui` reuses the current shared blue, Ocean grounds and contrast-checked state colors (upstream codewhale-hq/codewhale-ratatui 8311b65). Primary actions use blue fill with white text; raised panels keep a visible edge where 256-color backgrounds collapse. Built-in TUI palettes retain their own overrides, and existing working-motion and reduced-motion guards remain in place.
- **Fleet workers run the same Codewhale:**`codewhale fleet run` and Runtime API Fleet runs (`POST /v1/fleet/runs`) now start workers from the running `codewhale` binary instead of whichever `codewhale` is first on `PATH`, so they work with a minimal `PATH` and never pick up a stale copy. `CODEWHALE_FLEET_CODEWHALE_BINARY` still overrides it. (#7119)
- **Switching provider lands on its current model:**`/provider stepfun` now selects Step 5 Preview instead of the older Step 3.7 Flash; a model you saved for a provider is still kept. `/model` now lists the current provider's own models (bundled and live, newest first, up to 20) instead of only the selected one. Search also matches ids typed without separators (`step5`). While you search, Shift+P and Shift+F type their letters rather than pinning or adding to Fleet, so `Step-5-Preview` can be typed in full; Ctrl+P and Ctrl+F pin or add the highlighted row at any time.
- **First run without a key:**`/provider` now opens on the full provider list (DeepSeek and the other cloud providers) when only a keyless local runtime is set up, no longer shows a disabled Antigravity row that was never configured, and Shift+A toggles the view like `a`. A local Ollama model that is not loaded yet is loaded before the first turn, so the route uses its real context window (for example 32K for `qwen3:4b`) instead of an 8K fallback that refused the second message with "~5120 tokens usable"; the footer's context reading follows the same window. The TUI resolves an unknown Ollama default to an installed chat model on startup. If the daemon or chat model appears later, selecting `/provider ollama` retries discovery. Embedding-only tags keep the model unresolved. An installed Ollama model is listed in `/model` and `GET /v1/providers/ollama/models` once its own catalog has answered, even when another provider is active. (#7113, #7114, #7116)
- **Computer Use delivery:** the standalone Engine uses the separately released Computer Use plugin; desktop packaging owns its embedded background helper. The marketplace pins plugin 0.16.0 and its archive checksum. Consent tools load on first use, and decisions still require a human approval card.
- **First-party marketplace receipt:** the shipped catalog is pinned to marketplace revision `6096906d57a5a27460ec46eb916460c611aa32c8`.
- **Upgrading over older installs:**`codewhale update` writes an install receipt for a copy installed before receipts, and moves a mismatched `codew` to the recovery folder and replaces it instead of refusing the update. The `curl | sh` and archive installers upgrade an earlier Codewhale in the install directory instead of refusing, keep the old files in the recovery folder rather than as `.bak` files beside the commands, and finish with `codewhale doctor --installs --brief`; a symlink or a non-Codewhale file at the destination is still refused. The Windows archive installer keeps the replaced files in the recovery folder too.
- **The desktop app's Engine is never self-updated:**`codewhale update` refuses to write inside `*.app/Contents/MacOS/` or the app's pinned Engine store, and the update notice for that copy says to use Codewhale > Check for Updates.
- **GitHub Action needs an explicit provider:** the Action's `provider` input no longer defaults to the `codewhale` account relay. Name your BYOK provider (or `codewhale` for a separately verified account machine key); a missing provider stops with `configuration_missing` before any download or model call. The repository's own (disabled) review workflow now pins CLI `v0.10.2` by default instead of `v0.10.0`.
- Local Ollama defaults now come from chat-capable tags, and `/provider ollama`
refreshes the live catalog before switching. Exec and Runtime API defaults use
the same discovery path. Fresh context observations come from loaded models'
served windows; unloaded models retain an explicitly unverified fallback (#5848).
- The Runtime API's `turn.usage` receipts now carry each model call's priced
cost on the route that served it and the prompt size the provider billed, so
a client can follow a long turn while it runs. The mobile control page shows
live token usage and a partial cost estimate in its header, keeps the
estimate after the turn settles, starts fresh for the next turn, and counts a
replayed receipt once (#7074). Thanks @gaord.
- `--full-access` is now the documented flag for Full Access (`--yolo` stays an
alias), and `serve` accepts it after the subcommand: `codewhale serve --acp
--yolo` used to fail with "unexpected argument". `serve --acp` also writes one
stderr line naming the permission and sandbox it runs with, and the ACP
permission option's Full Access hint names the working command. A configured
`sandbox_mode = "danger-full-access"` still never widens Ask or Auto-Review
(#6992, #4955). Thanks @eugenicum for the request.
- Ctrl+C on an idle composer that holds a draft now clears the draft instead
of arming exit, and Ctrl+Z restores it. The "press Ctrl+C again" exit prompt
arms only once the composer is empty, and Ctrl+C during a running turn still
cancels the turn first. Clearing a draft with Ctrl+C or Esc also resets a
pending exit prompt (#6237, #7084).
- While a background job runs, the git status probe now backs off after 30
seconds without input or engine events, as it already did in an idle
session, instead of starting about a dozen git processes every 2 seconds for
as long as the job lives (#6728).
- An idle session wakes less often. While an approval, elevation or question
prompt waits on you, while a background job runs, or while only a
once-a-second label ticks, the event loop now relaxes to its 250 ms quiet
poll instead of polling every 24 to 48 ms; animations and the prompt's
timeout still wake it on their own deadlines. The terminal input thread
polls every 200 ms instead of 50 ms after 5 seconds without input. Measured
on macOS with release builds: an approval wait went from 29 to 12 timer
wakeups per second, a background job from 32 to 16 and an idle composer
from 25 to 11 (#6728).
- Saving a session no longer copies every message body: journal entries
share their content, so the snapshot taken on each update copies ids and
pointers. Resuming a session compares a leftover crash checkpoint against
the saved document's metadata instead of parsing the whole document first,
so `--resume` and attach read the document once (#6842).
- Multiline mode now has a send key on every terminal: with
`composer_multiline_mode = true`, `Enter` inserts a newline and `Alt-Enter`
sends. `Shift-Enter` also sends where the terminal reports it distinctly; on
Linux terminals that report it as plain `Enter`, multiline mode previously
had no way to send. `Ctrl-J` always inserts a newline. Thanks
[@luestr](https://github.com/luestr) for the report. (#7093)
- **Faster repository checks:** the Engine reads a repository's HEAD in-process
instead of starting `git`, without running the repository's filters or
fsmonitor.
### Removed
- **Claude subscription sign-in (breaking):** Claude subscription sign-in is
removed: it used Claude Code's sign-in, which Anthropic doesn't allow other
apps to use. Use an Anthropic API key instead, through
`codewhale auth set --provider anthropic`, `/provider setup anthropic` or
`ANTHROPIC_API_KEY`. `codewhale auth claude` and `/auth claude` now explain
the removal, and `/provider setup anthropic` goes straight to API-key entry.
A config that still selects `auth_mode = "oauth"` for Anthropic fails with
the same guidance instead of switching billing to an API key. Saved Claude
sign-in files are not deleted; `codewhale logout` removes them with your
other saved credentials (Refs #6932).
### Fixed
- **Anthropic and Messages-compatible routes accept any tool name.** Tool names that Anthropic's pattern rejects, such as `web.run` from a loaded tool group, are encoded on the wire and decoded in replies, as the chat and responses routes already did. Before, one such name made every request fail with "tools.N.custom.name: String should match pattern", which stopped sub-agents that had loaded it.
- **A large sub-agent fan-out no longer exhausts the usage journal.** The per-session limit of live usage receipts rises from 64 to 256, above the workflow ceiling of 128, so a full fan-out keeps its cost receipts instead of running with cost unknown.
- **A turn that stalls before it starts is now bounded.** The stall watchdog covers the setup before the first model request, so a wedged start is logged, cancelled after 180 seconds with a stated reason, and leaves a stall record instead of waiting silently. A warning names the case where all four blocking-work slots are held. Refs #6184.
- **One unreadable saved session no longer empties the recent-sessions list.** The launch card and ACP `session/list` show the readable sessions and log the failure. Refs #7095.
- **Windows uninstall removes the receipt and update leftovers.** The installer's uninstaller also deletes `.codewhale-install.sha256` and `codewhale.old-*`/`codew.old-*` left by a self-update, so `bin` can be removed. Refs #7091.
- **Windows `/undo` matches recorded file paths regardless of case.** A write recorded under a different drive-letter or directory case, or a `\\?\` prefix, is no longer dropped from the restore plan. Refs #6970.
- **Windows: Fleet and metrics read live files again.** Replaying a Fleet ledger and reading audit or receipt records no longer fail with a sharing violation while their writer is still open; the same regular-file, link and identity checks apply. Plugin enablement now says which snapshot check refused (stage root, content identity or final check) instead of one generic message. Generated protocol and SDK exports keep LF line endings in Windows checkouts.
- **A held coordination lock no longer makes a new session read-only.** When another session owns the delegated-agent store, the new session starts on private state and says so, instead of refusing every sub-agent with “Failed to clean up sub-agents”.
- **A dev server can outlive the turn in an interactive session.**`persist:true` now works in the TUI and desktop when the thread has Full Access; restricted postures and Fleet/sub-agents still refuse it.
- **`codewhale exec --add-dir <path>`** (repeatable) and `addDirs` on `POST /v1/threads` let the file tools read and write a sibling directory, a second checkout or a shared scratch root without turning on Full Access.
- **Unsettled usage is persisted in production, not only in tests.** The interactive sink now records a legacy usage receipt when a provider response has no settlement, so children and turns stop reporting settlement failure.
- **A full usage journal no longer fails a turn before dispatch.** The request runs with cost unknown instead of stopping on “native usage journal capacity reached”.
- **Reverting a file works in any posture.** Restoring a file the thread's own turns changed no longer requires `/trust` or Full Access; the exact snapshot and reviewed-hash checks still apply. **`fetch_url` can reach a local or private host you allowed** with `/network allow <host>`; cloud metadata stays blocked. Both refusals now name the setting.
- **`codewhale exec` offers tools by default**, still under the configured sandbox and approval posture. `--no-tools` is the one-shot. A pipe on stdin is the prompt when no arguments are given, or is appended to them.
- **A child no longer dies when usage settlement is not acknowledged.** The turn continues and cost stays unknown, matching the parent path.
- **Workspace memory works without a git origin.** A plain folder or a repo with no `origin` remote gets a stable workspace id. `codewhale plugin list` is an alias of `plugins status`. A heavy command runs after 30 seconds instead of waiting forever for an admission slot. An MCP registration 4xx names the status and the manual client-id path.
- **Wafer** is a selectable OpenAI-compatible host at `https://pass.wafer.ai/v1`. The public model list is the catalog; the default is `GLM-5.3`. Inference uses `WAFER_API_KEY`.
- **Provider defaults follow the provider's own model list.** A same-line successor (`grok-4.6` to `grok-4.7`, `muse-spark-1.2` to `muse-spark-1.3`) replaces a stale pin. A different line, such as GPT-6 beside GPT-5.6, does not. The provider pane shows one current model per line and spreads a gateway list across authors, instead of filling the screen with every Claude snapshot.
- **Turns no longer fail on a cost bookkeeping error.** When Codewhale could not
settle its own usage record ("previous usage publication has not been
acknowledged"), the whole turn failed and sub-agents were interrupted, even
though the model had answered. The turn now continues, the receipt keeps the
accounting error, and the status line says the cost is uncertain.
- **OrcaRouter offer:** no longer shown when Codewhale is in Simplified Chinese
or your computer is set to mainland China, and its note now says the link is
part of a referral campaign.
- **Cost line: a finished request is never "outcome unknown":** the cost
line drops "request outcome unknown" (and "provider omitted usage") once
the requests behind it have settled, even when another turn is still
unpriced for a different reason, and a request that is still running now
reads "request in progress" instead. A request that an exit or crash left
unsettled still reads "request outcome unknown" after a restart.
- **Sub-agents in `codewhale exec`:** a sub-agent started from
`codewhale exec` now runs. It used to stop before its first provider
request with "child provider call has no captured accounting origin",
because the exec session's accounting origin never reached the turn's
tools, so a fan-out ran in one context instead.
- **IME candidate window under modals:** the hidden terminal cursor now
follows the caret in `/config` search and its value editor, so the
input-method candidate window can appear there instead of over the
composer. Real Pinyin input on macOS and Windows is not yet confirmed.
Thanks [@cmdcorp6534](https://github.com/cmdcorp6534) for the report
(Refs #2323).
- **Sub-agents beside an older session:** while a Codewhale 0.10.2 session
still uses a folder's older delegated-agent store, a 0.10.3 session in the
same folder keeps working sub-agents with private state that is not saved,
instead of refusing every sub-agent action. The older session's files are
left untouched, and the store upgrades when a session starts after the older
one exits (Refs #7232).
- **Fleet members:** a replayed member start now matches only within its own
session, so two sessions that reuse an operation key no longer receive each
other's agent.
- **Plugin stages created during a registry load are checked:** a plugin whose staged copy appears while the registry is loading now goes through the same restage lock, receipt and policy checks as any other stage instead of being left unstaged; invalid bytes are still refused and stay in the failure cache.
- **Host-provided model clients:** keep configured session isolation and
approval deadlines when optional credential preflight fails.
- **Runtime SDK exports:** include the existing thread-scoped Git, snapshot,
worktree and job-operation capabilities in the committed schema and types.
- **Plugin enablement revalidates its review:** enabling rechecks the staged
snapshot and, under the existing state lock, refuses a changed review
generation or trust receipt. The macOS stale-enable check passed (1/1);
a separate Linux run reported 202 passed and one ignored on an earlier base
with matching plugin files and lockfile. Snapshot checking is point-in-time;
missing-stage recovery reuses the current receipt and policy. Filesystem
race coverage and final-candidate native qualification remain open.
- **Plugin status and UI admission:** an enabled, trusted plugin whose reviewed
runtime snapshot is missing or invalid now reports
`runtime-snapshot-unavailable`. Both plugin UI metadata and assets require a
declared DSH client; ordinary plugins cannot expose staged files through the
client UI route. Missing snapshots recover only from receipt-matching
canonical source; authenticated assets require an exact current grant.
Native and Electron qualification remains open; existing modified snapshots
require review.
- **DSH package-directory imports:** the existing offline reviewer uses npm's
version-range parser with the pinned DeepSeek host's prerelease policy, and
bare self-package exports resolve inside the selected package directory.
Invalid or incompatible ranges and paths outside the reviewed package still
refuse. Real published-plugin activation remains unqualified.
- **Coordination lock diagnostics (#7232):** stale lock-file contents no longer
identify an owner PID. A refused legacy admission keeps its reason in Work
and shows one notice per cause instead of repeating cleanup warnings on
every sidebar refresh. Legacy migration still requires the actual holder to
exit and the refused owning Runtime to restart; locks and retained state
remain protected.
- **A local proxy that stops mid-session no longer strands the session (#7231):** the model, catalog, search, vision, finance, MCP-registry, profile and remote-control clients watch a loopback proxy port and go direct while it refuses connections, then resume proxying when it returns. Only a definite refusal from every resolved address changes the route; remote proxies, `NO_PROXY` matches, credentials and the existing precedence are unchanged. Set `CODEWHALE_LOCAL_PROXY_FALLBACK=0` to keep the old build-time snapshot.
- **Proxy diagnostic privacy ([#7233](https://github.com/codewhale-hq/codewhale/issues/7233)):** malformed MCP proxy warnings omit configured values; local-proxy log labels mask userinfo and omit URL paths, queries and fragments. Routing is unchanged. All 23 existing proxy tests passed on macOS; runtime log capture and other platforms remain unqualified. Thanks [@SparkofSpike](https://github.com/SparkofSpike) for the report.
- **Fork, undo and retry work after a workspace drift notice (#7234):** the history-boundary walks now treat a whole `<context_update>` envelope as engine-owned, so a session that received one can be cut at every saved turn. A person quoting a notice or a truncated envelope still counts as their own prompt.
- **Git writes land in the right workspace:** stage, unstage, discard, commit, push and branch take `?thread_id=` and run in that thread's recorded workspace, matching the read routes. Before, they always ran in the server's own folder, so a commit asked for a thread in another folder could land in the wrong tree.
- **ChatGPT sign-in no longer depends on the device clock (#7203):** identity- and access-token expiry and not-before times are checked against the issuer's clock, read from the `Date` header of the issuer's key response, with a 60-second tolerance; without that header the device clock is used as before. Time errors report how far the device clock is from the issuer's when the difference exceeds the tolerance. A token signed with a key missing from the first key download triggers one fresh download before verification fails, and a missing or malformed claim is named exactly. Signature, issuer, audience, subject, nonce, account and plan-scope checks remain exact. Thanks [@d-onistack](https://github.com/d-onistack) for the report.
- **Remaining long-blocking work moved off async callers (#6553):** route
credential and certificate preflight, worktree creation, Runtime Chat relay
and remote-control journal transactions, and the remaining session, branch,
tree, skill, plugin and memory command I/O now run on the supervised blocking
owner. Results are still awaited before state publication; sync APIs remain
where sync callers still use them.
- **Frozen prices on DeepSeek endpoints:** published rates are captured for DeepSeek's root, `/v1`, `/beta` and Anthropic endpoint variants, and remain bound to the exact endpoint on replay. Other providers keep their existing pricing scopes; official credential aliases alone do not establish equivalent regional or plan prices. Request outcomes, missing provider usage, legacy usage and unverified corrections now have distinct cost explanations; saved receipts without a frozen quote remain unpriced.
- **Clipboard image persistence:** the existing confined writer handles relocated user state directly, without a second filesystem fallback that bypassed its protections and exceeded the blocking-call budget.
- **Case-sensitive model selection (#7214):** the provider picker restores the exact configured or wire model ID before trying case-insensitive compatibility matches. Thanks [@liuyy2](https://github.com/liuyy2) for the diagnosis and [@SparkofSpike](https://github.com/SparkofSpike) for the compatibility-preserving fix.
- **WeCom replies carry the API's error (#7208):** a rejected WeCom call now shows its `errcode` and message in the bridge reply instead of `[object Object]`. Thanks [@gaord](https://github.com/gaord).
- **WeCom streams survive the ten-minute expiry (#7210):** the bridge finalizes the current stream and opens a fresh one before WeCom stops accepting updates, and reopens once on a rejected update. Thanks [@gaord](https://github.com/gaord).
- **Non-English packs lose stale mode-jump and rail copy (#7225):** the sweep covers every non-English locale and a test pins it. Thanks [@asto18089](https://github.com/asto18089).
- **`image_analyze` accepts absolute paths inside the workspace (#7226):** POSIX and Windows spellings that resolve under the workspace are read instead of refused. Thanks [@asto18089](https://github.com/asto18089).
- **Sub-agent follow-ups report what happened (#7228):** a message to an existing successor says whether it was delivered without a resume, the focus view follows the actual recipient, and an undelivered follow-up keeps focus and shows the failure. Thanks [@asto18089](https://github.com/asto18089).
- **A long turn no longer ends at 64 model requests:** a turn that had recorded 64 provider usage receipts failed on the next one with "captured usage sink did not acknowledge its source", discarding the person's answer. The per-turn receipt cap is removed. Receipts keep recording exactly once; a sink refusal now retains the exact receipt for a later admitted flush and continues the turn, while owner-lock loss or thread mismatch still fails closed.
- **The `verify` tool names a callable surface (#7223):** its description taught the model to use the retired, hidden `run_verifiers` name; it now says to use the Run tool with `action="verifiers"`, and the retired-name guard test now covers `verify`'s description. Thanks [@asto18089](https://github.com/asto18089).
- **A home-directory workspace no longer refuses its own state (#7207):** a session started in the home directory treated it as a confined workspace, which broke the supported layout where `~/.codewhale` is a directory junction onto another volume (Windows `mklink /J`); only the home state directory is now exempt, and confinement for links elsewhere is unchanged. Thanks [@SparkofSpike](https://github.com/SparkofSpike).
- **The command palette keeps your draft (#7205):** picking a command that takes an argument, such as `/rename`, no longer discards what was in the composer; the draft is stashed so history search can recover it. Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Old sessions restore with the topology checkpoint in place (#7229):** sessions saved by v0.9.10 to v0.9.12 that compacted with live sub-agents placed the agent-topology checkpoint at the end of the history, which left a tool-then-user message pair that strict Chat Completions templates reject with HTTP 400. Restore now moves the checkpoint to where current saves place it, deletes nothing, and a restore followed by a re-compaction no longer keeps a superseded duplicate. Thanks [@asto18089](https://github.com/asto18089).
- **`/patch-undo` undoes the turn you chose (#7216):** `POST /v1/threads/{id}/patch-undo` ignored `turn_id` and undid the latest turn instead, so a caller got a different turn than `/undo` removes for the same request. It now removes the named turn and every turn after it. `GET` previews the exact turns and the files that would be restored; sending them back as `expected_turn_ids` and `expected_paths` makes a changed selection answer `409 undo_selection_changed` before any file is touched. Clients should require the `thread_patch_undo_turn_id` capability before sending a selected turn, because older Engines ignore the field. Thanks [@soarkit](https://github.com/soarkit) for the report.
- **`grep_files` matches brace and nested-directory globs (#7215):** `include` patterns such as `*.{txt,md}` and `**/*.{txt,md}` no longer return an empty result with no error; they match the same files the equivalent separate globs do, at the root and in nested directories. Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Sub-agent write claims accept absolute in-workspace paths (#7227):** a write-capable sub-agent that spelled an in-workspace target as an absolute path was refused while the relative spelling succeeded. Absolute paths that resolve inside the claimed workspace are accepted; paths outside it, `..` traversal and symlinked ancestors that escape are refused exactly as before. Thanks [@asto18089](https://github.com/asto18089).
- **WeCom replies are split by UTF-8 bytes (#7209):** the WeCom bridge now caps each reply chunk at 3,800 bytes (`WECOM_MAX_REPLY_BYTES`) on code-point boundaries, so a long Chinese reply is no longer delivered silently truncated at WeCom's 4,096-byte limit. Callers that do not pass a byte cap keep their behavior. Thanks [@gaord](https://github.com/gaord).
- **`file_search` reports workspace-root paths (#7213):** a search scoped with `path` now returns matches the way `read` and `grep_files` resolve them, so reading a result opens the file that matched. A `path` naming one file and glob searches under a subdirectory are fixed too. Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Sub-agent worktree isolation no longer adopts unrelated checkouts (#7224):** only the session anchor itself may adopt nested repositories; ancestors are probed for containment only, so a workspace a few levels below the home directory no longer fails with "Multiple git repositories found" over unrelated projects. Thanks [@asto18089](https://github.com/asto18089).
- **`fetch_url` no longer claims to be sandboxed (#7222):** its description now says it is an in-process HTTP client guarded by the network policy and the SSRF/DNS checks, and attributes the sandbox contrast to `exec_shell`. Thanks [@asto18089](https://github.com/asto18089).
- **Usage on long tool turns:** physical model-call receipts remain available after the 64th response without dropping earlier sources. A completed tool-only provider response uses its terminal stream event for accounting, while incomplete streams retain unknown coverage.
- **Retained browser connections follow their desktop owner:** authenticated runtime registration binds the browser endpoint and credential to its workspace; existing Core catalogs and connections retire a replaced registration before reuse.
- **`/new` waits for the Engine:** the terminal keeps the current session, transcript and draft until the exact session switch is acknowledged. A refused closure preserves them; a late acknowledgement can finish once while retaining input edited during the wait. Pending or uncertain switches pause new work and retain the existing scoped Stop controls.
- **Interactive command confirmations keep their stack headroom:** the existing interactive startup chain heap-pins its large futures instead of embedding their debug state machines in each caller.
- **Live MCP status includes runtime servers:** the existing pool snapshot now includes workspace-scoped dynamic servers, retaining static-name precedence and the same permission and connection checks.
- **Plugin reload confirms its workspace:** the status translation receives the required workspace value instead of producing an empty acknowledgement.
- **MCP credentials fail clearly:** missing or invalid required credential configuration stops before connection, stored OAuth discovery failures retain their cause, and reviewed-plugin errors redact credential details. Explicit reconnect still reloads saved credentials.
- **Desktop browser MCP stays with its workspace:** the paired desktop host registers its authenticated loopback server at runtime, late registrations refresh the tool catalog, and another workspace cannot inherit the connection. Recognizable obsolete global browser entries are ignored without rewriting user configuration.
- **Closing an empty delegated fleet avoids an unnecessary writer lock:** a session with no locally owned agent or worker records can close while another Codewhale process coordinates the workspace. Read-only or failed-admission state and sessions with owned records retain the existing coordination checks.
- Child, review and Auto usage keeps its captured session and route through late completion and persistence retries. Unreported usage stays unknown, cache writes and reasoning remain distinct, and cost calculations use the quote captured for the request.
- Interrupted children persist their continuation checkpoint and complete their workflow task instead of leaving it waiting on a worker whose execution already ended. Live approval waits retain their existing behavior.
- Session publication compares the document and crash checkpoint captured before work was queued. A delayed save refuses changed records without replacing newer history or clearing its checkpoint. Ordered completion retains real checkpoint acknowledgments, and native turn/control identity follows restores, undo and terminal saves. Legacy checkpoints require explicit recovery; canonical history recovery retains its original source and exact prepared generation.
- Damaged usage sidecars keep valid recovery data readable with incomplete coverage and no publication receipt. Known retirement, changed raw records and unsafe writes still refuse.
- Local control and ACP output serialize within the existing 8 MiB frame limit and stop a damaged or stalled output stream. Compatibility replies, events and relay stdout now share the 30-second write deadline; owner forwarding keeps its tighter 5 seconds. Standalone and attached ACP recover after complete invalid UTF-8 or oversized input frames, discard oversized tails through the real newline, and preserve cancellation, permissions and actual Core receipts.
- MCP composition records actual schema or description changes before the next request, so a conservative batch withdrawal re-pins the declared tool surface instead of failing the C5 prefix guard. Semantically unchanged runtime refreshes preserve the original serialized catalog and schema key order. The `execute_tools` description also explains that visual input needs a direct capture call because nested results do not deliver inline images to the model.
- Runtime SDK declarations for event, image and dynamic-tool messages are generated from the same Rust wire contracts. Output schemas retain required nullable fields while request defaults remain optional.
- Inference requests stop after uncertain delivery or an interrupted stream instead of silently sending another request. Automatic retries require an ordinary rate limit or a transient connection failure before dispatch. Redirects and HTTP protocol retries cannot bypass this policy; retained output and missing usage coverage remain visible. Terminal `exec` failures return exit 1; error categories no longer imply that repeating a saved command is safe.
- MCP calls inside `execute_tools` expose a single bare JSON result directly through `content`. Rich or annotated results retain their envelopes, and oversized results keep the original raw size and spill receipt.
- Session metadata reads stop at a bounded scan and report unreadable records without hiding healthy picker rows. Queued saves preserve durable renames, archive state and Runtime ownership under the session write lock; uncertain metadata refuses writes and cleanup. Persistence batches run off the async executor, and explicit placeholder-title renames retain their intent.
- Worker coordination serializes durable admissions across processes, preserves foreign workers and winning completion receipts, and fences stale checkpoints. Fleet restart reservations retain uncertain prior processes until exact teardown is confirmed; final output, usage and the receipt publish together without duplicate accounting on retry. Retained transcripts follow committed ownership.
- JSONPath projections bound path length, traversal steps and intermediate matches before cloning results. Direct fetches share the same parser and enforce one aggregate serialized-field budget; oversized selections refuse with narrower-selection guidance.
- Long tool output and diffs use bounded display windows and a byte-limited row cache. Retained details load verified byte ranges and label what search and copy include; explicit source copy keeps stored text with control-sequence cleanup. Oversized Unicode is shown safely without changing question answers; long answers retain their exact bytes in the existing owned output artifact before bounded model-context projection. New pager notices are translated across all 15 complete language packs.
- **Markdown character references:** ordinary prose renders valid references once, while inline code, plugin approval text and argv retain their literal values. Long URL punctuation stays linear to scan. Thanks [@Lstarsky0](https://github.com/Lstarsky0) for the report and original fix ([#7192](https://github.com/codewhale-hq/Codewhale/pull/7192)).
- Managed Fleet validates overlapping write roots with a component-sorted scan and deduplicates roots once. Large valid request bodies no longer spend quadratic CPU before admission; existing write-scope refusals and execution limits remain in force (#6554).
- MCP transports, connection pools and child Engines retain the owning host credential context for placeholders, headers, bearer tokens and OAuth setup. Missing injected values never fall back to process secrets. Reviewed plugins keep their captured environment authority, whose Debug output now masks values. Durable OAuth token custody and full subprocess isolation remain separate work (#5637).
- Python REPL drains stderr while code runs, retains at most 64 KiB of diagnostics and reports omitted bytes, so noisy code cannot block request completion (#6554).
- Saved tool results use bounded streaming inspection while preserving session ownership, digest and generation checks. Text refuses oversized lines or selections with byte-recovery guidance; verification also has explicit scan and cancellation limits (#6554).
- Telemetry bounds its pending event queue and disk-tail reads, keeps final flush admission available, and skips invalid UTF-8 records without discarding intact neighboring records. Existing opt-out and privacy ordering remain in force (#6554).
- Workflow history summaries retain large child totals without allocating one row per claimed child. Missing outcomes, usage and elapsed time remain unknown, including in the workbar (#6554). The independent terminal kit advances to unpublished 0.2.0 for its `u64` total API; registry-based TUI packaging waits for separately approved kit publication.
- Web build dependencies cap glob preprocessing and stop cancelled directory traversals through compatible, verified upstream backports. Raw dependency findings remain visible. Thanks [@isaacs](https://github.com/isaacs) for the [minimatch](https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8) and [glob](https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7) fixes (#6560).
- Repeated requests no longer make `/undo` restore files from an older invocation. `/undo select` chooses a request range and shows checking, restoring and saving progress. Missing, ambiguous or stale restore points refuse before changing files. Esc–Esc continues to rewind only the conversation. Thanks [@luestr](https://github.com/luestr) for reporting [#6970](https://github.com/codewhale-hq/Codewhale/issues/6970).
- `web.run` refuses more than 64 operations across its command arrays before starting network work or changing its session cache (#6554).
- Skill discovery and audit marker reads stop at 512 KiB. Approved linked global skills still load; oversized, invalid and non-regular files produce visible refusals instead of unbounded reads (#6554).
- OpenSandbox caps successful responses at 8 MiB before parsing and limits remote error details to 4 KiB with terminal controls removed. Oversized responses fail explicitly. Remote execution cancellation remains a separate requirement (#6554).
- The WinGet manifest generator now selects the published x64 portable executable by exact name and records its checksum and Visual C++ dependency.
- The Windows setup uninstaller preserves a trailing separator in the current-user PATH and retains other settings stored in the CodeWhale registry key.
- Inline code in terminal replies preserves embedded backticks. Text after an unmatched delimiter keeps its normal styling. Thanks [@Lstarsky0](https://github.com/Lstarsky0). [#7185](https://github.com/codewhale-hq/Codewhale/pull/7185)
- Windows Ctrl+Break and terminal-close events now request the same bounded session checkpoint and persistence flush as Ctrl+C (CW-7553).
- When a keyless local Ollama route has no resolved chat model, retrying `/provider ollama` refreshes the catalog in the background. You can keep typing while the daemon responds. [#5848](https://github.com/codewhale-hq/Codewhale/issues/5848)
- Auto checks the served context window on an active keyless Ollama route when its default model still has an unverified limit. A later turn can use the running model’s window once Ollama has loaded it. [#5848](https://github.com/codewhale-hq/Codewhale/issues/5848)
- The bundled catalog recognizes the bare `deepseek-v4.1-flash` model ID. It reports a 1,000,000-token context window and a 384,000-token output ceiling. [#7183](https://github.com/codewhale-hq/Codewhale/pull/7183)
- After `/undo` restores files, Codewhale saves the conversation rewind before reporting completion. Pressing Esc twice and choosing an earlier request also saves that exact conversation boundary, even when two requests have identical text. The picker keeps workspace files as they are. Thanks [@luestr](https://github.com/luestr) for reporting [#6970](https://github.com/codewhale-hq/Codewhale/issues/6970).
- Feishu and Weixin persist each incoming message ID before handling it. Concurrent deliveries share one result. After a restart, a message with an uncertain outcome stays pending until the bridge can tell the user to check its status. Thanks [@7jrxt42BxFZo4iAnN4CX](https://github.com/7jrxt42BxFZo4iAnN4CX) for the durability audit (#6555).
- Custom OpenAI-compatible routes now honor explicit output requests within the
configured window and serving limits. A hosted model with the same name
could previously truncate reasoning at 32,768 tokens. Thanks
[@Gabriel-Degret](https://github.com/Gabriel-Degret) for reporting [#7179](https://github.com/codewhale-hq/Codewhale/issues/7179).
- Saving a user turn when the Engine adds its metadata preserves the journal entry and its place in history. Sessions with a fork keep the earlier branch intact. Thanks [@SparkofSpike](https://github.com/SparkofSpike). ([#7180](https://github.com/codewhale-hq/Codewhale/pull/7180))
- **Star keycaps stay intact in Markdown (#7176):** plain and escaped text
preserve the full grapheme, and a keycap cannot open emphasis. The separate
Windows Terminal font-fallback issue remains unqualified. Thanks
[@SparkofSpike](https://github.com/SparkofSpike).
- **Codewhale runs from a HarmonyOS user directory (#7168):** on HarmonyOS hmdfs (the 2in1 `/storage/Users/currentUser` mount), which reports its own owner and a group-writable mode for every object and refuses `chmod` and advisory locks, a GUI start failed one feature at a time — the workspace lease, the owner control socket, then the OAuth credential directory. Private directories, the secret store and credential files now probe the mount once, keep the strict ownership check everywhere it can be expressed, and on a mount that cannot express ownership still enforce no-follow, single-link and atomic publication, with one warning naming what the mount reported. A filesystem without advisory locks serialises secret-store writes within the process instead of refusing; a held lock is still contention. Not observed here on a real HarmonyOS device. Thanks [@gaord](https://github.com/gaord).
- **Notes stop swallowing a backslash:** a transcript note is machine-generated and names paths, but it went through the markdown renderer, where CommonMark §2.4 reads a backslash before ASCII punctuation as an escape. A note naming `C:\Users\asus\.codewhale\setup_state.json` therefore printed as `C:\Users\asus.codewhale\setup_state.json` — a directory that does not exist, in the one line a user would copy to find the real one. Notes are now escaped where they are rendered. Fenced blocks, and lines carrying inline code or a table row, are passed through untouched, because the renderer already copies those verbatim and doubling a backslash inside one would print it doubled.
- **Setup state survives a second instance:** two running Codewhale windows share one home, and both rewrite `setup_state.json` when the provider or model changes. The replacing rename is now retried briefly when the destination is held open for a read — Windows refuses it outright while that handle lives — instead of surfacing a write the caller could have made. The failure message also carries the underlying I/O error instead of only the outer context, so the next occurrence is diagnosable.
- **`doctor` stops flagging a user's own temp-named logs:** the `stale_setup_temp_files` check matched any file whose name starts with `.tmp`, so scratch files such as `.tmp-build-release.log` made a clean home report as half-applied. It now matches the shape a staged write leaves when it never lands (`.tmpXXXXXX`, no extension).
- **Approval cards are translated in every locale (#7071):** the "Do you want to proceed?" question, the Why and Stop explanations on destructive actions, the Approve, Edit plan and Cancel choices on workflow plans, the Save row, the details pager's title and the card's impact lines (one sentence per tool category plus the Reads, Writes, Target, Connected app, Agent type and Primary input rows) came from English literals, or from Simplified Chinese only. They now use the shared message catalogs, so all 15 packs carry them. The 14 non-English translations were written without native-speaker review. Still English outside Simplified Chinese: a workflow plan's own impact lines and detail labels, and the delegated-authority rows.
- **Local vLLM models keep their own reasoning ladder (#7124):** a vLLM or SGLang route treated every model as low/medium/high and folded low and medium onto high. Reviewed model-template facts (`crates/config/src/local_reasoning.json`) now give Qwen3.8, Qwen3.6-35B-A3B, Ornith, GLM-5.3-Flash and DeepSeek-V4-Flash-Vision-Exp the controls their template accepts, and the effort picker offers exactly those tiers, so low stays low and medium stays medium where the model has them. Unreviewed models are unchanged. Not yet observed against a real vLLM or SGLang server. Thanks [@gannp](https://github.com/gannp).
- **`/undo`, retry and fork-at-turn work on large and attachment-heavy conversations again (#7147):** a fork was measured by the shape it is stored in (a saved session repeats its conversation while it carries a journal, so the file can be twice the history) against the 8 MiB bound the reader judges by what the conversation carries, so a conversation the runtime kept opening and extending could still refuse `/undo` with "full history exceeds byte transport bound". The saved-history boundary also counted MCP-server notices, shell-completion handoffs, the deferred-toolbox snapshot and `<image>` attachment tags as prompts you typed, so a conversation that had received one refused with "Cannot identify an exact saved-history boundary". Both now use what the conversation carries. Thanks [@gaord](https://github.com/gaord).
- Table cells retain code, bold text and clickable links when they wrap. Inline code that fits its cell keeps its indentation and any space-only content. Thanks [@Lstarsky0](https://github.com/Lstarsky0). [#7181](https://github.com/codewhale-hq/Codewhale/pull/7181) · [#7184](https://github.com/codewhale-hq/Codewhale/pull/7184)
- **Markdown shows what was written:** a paragraph nested under a list item keeps its indent (#7146), `~~~` fences render as code blocks and keep backtick lines inside them as code (#7156), asterisks that do not open emphasis (`5 * 60 * 60`, `*args`) stay literal (#7157), a bare URL ends at full-width punctuation such as `。` and `）` instead of swallowing it (#7158), a link whose target has its own parentheses (`…/wiki/Rust_(programming_language)`) keeps its closing `)` (#7170), and inline code and links inside bold, italic or strikethrough render as code and links instead of their raw backticks and brackets (#7171). Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Fleet changes no longer put a stray English status in the footer (#7152):** the engine's "Fleet roster refreshed for subsequent turns" arrived after the change's own receipt, stayed for seconds, took over the footer, pushed the Shift+Tab hint off the row and stayed English in every locale. `/config stream_chunk_timeout_secs` no longer leaves the engine's "Stream chunk timeout set to …" status in the footer after its own note either (#7169). Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Simplified Chinese uses one form per term (#7150):** the pack addresses you as 你 throughout (the telemetry notice mixed 你 and 您), says 提供商 for provider and token for usage, and drops two stray spaces after full-width punctuation. Thanks [@luochen211](https://github.com/luochen211).
- **A turn can no longer wedge forever after a tool returns (#6184):** the heartbeat's tool phase carried no bound, on the assumption that per-tool timeouts covered it. They cover a *running* tool, not the engine's own work after a result comes back, so that window had no owner: the in-app watchdog deferred to the engine because the engine still looked like the owner, and the engine watchdog only reported. A real turn sat there for 56 minutes, produced no stall record and never cancelled. The tool phase now has a ceiling, and a watchdog report cancels the turn so it ends with a stated reason instead of hanging.
- **A restored conversation can be undone again:** a saved document keeps each turn's `<turn_meta>` envelope before the prompt while a thread rebuilt from its turn records keeps it after, and only the leading shape was stripped before comparing the two. Every record-side prompt was therefore longer than its transcript twin, so the exact-boundary search never matched and `/undo` on a resumed thread refused with "Cannot identify an exact saved-history boundary" instead of answering. Both shapes are now stripped, so the comparison sees the prompt text alone.
- **MCP servers that reject the modern probe now fall back to the legacy handshake:** a server answering `server/discover` with HTTP 400 and a JSON-RPC error (for example `-32600 Unsupported protocol version`) was treated as a hard failure instead of evidence that it speaks the older handshake, so such a server could not connect at all. Codewhale now reads a parsed JSON-RPC error on the probe as a transport refusal and negotiates the legacy `initialize` handshake, which is what a server that clearly answered in JSON-RPC means. Reproduced against `mcp.deepwiki.com` (three tools after the fix); Linear is unaffected.
- **MCP servers reject requests that carried two framing headers:** Codewhale sent every Streamable HTTP request with a duplicated `Accept` and `Content-Type`, because the extension host forwarded the SDK's headers and the Rust send path added them again. A server that validates those headers answered `415`, which Codewhale read as "this endpoint is not Streamable HTTP" and answered by switching to the deprecated SSE transport; servers that refuse `GET` then returned `405` and the connection failed with only `SSE error: Non-200 status code (405)`. Linear was unreachable this way. The send path now collapses the framing headers to one value each. Verified against Linear: discovery, tool listing (77 tools) and connection succeed.
- **One context window from planning to compaction (#7133):** the window a route resolves (from provider facts, your configuration or a fallback) and where it came from now travel together. Turn planning, automatic compaction, tool-output sizing, output caps, child agents, the context inspector and the model picker all use the same window. Previously a custom model with no context metadata was sent with a 128K fallback while compaction planned against 1M. A model switch or re-sync that keeps the same model and limits keeps that window. On resume, `/context` shows the last Auto route’s saved window and its source. Each new turn resolves its own window from current settings and provider facts. After a model switch, the `/preview-request` body hash includes the compaction setting the new route will send. The `/context report` command identifies the Engine as the source of both its bundled constitution and the session relay template. The original Windows report has not been reproduced.
- **Session saves no longer fail silently (#7095):** if the session store has stopped, a checkpoint or reset save now reports the failure in the status line instead of being dropped with only a log line.
- **Saves keep your recovery checkpoint (#7095):** a finished turn is saved even when a newer in-progress checkpoint arrives at the same time, and a `/clear` or `/new` reset no longer drops its own snapshot when saves queue up. If the reset snapshot cannot be built or written, the previous recovery checkpoint is kept and the save failure is shown in the transcript and status line instead. Retrying an interrupted session deletion finishes it without removing the shared checkpoint an older Codewhale may still be writing. These fixes do not yet reproduce the original report.
- **Context inspector shows the real compaction trigger (#7133):**`/context` uses the current route's effective threshold, including when it is zero. When automatic compaction is off, it says so, and the Work rail points to manual `/compact`.
- **`doctor --probe-local` changes nothing (#7115):** when a configured route rules out local Ollama, the check skips credential inspection. Otherwise it reads credentials without migrating the legacy secret store; `exec` keeps its normal resolver.
- **Blockquotes keep their rail when wrapped (#7144):** every wrapped row of a blockquote keeps the quote rail, and copying a selection still leaves the rail out. Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Localized activity and file receipts:** grouped tool activity, file counts, patch outcomes and tool status use the shared 15-language catalog. Language changes refresh cached summaries; filenames, diffs and execution receipts keep their original data.
- **Automatic compaction stays off when disabled:** preflight and provider context-overflow recovery preserve the conversation and report the setting instead of forcing a summary. Manual compaction remains available, and a rejected recovery request retains its actual cause in both paths. (#7142)
- **VS Code packaging security:** use patched MSAL Node in the extension packager, addressing [GHSA-xcx6-jx8p-x3h5](https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5).
- **Compaction preserves task state:** a summary that is empty, a placeholder or only leaked reasoning tags (as local models sometimes return) no longer replaces your history. The recent tail is chosen by token budget on whole tool exchanges, the older span and any earlier checkpoint are summarized, and the original history is saved before the swap. Context budgeting learns from provider-reported usage within a turn and reports repeated rapid refills instead of looping. (#7133)
- **Vim Normal mode works on every terminal:** with `composer_vim_mode = "vim"`, Normal-mode keys no longer land in the draft as text on Windows terminals or on any terminal that does not report bracketed paste (everything except ghostty, iTerm, WezTerm and Apple Terminal, tmux and VS Code's terminal included). A held key now reaches Normal mode, shifted keys such as `G` move instead of typing, and `k` history recall repaints at once. Keys that arrive in one burst are still taken as a paste. (#7126, #7130) Thanks [@Lstarsky0](https://github.com/Lstarsky0).
- **Remote-control start failures stay visible:** a refused or failed `/rc` start now leaves the controller in the Failed state with its reason, logs a redacted line, and keeps `/rc status` in the footer after the toast expires instead of reporting "off". (#7127, #7120) Thanks [@laozidabo](https://github.com/laozidabo).
- **`/undo` follows your language:** what `/undo` reports (the request it undid, each file it restored, what it left in place) now comes from the locale catalog in all 15 complete packs instead of English text in the code; English output is unchanged. If a localized report cannot be built, the restore still syncs with the Engine and an English report is shown. (#7121, part of #7071) Thanks [@Aboysky](https://github.com/Aboysky).
- **TSX files get TSX diagnostics:** the language server now opens `.tsx` documents as `typescriptreact`, so valid JSX is no longer reported as a TypeScript syntax error. (#7140) Thanks [@Ricardo-M-L](https://github.com/Ricardo-M-L).
- **Work stays with the session that was saved (#7118):** saving, forking, renaming and rewinding a conversation now publish only the Work (To-do) state that belongs to the session just saved, and a newer update stays pending instead of being overwritten. A rewind that applied but could not be saved says so and puts the retry or replacement prompt where you can copy it. Tasks missing from `/task list` while the tracker shows them are not explained by this change.
- **Interrupted session hint stays visible (#7095):** when a plain `codewhale` launch finds a session whose turn never finished, the "Run `codewhale --continue` to resume it" hint now appears in the TUI's status line instead of being printed to the terminal just before the TUI covered it.
- **Interrupted sessions are kept and listed (#7095):** crash checkpoints are no longer deleted after 24 hours. The resume picker shows a session that exists only as a checkpoint, labelled Interrupted, `--resume <id-prefix>` finds it, and `codewhale sessions` lists it with an `interrupted` mark. A newer checkpoint is promoted into its saved session only under the session lease, and only for the same workspace. Retained checkpoints are not yet capped in number.
- **Resume an interrupted reply (#7095).** Escape preserves the visible partial reply. On SIGINT, SIGTERM or SIGHUP the terminal has up to two seconds to save the active turn and flush pending writes. A second signal exits immediately. On Ubuntu, killing the process after its regular checkpoint preserved the visible text through that checkpoint. On resume, the transcript marks the partial reply interrupted, and `/copy` returns the last completed answer. Thanks [@laozidabo](https://github.com/laozidabo) for the signal handling in [#7122](https://github.com/codewhale-hq/Codewhale/pull/7122).
- **Remote control works again:**`codewhale rc` (`/rc`) can attach to the hosted control plane for web Chat again. The control plane had only accepted the retired 0.9.13 runtime identity, so every 0.10.x Engine was refused with `runner_runtime_identity_unavailable`; it now accepts the exact released runtime identity (commit, image and digest) and fails closed when they are not configured.
- **MCP compatibility fixes:** older servers that answer the discovery probe with an error or an unrelated result now connect through the legacy handshake instead of being refused after the probe. A server that rejects sign-in reports its real 401 and the `/mcp login` hint rather than the probe's "method not found". A stale OAuth token is refreshed once when the probe itself is rejected. A server whose command cannot start now says why (for example, command not found) instead of a generic broker refusal.
- **Image-heavy session recovery:** ordinary image reads use a 256 KiB delivery budget. Requests measure serialized bytes; over the local budget, older images are omitted from the outbound copy first, with receipts. An initial HTTP 413 is retried exactly once without image attachments, each replaced by an omission note. Saved images and executed tool actions remain intact.
- **Composer history honors `CODEWHALE_HOME`:** with `CODEWHALE_HOME` set, prompt history reads and writes `$CODEWHALE_HOME/composer_history.jsonl` instead of sharing `~/.codewhale` across isolated homes; an invalid `CODEWHALE_HOME` keeps no history rather than falling back to your real home. (#7069)
- **Slow tools are not reported missing:** a tool whose `--version` probe is still running at its 3-second deadline (for example the `cargo` rustup shim on a busy machine) now counts as installed instead of being cached as missing for the rest of the session.
- **Telegram recovery:** prompts and their initiating identity are durable before the polling cursor advances. Restart recovery reuses the original Engine operation, questions preserve human ownership, and uncertain final replies remain available through `/status` without an automatic resend.
- Long drafts now show a localized external-editor hint when the actual composer
viewport clips their text. The hint uses the shared F4 binding and preserves
queue, running-turn, history, and menu hints (#7049). Thanks @Lstarsky0.
- Archived context markdown now uses the active theme's palette when rendered
in the transcript, preventing unreadable dark text on dark backgrounds (#7043).
Thanks @Statter.
- Plan-to-Work handoff now names the seeded To-do item in a localized reminder
to keep it on the list and complete it after the plan (#7068).
- Localized question footers, approval and plan-handoff chrome, tool waiting
status, and /color receipts use the shared locale packs (#7071).
- Clearing a conversation with no goal no longer shows a misleading "Goal cleared."
receipt. Clearing an existing or configured goal still reports it (#7089).
Thanks @Lstarsky0.
- A fatal engine error no longer turns on offline queueing by itself. When the
error came from a step that never starts a turn (a finished background
shell, a goal continuation or a child completion that cannot resolve its
route), every later message used to be queued behind it; it is now sent
normally. An environment-only authentication failure still reopens provider
setup and queues until you fix it (#6561).
- `codewhale --provider <name> resume <id>` now moves the saved session to the
named provider, as `exec --resume` already did, so a session whose provider
table was deleted can be reopened on a provider you still have. It takes
that provider's default model unless `--model` is also given. Without
`--provider` the resume still refuses rather than fall back, and the refusal,
now also on the `codewhale resume` and `fork` mount path, names this command
- **Dollar signs stay dollar signs:**`$5 a month`, `10$ per year` and
`PATH=$HOME/bin:$PATH` no longer start inline math that swallows the text up
to the next `$`.
- **Math with non-ASCII text no longer crashes the TUI:** a reply with
`\text{如果}` or Greek letters inside `\begin{cases}` or `\begin{aligned}` used
to panic, and the saved reply panicked again on `--continue`. Escaped
characters (`\%`, `\{`, `\$`) and delimiters such as `\left\{` now render.
- **Markdown tables, rules, images and tabs:** table columns size to their
content instead of taking equal shares; `<br>` in a table cell breaks the
line; `- - -` and `* * *` are rules, not bullets; images render as their alt
text; and tabs in replies and sent messages expand, so Go and Makefile code
keeps its indentation.
- **The read tool opens text that starts with "BM":** a note beginning "BM25
is..." came back as "[Image omitted...]". A file is treated as a bitmap only
when its header is valid.
- **The launch card keeps the folder you are in:** on a narrow pane its path
drops to the folder name before it clips, and `/context` keeps the end of the
workspace path instead of its root.
- **A narrow rail keeps urgent notices:** warnings and errors are cut to fit
instead of vanishing when their first clause does not fit.
- **Truer status text:** "Model set to" appears only when the model changes, so
`/effort high` shows its own message; `/status` shows an unpriced session's
cost as unknown instead of `$0.0000`; and `/cache` no longer prints
`Σ hit: 0` for routes that report no cache tokens.
- **Compaction never drops history to fit:** when a complete summary cannot fit
the context window, the pass fails and your history stays, instead of
retrying with older messages silently left out.
- **`/diff` keeps its place on resize:** resizing the terminal no longer jumps
the pager and its search match back to an earlier line. (#7087)
- **First downloads for `npx` and `uvx` MCP servers:** a stdio server started
through `npx`, `pnpx`, `bunx` or `uvx` with no `connect_timeout` of its own
now gets at least 120 seconds to connect, so a recommended server such as
Playwright no longer fails its first `/mcp add` on a cold download.
- **The Linux extension host falls back to Node when Bun cannot run in the
sandbox:** a Bun that is a shim or script (asdf's, for example) now triggers
the `runtime = "auto"` fallback instead of failing the start.
- **Shell jobs hold their worktree (Runtime API):** removing a managed worktree
while one of its tracked shell jobs runs is refused with 409
`worktree_busy`, and the folder stays until the job ends.
- **The installer reuses an identical download:**`codew` is not downloaded
again when its manifest digest matches `codewhale`'s. (#7102)
- **The zsh missing-key hint reads as guidance:** the first-run hint no longer
looks like a shell error.
### Security
- Saved tool-result reads refuse links in the selected session, including a linked session directory, while preserving deliberately relocated application storage. Owned files and digest-checked legacy results keep their existing access paths.
- **Pinned marketplace archives:** a Codewhale or Claude marketplace entry whose tarball source carries a `sha256` now installs only when the downloaded bytes match it; a mismatch, a malformed pin or a pin on a non-archive source refuses the install with nothing written. The pin also applies to direct installs as `https://…/x.tar.gz#sha256=<hex>`.
- **Sandboxed commands cannot plant git hooks or edit git config:** in workspace-write mode, `.git/hooks` and `.git/config` (and a linked worktree's shared `hooks` and `config`) are read-only to sandboxed commands, so a command cannot leave a hook or `core.hooksPath` that later runs outside the sandbox. The workspace's `.codewhale/` is protected even before it exists (on Linux it is created first, because bubblewrap can only protect existing paths). `git commit` and ordinary file writes are unaffected; `git config` writes and hook edits need an approved unsandboxed command.
- **Tool image validation:** an image returned by a tool must decode before it is sent, so truncated or corrupt files are omitted with a receipt even when they are already within the delivery budget.
- **Terminal graphics advisory (RUSTSEC-2026-0430):** the terminal emulator
library moves to rio-vt 0.5.29, closing a path traversal in its Kitty
graphics handler that could read or delete files outside the intended
directory.
- **Workspace status no longer runs repository filter drivers:**
`GET /v1/workspace/status` and the Git status detail neutralize clean and
process filters a repository defines, so opening a cloned repository cannot
run its code. A failing filter used to make the route report a clean tree; it
no longer does.
- **Bridge and extension dependency advisories:** the Feishu and WeCom bridges
move to `follow-redirects` 1.16.2 (high severity), and the VS Code extension
build no longer pulls a vulnerable `minimatch`.
- **Approval answers must match their request (Runtime API):** an approval,
user-input or tool answer that names a different thread, turn or call is
refused with 403 instead of being delivered. Callers that send no binding,
such as the existing HTTP route, behave as before.
- **Bounded release discovery:**`codewhale update` reads at most 8 MiB of
release metadata and 4 KiB of error text, strips control characters from
remote errors and no longer echoes malformed input.
### Maintenance
- **Windows release harness:** the terminal-clipboard check strips Windows PowerShell's UTF-8 BOM before parsing cleanup receipts and still runs the bounded private-path cleanup fallback after its controller has exited; the vendored terminal kit lock follows Protocol 0.10.3.
- **Windows release import floor:** the 10 ARM64 import pairs that the native export probe resolved on Windows 11 ARM64 are qualified, and 12 x64 pairs are recorded as documented API contracts until a native x64 export probe exists. The Windows 10 build 14393 floor, the guard and the x86 profile are unchanged; the next frozen candidate's import job is the real check.
- MCP regression fixtures retain private extension-host roots and wait for their own workers to finish, preventing parallel checks from borrowing a deleted fixture home. Production connection and credential policy is unchanged.
- **Independent terminal kit candidate 0.2.0:** its workflow totals use `u64`, and its existing avatar API reexports the shared Protocol contract. All local consumers pin 0.2.0. Protocol 0.10.3 must be published and verified before the kit, followed by the dependent Engine packages; each publication retains its separate approval.
- **`codewhale-plugins` crate:** plugin discovery, review, install and marketplace parsing move out of `codewhale-tui` into a new crate; MCP server config types move to `codewhale-mcp`, and the skill parse core and recommendations to `codewhale-skill-install`. Review and trust behavior is unchanged. (S19, #5316)
- **`codewhale-config` modules (internal):** the 8,100-line `lib.rs` is split into 23 modules (provider TOML, permissions, fleet, config resolution, env overrides, state dirs, config store and backup, and others); `codewhale_config::` paths are unchanged. No behavior change. (S57, #5316)
- **`codewhale-app-server` modules (internal):** `lib.rs` is carved into `http`, `stdio`, `turns`, `bridge` and `config_rpc` modules; `BoundedLines` and `runtime_compatibility_router` now live at `codewhale_app_server::stdio` and `::http`. No behavior change. (S49, #5316)
- **`codewhale-account-cli` crate (internal):** the cloud account, cloud computer and dispatch CLI commands move out of `codewhale-cli` into a new crate. No behavior change. (S50, #5316)
- **`runtime_threads` store and manager (internal):** `runtime_threads` is split into the durable store (`runtime_threads.rs`) and the thread manager (`runtime_threads/manager.rs`); callers import from `runtime_threads::manager`. No behavior change. (S35, #5316)
- **Crate split S24a (internal):** the workshop byte-budget slot moves to `codewhale-runtime`, `AutoRouteDecisionEvidence` to `codewhale-models`, and cost-status session persistence to a tui `usage_persistence` module, so billing no longer reaches the session manager or model routing. No behavior change. (#5316)
- **Provider pre-cuts B (internal):** client wire helpers, reasoning-effort mapping and the Ollama catalog parsers move into their own client modules, and test-only provider gates use the shared test-isolation predicate. No behavior change. (#5316)
- **`codewhale-dependencies`, `codewhale-snapshot`, `codewhale-lsp`, `codewhale-repl` crates:** external-tool resolution, workspace snapshots, the language-server client and the Python REPL runtime moved out of `codewhale-tui` into their own crates; `write_context_file` now lives in `codewhale-repl`. No behavior change. (#5316)
- **`codewhale-skill-install` crate:** the community-skill installer, package content digest and `SKILL.md` frontmatter reader move out of `codewhale-tui` into a new crate; the install SSRF guard and timeouts are unchanged in production builds. (#5316)
- **`codewhale-util` crate:** shared utilities, confined workspace file access, link and file-identity checks, bundle file readers, the `.git` name rule and the owner file lock move out of `codewhale-tui` into a new crate; no behavior change. (#5316)
- **Crate-split contract hygiene:** the `canonical_action` policy table now lives in `codewhale-execpolicy`, `required_action`, the file path-alias folding and the `apply_patch` preflight parser in `codewhale-tools`, and `DEFAULT_SPAWN_DEPTH`, `PermissionCeiling` and `ShellCeiling` in `codewhale_protocol::fleet`, so `codewhale-agent-contract` no longer depends on `codewhale-config` or `codewhale-workflow`. Approval and authority behavior is unchanged. (#5316)
- **Provider pre-cuts (internal):** schema sanitizing, prompt-turn classification, image-window capping, tool-projection warning names and the reasoning-effort tier moved into `codewhale-models`; stall records and route-label sanitizing moved into `codewhale-runtime`. No behavior change. (#5316)
- **Linux hardening tests:** the NoNewPrivs child matrices now respect a parent that already holds the irreversible flag, keeping the full assertions on unpinned hosts and checking the kernel ratchet on pinned hosts. Thanks [@asto18089](https://github.com/asto18089) for diagnosing the hardened-container failure. (#7021)
- Removed the internal config re-export facade and its model-constant wrapper;
provider types, shared constants, credential helpers, and notification types
now come directly from their shared owners. Configuration and saved settings
keep their existing behavior.
- Removed superseded home-directory and Fleet-role re-export shims, unused
tool-context sandbox/MCP fields, and the redundant core tool-parser facade.
Consumers now call their existing owners directly; tool denial rules, approval
posture, strict tool schemas, home resolution, and legacy saved-role migration
retain their behavior. The cleanup removes three dead-code suppressions and
keeps the engine as the sole owner of human approval attestations.
- Removed unused plan/journal accessors, an unused plan-status glyph helper,
and a cancellation case that no execution path issued. Active mailbox and
cancellation wiring stays in place; its stale unused-code suppressions are
removed. No supported command or feature is retired by this cleanup.
- README translations carry refreshed source stamps after the 0.10.3 batch.
- **[@cmdcorp6534](https://github.com/cmdcorp6534)** — reported the Chinese input-method candidate window appearing away from the field being typed into ([#2323](https://github.com/codewhale-hq/Codewhale/issues/2323)).
- **[@Asteria1028](https://github.com/Asteria1028)** — reported pasted clipboard images piling up with no way to remove them ([#7221](https://github.com/codewhale-hq/Codewhale/issues/7221)).
- **[@printf033](https://github.com/printf033)** — enabled exclusive rename on Android so Fleet publication does not fall back to SELinux-denied hard links (`fbe9f24ee`).
- **[@liuyy2](https://github.com/liuyy2)** — diagnosed case-sensitive model selection collisions in the provider picker ([#7214](https://github.com/codewhale-hq/Codewhale/issues/7214)).
- **[@isaacs](https://github.com/isaacs)** — upstream minimatch preprocessing and glob cancellation fixes reused in compatible web build dependency backports.
- **[@Gabriel-Degret](https://github.com/Gabriel-Degret)** — reported that a hosted output limit truncated reasoning on a custom endpoint ([#7179](https://github.com/codewhale-hq/Codewhale/issues/7179)).
- **[@soarkit](https://github.com/soarkit)** — reported that `/patch-undo` ignored `turn_id` and undid the latest turn ([#7216](https://github.com/codewhale-hq/Codewhale/issues/7216)).
- **[@d-onistack](https://github.com/d-onistack)** — reported ChatGPT sign-in failing token verification on Windows after a successful browser sign-in, with clock and endpoint checks that narrowed it to local verification ([#7203](https://github.com/codewhale-hq/Codewhale/issues/7203)).
- **[@Felixkw12](https://github.com/Felixkw12)** — added Opper as a bundled provider ([#7131](https://github.com/codewhale-hq/Codewhale/pull/7131)).
- **[@Lstarsky0](https://github.com/Lstarsky0)** — kept the `/diff` pager's place across a resize ([#7087](https://github.com/codewhale-hq/Codewhale/pull/7087)), said "Goal cleared." only when there was a goal ([#7089](https://github.com/codewhale-hq/Codewhale/pull/7089)), and stopped printing an unpriced session cost as `$0.0000` in `/status` ([#7090](https://github.com/codewhale-hq/Codewhale/pull/7090)), kept Normal-mode keys out of the draft on terminals without bracketed paste ([#7126](https://github.com/codewhale-hq/Codewhale/pull/7126)) and let shifted keys such as `G` reach Normal mode ([#7130](https://github.com/codewhale-hq/Codewhale/pull/7130)), kept the quote rail on every wrapped row of a blockquote ([#7144](https://github.com/codewhale-hq/Codewhale/pull/7144)), kept a nested list paragraph's indent ([#7146](https://github.com/codewhale-hq/Codewhale/pull/7146)), rendered `~~~` fences as code ([#7156](https://github.com/codewhale-hq/Codewhale/pull/7156)), left asterisks that do not open emphasis literal ([#7157](https://github.com/codewhale-hq/Codewhale/pull/7157)), ended bare URLs at full-width punctuation ([#7158](https://github.com/codewhale-hq/Codewhale/pull/7158)), kept a link target's own parentheses ([#7170](https://github.com/codewhale-hq/Codewhale/pull/7170)), rendered code and links inside emphasis ([#7171](https://github.com/codewhale-hq/Codewhale/pull/7171)) and stopped the engine's fleet-roster and stream-timeout statuses from taking over the footer ([#7152](https://github.com/codewhale-hq/Codewhale/pull/7152), [#7169](https://github.com/codewhale-hq/Codewhale/pull/7169)). Preserved indentation and space-only inline code in table cells ([#7184](https://github.com/codewhale-hq/Codewhale/pull/7184)). Reported `file_search` matches relative to the workspace ([#7213](https://github.com/codewhale-hq/Codewhale/pull/7213)). Matched brace and nested-directory globs in `grep_files` ([#7215](https://github.com/codewhale-hq/Codewhale/pull/7215)). Kept the draft when the command palette inserts a command ([#7205](https://github.com/codewhale-hq/Codewhale/pull/7205)).
- **[@gaord](https://github.com/gaord)** — a running turn's cost and context in the Runtime ([#7074](https://github.com/codewhale-hq/Codewhale/pull/7074)) forks that measure the history they carry ([#7147](https://github.com/codewhale-hq/Codewhale/pull/7147)), and private state on a HarmonyOS mount that cannot express ownership ([#7168](https://github.com/codewhale-hq/Codewhale/pull/7168)). Capped WeCom reply chunks by UTF-8 bytes ([#7209](https://github.com/codewhale-hq/Codewhale/pull/7209)). Accepted media and voice messages on the WeCom bridge ([#7212](https://github.com/codewhale-hq/Codewhale/pull/7212)). Steered a running turn from the WeCom bridge ([#7211](https://github.com/codewhale-hq/Codewhale/pull/7211)). Surfaced WeCom API error details in bridge replies ([#7208](https://github.com/codewhale-hq/Codewhale/pull/7208)) and rotated WeCom stream replies before the ten-minute expiry ([#7210](https://github.com/codewhale-hq/Codewhale/pull/7210)); both were harvested with the original commits kept.
- **[@luochen211](https://github.com/luochen211)** — one form per term in the Simplified Chinese pack ([#7150](https://github.com/codewhale-hq/Codewhale/pull/7150)) and dropped blanket dead-code allows in fleet alerts and the pet worker ([#7149](https://github.com/codewhale-hq/Codewhale/pull/7149)).
- **[@gannp](https://github.com/gannp)** — reported vLLM effort values that ignored the local model template and fixed it with a reviewed template registry ([#7124](https://github.com/codewhale-hq/Codewhale/issues/7124), [#7125](https://github.com/codewhale-hq/Codewhale/pull/7125)).
- **[Sh1Zuku / @SparkofSpike](https://github.com/SparkofSpike)** — resolved a relocated state root before session-side state opens ([#7097](https://github.com/codewhale-hq/Codewhale/pull/7097)) and made a goal pause to ask instead of inventing the answer ([#7175](https://github.com/codewhale-hq/Codewhale/pull/7175)), and gave the model a way back into the transcript compaction replaced ([#7173](https://github.com/codewhale-hq/Codewhale/pull/7173)). Also preserved journal history when a provisional input receives its Engine metadata ([#7180](https://github.com/codewhale-hq/Codewhale/pull/7180)). Added the bare DeepSeek V4.1 Flash catalog entry ([#7183](https://github.com/codewhale-hq/Codewhale/pull/7183)). Stopped a home-directory workspace from refusing its own state ([#7207](https://github.com/codewhale-hq/Codewhale/pull/7207)).
- **[@ddlw](https://github.com/ddlw)** — repaired main for the 0.10.3 batch: clippy `-D warnings` across protocol, runtime, util and tui (boxed review and MCP-add payloads, scoped dead-code expectations, cfg-gated platform test helpers), rustfmt, split extension-host imports, the provider-registry identity check, Windows-stable DSH receipt bytes, and the first-party marketplace receipt ([#7108](https://github.com/codewhale-hq/Codewhale/pull/7108), [#7109](https://github.com/codewhale-hq/Codewhale/pull/7109)).
- **[@laozidabo](https://github.com/laozidabo)** — localized `/diff` feedback ([#7101](https://github.com/codewhale-hq/Codewhale/pull/7101)), flushed queued saves before signal exit ([#7122](https://github.com/codewhale-hq/Codewhale/pull/7122)) and kept `/rc` start failures visible ([#7127](https://github.com/codewhale-hq/Codewhale/pull/7127)).
- **[Boyce / @Aboysky](https://github.com/Aboysky)** — refreshed the README translation source stamps ([#7104](https://github.com/codewhale-hq/Codewhale/pull/7104)) and localized `/undo` feedback ([#7121](https://github.com/codewhale-hq/Codewhale/pull/7121)).
- **[@Ricardo-M-L](https://github.com/Ricardo-M-L)** — opened `.tsx` documents with the `typescriptreact` language ID ([#7140](https://github.com/codewhale-hq/Codewhale/pull/7140)).
- **[@M-Maciej](https://github.com/M-Maciej)** — reported answerless output-limit stops in long Fleet proofs ([#6990](https://github.com/codewhale-hq/Codewhale/issues/6990)).
- **[@asto18089](https://github.com/asto18089)** — diagnosed the NoNewPrivs child-matrix failure on hardened containers ([#7021](https://github.com/codewhale-hq/Codewhale/issues/7021)). Dropped the false sandbox claim from the `fetch_url` description ([#7222](https://github.com/codewhale-hq/Codewhale/pull/7222)) and limited nested-repository discovery to the sub-agent worktree anchor ([#7224](https://github.com/codewhale-hq/Codewhale/pull/7224)). Accepted absolute in-workspace paths in sub-agent write claims ([#7227](https://github.com/codewhale-hq/Codewhale/pull/7227)). Repaired pre-0.10.0 topology checkpoint placement on session restore ([#7229](https://github.com/codewhale-hq/Codewhale/pull/7229)). Pointed the `verify` description at the Run tool instead of a retired name ([#7223](https://github.com/codewhale-hq/Codewhale/pull/7223)). Swept stale mode-jump and rail copy from the non-English packs ([#7225](https://github.com/codewhale-hq/Codewhale/pull/7225)), accepted absolute image paths that resolve inside the workspace ([#7226](https://github.com/codewhale-hq/Codewhale/pull/7226)) and reported follow-up delivery truthfully ([#7228](https://github.com/codewhale-hq/Codewhale/pull/7228)); all three were harvested with the original commits kept. Paused the durable task wall clock while an answerable prompt waits ([#7230](https://github.com/codewhale-hq/Codewhale/pull/7230)).
- **[@Statter](https://github.com/Statter)** — reported black-on-black text on terminals that do not report their background ([#7043](https://github.com/codewhale-hq/Codewhale/issues/7043)).
- **[@eugenicum](https://github.com/eugenicum)** — asked for a visible Full Access flag for `serve --acp` ([#6992](https://github.com/codewhale-hq/Codewhale/issues/6992)).
- **[@luestr](https://github.com/luestr)** — reported file and conversation rollback diverging ([#6970](https://github.com/codewhale-hq/Codewhale/issues/6970)), the Linux multiline send key ([#7093](https://github.com/codewhale-hq/Codewhale/issues/7093)) and session export guidance ([#6996](https://github.com/codewhale-hq/Codewhale/issues/6996)).
## [0.10.2] - 2026-10-22
@@ -12828,6 +13630,7 @@ overflow report and `/theme` picker edge-wrapping patch in #1814.
Older releases (v0.8.39 and earlier) are archived in [docs/CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md).
@@ -229,9 +229,9 @@ Co-author a *person* freely; the address must be their GitHub-linked one
When a commit harvests code from a community PR (see "How Your Contribution
Lands" below), include a `Harvested from PR #N by @author` line in the commit
body. An auto-close workflow watches for this pattern and closes the
referenced PR with credit so the contributor gets a clear signal that
their work shipped.
body. A maintainer then closes the referenced PR by hand with a thank-you and
a link to the commit, so the contributor gets a clear signal that their work
shipped.
## What happens after you open a pull request
@@ -242,26 +242,23 @@ maintainer to approve the first run for a brand-new GitHub account.
| Check | What it runs | When it is red |
| --- | --- | --- |
| `Lint` (required) | `cargo fmt --check`, clippy on every target, and the fast drift checks (locales, READMEs, provider registry, dead-code and blocking-call budgets) | Run `cargo fmt --all` and the clippy command in [Pre-push verification](#pre-push-verification); the log names the file and the check |
| `Test (ubuntu-latest)` | The whole workspace suite on Linux with `cargo nextest`, plus doctests | Re-run the named test locally, for example `scripts/dev-test.sh tui <test name>` |
| `Test (windows-latest)` (required) | Compiles every workspace target for Windows with warnings denied, and the installer PATH helper tests | Usually a `cfg(windows)` path or an import only Windows sees; the log has the compiler error |
| `npm wrapper smoke (ubuntu-latest)` (required) | Builds `codewhale` and installs it through the npm wrapper | The log shows the failing install or entrypoint step |
| `Safety gate` | The sandbox, authorization and auto-review tests | Treat it as a real regression in a trust boundary |
| `Version drift` | Version files, the `feat:` release-note rule, release helper tests and contributor credit | The credit step only reports: a maintainer adds your credit when the PR merges |
| `PR closes an issue` | Your description has `Closes #N`, `Refs #N` or `No-Issue: <reason>` | Edit the description, then re-run the check |
| `DCO` | Lists commits without `Signed-off-by` | Advisory; it never blocks |
| `Contribution gate` | Labels PRs from authors not yet in `.github/APPROVED_CONTRIBUTORS` | A label, not a judgement; see [Contribution Gate](#contribution-gate) |
Smaller checks cover MSRV, the VS Code extension, integrations, the extension
host and plugin conversion, plus workflow lint when you change
`.github/workflows`. A documentation-only change skips the Rust builds but
still reports the required checks, so it can merge. The Linux test suite took
45 minutes on a recent pull request; the other checks run alongside it.
Smaller checks cover the VS Code extension, integrations, the extension host
and plugin conversion, plus workflow lint when you change `.github/workflows`.
A documentation-only change skips the Rust builds but still reports the
required checks, so it can merge.
Your pull request does not run the macOS and Windows test suites, the slow
runtime-contract and persistence-backlog measurements, the dependency audits
or the OpenHarmony build. Maintainers run those once per release, on the exact
commit being released. If that run finds a problem your change introduced, we
fix it on `main`; we will not ask you to chase it.
Your pull request does not run the test suites, the safety gate, MSRV, the npm
wrapper smoke, the slow runtime-contract and persistence-backlog measurements,
the dependency audits or the OpenHarmony build. Maintainers run those once per
release, on the exact commit being released. If that run finds a problem your
change introduced, we fix it on `main`; we will not ask you to chase it.
A red check that your change did not cause is not your job to fix. We rerun it
or fix it on `main`, and we never close a PR because CI is slow or flaky. Your
PR may be a draft, and the issue line in its description is optional.
## How Your Contribution Lands
@@ -280,9 +277,10 @@ Before merging, a maintainer may:
### Fallback — harvest
Rarely, a branch cannot merge in reasonable time, for example when it is in a
fork we cannot push to and the conflicts cannot be resolved there. Then a
maintainer may **harvest** the useful commits into `main` instead. This is
**not a rejection**: your code landed, and your credit is kept mechanically.
fork we cannot push to and the conflicts cannot be resolved there. We will ask
on your PR first. If it still cannot merge, a maintainer may **harvest** the
useful commits into `main` instead. This is **not a rejection**: your code
landed, and your credit is kept mechanically.
- You stay the author of the harvested commit, with your GitHub-linked address
from `.github/AUTHOR_MAP` or
@@ -291,8 +289,8 @@ maintainer may **harvest** the useful commits into `main` instead. This is
- The commit body includes `Harvested from PR #N by @your-handle`. That line is
the contract: it is your credit and the signal that your work shipped.
- The `CHANGELOG.md` entry for the next release credits you by handle.
- `auto-close-harvested.yml` closes your PR with a thank-you and a link to the
commit on `main`.
- A maintainer closes your PR by hand with a thank-you and a link to the commit
on `main`.
When a maintainer closes a harvested PR by hand, the closing comment
follows this template (the pattern set on PR #2634):
@@ -382,49 +380,25 @@ because `main` moved while it was in review, say so and a maintainer resolves
it on your branch. If your branch is in a fork we cannot push to, we ask on the
PR first; harvesting is the last resort.
## Contribution Gate
## Labels
Codewhale uses a maintainer-managed contribution gate for the community front
door. Maintainers and collaborators bypass this gate automatically. The gate
workflows run in dry-run mode and only add labels, so maintainers can observe
the signal before changing contributor flow.
Issues and pull requests are labelled by `.github/workflows/triage.yml`, which
only ever adds labels that already exist. Pull requests get their labels from
the paths they change and their conventional-commit title prefix; issues get
them from the title and form answers.
The maintainer posture is documented in
[docs/AGENT_ETHOS.md](docs/AGENT_ETHOS.md): automation should reduce load while
keeping good-faith contributors seen, credited, and able to keep helping.
@@ -72,8 +72,9 @@ two copies end up on `PATH` and whichever comes first wins.
## Quickstart
1. Commit or stash your work, then run `codewhale` from the root of a git
repository. By default it applies file edits there without asking and
shows you the diff.
repository. By default it asks before each file edit and command; press
`Shift+Tab` once for **Accept Edits** to let it edit files in the
repository without asking.
2. Run `/provider` (or press `F3`), pick a provider, paste its API key, and
choose a model. DeepSeek is the default provider. With no key, pick a local
runtime instead. If no provider is configured and Ollama is already serving
@@ -107,7 +108,7 @@ A fresh install starts in Work mode with the Ask permission.
| | Switch with | Options |
| --- | --- | --- |
| Mode | `Tab` (when the input is empty) or `/mode` | **Plan** reads and searches but changes nothing. **Work** edits files and runs commands. **Operate** has the same access as Work, treats your request as a goal, and keeps going until the goal is verified or it needs input from you. |
| Permission | `Shift+Tab` | **Ask** applies file edits in your repository without asking and asks before shell commands that are not read-only. **Auto-Review** lets rules and a reviewer model approve routine calls and refuses high-risk ones; switch to Ask to approve those yourself. **Full Access** never asks and turns off Codewhale's sandbox; repository rules and managed policy still apply. |
| Permission | `Shift+Tab` | **Ask** asks before every file edit and every shell command that is not read-only. **Accept Edits** applies file edits in your git repository without asking and still asks before commands. **Auto-Review** lets rules and a reviewer model approve routine calls and refuses high-risk ones; switch to Ask to approve those yourself. **Full Access** never asks and turns off Codewhale's sandbox; repository rules and managed policy still apply. |
See the [modes and permissions guide](docs/MODES.md) for the details.
@@ -191,10 +192,10 @@ Connect [MCP servers](docs/MCP.md), add [skills](docs/SKILLS.md) and
[plugins](docs/PLUGINS.md), and run [hooks](docs/HOOKS.md) on session and tool
events. Code mode (experimental, on by default) lets the model write one
`execute_tools` program that calls several MCP and plugin tools; each call
still meets your approval rules and keeps its receipt. The bundled Computer
still meets your approval rules and keeps its receipt. The independently installed Computer
Use plugin (experimental, macOS only) can observe
and operate other apps. It stays off until you review its access and enable it
@@ -203,7 +204,7 @@ and operate other apps. It stays off until you review its access and enable it
| `codewhale` | The interactive terminal app |
| `codewhale exec "…"` | One task without the interface. On its own it answers without using tools; `--auto` enables tools with Full Access by default, `--sandbox workspace-write` restricts them, and `--output-format stream-json` streams events as JSON |
| `codewhale web` | A local web UI on `127.0.0.1` ([guide](docs/WEB.md)) |
| `codewhale review --pr N` | An advisory review of a GitHub pull request. It posts nothing unless you add `--post`; the [GitHub Action](docs/GITHUB_ACTION.md) runs the same review in CI |
| `codewhale review --pr N` | An advisory review of a GitHub pull request. The [GitHub bot setup](docs/GITHUB_ACTION.md#set-up-your-own-bot) generates a pinned workflow for automatic reviews and `@codewhale review`, using your own model key and optional App identity |
| `codewhale app-server --http` | The [Runtime API](docs/RUNTIME_API.md), a local HTTP API for threads, events, approvals, and each turn's file changes |
| `codewhale serve --acp` | The Agent Client Protocol over stdio, for editors such as Zed |
## Model Context Protocol SDK and bundled dependencies
The pinned builtin MCP bundle (`crates/tui/extension-host/dist/builtin/mcp.mjs`)
The pinned builtin MCP bundle (`crates/engine/extension-host/dist/builtin/mcp.mjs`)
contains the following packages. The MCP packages are labeled Apache-2.0 and
carry the upstream licensing-transition statement and full Apache-2.0 text
reproduced below. The other packages are labeled MIT. Their exact distributed
notices are preserved.
### `@modelcontextprotocol/client` 2.3.1
### `@modelcontextprotocol/client` 2.4.0
```text
The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -369,7 +392,7 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
the full license text.
```
### `@modelcontextprotocol/core` 2.3.1
### `@modelcontextprotocol/core` 2.4.0
```text
The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -725,9 +748,9 @@ SOFTWARE.
The host and its offline composition reviewer also contain these packages.
"`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`"
returnErr(CloudTransportError::new("The Work reply does not confirm the requested source context; replay the same message and context",std::io::Error::other("task context mismatch")).into());
The request-ID, request/notification/error data shapes in src/rpc.rs and initialization data shapes in src/lifecycle.rs are adapted from official openai/codex rust-v0.166.0, immutable commit6ff1e1ca3b30fc8b914720681fcf5fe62e95f856, codex-rs/app-server-protocol/src/rpc.rs and src/protocol/v1.rs. Apache-2.0 LICENSE-APACHE and upstream NOTICE are retained with the original Codewhale MIT license in LICENSE-MIT. The crate combines MIT Codewhale implementation with Apache-2.0 contract adaptations.
Changed files: these adaptations remove Codex-specific derive/export dependencies and replace the absolute-path wrapper with PathBuf on the server-created response, whose producer validates absolute scope. RpcCall normalizes existing optional jsonrpc compatibility input and requires present request IDs to be strings or i64. It preserves notification ID absence. Correlated results and errors require RequestId. The existing compatibility uncorrelated parse-error helper uses a distinct null-ID error record; that response does not satisfy the pinned correlated Codex error envelope and remains explicit phase4 closure work. No private Engine source observation, receipt or accounting producer proof appears in this protocol crate.
The exact pinned wire golden fixtures under tests/pinned are unmodified members of the local stable precomputed schema export. This is a staged owner/lifecycle adoption, not complete wire/parity acceptance.
"description":"Optional namespace that groups related tools (e.g. `\"tau_bench\"`).\nWhen present, the runtime may expose the tool as\n`<namespace>::<name>` to the model."
},
"name":{
"type":"string",
"description":"Short tool name. Combined with `namespace` it forms a unique tool id."
},
"description":{
"type":"string",
"description":"Human-readable description exposed to the model."
},
"input_schema":{
"description":"JSON Schema describing the tool's input parameters."
},
"defer_loading":{
"type":"boolean",
"description":"If true, the runtime may defer schema validation / tool loading until\nthe model actually calls the tool.\n\nDefaults to `false` so that older clients omitting this field still\nbehave the same way.",
"default":false
}
},
"required":[
"name",
"description",
"input_schema"
],
"description":"Specification for a dynamic external tool registered by a runtime client.\n\nExample JSON from the spec:\n\n```json\n{\n \"namespace\": \"tau_bench\",\n \"name\": \"get_reservation\",\n \"description\": \"Look up an airline reservation.\",\n \"input_schema\": {\n \"type\": \"object\",\n \"properties\": {\n \"reservation_id\": { \"type\": \"string\" }\n },\n \"required\": [\"reservation_id\"],\n \"additionalProperties\": false\n }\n}\n```"
},
"DynamicToolItemStatus":{
"type":"string",
"enum":[
"in_progress",
"completed",
"failed"
],
"description":"Lifecycle status of a dynamic tool item shown in thread detail and event\npayloads."
},
"DynamicToolCallResult":{
"type":"object",
"properties":{
"success":{
"type":"boolean",
"description":"Whether the client-side tool execution succeeded."
},
"content":{
"type":"array",
"items":{
"$ref":"#/$defs/DynamicToolCallContent"
},
"description":"Content fragments returned by the tool.\n\nDefaults to an empty vector when omitted so clients can send a minimal\n`{ \"success\": false }` payload.",
"default":[]
}
},
"required":[
"success"
],
"description":"Result submitted by a runtime client after executing a dynamic tool."
},
"DynamicToolCallContent":{
"oneOf":[
{
"type":"object",
"properties":{
"text":{
"type":"string"
},
"type":{
"type":"string",
"const":"input_text"
}
},
"required":[
"type",
"text"
]
},
{
"type":"object",
"properties":{
"image_url":{
"type":"string"
},
"type":{
"type":"string",
"const":"input_image"
}
},
"required":[
"type",
"image_url"
]
}
],
"description":"A single content fragment inside a [`DynamicToolCallResult`]."
},
"TurnEnvironmentParams":{
"type":"object",
"properties":{
"environment_id":{
"type":"string"
},
"cwd":{
"type":"string"
}
},
"required":[
"environment_id",
"cwd"
],
"description":"Environment target selected for a turn's shell/filesystem work.\n\nExample JSON:\n\n```json\n{\n \"environment_id\": \"local\",\n \"cwd\": \"/workspace\"\n}\n```"
},
"RuntimeEventEnvelope":{
"type":"object",
"properties":{
"schema_version":{
"type":"integer",
"format":"uint32",
"minimum":0,
"default":1
},
"seq":{
"type":"integer",
"format":"uint64",
"minimum":0
},
"event":{
"type":"string"
},
"kind":{
"type":"string"
},
"thread_id":{
"type":"string"
},
"turn_id":{
"type":[
"string",
"null"
]
},
"item_id":{
"type":[
"string",
"null"
]
},
"timestamp":{
"type":"string"
},
"created_at":{
"type":"string"
},
"payload":true
},
"required":[
"schema_version",
"seq",
"event",
"kind",
"thread_id",
"turn_id",
"item_id",
"timestamp",
"payload"
],
"additionalProperties":true
},
"ThreadLoadedListResponse":{
"type":"object",
"properties":{
"data":{
"type":"array",
"items":{
"type":"string"
}
},
"nextCursor":{
"type":[
"string",
"null"
]
}
},
"required":[
"data",
"nextCursor"
]
},
"ThreadSetNameResponse":{
"type":"object",
"additionalProperties":false
},
"RuntimeCapabilities":{
"type":"object",
"properties":{
"client_token_intents":{
"type":"boolean",
"description":"Device client tokens have immutable watch/drive intent. Watch cannot\nmutate Runtime state, acquire control, or forward display input.",
"default":false
},
"account_session":{
"type":"boolean",
"default":false
},
"account_model_owner":{
"type":"boolean",
"default":false
},
"session_provider_keys":{
"type":"boolean",
"default":false
},
"threads":{
"type":"boolean"
},
"thread_create_idempotency":{
"type":"boolean",
"default":false
},
"thread_idle_precondition":{
"type":"boolean",
"default":false
},
"thread_patch_undo_turn_id":{
"type":"boolean",
"default":false
},
"thread_scoped_reads":{
"type":"boolean",
"default":false
},
"thread_scoped_git_writes":{
"type":"boolean",
"description":"Git stage, unstage, discard, commit, push and branch accept\n`?thread_id=` and act on that thread's workspace.",
"default":false
},
"thread_scoped_snapshots":{
"type":"boolean",
"description":"`GET /v1/snapshots` and `POST /v1/snapshots/{id}/restore` accept\n`?thread_id=` and act on that thread's workspace.",
"default":false
},
"thread_scoped_terminals":{
"type":"boolean",
"description":"`GET /v1/threads/{id}/terminals` lists the thread's live shells, and\n`/v1/threads/{id}/terminals/{terminal_id}/output|input|resize|kill`\ndrive one by the identity the Engine issued it.",
"default":false
},
"worktrees":{
"type":"boolean",
"description":"`GET`/`POST /v1/worktrees` and `POST /v1/worktrees/remove`.",
"default":false
},
"job_operations":{
"type":"boolean",
"default":false
},
"thread_shell_consent":{
"type":"boolean",
"description":"Explicit per-thread shell opt-in is checked against loaded policy and\ncannot broaden a conversation while it has an active turn.",
"default":false
},
"turns":{
"type":"boolean"
},
"turn_operation_idempotency":{
"type":"boolean",
"description":"`POST /v1/threads/{id}/turns` accepts a durable, thread-scoped\n`operation_key` and returns the original turn for exact retries.",
"default":false
},
"turn_operation_lookup":{
"type":"boolean",
"description":"Read-only exact accepted-turn lookup by thread and operation key.",
"description":"Bounded inline image inputs, persisted and replayed with their turn.",
"default":false
},
"turn_output_token_limit":{
"type":"boolean",
"description":"Per-turn maxOutputTokens is validated and intersected with the route ceiling.",
"default":false
},
"profile_constitution":{
"type":"boolean",
"description":"Account profile snapshots and Engine-owned constitution preview.",
"default":false
},
"turn_steer":{
"type":"boolean"
},
"turn_interrupt":{
"type":"boolean"
},
"event_replay":{
"type":"boolean"
},
"external_tools":{
"type":"boolean"
},
"environments":{
"type":"boolean"
},
"worker_runtime":{
"type":"boolean"
},
"fleet_run_create":{
"type":"boolean",
"default":false
},
"thread_fleet_members":{
"type":"boolean",
"default":false
},
"fleet_run_start":{
"type":"boolean",
"default":false
},
"fleet_event_replay":{
"type":"boolean",
"default":false
},
"fleet_event_stream":{
"type":"boolean",
"default":false
},
"fleet_local_target":{
"type":"boolean",
"default":false
},
"thread_goals":{
"type":"boolean",
"description":"`GET/PUT/DELETE /v1/threads/{id}/goal` and the `complete`/`block`\nlifecycle actions are available.",
"default":false
},
"memory":{
"type":"boolean",
"description":"`GET /v1/memory` and `GET /v1/memory/{id}` are available for\nbounded inspection of the native memory store. `POST /v1/memory`\nand `DELETE /v1/memory` are also available (auth-gated via the\nstandard route layer) for lifecycle controls.",
"default":false
},
"mcp_server_management":{
"type":"boolean",
"description":"Whether the runtime supports create/update/enable/disable/reconnect/delete\noperations on MCP server configuration via the `POST|GET|PATCH|DELETE\n/v1/apps/mcp/servers` family of endpoints.",
"default":false
},
"skill_lifecycle":{
"type":"boolean",
"description":"Skill lifecycle operations (install, update, uninstall, trust, audit)\nare available via the HTTP API.",
"default":false
},
"skill_detail":{
"type":"boolean",
"description":"`GET /v1/skills/{name}` returns one skill's full body and routing\nmetadata, so a client can compose an activation instruction for its\nnext turn. `GET /v1/skills` rows also carry `invocation`, `aliases`,\nand `bundled_tier` routing fields when this flag is set.",
"default":false
},
"plugin_management":{
"type":"boolean",
"description":"Plugin bundle and marketplace lifecycle operations (list/detail,\ninstall/update/uninstall, trust/enable/disable/revoke, marketplace\nadd/remove/install) are available via the `/v1/apps/plugins` and\n`/v1/apps/marketplaces` endpoint families.",
"default":false
},
"agent_mail":{
"type":"boolean",
"description":"Durable, workspace-scoped cross-task Agent Mail endpoints and events.",
"default":false
},
"event_stream_resume":{
"type":"boolean",
"description":"`GET /v1/threads/{id}/events` puts the durable `seq` on every journal\nframe as the SSE `id:` and resumes from a `Last-Event-ID` header, so a\nbrowser `EventSource` reconnects without a cursor in the query string.",
"default":false
}
},
"required":[
"client_token_intents",
"account_session",
"account_model_owner",
"session_provider_keys",
"threads",
"thread_create_idempotency",
"thread_idle_precondition",
"thread_patch_undo_turn_id",
"thread_scoped_reads",
"thread_scoped_git_writes",
"thread_scoped_snapshots",
"thread_scoped_terminals",
"worktrees",
"job_operations",
"thread_shell_consent",
"turns",
"turn_operation_idempotency",
"turn_operation_lookup",
"watch_event_turns",
"structured_review_turns",
"structured_review_version",
"automation_mutation_preconditions",
"turn_image_inputs",
"turn_output_token_limit",
"profile_constitution",
"turn_steer",
"turn_interrupt",
"event_replay",
"external_tools",
"environments",
"worker_runtime",
"fleet_run_create",
"thread_fleet_members",
"fleet_run_start",
"fleet_event_replay",
"fleet_event_stream",
"fleet_local_target",
"thread_goals",
"memory",
"mcp_server_management",
"skill_lifecycle",
"skill_detail",
"plugin_management",
"agent_mail",
"event_stream_resume"
],
"description":"Fixed capability map advertised by `GET /v1/runtime/info`.\n\nAll fields are required on serialization so clients can rely on the shape."
},
"FleetProfileDocument":{
"type":"object",
"additionalProperties":false,
"properties":{
"id":{
"type":"string"
},
"kind":{
"$ref":"#/$defs/FleetProfileDocumentKind"
},
"origin":{
"type":"string"
},
"path":{
"type":[
"string",
"null"
]
},
"text":{
"type":"string"
},
"revision":{
"type":"string"
},
"writable":{
"type":"boolean"
},
"refusal_reason":{
"type":[
"string",
"null"
]
}
},
"required":[
"id",
"kind",
"origin",
"path",
"text",
"revision",
"writable",
"refusal_reason"
]
},
"FleetProfileDocumentKind":{
"type":"string",
"enum":[
"profile",
"fleet"
]
},
"RuntimeExperimentalCapabilities":{
"type":"object",
"properties":{
"environments":{
"type":"boolean",
"default":false
}
},
"required":[
"environments"
],
"description":"Experimental opt-in flags advertised by `GET /v1/runtime/info`.\n\nFields are additive and default to `false` when omitted by older servers."
},
"DynamicToolCallParams":{
"type":"object",
"properties":{
"thread_id":{
"type":"string"
},
"turn_id":{
"type":"string"
},
"call_id":{
"type":"string"
},
"namespace":{
"type":"string",
"description":"Optional namespace that was registered with the tool."
},
"tool":{
"type":"string",
"description":"Tool name that the model invoked."
},
"arguments":{
"description":"Arguments supplied by the model, validated against `input_schema`."
}
},
"required":[
"thread_id",
"turn_id",
"call_id",
"tool",
"arguments"
],
"description":"Parameters identifying a dynamic tool call request emitted by the runtime.\n\nThis is the typed payload for `tool_call.requested` events and also the\nnatural identifier used when the runtime looks up a pending call."
},
"DynamicToolSpecOutput":{
"type":"object",
"properties":{
"namespace":{
"type":"string",
"description":"Optional namespace that groups related tools (e.g. `\"tau_bench\"`).\nWhen present, the runtime may expose the tool as\n`<namespace>::<name>` to the model."
},
"name":{
"type":"string",
"description":"Short tool name. Combined with `namespace` it forms a unique tool id."
},
"description":{
"type":"string",
"description":"Human-readable description exposed to the model."
},
"input_schema":{
"description":"JSON Schema describing the tool's input parameters."
},
"defer_loading":{
"type":"boolean",
"description":"If true, the runtime may defer schema validation / tool loading until\nthe model actually calls the tool.\n\nDefaults to `false` so that older clients omitting this field still\nbehave the same way.",
"default":false
}
},
"required":[
"name",
"description",
"input_schema",
"defer_loading"
],
"description":"Specification for a dynamic external tool registered by a runtime client.\n\nExample JSON from the spec:\n\n```json\n{\n \"namespace\": \"tau_bench\",\n \"name\": \"get_reservation\",\n \"description\": \"Look up an airline reservation.\",\n \"input_schema\": {\n \"type\": \"object\",\n \"properties\": {\n \"reservation_id\": { \"type\": \"string\" }\n },\n \"required\": [\"reservation_id\"],\n \"additionalProperties\": false\n }\n}\n```"
"description":"A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
"type":"string"
}
},
"properties":{
"codexHome":{
"allOf":[
{
"$ref":"#/definitions/AbsolutePathBuf"
}
],
"description":"Absolute path to the server's $CODEX_HOME directory."
},
"platformFamily":{
"description":"Platform family for the running app-server target, for example `\"unix\"` or `\"windows\"`.",
"type":"string"
},
"platformOs":{
"description":"Operating system for the running app-server target, for example `\"macos\"`, `\"linux\"`, or `\"windows\"`.",
/// Repo root, resolved from this crate's manifest dir (`crates/tui`).
/// Repo root, resolved from this crate's manifest dir (`crates/app-server`).
fnrepo_root()-> PathBuf{
Path::new(env!("CARGO_MANIFEST_DIR"))
.parent()
.and_then(Path::parent)
.expect("crates/tui has a two-level parent (repo root)")
.expect("crates/app-server has a two-level parent (repo root)")
.to_path_buf()
}
Loaded 100 of 2390 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
