0 Fork 0

mirror of https://github.com/codewhale-hq/Codewhale.git synced 2026-11-07 10:36:05 -10:00

Files

T

CodeWhale BotandClaude Sonnet 5.5 34bf6568f2 0.10.2 candidate: MCP connects at start, background promotion, shell inspector, Full Access confirmation, Daytona and Sprite removal, composer-first launch, QA fixes

One integrated slice of the 0.10.2 release work, three-way merged onto
64bb073a4. User-visible changes (details and per-item evidence in CHANGELOG.md):

- MCP: user-configured servers connect in the background at session start
  (`lazy = true` opts out, `required` still blocks, plugin-contributed servers
  stay on demand); a finished OAuth login reconnects that one server;
  `/mcp reload` redials every non-lazy server; the reload summary reports a
  not-connected count and the configured total.
- #6944: bash promotes itself to the background after 30 s with elapsed time,
  last-output age and a cargo-shaped phase hint; kills say how far it got;
  task_shell_start is removed in favour of one background path.
- #6931: a live shell inspector (cwd, owner, state, bounded output, stop);
  Alt+V opens the newest running shell when nothing is selected; dock rows
  share the formatter.
- #6470: entering Full Access asks first (session by default, per-repo opt-in
  full_access_repos), chip text carries the scope, permission changes are
  receipted in the transcript and as a runtime status item; a saved
  full-access posture migrates to Ask once. Runtime API: PATCH into Full
  Access without full_access_confirmation is a 400 (documented).
- Daytona and Sprites are gone from the engine: own-sandbox dispatch
  (`--own-sandbox`, `/dispatch`, `agent runtime:"cloud"`, cloud-agent alias),
  cloud_dispatch.rs, dispatch_runner.rs, cloud_proposal.rs, computer_meter and
  the computer-use Sprite task-hold are deleted (archived in
  codewhale-hq/codewhale-sandboxes b68803e); logout sweeps a stored legacy
  sandbox token. `codewhale dispatch` is account-only, requires an actionable
  or queued intent, prints the Message ID, and prompts only when stdin and
  stdout are terminals. The CLI never prints a code or prose naming the VM
  vendor or retired providers.
- CW-7167: a keyless first launch opens on the composer; the first send opens
  the provider picker with the draft kept; the first-run picker shows the typed
  filter (CW-7170). A local runtime is offered only when Ollama answers.
- QA fixes: unknown --profile and a missing explicit --config fail loudly, -C
  on a missing directory errors, `codewhale web` works under a root-owned
  symlinked HOME ancestor (user-controlled symlinks are still rejected),
  `/exi` Enter fills instead of running destructive commands, Shift+Tab hint
  stays in Auto/Full Access, a crashed session shows an interrupted marker,
  help/exit-code fixes, README exec examples, zh docs. #6728: the pet owner
  stops building frames while nobody views.
- Credit: @xiaoray-blip (0.9.8) and @xyzs996 (0.9.11) added to AUTHOR_MAP,
  CONTRIBUTORS and the CHANGELOG; 0.9.9 placement for @Lstarsky0 and
  @SparkofSpike.

Evidence (2026-10-10, local only, on this exact tree):
- cargo clippy --workspace --all-targets --all-features --locked with CI's
  flags: exit 0.
- cargo nextest run --workspace --locked: 18981 tests, 18978 passed, 3 failed;
  the three are tools::test_runner::tests::* (environment-only: nested cargo
  inherits this machine's build-dir wrapper; they pass in CI).
- scripts/check-dead-code-budget.py PASS 221; check-blocking-calls-budget.py
  within budget (537 sites; private_directory.rs records one canonicalize and
  one std_fs: sync startup path resolution, not on the async runtime);
  check-command-crate-boundaries.py PASS; module_graph.py --check PASS;
  check-contributor-credit.py v0.10.1 clean; check-versions.sh OK (0.10.2).
- cargo fmt --all -- --check clean. Conformance goldens regenerated for the
  tool-catalog change (task_shell_start removed, bash description).
Not verified: hosted CI on this commit, a real-TTY run of composer-first
launch, MCP default connect, the shell inspector and the Full Access modal,
bwrap on Linux, a real provider turn, the live ChatGPT sign-in (#6925), a real
dispatch against the account service, and re-measuring
runtime-contract-budget on Linux.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

2026-10-10 03:19:16 -07:00

5.8 KiB

Raw Permalink Blame History

Termux / Android arm64 Support

阅读简体中文版：zh_hans/TERMUX.md。

Codewhale provides an Android arm64 build and archive path for Termux. Treat Termux support as a preview until the real-device runtime QA tracked in #4236 and #4242 is complete. This document covers the install path and the platform-specific behavior differences you should know about.

Installation

Use the Android-specific GitHub release archive. The v0.9.11 release includes codewhale-android-arm64.tar.gz; device support remains preview. Follow the Android / Termux installation steps to verify the archive against the matching codewhale-bundles-sha256.txt, then run the bundled installer with PREFIX="$PREFIX" so commands go into $PREFIX/bin. Use codewhale update for an existing direct installation; keep package-managed files under their package manager's control.

If a release has no compatible Android archive or you are validating a source build, Cargo remains a preview fallback inside Termux:

pkg install -y rust clang pkg-config make git
cargo install codewhale-cli --locked

The general macOS/Linux web installer is not the Android installation route. Do not install codewhale-linux-arm64 in Termux: Android uses Bionic libc and a separate build target. A Linux release asset is not an Android binary.

Platform behavior on Android

Codewhale's security model has three distinct layers on Android:

Android's app sandbox — Android assigns Termux its own app UID and applies the platform's SELinux and seccomp protections. Commands started by Codewhale inherit that app boundary and any storage or other permissions the user has granted to Termux. See the Android application sandbox and Termux filesystem layout.
Codewhale's per-command sandbox backend — Seatbelt (macOS) or the bubblewrap wrapper (Linux) can further narrow what a child command may access. Codewhale does not currently provide that additional layer on Android.
Codewhale's own gates — workspace trust, approval prompts, allow_shell/disallowed-tools, and the file-tool permission system. These share the cross-platform application code path; their Android behavior still needs the real-device QA tracked below.

Codewhale sandbox backend: none

Codewhale's existing Seatbelt and Linux bubblewrap integrations do not target Android. Consequently, codewhale doctor --json reports the sandbox as {"available": false, "kind": null} on Android. That status describes the absence of an additional Codewhale child-process sandbox; it does not mean Android or Termux provides no OS isolation.

get_platform_sandbox() returns None on Android.
No Linux-only bubblewrap wrapper is compiled into the Android build — it is #[cfg(target_os = "linux")]-gated and Rust treats android as a distinct target from linux.
Shell commands retain Termux's Android app boundary but receive no Codewhale-specific filesystem narrowing. Treat every location available to Termux, including user-granted shared storage, as potentially available to a command that you approve.

Approvals: still apply

Codewhale's approval system (interactive prompts for risky actions, allow_shell, --disallowed-tools) is implemented at the application layer, independently of the OS sandbox. The Android code path is present, but its interactive behavior still needs the real-device QA tracked in #4242.

Secret storage: file-backed

Codewhale's Termux/native build has no supported OS keyring backend (the desktop Secret Service/dbus integration is unavailable, and Codewhale does not yet integrate Android Keystore). It therefore falls back to file-backed secret storage: plaintext JSON files under ~/.codewhale/secrets/ (Termux home directory), protected only by 0600 file permissions — they are not encrypted at rest. On single-user Termux this uses the same Unix permission mode as ~/.ssh private keys; it is not encrypted at rest.

Keys saved through setup, /provider, or codewhale auth set are written to ~/.codewhale/config.toml and mirrored to ~/.codewhale/secrets/secrets.json. Treat both as plaintext sensitive files.
codewhale auth status --provider <id> reports which secret backend is active for a provider.

Self-update

codewhale update on Android requests the codewhale-android-arm64 release asset — never the Linux arm64 assets. The GNU libc (glibc) compatibility preflight is Linux-only and is skipped entirely on Android (Bionic libc).

Known limitations (first Termux release)

Feature	Status	Notes
Android app sandbox	✅ inherited	Per-app UID plus Android platform protections
Codewhale command sandbox	❌ unavailable	No bubblewrap/Seatbelt backend on Android
Codewhale keyring backend	❌ unavailable	Falls back to file-backed secrets
Approvals / gates	⚠️ implemented	Device QA pending
File tools	⚠️ implemented	Device QA pending
Self-update	⚠️ asset selection implemented	Published-asset and device QA pending
Shell execution	⚠️ app boundary only	No Codewhale-specific narrowing; runtime QA pending

#4236 — Epic: official Termux / Android arm64 support
#4238 — Make Android sandbox and secret-store behavior explicit
#4240 — Build and bundle Android arm64 release assets
#4241 — Teach updater to select Android assets on Termux
#4242 — Run Termux runtime QA

5.8 KiB Raw Permalink Blame History