Derive website sandbox facts from explicit runtime capability markers instead of source filenames. Document actual platform wrappers, narrow model and audit claims, and make two-package/three-command installs exact.
Verify release assets under their manifest filenames before renaming them, with an executable contract test for every Unix snippet. Refresh localized README receipts and keep source-candidate toolCount at 66.
Signed-off-by: Hunter B <hmbown@gmail.com>
Promote the workspace, npm wrapper, internal crate pins, generated web
facts, mirrored changelogs, current docs, and the remote-smoke default
from 0.9.0 to 0.9.1.
The 0.9.1 changelog entry covers the local web client, OpenCode Go, the
xAI device-login restore, calendar-anchored hourly automations,
content-watch canonical draft identities, and the remaining runtime and
Windows fixes, with contributor credits for @h3c-hexin, @zhangweiii,
@sternelee, and @seanthefuturegorilla.
check-versions.sh passes; check-published.sh 0.9.1 reports nothing
published, as expected before release.
Signed-off-by: Hunter B <hmbown@gmail.com>
Promote the expanded underwater release from the 0.8.68 candidate number to 0.9.0 across Cargo, npm, generated facts, changelogs, current docs, and the authoritative release ledger.\n\nDocument the final runtime, Operate, Fleet, motion, Inkling, community, and deferred-work cutlines without rewriting historical fixtures. Version and release-helper checks pass.
Distinguish Android app isolation from Codewhale command sandboxing, document the exact doctor and dual-write secret behavior, and align the install matrix with the unverified real-device preview status.
Two defects blocked the advertised Android/Termux arm64 target:
- rquickjs ships no pre-generated aarch64-linux-android binding, so the
release build could not compile. Android builds now enable bindgen
against the NDK sysroot (workflow-js target dep + release.yml NDK
setup with libclang).
- Real Termux TUI startup panicked because rustls-platform-verifier
expects an Android JVM/context that a standalone Termux CLI process
does not have. Android CLI/TUI HTTP clients (tls.rs, updater, skills
install, prompt suggestion, app-server/hooks callers) now use a
preconfigured rustls root store built from Mozilla WebPKI roots.
Also:
- Extend the OHOS dead-code allowance on ClipboardContent to Android;
the release workflow builds with -Dwarnings and the Android target
never constructs those variants, so the release build would otherwise
fail even though a plain cargo build is green.
- docs/TERMUX.md: stop calling the JSON secret store "encrypted at
rest" - actual behavior is permission-protected (0600) plaintext, and
auth set also writes the key to config.toml.
- docs/INSTALL.md: stop recommending --no-alt-screen as if it disables
the alternate screen; it is a deprecated compatibility no-op.
Verified on this branch (rustc 1.97.0):
- cargo check -p codewhale-cli -p codewhale-tui -p codewhale-app-server
-p codewhale-hooks -p codewhale-release --locked (host)
- RUSTFLAGS=-Dwarnings cargo check --target aarch64-linux-android
-p codewhale-cli -p codewhale-tui --locked (NDK 27.2.12479018)
- cargo fmt --all --check
On-device evidence (ARM64 Android 15 emulator, F-Droid Termux 0.118.3):
binaries report 0.8.68, doctor reports Android/aarch64 with
sandbox.available=false, config/secret files are 0600, loopback
model/tool roundtrip, foreground/background shell lifecycle, and
timeout recovery all green. Remaining on-device residuals (nonzero-size
PTY evidence, real HTTPS updater-metadata check, rebuild at the landed
SHA) are tracked in #4242.
Agent-assisted: Claude Code (Fable 5) under Hunter's direction.
Add docs/TERMUX.md covering the Android platform posture:
- Sandbox: unavailable (type=none). get_platform_sandbox() returns None on
Android; no Linux-only sandbox modules are compiled (cfg-gated).
- Approvals/gates: full, application-level, platform-independent.
- Secret storage: falls back to file-backed JSON (~/.codewhale/secrets/)
since Android has no OS keyring.
- Self-update: selects android-arm64 assets; glibc preflight is Linux-only.
- Known limitations table for the first Termux release.
Verified against code: sandbox mod.rs cfg guards, secrets crate
FileKeyringStore fallback, update.rs preflight_downloaded_binary guard.
Refs #4238
Signed-off-by: Hunter B <hmbown@gmail.com>
Hunter B