The remote step used to list registry counts — three cloud targets, two
chat bridges, twelve providers — which told the user what Codewhale
knows about rather than what they can do. It now answers one question in
four plain rows: local-only, runtime API, phone on your network, chat
app; each carrying its own observed status.
Every status comes from a fact this process can actually observe: whether
a credential *name* is set in the environment, that the shipped runtime
unit binds loopback, and what the bridge registry declares. Secret values
are never read and never rendered — only variable names and presence. A
LAN bind with no token is the one case that asks for action, because it
is reachable *and* unauthenticated.
Missing configuration records NeedsAction, which by contract never blocks
the ready screen, so a user who wants none of this leaves in one key.
The R preview still renders through the same remote_setup::bundle
planning contract the CLI uses, fully in memory with every secret
replaced by <redacted>: nothing is written, applied, or provisioned.
The registry counts stay reachable in that preview; the card no longer
leads with them.
Run observer and background hooks through bounded supervisors, enforce timeout containment and reaping, and preserve one hook session identity across runtime rebinds. Carry real tool exit codes into after/error events, fire tool-scoped on_error hooks for every settled failure, and keep message-submit stdin and queue recovery exact without parking the terminal loop.
Document the implemented TUI-only event, steering, shell_env, timeout, environment, and audit contracts without implying headless or public-API coverage.
Verified: hook filter 144/144; message_submit 29/29; reported_tool_exit_code 1/1; on_error filter 11/11; TUI locale parity; README locale links; cargo fmt --check; git diff --check.
Expand Hotbar event regression coverage across all eight slots and reserved modifier/key shapes, and record a truthful terminal QA matrix without fabricating device passes.
Resolve#4468 with a receipt-preserving presentation/export boundary: canonical model output and signed thinking remain immutable, while show_thinking and stream-json provide safe accessible derived views.
Credit: #4468 proposal and measurements by @eugenicum.
Refs #3758Closes#4468
Promote the expanded underwater release from the 0.8.68 candidate number to 0.9.0 across Cargo, npm, generated facts, changelogs, current docs, and the authoritative release ledger.\n\nDocument the final runtime, Operate, Fleet, motion, Inkling, community, and deferred-work cutlines without rewriting historical fixtures. Version and release-helper checks pass.
Capture the maintainer decision that interactive provider auth converges
on 'codewhale auth login --provider <id>' with a shared adapter contract
(initiate/store/resolve/send/status/logout/tests) instead of one verb per
provider. The xAI device flow (#4257) becomes the first adapter behind a
compatibility alias; the Anthropic Claude Pro/Max adapter is explicitly
blocked on verifying that CodeWhale may use Claude-Code-compatible OAuth
constants before any are copied from reference implementations.
A full audit of every document claiming to define 0.9.0 or the next major
found that most of the old cutover plan already shipped in v0.8.68 under a
different route, while several committed documents still presented stale
obligations as binding — including a tracker asserting unshipped Multitask
work as Done and a handoff instructing removal of todo_* aliases that #4132
deliberately kept.
Give every roadmap-era document an explicit status: the workrooms RFC is a
future RFC with Phase 1 shipped; the external-memory cutline is marked
principle-only with its aspirational layer rows called out; the harness
cutline records its shipped schema/resolver lane; the file-decomposition RFC
is re-scoped honestly (config.rs was overtaken by ProviderLake while ui.rs
and main.rs grew); the 0.8.68 playbook, tracker, and completion handoff are
stamped Historical with their live residuals (#4175/#4177/#4178/#4179) and
their false-Done rows named. TOOL_SURFACE gets its version stamp and the
alias paragraph corrected to shipped-in-0.8.68; ARCHITECTURE gains the
workflow/workflow-js/lane crates; LOCALIZATION states its website-only scope
next to the TUI packs; REBRAND's product framing is neutralized to
every-provider-first-class per stewardship policy.
The present-day description of what a next-major release would actually
mean now lives in docs/AGENT_RUNTIME.md — scope, not a version promise —
and the six-module do-not-delete guardrail is salvaged from the handoff
into AGENTS.md where agents will see it.
docs/rfcs/1364-hooks-lifecycle.md exists on main but was deleted by the
0.8.67 wip checkpoint (000c04189). web/lib/docs-map.ts still points its
hooks topic at the file, so the Web Frontend check-docs gate fails on the
release PR. Restore the file verbatim from origin/main.
Explain the split the Orchestration regulation depends on: the
disposition (the model's judgment about when and how to delegate,
sequence, and verify) versus Fleet (#3154/#3167/#3205 — the substrate
that preconfigures worker roles, loadouts, and slots the orchestrator
reaches for). Maps each orchestration behavior to its Fleet mechanism and
shows how a FleetProfile lets a user pre-set the Codex-coder / Claude-
resolver / design-panel / verifier loadouts an agent would otherwise
improvise every turn.
Forward-looking and honest about scope: the disposition stands on the
current `agent` substrate today and lands durably on Fleet later; the
note proposes no new constitution machinery and does not duplicate the
Fleet schema owned by #3167/#3205.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Restructure the remote-setup RFC around "local-first by default, tailnet-private
when remote, public only when explicitly chosen": a guided "How do you want to
reach CodeWhale?" flow with per-path setup commands, env templates, doctor-style
validation, and a trust-boundary mental model for each path — localhost,
Tailscale (recommended), Telegram, Feishu/Lark, Weixin, and public Funnel
(advanced, last). Cloud/VPS framed as placement, not a trust model.
Commands are explicitly marked verified (codewhale app-server --http/--mobile/
--auth-token, doctor --json, bridge validate:config) vs proposed (the
remote-setup wizard) vs external (tailscale serve/funnel examples). Preserves the
prior RFC material (registry design, auto-provision safety, migration, tests).
Drafted by a Codex sub-agent; orchestrator-reviewed.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Harvested from PR #3277 by @idling11.
Keeps the v0.9 Workrooms protocol/RFC foundation while leaving runtime endpoints, mobile UI, and model-visible tool registration for a later implementation with stable IDs and matching auth docs.
Co-authored-by: Hanmiao Li <8055620+idling11@users.noreply.github.com>
The repo lives on multiple devices, so hard-coded local paths leak machine
details and mislead any agent that follows the docs literally. Replace them
with neutral, portable references:
- /Volumes/VIXinSSD/codewhale (and the hermesagent sibling) -> 'the local
CodeWhale checkout' + git rev-parse --show-toplevel, across the three gh-*
skill files, TOOL_LIFECYCLE.md, and REMOTE_SETUP_DESIGN.md.
- /Users/huntermbown/Desktop/whalebro/codewhale (TOOL_LIFECYCLE.md) -> 'the
current CodeWhale checkout'.
- /opt/homebrew/bin/gh -> plain 'gh' across 9 skill files (the path is
macOS-Homebrew-specific; 'gh' resolves via PATH everywhere).
- codex/v0.8.61 -> <release-branch> across 5 skill files (old branch-naming
convention; the placeholder keeps the instruction correct for any release).
- CLAUDE.md: drop the device-specific worktree reference (match the AGENTS.md
fix from earlier this branch) and version-neutralize the scratch-branch
example.
Left intact: /opt/whalebro is the documented Tencent Lighthouse deployment
workspace-root convention (WHALEBRO_ROOT, systemd, bridge configs) — an
intentional product path, not a leak. The /Users/hunter/private/* paths in
session_failure_classifier.rs are synthetic fixtures for the path-redaction
privacy test. docs/V0_8_61_EXECUTION.md and docs/LOCALIZATION.md keep their
historical codex/v0.8.61 and /opt/homebrew references as accurate records.
WIP branch for v0.8.61 sub-agent cutover. Removes old lifecycle/tool-agent surface, runtime tag injection, heartbeat scaffolding, and capacity/coherence code, but release readiness is not final: interactive fanout can still freeze the TUI and needs follow-up investigation before shipping.
Harvested the narrow Rust/docs slice of PR #2578 by @AresNing for #1364. The event uses the maintained structured observer path: JSON stdin, stdout ignored, warn-only failures, and no ability to block or mutate the turn.
The hook fires after post-turn app state, usage totals, cost, notification, receipt, and queue-recovery state are updated, before queued follow-up dispatch. Docs, RFC notes, /hooks discovery, and v0.9 tracking now describe the observer-only contract.
Co-authored-by: AresNing <49557311+AresNing@users.noreply.github.com>
* docs: v0.8.46 CHANGELOG — platform archives, palette, sub-agents, sandbox, web install, search fixes
Closes#2188
* feat(v0.8.46): quick fixes — palette, model picker Esc, sub-agent sidebar, shell chip, model name casing, CVE bump (#2212)
* fix: bump qs to >=6.15.2 for CVE-2026-8723
Add qs override in feishu-bridge package.json to force transitive
dependency resolution to >=6.15.2, addressing CVE-2026-8723.
Refs: #2198
* fix: Esc in model picker applies last-highlighted choice
Previously Esc reverted to the initial model when the user hadn't
moved the selection. Now Esc always applies the currently highlighted
model and thinking-effort tier, making Esc consistent with Enter.
Also updates the picker footer hint from 'Esc cancel' to 'Esc apply'.
Refs: #2196
* feat: show '⏳ shell running' chip in TUI footer
Adds a footer_shell_chip function that displays a '⏳ shell running'
status chip in the footer's right cluster whenever a foreground shell
command is active via exec_shell. The chip is always visible regardless
of user-configured status items.
Refs: #2194
* feat: auto-collapse finished sub-agents in sidebar
When a sub-agent completes (status = 'done'), its detail lines
(id, steps, duration, progress) are now hidden in the sidebar agents
panel. Only the summary label line is shown, keeping the sidebar
compact. Running agents still show full detail.
Refs: #2195
* feat: refresh Whale dark palette for better contrast
Improve contrast and layer separation in the Whale dark theme:
- Deepen base background for more depth (10,17,32)
- Lighten panel (22,34,56) for clearer distinction from bg
- Lighten elevated surface (36,52,78) for better elevation
- Lighten selection (48,68,100) for clearer selected state
- Boost text hint (138,150,174) and dim (118,130,156) readability
- Brighter border (52,88,145) for better edge definition
- Update tool surface colors for consistency
Refs: #2197
* fix: preserve model name casing in normalize_model_name_for_provider
When the user enters a model name like 'DeepSeek-V4-Flash', the
normalizer was lowercasing it to 'deepseek-v4-flash' via the
canonical_official_deepseek_model_id function. Now the normalizer
preserves the caller's casing when the input already matches a known
model id case-insensitively. Compact aliases like 'deepseek-v4pro'
are still rewritten to 'deepseek-v4-pro'.
Refs: #2109
* feat(web): install download tile with arch detection, SHA256, China mirrors + companion binary fix (#2213)
* fix(web): download both codewhale and codewhale-tui binaries in install snippets
The SNIPPETS map only fetched one binary per platform, causing the
dispatcher to fail with MISSING_COMPANION_BINARY. Every arch now
downloads both codewhale AND codewhale-tui side-by-side.
- macOS/Linux: added second curl + combined chmod/xattr/mv for tui
- Windows: added second Invoke-WebRequest for codewhale-tui.exe
- VERIFY: PowerShell now hashes both binaries; Unix --ignore-missing
covers all present binaries in a single sha256sum pass
* feat(web): add install download tile with arch detection, SHA256, and China mirrors (#2192)
* feat(sandbox/linux): process hardening — PR_SET_DUMPABLE, NO_NEW_PRIVS, RLIMIT_CORE (#2214)
* feat(sandbox/linux): add process hardening module — PR_SET_DUMPABLE, NO_NEW_PRIVS, RLIMIT_CORE (#2183)
* feat(sandbox/linux): seccomp filter + bwrap passthrough
- seccomp: BPF filter whitelisting safe syscalls, denying ptrace/mount/kexec
and other dangerous syscalls. Uses raw BPF instructions via libc prctl to
avoid external dependencies (#2182).
- bwrap: optional bubblewrap passthrough when /usr/bin/bwrap is present
and [sandbox] prefer_bwrap=true in config. Creates read-only rootfs with
write access limited to the working directory (#2184).
- landlock detect_denial extended to recognize seccomp SIGSYS/"Bad system
call" patterns alongside existing Landlock EACCES/EPERM detection.
- SandboxManager gains prefer_bwrap field; set_prefer_bwrap on ShellManager.
- EngineConfig gains prefer_bwrap field, wired through main/ui/runtime_threads.
- Diagnostics now reports bwrap_available and cgroup_version.
- config.example.toml documents the prefer_bwrap key.
Pre-existing clippy fixes picked up in the same build:
- collapsible_if in ui.rs version-check
- cmp_owned in goal.rs test
- consecutive str::replace in normalize_auth_mode
Closes#2182, closes#2184
* docs: add cross-links to issue and PR templates in CONTRIBUTING.md (#2215)
- Link .github/ISSUE_TEMPLATE/bug_report.md and feature_request.md from
the Reporting Issues section
- Link .github/PULL_REQUEST_TEMPLATE.md from the Pull Request Guidelines
section
* feat(release): bundle platform archives with install scripts (#2216)
- Add bundle job to release workflow that creates per-platform archives
(tar.gz for Linux/macOS, .zip for Windows) containing both codewhale
and codewhale-tui binaries plus install scripts
- Create install.bat (Windows) — copies binaries to %USERPROFILE%\bin
- Create install.sh (Unix) — copies binaries to ~/.local/bin
- Windows gets a portable .zip variant without install script
- Release notes updated to promote archives as primary download method
- Individual binaries retained for npm wrapper and scripting
Closes#2193
* fix(web_search): fall back to DuckDuckGo when Bing returns zero results (#2130)
When the configured search provider is Bing and the query returns zero
results (common for technical/compound queries), fall through to the
DuckDuckGo path instead of reporting empty. A provenance message is
surfaced: "Bing returned no results; used DuckDuckGo fallback".
Also adds Security and Code of Conduct cross-links to CONTRIBUTING.md
per the sub-agent renovation (#2203).
* docs: SANDBOX.md threat model + RFCs for persistence and MCP + SandboxExecutor trait
- docs/SANDBOX.md: complete threat model describing each platform's sandbox
(Seatbelt, Landlock, seccomp, process hardening, bwrap, Windows v1).
Covers defense-in-depth layering, config keys, denial detection, limitations.
- docs/rfcs/2189-persistence-sqlite.md: RFC for SQLite migration (drafted by sub-agent)
- docs/rfcs/2190-mcp-modularization.md: RFC for MCP crate split into
protocol/client/server with OAuth support
- crates/tui/src/sandbox/policy.rs: SandboxExecutor trait definition and
SafetyLevel→SandboxPolicyBehavior mapping function with tests
Closes#2180, closes#2186, closes#2189, closes#2190
* feat: sandbox parity tests + remove sub-agent 100-turn cap
- Add sandbox parity tests covering platform detection, denial patterns,
bwrap preference, and policy consistency across modes (#2187)
- Remove arbitrary 100-turn sub-agent cap: DEFAULT_MAX_STEPS changed
from 100 to u32::MAX. Sub-agents now run until they produce a final
text response, are cancelled by the parent, or hit a configured
explicit budget (#2034)
Closes#2187, closes#2034
Hmbown