Open-source coding agent for your terminal, built in Rust and on a journey of continuous community improvement. Issues and PRs welcome.
| Files | Last commit | Last update |
|---|---|---|
Trim unused syntax loaders and obsolete advisory exceptions Use Syntect embedded syntax/theme assets with the existing fancy-regex backend. Remove unused YAML/plist/HTML loader features and the three now-unreferenced lock packages. Preserve versions and checksums of every retained package. Remove advisory ignores for four crates already absent from the lock and for yaml-rust removed by this change. Keep only the existing cargo-deny bincode maintenance exception with current consumer and retirement notes; cargo-audit ignores are now empty. Validation: independent five-file source review, TOML parsing, exact lock graph comparison, and git diff --check passed. Lock pruning is mechanical; Cargo resolver acceptance, locked compilation, renderer tests and fresh audit/deny qualification remain UNRUN in the release owner's native lane. This does not resolve separate Apps/GTK or GLib qualification. (cherry picked from commit 0e9911378358a44e75e3fc1789417bec635f1c36) | 1 month ago | |
chore(hooks): project hooks that block blanket staging, secrets and build output [skip ci] .codewhale/hooks.toml adds two tool_call_before hooks backed by one policy script, scripts/agent-guard.py: - Shell guard: denies git add -A, --all, -u, a dot, .., a star or the repo root; git commit -a or --all; and add or commit pathspecs naming .env files (templates ending .example, .sample or .template stay allowed), private keys (pem, key, p8, p12, pfx, jks, keystore, ppk, ssh identities) or target/, node_modules/ and .mimosa/ paths (a fixtures folder is exempt for build folders). It reads chained, subshell, bash -c and eval forms and skips heredoc bodies, quoted messages and comments. - Edit guard: opt-in release freeze. With CODEWHALE_RELEASE_FREEZE set, edits to .github/workflows/release*.yml and auto-tag.yml through the file tools, apply_patch or mutating shell commands are denied; reads stay allowed. Every deny names the rule and the way forward, worded to pass the Engine's 240-character denial redactor unchanged. The hooks file pins the script's SHA-256, so approving the hooks digest approves the script too: a changed script fails the pin and never runs. Both hooks keep continue_on_error = true, so a guard that cannot run (no python3 or shasum, a Windows cmd shell) reports no verdict and never blocks work. Nothing runs until the person trusts the workspace and approves the digest (/hooks review, then /hooks approve). The script also answers Claude Code's PreToolUse protocol (JSON on stdin, exit 2 with the reason on stderr), so wiring it there later adds no second policy. Verified: 77 of 77 block and allow cases (both protocols, freeze on and off, truncated arguments) in a scratch harness that runs the script with the Engine's hook environment; all 18 distinct deny reasons pass a replica of sanitize_hook_denial_reason unchanged, worst case 221 characters; the exact hooks.toml commands run through sh -c, and a tampered copy of the script exits 1 without running; tomllib parses the file with only Hook fields. No Rust changed. No CHANGELOG line: this is repository tooling, not a user-visible change. Hooks digest: f4112f65c9e5f389a211d4cfb08414de4a7e516096e912afd038314d907d5b1e Refs CW-7860 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 8 hours ago | |
refactor(engine): extract the shared runtime from the TUI [skip ci] Move the Engine band, extension host, fixtures and shared test support into codewhale-engine; wire TUI/CLI to that owner. Preserve human-decision construction boundaries and lower reusable test helpers. Remove unused copied dependencies and repair path-based guards, scripts and crate maps. Correct the blocking scanner external-module scope leak; raised counts equal the corrected pre-move source. Refresh embedded built-in hashes after path-only bundle regeneration. Restore the provider-free prompt budget to the exact pre-b984e31290 macOS bytes and representative identities; tool catalogs are unchanged. Portable prompt-fixture pinning remains follow-up work. Local validation: Engine/TUI/CLI clippy --tests --no-deps -D warnings passed with the existing allow-list; production CLI check passed; fmt passed. Focused native run: 705 passed / 83 failed initially; after hash/path repairs, 81 affected cases plus 2 existing build-relocation cases passed (83/83). Thus 786/788 original cases pass; 2 compiled-release-image cases lack input and are not qualified. Frozen input inventories unchanged. macOS test-link unwind-table warnings remain. Four metric tests pass; all 55 budgets pass. Host Node: 413 pass, 7 skip; Bun: 414 pass, 6 skip. Existing scanner checks: 34 + 33 pass. Compiled-delivery synthetic fixtures: 7 pass. Web: 42 pass. Import, blocking, dead-code, coarse-map, version and facts checks pass. CW-7701. No hosted CI, provider call, release build or publication. Stage A part 2 and the old App Server/ratatui dependencies remain separate. | 7 days ago | |
fix(devcontainer): support Windows development Use a dedicated development image so Cargo builds have the Rust toolchain, rustfmt, pkg-config, and DBus headers instead of inheriting the minimal release runtime.\n\nReplace the host HOME bind mount with named volumes for CodeWhale state and Cargo artifacts. This avoids invalid Windows HOME expansion, preserves non-root write access, and keeps Rust build churn off the workspace bind mount.\n\nDocument the Dev Container storage and rebuild behavior.\n\nVerification:\n- Built the Dev Container image with Docker Desktop\n- Verified non-root Cargo, Rust, Git, pkg-config, DBus discovery, and writable state/target paths\n- cargo build --locked\n- cargo test -p codewhale-config --locked (cherry picked from commit 8b1ceea7f03394246fa86b9a23b7c75fe661dd46) Signed-off-by: Hmbown <101357273+Hmbown@users.noreply.github.com> | 3 months ago | |
ci: keep aarch64 release builds alive; align workflow tests [skip ci] Release candidate runs 42381818665 (549ff01ebb) and 42408096045 (b175b1f9ed) both lost the linux-arm64, android-arm64 and ohos-arm64 dist builds to "The runner has received a shutdown signal" (exit 143) 20-40 minutes into the quiet compile of the large crates, with no compiler, linker or disk error. linux-x64 on the same ubuntu-latest image succeeds, and 0.10.2 shipped these targets, so the dist profile (fat LTO, one codegen unit) on a grown workspace exhausting 16 GB runner memory is the likely cause. The three Linux aarch64 legs now add an 8-16 GB swapfile on the largest writable disk before building; the shipped binaries are unchanged. The next release-candidate run is the proof. Also fixes two workflow tests my CI slim-down (99cb5a0f4f) made wrong: release-workflows.test.js now expects the npm wrapper smoke to be manual only (Ubuntu + Windows on dispatch), and agent-task-metadata.test.sh no longer requires the removed agent-task-labels.yml but guards that it stays retired. The stale change-detection path for that workflow is dropped. Verified: node --test .github/scripts/release-workflows.test.js 1/1 pass; d8-executable.test.js 4/4 pass; agent-task-metadata.test.sh pass; actionlint with CI flags passes on ci.yml and release-artifacts.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 10 hours ago | |
fix(packaging): generate a valid manifest for the published WinGet route [skip ci] The stale singleton had no package locale, exceeded the one-installer schema limit and repeated ZIP installer identities. Match the actual portable x64 contract, VC++ dependency and codewhale command. Look up the exact compatibility asset in the release checksum manifest and keep the mirror byte-identical. Native WinGet 1.29.380 validated the generated 0.10.1 and 0.10.2 manifests against the actual published checksums. Four invalid inputs preserved both outputs. Sixteen ordinary-user checks on Windows 11 ARM64 covered x64 0.10.1 install, upgrade to 0.10.2, payload hashes, candidate owner delegation, removal, and exact user PATH restoration. ShellCheck, bilingual guide rendering and embedded changelog sync passed. Distribution publication and native Windows 10 floor validation remain separate. | 6 days ago | |
brand: retire the old traced marks, sync the canonical vector family The repo's brand/mark.svg + wordmark traces were an earlier lower-fidelity trace of the C-curl whale (black currentColor instead of the navy family), and crates/tui/src/runtime_web/codewhale-192.png was still the retired diving-whale tile served by the embedded runtime web client. - brand/ and web/public/brand/ now carry byte-identical copies of the canonical family (codewhale-apps/packages/brand/svg/), adding the missing mark-mono and mark-reversed variants. - extensions/vscode/media/codewhale.svg uses the family mono mark. - runtime_web/codewhale-192.png is the canonical 192 tile (same bytes as codewhale-apps apps/web/public/icons/codewhale-192.png). - opengraph-image.tsx reads mark-reversed.svg (the family's white-on-navy variant) instead of string-replacing currentColor, which the family mark.svg does not contain; wordmark aspect corrected to the family's 1024x160 viewBox. - Deleted brand/mark-navy.svg (duplicate of the family navy mark), brand/wordmark0901.png + wordmarkinverted.png (only consumer was the retired generator; founder rasters preserved in codewhale-apps/packages/brand/source/), and scripts/brand/trace-brand.py (regenerated the retired trace; not referenced by CI). The founder brand sheet brand/codewhalemarkfinal.png stays as scripts/brand/braille-mark.py's input. - PRODUCT.md and the public-auth-routes provenance comment updated to name the canonical family home. Checks: npx tsc --noEmit (web) exit 0. Asset swap + comments; runtime_web route tests reference the icon path, not bytes. (cherry picked from commit 116a57b8143167265e48a8c48b10d35828031cf3) | 1 month ago | |
fix(windows): read live Fleet and diagnostic files with shared access; name the plugin snapshot refusal Hosted Windows run 42381817495 (549ff01) failed 221 cases. Fleet ledger replay and state rebuild, and the CLI metrics diagnostic reader, opened files through the protected reader that denies concurrent writers, so a live writer caused OS error 32. They now use WorkspaceFile::open_file_shared, which keeps the regular-file, link and identity checks. Plugin enablement now reports which snapshot check refused (stage root, content identity, final root check) so the 118 snapshot rejections can be diagnosed from the next hosted run; the refusal itself is unchanged. .gitattributes keeps LF on the generated protocol schema and SDK exports. Verified on macOS only: plugins lib 201 passed/0 failed; engine fleet:: 435 passed/0 failed; cli metrics:: 42 passed/0 failed; cargo fmt clean. The Windows effect is unproven until hosted CI runs. The 2 MiB stack-overflow case is not addressed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> | 5 minutes ago | |
fix(release): promote tested v0.9.11 nonbenchmark candidate Promotes the fully gated non-benchmark candidate while preserving the benchmark tree exactly from the prior release-PR head. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 2 months ago | |
fix(providers): identify defaults from each provider's model list A same-line successor replaces a stale pin. grok-4.7 and muse-spark-1.3 are the current models; a different line, such as GPT-6 beside GPT-5.6, does not take over. The provider pane shows one current model per line and spreads a gateway roster across authors, so OrcaRouter no longer opens as a wall of Claude snapshots. Wafer is a selectable OpenAI-compatible host. The public model list is the catalog, GLM-5.3 is the default, and inference uses WAFER_API_KEY. Verification: codewhale-config lib tests for default identity, Grok hydration, web search, and the Wafer descriptor (4 passed). codewhale-agent xAI and Meta default resolution (2 passed). codewhale-tui provider pane default-first (1 passed). codewhale-engine fleet xAI fallback (1 passed). python3 scripts/catalog_models_dev.py defaults audit reported 0 stale. python3 scripts/check-provider-registry.py passed. | 2 hours ago | |
docs, scripts and CI: follow the host move; document stdio/websocket controls and usage statistics Updates moved-file paths in the CI path filters, scripts, vitest config and editor/bridge sources; documents the Runtime API stdio/websocket controls and usage statistics (en and zh_hans); adds the usage-statistics and cache-call-receipts features to features.toml with regenerated web data; updates coarse-split design docs and crate maps, split scripts, the blocking-calls budget and release smoke scripts. Verification: whole-tree evidence only, not per group. A native21 build of the full dirty tree completed (patch sha ea25c782...), and an unsealed nextest rerun of all 389 selected existing checks passed 389/389 on it. The earlier sealed native20 run failed 369/20 before fixes and was not re-sealed. No CI run. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> | 4 days ago | |
feat: fleet simplified to role layer over subagents | 2 months ago | |
fix(bridges): rotate WeCom stream replies before the 10-minute expiry WeCom stops accepting updates to a stream message after ~10 minutes and answers errcode 846608. A turn that streams for longer lost every remaining update, so the phone never saw the final result. Wrap the replyStream calls in a helper that finalizes and reopens the stream near the cap and reopens once when an update is rejected. Conflicts with the merged #7211/#7212 and the harvested #7208 (same exports and tests in lib.mjs and lib.test.mjs) were resolved by keeping every side; node --check passes on both sources and npm test in integrations/wecom-bridge passes 22 of 22. Harvested from PR #7210 by @gaord Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> | 2 days ago | |
docs: point every link at the codewhale-hq organization Hunter moved the Codewhale repositories to github.com/codewhale-hq on 2026-10-05. Rewrite Hmbown/<moved repo> slugs to codewhale-hq/<repo> in docs, READMEs (all 19), website, CHANGELOGs, workflows, issue templates, Cargo/npm/VS Code/nix/winget metadata, install and updater code, the bundled first-party marketplace catalog and their tests: 1,795 references in 434 files, plus four escaped regex literals. Docker images publish to ghcr.io/codewhale-hq/codewhale from the next release. Old URLs keep working through GitHub's transfer redirects (verified live: API releases/latest, HTML releases/latest, release asset downloads, codeload tarballs, git clone), so released clients keep updating. Left unchanged on purpose: Hmbown/codewhale-cu-plugin (not moved yet; its shipped updater refuses redirects), Hmbown/deepseek-skills, cwc and other repos that did not move; package identities (winget Hmbown.CodeWhale, NSIS publisher); vendor/codewhale-ratatui (frozen reviewed package); and the extension-host GitHub adapter with tools/github/report.rs and their parity fixture, which need a bundle rebuild and move together in a follow-up. README translation stamps updated to the new README.md hash. Validation: npm test (wrapper 101/0, SDK 19/0, extension host 398 passed / 0 failed / 7 skipped, web 763/0) and npm run check:web exit 0 (one pre-existing facts-lib.mjs lint warning). cargo check --workspace --tests --all-features --locked: exit 0. cargo test -p codewhale-cli -p codewhale-release -p codewhale-protocol and the touched codewhale-tui modules (client, cloud_dispatch, commands, dispatch_runner, llm_client::mock, oauth, operate, plugins::marketplace, remote_control, remote_setup, tools::mcp_registry, tools::web::fetch, working_set, tui::ui::tests): all ok, 0 failed. check-readme-translations (18 in sync), readme locales, TUI locale parity, product vocabulary, web locales, contributor credit, plugin claims, release-workflows.test.js and check-versions all pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 1 month ago | |
feat(runtime-api): bind Engine terminals to their thread and an issued identity CW-7669. Engine terminal routes addressed a live PTY by a reusable name looked up against the server's root workspace, so a worktree thread's pane reached the root's same-named shell, and two conversations using term-1 in one folder shared one shell (cwd, running command and output crossed between them). Reconnect and restart semantics were undefined. Engine owner (crates/engine/src/tools/terminal_session.rs): - The registry key is (canonical workspace, owner, name); the owner is the tool context's state_namespace, which a runtime thread's engine sets to the thread id (runtime_threads/manager.rs session_id: thread.id), so each conversation gets its own shells; sub-agents share their parent's. - The issued session_id is stored beside the handle in the registry, so an identity resolves without taking a session lock a blocked write holds. lookup(workspace, owner, id) replaces lookup(name, workspace). - get_or_create no longer holds the registry mutex while it waits on an existing session's lock, so one wedged shell cannot stall every thread. - write_human_input is the one human-input path for the TUI dock and HTTP: identity, sandbox-reuse guard, exited shell, and the confirmed ETX interrupt the dock already used. HumanInputError keeps the dock's strings and lets HTTP map statuses. - terminal/reset metadata reports terminal_session_id and previous_session_id. Durable summaries hash the owner too. Runtime API (crates/app-server): - GET /v1/threads/{id}/terminals lists the thread's live shells with the registry instance; /v1/threads/{id}/terminals/{terminal_id}/ output|input|resize|kill drive one by identity, mirroring the thread jobs routes. Every call re-resolves the thread's recorded workspace (thread_workspace split out of scoped_workspace). A reset, foreign-thread, foreign-workspace or pre-restart identity is 404 terminal_not_found; nothing substitutes a same-named shell. Input needs the thread's shell consent and loaded shell policy plus the sandbox-reuse guard against thread_job_sandbox_policy (the derivation a turn uses). Kill reports killed:false for an exited shell; output adds gap. Lookups and PTY work run on the blocking pool (previously open_session locked the registry inline on a runtime worker). - /v1/terminal/{name}/* answers 410 terminal_route_retired on every platform. runtime/info advertises thread_scoped_terminals; the four terminal_stream/input/resize/kill flags leave the protocol RuntimeCapabilities (absent reads as false, so an older client hides Engine terminals instead of reaching the retired routes). A compatibility window was rejected: the old routes carry no thread, so answering them means choosing a shell by name, which is the defect. JSON schema, the TypeScript declaration and the SDK declaration are regenerated. - docs/RUNTIME_API.md (and zh_hans) define reconnect, reset, exit, Engine restart, unconfirmed interrupt and uncertain-input semantics and the known limits, including that deleting a thread does not end its shells. TUI dock: human terminals are created under the current session's owner; resize resolves by identity through resize_dock_session. Behavior change: in the TUI, a new conversation starts its own term-1 instead of reusing the previous conversation's shell (the dock still lists both). The community VS Code extension's client calls no terminal route. Ratchets: blocking-calls budget tightened for terminal_session.rs only (path_canonicalize 3 -> 1, from the canonical() dedup); dead-code budget unchanged at 137/137. Evidence (local, -j6, hermetic test home; source at commit time): - codewhale-app-server-schema --write: exit 0; the JSON schema and both TypeScript declarations change only by the capability swap. - cargo test --locked --offline -j6 -p codewhale-app-server-protocol --features schema: lib 10 passed; tests/schema.rs 2 passed (includes committed_runtime_schema_and_sdk_exports_match_one_rust_contract); tests/wire.rs 3 passed; 0 failed. - cargo test --locked --offline -j6 -p codewhale-engine -p codewhale-app-server --lib -- terminal: app-server 21 passed, 0 failed (the 4 terminal.rs unit tests, terminal_routes_serve_a_live_engine_ session_over_http, terminal_output_for_an_unknown_session_is_not_found_ and_creates_nothing, runtime_info_advertises_terminal_capabilities); engine 146 passed, 0 failed (all 25 tools::terminal_session tests, including session_names_are_scoped_to_owner_and_workspace and dock_never_attaches_to_a_reset_name_without_selecting_its_new_identity). - cargo check --locked --offline -j6 -p codewhale-tui --lib: the engine compiled; the TUI crate stopped on one error outside this change (commands/groups/config/status.rs:325, another session's in-progress Accept Edits work), so the dock edit is type-checked but not borrow-checked. Its only borrow-relevant line was then reduced to the call shape that compiled before (owner computed first). - rustfmt --check on each changed Rust file; check-blocking-calls-budget and check-dead-code-budget run. Tests ran on the shared working tree, which also held other sessions' uncommitted edits; this commit carries only this slice. Not verified: no packaged build, no live desktop pane (needs the App adoption and the 0.10.3 repin), Windows/ohos stubs not compiled here. Refs CW-7669 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 9 hours ago | |
fix(packaging): generate a valid manifest for the published WinGet route [skip ci] The stale singleton had no package locale, exceeded the one-installer schema limit and repeated ZIP installer identities. Match the actual portable x64 contract, VC++ dependency and codewhale command. Look up the exact compatibility asset in the release checksum manifest and keep the mirror byte-identical. Native WinGet 1.29.380 validated the generated 0.10.1 and 0.10.2 manifests against the actual published checksums. Four invalid inputs preserved both outputs. Sixteen ordinary-user checks on Windows 11 ARM64 covered x64 0.10.1 install, upgrade to 0.10.2, payload hashes, candidate owner delegation, removal, and exact user PATH restoration. ShellCheck, bilingual guide rendering and embedded changelog sync passed. Distribution publication and native Windows 10 floor validation remain separate. | 6 days ago | |
feat: integrate the verified 0.10.3 combined Engine batch [skip ci] Lands the 0.10.3 program work that two Codex sessions left uncommitted on canonical main (chats 01a176ff "Review latest MCP updates" / 01a176e0 "DSH plugin compatibility"), on top of contributor PR #7086, which merged as itself (5c3d461d8a) immediately before this commit. The pieces share compiler inputs (the crate-split moves touch most of them), so they land as one verified tree rather than as intermediate commits that would not build. Contents: - Crate split slices: codewhale-net, codewhale-notify and codewhale-sandbox crates; runtime config, config persistence, oauth, settings, catalog cache and Codex model roster moved from tui to runtime; hooks, extension host config and instruction budget to config; callers rewired, re-export facades removed (CW-6129). - Follow-up repairs to #7086 instruction budgets (per-scope budgets, canonical source labels, instruction_assembly session snapshot). - MCP: official SDK 2.4 host backend by default with server/discover and legacy fallback, metadata/output schema handling, OAuth issuer binding, Engine/CU server modernization (CW-6713, CW-7543, CW-7544, CW-7546). - DSH plugin compatibility from the authorized exception lane 26ba80b06a: shared compatibility table, native command lifecycle, reviewed imports, Native-only filesystem sandbox (CW-7054). - Computer Use plugin-only cutover: vendored bundle removed, marketplace install from the independent release (CW-6732). - Image-heavy sessions: 256 KiB read budget, outbound image omission with receipts, one smaller retry on HTTP 413 (CW-7550). - Typed review operation (core/engine/review.rs, runtime_api/review.rs) used by Platform structured reviews. - Receipt-owned Unix uninstall (Refs #7091). - Steering (CW-7552) and Linux Shift+Enter (CW-7551, Refs #7093) source changes; runtime/manual proof still pending. Fixes made during takeover verification: - MCP: Rust now admits the legacy handshake whenever the SDK classifies the discovery probe as legacy (any JSON-RPC error, or a result without the modern supported version); before, servers answering the probe with a result were refused after it. - MCP: an admitted legacy handshake reports initialize's own failure (e.g. 401) instead of the probe's -32601. - MCP: OAuth reactive refresh covers the side-effect-free probe. - MCP: broker launch failures keep their diagnostic (missing command). - Tool images must decode before delivery (truncated PNG was accepted). - THIRD_PARTY_NOTICES lists MCP SDK 2.4.0 and DSH 0.2.1-rc.2 excerpts. - Changelog entries for MCP, DSH, Computer Use and image validation. - #[cfg(test)] on three test-only items; cargo fmt --all; tests updated to post-cutover behavior (no built-in CU, $schema manifests, canonical paths, lazy CU tools, SyncSession resets instruction assembly). Verified on this exact tree (macOS, source sha 4353faf1 before changelog edits; changelog/generated-doc edits only after): - cargo check --workspace --all-targets --locked: exit 0, no warnings - codewhale-config 806 passed; codewhale-runtime 850 passed; codewhale-net 52 passed; codewhale-notify 31 passed; codewhale-cli 501 passed (nextest, 0 failed) - codewhale-tui lib: 14515 passed, 0 failed, 21 skipped - extension host npm test: 420 tests, 413 passed, 0 failed, 7 skipped - web check-facts OK Linux x86_64 (Boat VM, same source before the #7097 fold-in): cargo check --workspace --all-targets --locked exit 0; codewhale-config 808, codewhale-runtime 849, codewhale-net 52, codewhale-notify 31, codewhale-sandbox 100, codewhale-cli 501 passed, 0 failed. The tui lib test binary was still compiling on the 16 GB VM at commit time. #7097 (main) was three-way merged into approval_log.rs and clipboard.rs; re-check after the fold-in: workspace check exit 0; tui approval_log, clipboard, session_export, file_mention, pet_watch 213 passed. Not run: hosted CI, clippy -D warnings, release packaging, live provider or real MCP servers beyond local fixtures, Deepin run for #7093. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 12 days ago | |
fix(mcp): qualify the local 0.10.3 rebuild and workspace routing Keep required credential failures explicit before connection, propagate stored OAuth initialization failures, and keep transient desktop browser servers with their admitted workspace. Forward the shared runtime map to the existing Core and child adapters, schedule late registrations through the existing supervisor, and include them in the live manager snapshot. Preserve static precedence, private-network admission, redaction and credential authority. Avoid an unnecessary coordination transaction when a validated session owns no agent or worker records. Preserve owned/read-only/failed-admission fences. Supply the plugin reload workspace translation argument. Heap-pin eight existing interactive awaits: the real plugin confirmation overflowed the 32 MiB owner stack; measured heavy frames shrink by 7,339,536 bytes without changing the stack limit, confirmation or execution ownership. Prepare consistent 0.10.3 development metadata with the incumbent release preparer: 49 local lock records updated, all 698 external registry records and the latest-published-release fact unchanged. This does not publish a release or freeze a final candidate. Verification: ordinary production CLI build PASS (56.31s, 3025 frozen inputs); actual --version codewhale 0.10.3 (dev), binary e5fc64ca47e3. Nine scoped Engine/MCP observations PASS through seven retained and two fresh controls on the unchanged Engine cohort; all eight ordinary dependency fingerprints match this TUI-only rebuild. Native plugin journey PASS 46/46 plus 20 public renderer comparisons: exact two-step trust, literal argv, stale/prefix refusal, trust remains disabled, no plugin execution, exit 0, actual terminal EOF and owned cleanup. One owned catalog GET, zero inference POSTs. Earlier failed runs are preserved. Modified Rust formatting and JSON parsing pass. Receipts: CW/artifacts/engine-0103-execution-20261102/local-0103-rebuild/ LOCAL-QUALIFICATION-V5.json (4601029555d3) and the retained ordinary Native receipt (368289757940). Full fresh-session ACK, actual Child/RLM, paired Desktop, broader Ubuntu and native-platform/final release gates remain open. | 5 days ago | |
refactor: extract palette into its own crate and move command_safety to execpolicy Two more modules out of the TUI monolith, on the same evidence as the localization extraction: a dependency census that counted crate:: mentions inside doc comments and #[cfg(test)] blocks made these look entangled. With comments and test code excluded, both had **zero** real production dependencies on the rest of the crate. palette -> codewhale-palette (5,850 lines). Theming and colour tokens, with a wide but shallow consumer rewrite. No contrast or colour value changed while moving; scripts/export-design-tokens.py and the check:tokens gate follow the new path, and the gate passes with 64 tokens unchanged. Two OSC probes (osc11::query_terminal, used by tui::mark for the kitty graphics query) had to widen from pub(crate) to pub to cross the new crate line — a terminal capability query, not a trust boundary, and stated here rather than left for a reader to notice. command_safety -> crates/execpolicy (2,951 lines). Deliberately **not** a new crate: execpolicy already owns ApprovalMode and approval policy, and a codewhale-command-safety beside it would be a second authority for one concern. This is security-relevant code that classifies whether a shell command is safe to run, so it moved unchanged — not one classification rule, allowlist entry or matcher was touched. crates/tui already depended on execpolicy, so this move *removes* a dependency edge rather than adding one, which is the ideal shape for this work. The CI step that ran its tests under codewhale-tui now picks them up from the codewhale-execpolicy run on the line below it. crates/tui: 973,442 -> 957,746 lines across this session's three extractions. Verified: cargo check --workspace --all-targets 0 errors, 0 unused warnings cargo test -p codewhale-palette 81 passed; 0 failed cargo test -p codewhale-execpolicy 188 + 1 + 5 passed; 0 failed cargo test -p codewhale-localization 51 passed; 0 failed scripts/check-tui-locale-parity.py PASS scripts/export-design-tokens.py --check up to date, 64 tokens No new tests: the moved suites passing unchanged is the proof a move is correct. Refs: Linear C03-C10 / SHA-6179, docs/design/TUI_DECONSTRUCTION.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X57KRgwqYkmmtVQScczqiL | 1 month ago | |
fix(providers): identify defaults from each provider's model list A same-line successor replaces a stale pin. grok-4.7 and muse-spark-1.3 are the current models; a different line, such as GPT-6 beside GPT-5.6, does not take over. The provider pane shows one current model per line and spreads a gateway roster across authors, so OrcaRouter no longer opens as a wall of Claude snapshots. Wafer is a selectable OpenAI-compatible host. The public model list is the catalog, GLM-5.3 is the default, and inference uses WAFER_API_KEY. Verification: codewhale-config lib tests for default identity, Grok hydration, web search, and the Wafer descriptor (4 passed). codewhale-agent xAI and Meta default resolution (2 passed). codewhale-tui provider pane default-first (1 passed). codewhale-engine fleet xAI fallback (1 passed). python3 scripts/catalog_models_dev.py defaults audit reported 0 stale. python3 scripts/check-provider-registry.py passed. | 2 hours ago | |
Preserve schema 4 telemetry notice version [skip ci] Map schema 4 notice_version into the existing privacy version column, retaining schema 1–3 behavior. This source change does not deploy the telemetry Worker. TypeScript passed and 45 existing ingest tests passed. A network-denied replacement Worker replay passed 30 cases, including 40 schema 4 rows with notice 6 and no mocked PostHog egress; production route, settings and live ingestion remain unverified. | 1 day ago | |
refactor(commands): adopt portable core navigation Shapes (FEAT-031) (#7009) * test(commands): reconcile baseline capability and config proof guards Match /init's existing WORKSPACE|PRESENTATION authority after 8867749f5. Approve only the already-declared pure sanitizer in the config normal graph; preserve all existing service rejection controls. FEAT-031 P0 baseline: 19066 nextest passed, 34 skipped; 3 doctests passed, 8 ignored; config proof 35 passed and 7 controls. Full Clippy, debug/release builds and format passed. No navigation implementation or product behavior change. Refs #5316. * refactor(commands): adopt pure core navigation outcomes and registration FEAT-031 P2 replaces hotbar/transcript/turn FunctionCommand App wrappers with shared pure handlers, real navigation inventory and exhaustive host action conversion. Preserve the original metadata, grammar, output and nine leaf assertions; core remains pending. Verified: 79 contract and 482 scoped native tests pass; 1125 actual observations across 15 locales plus all 40 metadata entries replay byte-identically. Full Clippy, rustfmt, 30 boundary and 63 migration controls pass. Complete 13-command portability proof remains P4; no physical move. Refs #5316. * refactor(commands): adopt stateful core navigation Shapes FEAT-031 P3 replaces the App-bound help/home/overview/links/anchor/workspace/translate wrappers and nine core.rs helpers with command-owned parsing/rendering, NAVIGATION bit30, narrow workspace/config operations and explicit host adapters. Retain all34 relocated host tests, old capability identities and confinement controls. No physical move or complete-core claim. Verified:79 contract and1289 commands/help/voice tests pass;1125 native observations across15 locales plus40 metadata entries remain byte-identical. Full Clippy, formatting,30 boundary/63 migration controls and locale guards pass; all failures/retries retained. Refs #5316. * refactor(commands): complete portable core navigation voice boundary FEAT-031 P4 replaces the remaining voice App handlers with VOICE_INPUT bit31 Shapes, preserving u32 identities and exact authority. Relocate the unchanged capture runtime outside the movable group and retain builtin shortcut semantics. The real complete13-entry root compiles independently as an unpublished normal library; core remains pending for other slices. Verified:79 contract and1289 native command/help/voice tests;1125 observations/15 locales and40 metadata entries byte-identical;9 actual-source portable tests and7 rejection controls. Normal graph/build, full Clippy/fmt,30 boundary/63 migration controls, locales, developer routing and publication-order validation pass. No physical move or release. Refs #5316. * test(commands): strengthen navigation preservation assertions FEAT-031 P5 extends existing host tests for user help precedence/alias shadowing, one-dismissal help behavior, home-directory routes and exact anchor read/open/partial-write/replacement failures. Production code and all original test identities remain unchanged. Verified:1289 commands/help/voice tests pass after correcting the fixture's comma-separated alias syntax;58 native/PTY acceptance tests pass against rebuilt current CLI. Contract79, navigation9+7 controls, config35+7, session65+5, boundary30/migration63 and locale/format checks pass. Numeric final coverage remains pending. Refs #5316. * docs(web): refresh generated agent docs from current main * fix(commands): address core navigation extraction review Relocate the existing canonicalization budget without increasing total authority or blocking-call allowance. Correct both localization guides, restore native command tests for command source paths, and make the complete navigation proof tolerate unrelated registry insertions while rejecting omitted/duplicate/reordered entries. Enforce source and normal graph checks on heavy main and PR lint jobs; retain explicit dependency review. Verified: 1215 native command tests (including all 34 relocated host tests), 9 portable tests, 7 proof controls, 34 blocking-budget controls, workflow regression, docs/facts and formatting pass. Preserved maintainer merge fc5ac7d904. Workspace operation-level authority remains an explicitly documented follow-up; no capability renumbering or widening. Refs #5316. Signed-off-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com> * fix(commands): resolve builtin voice shortcut by canonical name Address the non-blocking PR #7009 review nits: replace dispatch::<10> with builtin-registry lookup using VOICE_INFO.name, preserve capability-scoped dispatch and user-command shadowing isolation, and fix all 13 proof-message spacing. Verified 1215 native command tests, including existing shadowed-voice and pure action assertions plus safe missing-name rejection; 9 portable tests and 7 proof controls pass. Scoped TUI Clippy and formatting pass. No workspace authority redesign; maintainers own that follow-up and the post-v0.10.2 merge timing. Refs #5316. Signed-off-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com> * fix(security): patch follow-redirects in Feishu and WeCom bridges Resolve the two red npm-audit checks on PR #7009 (GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c). Update only the follow-redirects lock entries from 1.16.0 to 1.16.1; keep SDK versions, manifests and all other packages unchanged. No audit exclusions or threshold changes. Verified on Node 22.22.1: clean locked installs, syntax checks, Feishu 19/19 tests and WeCom 17/17 tests, zero vulnerabilities in both npm audit JSON reports, and installed dependency trees at 1.16.1. Original failing reports retained. Refs #5316. Signed-off-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com> --------- Signed-off-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com> Co-authored-by: Paulo Aboim Pinto <paulo.aboim.pinto@gmail.com> Co-authored-by: CodeWhale Bot <bot@codewhale.net> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Hunter Bown <hmbown@gmail.com> | 16 days ago | |
fix(release): handle Windows cleanup and align kit lock [skip ci] Strip Windows PowerShell's UTF8 BOM before parsing normal cleanup receipts. Run the existing bounded exact-private-path cleanup fallback on failures even when its controller has already exited, verify its returned path and zero remaining Terminal processes, and retain the original failure result. Use Cargo's conservative offline update for the standalone vendored kit lock: app-server-protocol0.10.3 and its declared chrono edge. Root Cargo.lock and runtime Rust sources are unchanged from4ba0c656ac9c. Verified on the frozen4ba+these2paths: existing standalone kit themes 14passed/0failed; surfaces3passed/0failed, both locked/offline with source unchanged and disk guard retained. Node syntax and diff checks exit0. Independent review confirms both Windows findings are closed. Actual PowerShell/Windows execution remains pending finalCI. Mac4ba CLI build and strict HTTP admission/recovery observations passed; Linux4ba-equivalent CLI build passed with full4270source invariants. Those executables retain their exact4ba identity and scope; this commit is not a claim that they were rebuilt from the later script/kit-lock metadata. No publication or deployment. | 17 hours ago | |
chore(web): re-derive the feature registry for Accept Edits docs/features.toml has described the Accept Edits posture since 7e6000aa43, but web/data/features.generated.json still carried the pre-Accept-Edits summary and source hash. Regenerated from the file on disk; no source change. Refs CW-7876 | 3 hours ago | |
refactor(engine): extract the shared runtime from the TUI [skip ci] Move the Engine band, extension host, fixtures and shared test support into codewhale-engine; wire TUI/CLI to that owner. Preserve human-decision construction boundaries and lower reusable test helpers. Remove unused copied dependencies and repair path-based guards, scripts and crate maps. Correct the blocking scanner external-module scope leak; raised counts equal the corrected pre-move source. Refresh embedded built-in hashes after path-only bundle regeneration. Restore the provider-free prompt budget to the exact pre-b984e31290 macOS bytes and representative identities; tool catalogs are unchanged. Portable prompt-fixture pinning remains follow-up work. Local validation: Engine/TUI/CLI clippy --tests --no-deps -D warnings passed with the existing allow-list; production CLI check passed; fmt passed. Focused native run: 705 passed / 83 failed initially; after hash/path repairs, 81 affected cases plus 2 existing build-relocation cases passed (83/83). Thus 786/788 original cases pass; 2 compiled-release-image cases lack input and are not qualified. Frozen input inventories unchanged. macOS test-link unwind-table warnings remain. Four metric tests pass; all 55 budgets pass. Host Node: 413 pass, 7 skip; Bun: 414 pass, 6 skip. Existing scanner checks: 34 + 33 pass. Compiled-delivery synthetic fixtures: 7 pass. Web: 42 pass. Import, blocking, dead-code, coarse-map, version and facts checks pass. CW-7701. No hosted CI, provider call, release build or publication. Stage A part 2 and the old App Server/ratatui dependencies remain separate. | 7 days ago | |
feat: consolidate 0.10.1 Engine, reviewed TS mods and Ratatui integration Use the existing Engine for ACP, children and recursive RLM; retain captured approval, deadline, history/checkpoint, delivery and one-bill usage authority. Move legacy thread controls to the authenticated canonical owner with complete history and durable operation receipts. Keep Rust wire/policy authority and opt-in extension/Native execution; adopt the pinned Ratatui kit and source/docs. Exact V22 local validation: Rust 1351 passed/0 failed/0 ignored; additional localization 54 passed/0 failed/0 ignored; workspace/all-target/all-feature Clippy passed under existing CI policy. CLI: 3 actual processes / 6 checks / 6 local fixture requests / 0 paid calls; approval, resume, cancellation and EOF effects passed. npm test + check:web: 1180 passed / 0 failed / 7 explicit skips (wrapper101, SDK19, host378, website682); strict TypeScript and production web passed. No hosted/platform/install/live ChatGPT/DO adapter/publication/release claim. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 1 month ago | |
fix(release): embed user-theme schema inside codewhale-tui package cargo publish and the Docker image both failed because palette/user_theme.rs include_str!'d docs/schemas/..., which is outside the crate package and excluded by .dockerignore. Copy the schema into crates/tui/src/assets and include it from there so crates.io packaging and container builds can compile codewhale-tui. Keep a .dockerignore exception for docs/schemas as belt-and-suspenders for other embeds. | 3 months ago | |
Let the codewhale provider reach the account API's Responses wire A catalog row stating codewhale.protocol = "responses" now resolves to WireFormat::Responses and dispatches to {base}/responses — the account API serves /v1/responses natively and the wire machinery already existed; the catalog label map was the only missing seam. Unknown protocol labels still fall back to the namespace rule so a row this build predates stays reachable, and the id alone never invents a Responses route. codewhale-config --lib: 706 passed, 1 skipped. codewhale-filtered codewhale-tui tests: 95 passed including a new end-to-end catalog→Responses dispatch test. fmt clean. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> | 1 month ago | |
fix(windows): read live Fleet and diagnostic files with shared access; name the plugin snapshot refusal Hosted Windows run 42381817495 (549ff01) failed 221 cases. Fleet ledger replay and state rebuild, and the CLI metrics diagnostic reader, opened files through the protected reader that denies concurrent writers, so a live writer caused OS error 32. They now use WorkspaceFile::open_file_shared, which keeps the regular-file, link and identity checks. Plugin enablement now reports which snapshot check refused (stage root, content identity, final root check) so the 118 snapshot rejections can be diagnosed from the next hosted run; the refusal itself is unchanged. .gitattributes keeps LF on the generated protocol schema and SDK exports. Verified on macOS only: plugins lib 201 passed/0 failed; engine fleet:: 435 passed/0 failed; cli metrics:: 42 passed/0 failed; cargo fmt clean. The Windows effect is unproven until hosted CI runs. The 2 MiB stack-overflow case is not addressed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> | 5 minutes ago | |
feat(catalog): verify signed cloud facts and freeze dispatch prices Add an optional signed catalog layer through the existing config, provider lake, route resolver and dispatch-pricing receipt. Cloud prices are captured at admission and remain stable after refresh, disable and session reload; old turns without a quote cannot borrow later cloud prices. Provider live rosters, exact identities/endpoints, hand tiers and billing modes retain authority. Preserve separate legacy Chat and Anthropic route identities. Bound and authenticate HTTP/disk/cache envelopes, applicability, expiry and rollback history. One ticket gate rejects superseded callbacks and guards publication with atomic cache writes. Reject unsafe file inputs, untrusted future cache hints and provider cache attempts to claim cloud/config price authority. Keep cloud endpoint scope static, independent of operator URL overrides, and retain the existing provider-live wire receipt compatibility. Add fail-closed web transport, strict HEAD/ETag handling, bounded KV reads, fixture validation and guarded authoring. Production trust tables remain empty and cloud facts default off. Public test keys do not activate a feed. Generated website facts remain reserved for combined release integration. Validation on final source: - Rust selected suite: 3396 passed, 0 failed, 9436 skipped (674 config, 17 cloud-facts, 2705 TUI). - Web: 440 passed across 49 files; TypeScript, generated route types, scoped ESLint and cloud-facts fixture/key parity passed. - Production/test cargo check, cargo fmt and diff whitespace checks passed. - Two negative controls: 0 passed, 2 failed as required; digest rejection and late-publication guards restored and hash-verified before final tests. - Earlier executed TUI run: 2509 passed, 2 failed; first combined run: 3394 passed, 1 failed. Fixed status width, explicit MiniMax PAYG fixture authority and the actual legacy identity-parser bug; logs retained. - Required root npm test / check:web both fail: those scripts are absent. Web check:facts reports deferred generated crate/credential-label drift. Local macOS fixture evidence only; Windows checks are source-reviewed. No hosted CI, live provider calls, production key reads, remote database changes, public push, publication or deployment are claimed. Local commit uses an empty per-command hooks path to omit optional session capture; shared hooks configuration is unchanged. Harvested and adapted from PR #5752; donor head 98785c585c3f4f04809438024eac760dda4700fc. Excludes stale synchronization merges and unrelated release history. Exact ownership, hashes, commands and failure logs: /private/tmp/cw-5752-verification-20260907/REPORT.md Co-authored-by: Hmbown <101357273+Hmbown@users.noreply.github.com> | 1 month ago | |
chore(hooks): project hooks that block blanket staging, secrets and build output [skip ci] .codewhale/hooks.toml adds two tool_call_before hooks backed by one policy script, scripts/agent-guard.py: - Shell guard: denies git add -A, --all, -u, a dot, .., a star or the repo root; git commit -a or --all; and add or commit pathspecs naming .env files (templates ending .example, .sample or .template stay allowed), private keys (pem, key, p8, p12, pfx, jks, keystore, ppk, ssh identities) or target/, node_modules/ and .mimosa/ paths (a fixtures folder is exempt for build folders). It reads chained, subshell, bash -c and eval forms and skips heredoc bodies, quoted messages and comments. - Edit guard: opt-in release freeze. With CODEWHALE_RELEASE_FREEZE set, edits to .github/workflows/release*.yml and auto-tag.yml through the file tools, apply_patch or mutating shell commands are denied; reads stay allowed. Every deny names the rule and the way forward, worded to pass the Engine's 240-character denial redactor unchanged. The hooks file pins the script's SHA-256, so approving the hooks digest approves the script too: a changed script fails the pin and never runs. Both hooks keep continue_on_error = true, so a guard that cannot run (no python3 or shasum, a Windows cmd shell) reports no verdict and never blocks work. Nothing runs until the person trusts the workspace and approves the digest (/hooks review, then /hooks approve). The script also answers Claude Code's PreToolUse protocol (JSON on stdin, exit 2 with the reason on stderr), so wiring it there later adds no second policy. Verified: 77 of 77 block and allow cases (both protocols, freeze on and off, truncated arguments) in a scratch harness that runs the script with the Engine's hook environment; all 18 distinct deny reasons pass a replica of sanitize_hook_denial_reason unchanged, worst case 221 characters; the exact hooks.toml commands run through sh -c, and a tampered copy of the script exits 1 without running; tomllib parses the file with only Hook fields. No Rust changed. No CHANGELOG line: this is repository tooling, not a user-visible change. Hooks digest: f4112f65c9e5f389a211d4cfb08414de4a7e516096e912afd038314d907d5b1e Refs CW-7860 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 8 hours ago | |
chore: map github web committer | 6 months ago | |
ci: cut PR CI to the fast required set; welcome contributor PRs [skip ci] Founder direction (2026-11-07): remove CI/CD steps that cost time without need, use CI conservatively, and make contributor rules standard and welcoming instead of closing or blocking PRs over CI. A read-only audit of two weeks of run history (Sonnet workflow with an adversarial release- engineer critique) drove the list; nothing release-critical is touched. Removed (enforced nothing, duplicated other checks, or gated contributors): - dco.yml (always exited 0), pr-issue-link.yml (red X on ~8% of contributor PRs), auto-close-harvested.yml, pr-gate.yml / issue-gate.yml / approve-contributor.yml and .github/APPROVED_CONTRIBUTORS (dry-run allowlist gate; drops a pull_request_target surface), agent-task-labels.yml (duplicates triage.yml). Moved to manual (workflow_dispatch) only: - codewhale-review.yml (review bot; AGENTS.md says review bots stay off), main-landing.yml (push trigger; run scripts/preflight.sh --check locally), ci.yml test (Linux suite, 54-94 min per PR), safety-gate (18-29 min), msrv, mobile-smoke, npm-wrapper-smoke (macOS leg dropped from the dispatch matrix; the release artifacts cover macOS). - The PR feature release-note receipt step is advisory (continue-on-error). - spam-lockdown keeps only unambiguous spam patterns. Unchanged: Lint and the compile-only Test (windows-latest) stay the required PR checks; release-candidate, release-artifacts, release-parity, release, the mirrors, OHOS and the Windows import guard are untouched. The branch ruleset drops "npm wrapper smoke (ubuntu-latest)" next (founder approved "Lint + 1 compile"). Rules: AGENTS.md, CONTRIBUTING.md, the PR template, AGENT_ETHOS.md and the cw-land skill now say contributor PRs are never closed or blocked because CI is slow, flaky or red for a reason they did not cause; nothing closes a PR automatically; harvesting is a rare, asked-first fallback with the contributor as author; the PR issue line is optional; maintainers reply generously. web/data/agent-docs.generated.json is regenerated from a clean export of main plus this change only. Verified: actionlint with CI's flags (-ignore SC2129/SC2221/SC2222) over all workflows passes; web/scripts/check-facts.mjs passes on the isolated export; only the contribution entry of agent-docs.generated.json changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 10 hours ago | |
fix(windows): read live Fleet and diagnostic files with shared access; name the plugin snapshot refusal Hosted Windows run 42381817495 (549ff01) failed 221 cases. Fleet ledger replay and state rebuild, and the CLI metrics diagnostic reader, opened files through the protected reader that denies concurrent writers, so a live writer caused OS error 32. They now use WorkspaceFile::open_file_shared, which keeps the regular-file, link and identity checks. Plugin enablement now reports which snapshot check refused (stage root, content identity, final root check) so the 118 snapshot rejections can be diagnosed from the next hosted run; the refusal itself is unchanged. .gitattributes keeps LF on the generated protocol schema and SDK exports. Verified on macOS only: plugins lib 201 passed/0 failed; engine fleet:: 435 passed/0 failed; cli metrics:: 42 passed/0 failed; cargo fmt clean. The Windows effect is unproven until hosted CI runs. The 2 MiB stack-overflow case is not addressed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> | 5 minutes ago | |
docs: adopt the ponytail decision ladder (#5787) Founder-directed. From dietrichgebert/ponytail -- 'the laziest senior dev in the room', 'the best code is the code you never wrote'. Encodes the ladder verbatim rather than paraphrasing it: 1. Does this need to exist? -> Skip it 2. Already in this codebase? -> Reuse it 3. Stdlib does it? -> Use it 4. Native platform feature? -> Use it 5. Installed dependency? -> Use it 6. One line? -> One line 7. Only then: the minimum that works Two parts of the source method matter as much as the rungs and are kept explicit. The ladder runs *after* understanding the problem -- lazy about solutions, never about reading the code first. And it never cuts trust-boundary validation, data-loss handling, security, or accessibility. Rung 2 is the one this repository keeps failing, so the section says so and points at the existing model_*/ *_config / provider_* grep rule rather than restating it. Two corollaries earned here are added because the ladder does not cover them: an abstraction must delete caller code, and migrate the last consumer or do not start. Carries no counts. AGENTS.md's first line says to derive changing state from the repository rather than from instructions, so the dead-code corollary points at scripts/check-dead-code-budget.py instead of freezing a number. CLAUDE.md gets a pointer, not a copy. Signed-off-by: CodeWhale Bot <bot@codewhale.net> Co-authored-by: CodeWhale Bot <bot@codewhale.net> | 2 months ago | |
ci: cut PR CI to the fast required set; welcome contributor PRs [skip ci] Founder direction (2026-11-07): remove CI/CD steps that cost time without need, use CI conservatively, and make contributor rules standard and welcoming instead of closing or blocking PRs over CI. A read-only audit of two weeks of run history (Sonnet workflow with an adversarial release- engineer critique) drove the list; nothing release-critical is touched. Removed (enforced nothing, duplicated other checks, or gated contributors): - dco.yml (always exited 0), pr-issue-link.yml (red X on ~8% of contributor PRs), auto-close-harvested.yml, pr-gate.yml / issue-gate.yml / approve-contributor.yml and .github/APPROVED_CONTRIBUTORS (dry-run allowlist gate; drops a pull_request_target surface), agent-task-labels.yml (duplicates triage.yml). Moved to manual (workflow_dispatch) only: - codewhale-review.yml (review bot; AGENTS.md says review bots stay off), main-landing.yml (push trigger; run scripts/preflight.sh --check locally), ci.yml test (Linux suite, 54-94 min per PR), safety-gate (18-29 min), msrv, mobile-smoke, npm-wrapper-smoke (macOS leg dropped from the dispatch matrix; the release artifacts cover macOS). - The PR feature release-note receipt step is advisory (continue-on-error). - spam-lockdown keeps only unambiguous spam patterns. Unchanged: Lint and the compile-only Test (windows-latest) stay the required PR checks; release-candidate, release-artifacts, release-parity, release, the mirrors, OHOS and the Windows import guard are untouched. The branch ruleset drops "npm wrapper smoke (ubuntu-latest)" next (founder approved "Lint + 1 compile"). Rules: AGENTS.md, CONTRIBUTING.md, the PR template, AGENT_ETHOS.md and the cw-land skill now say contributor PRs are never closed or blocked because CI is slow, flaky or red for a reason they did not cause; nothing closes a PR automatically; harvesting is a rare, asked-first fallback with the contributor as author; the PR issue line is optional; maintainers reply generously. web/data/agent-docs.generated.json is regenerated from a clean export of main plus this change only. Verified: actionlint with CI's flags (-ignore SC2129/SC2221/SC2222) over all workflows passes; web/scripts/check-facts.mjs passes on the isolated export; only the contribution entry of agent-docs.generated.json changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 10 hours ago | |
feat(runtime): reconcile reviewed plugins and unify native account setup [skip ci] Restore missing plugin stages only from receipt-matching bytes under the existing state writer, with generation and policy checks. Refuse changed existing stages. Reuse normal reload/MCP invalidation for explicit restage; add read-only shell status and bounded authenticated DSH asset grants. Expose current-server MCP backoff without treating an absent backoff as health. Share profile-scoped Rust account custody across terminal and native hosts, keep local provider setup optional, and make ordinary logout session-only. Fence browser imports and cleanup by exact revision; preserve ambiguous or newer sessions. Keep definitely unadopted device grants in cleanup custody. Validation: six-crate Mac all-target check exit0, 4,270 source entries unchanged, 35m37s, no disk stop. Grok Linux raw evidence verified: secrets account6 and plugins202 passed, one existing real-home rehearsal ignored; all4,270 entries exactly matched that Mac freeze. Existing command-crate boundary gate passed; 2,816 keys complete in all15 TUI locales. The subsequent two-file private account cleanup has independent source review and exact pre/post hash checks; Linux verification is in progress. Only that cleanup and the already-landed visual-change changelog entry differ from the passing Mac compile snapshot. No new tests or code comments added. Qualification is incomplete: production recovery/asset HTTP smoke, published plugin, Electron, live sign-in, cross-platform/package and final release gates remain. This local candidate commit is not a release or publication. | 21 hours ago | |
refactor(deps): remove unused Rust dependency edges [skip ci] Remove unused direct dependency declarations and their orphan lockfile edges while retaining the actual owners of the enabled features. No locked package versions are removed. Verified: Mac development CLI build and isolated plugin/MCP fixture; separate locked Engine library check; locked offline metadata without dependencies; diff check. An earlier existing DSH test passed with identical dependency files but crossed other concurrent source changes. Test configurations and non-Mac targets remain unqualified. | 1 day ago | |
fix(vscode): patch MSAL packager dependency and remove waiver [skip ci] CW-7639: replace vulnerable MSAL Node 6.0.1 with 7.1.2 through an Azure Identity scoped override. Keep VSCE on its current supported route; materialize the lockfile and remove the obsolete advisory acceptance from the audit classifier and dependency-security documentation. Verification: 47 existing extension checks passed; npm audit reported zero vulnerabilities; replaying the old advisory is blocked. Credential-free local VSIX packaging passed (30 files; no development dependencies). Installed dependency graph resolves MSAL Node 7.1.2. No publishing or live authentication was performed; no exploit or affected invocation is claimed. | 9 days ago | |
fix(release): promote tested v0.9.11 nonbenchmark candidate Promotes the fully gated non-benchmark candidate while preserving the benchmark tree exactly from the prior release-PR head. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 2 months ago | |
docs: the legacy project was DeepSeek-TUI, not "DeepSeek CLI" Both LICENSE files and one app-server doc comment attributed copyright to "DeepSeek CLI Contributors" — a project name that never existed. The founder confirmed the lineage is DeepSeek-TUI, which is also what the retained legacy npm package is called (npm/deepseek-tui, kept private and never republished). This corrects a project name, not the license. Verified: with line 3 removed, both LICENSE files are byte-identical to their previous contents, so the MIT text, the year range and the copyright holder shape are untouched. Deliberately NOT changed, because they are not attribution: - crates/tui/src/tools/review.rs — deepseek-ai/deepseek-cli is a test URL for the PR-URL parser - crates/cli/src/lib.rs — deepseek-cli-auth-*-test are temp filenames - npm/deepseek-tui/package.json — the deprecated legacy package name Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net> (cherry picked from commit 18d5f95edde2d483b874233d7afd57ab0a529904) | 1 month ago | |
feat(permissions): Ask asks before every edit; add Accept Edits [skip ci] Ask ( suggest) now opens a card for file edits inside the workspace too, as its name, the Plan handoff copy ("Edits and commands ask you first") and the founder-agreed model (2026-11-07, modeled on Claude Code's permission modes) promise. CW-7663 found that the desktop edit card could not appear with default settings because Ask ran in-repository writes unasked. The #5185 in-workspace write carve-out moves to a new posture, Accept Edits (ApprovalMode::AcceptEdits; settings and config.toml accept-edits, Runtime wire accept_edits), between Ask and Auto-Review: an edit whose every target stays inside the workspace git work tree runs without a card; .git, .codewhale, .env*, credential and key files, folders without git, commands, network and MCP actions ask exactly as in Ask. Everywhere else Accept Edits is an asking posture (ApprovalMode::is_ask_family): repo-law asks, sandbox escalation and Computer Use consent open a card; remembered grants treat it as Ask; non-authoritative provenance narrows it to Ask with a recorded narrowing event; live-authority narrowing ranks it between Ask and Auto-Review. - Shift+Tab: Ask -> Accept Edits -> Auto-Review -> Full Access. - Settings schema rows (permission_posture, approval_mode, approval_policy), /permissions, /status, /config, the Plan handoff ("Work (Accept Edits)"), footer chip and help strings; 7 new and 3 updated strings in all 15 locale packs. - config.toml approval_policy = "accept-edits"; a project file may only tighten: auto < accept-edits < on-request < never. - ACP runs Accept Edits as Ask, because ACP turns never apply the carve-out. - /import-claude maps Claude Code's acceptEdits to Accept Edits. - Docs: MODES, KEYBINDINGS, CONFIGURATION, INSTALL, GUIDE, README and its 18 translations (restamped), zh_hans mirrors, features.toml row, CHANGELOG entry, regenerated web/data/agent-docs.generated.json. Stated limits: write-capable workers keep #5186's in-folder edits under Ask (their spawn card is the consent); modes, Tab and Operate are unchanged pending the founder's answers to the modes/postures design (CW/artifacts/modes-postures-20261107/DESIGN.md D1-D4; Operate in CW-7849). Verification (shared checkout, source b3d18fe6bc plus this diff): - scripts/dev-cargo.sh test --locked --offline -j6, focused filters (approval_mode, posture, permission*, carve_out, authority::, protocol_parity, repo_law, sandbox_escalation, computer_use, narrow, approval_request, runtime_policy, project_config, settings_schema, plan_handoff, import_claude, file_edit_card, config_choice, keybinding, locale parity): codewhale-engine lib 263 passed, 0 failed; codewhale-tui lib 103 passed, 0 failed; codewhale-app-server lib 13 passed, 0 failed; codewhale-config 35 passed; codewhale-runtime 20 passed; codewhale-localization 15 passed; codewhale-execpolicy 12 passed; all 0 failed. Includes write_carve_out_posture_is_exactly_ accept_edits, workspace_write_carve_out_covers_accept_edits_only, file_write_card_names_the_missing_repository..., permission_cycle_is_a_ closed_loop..., cycle_approval_scenario, permission_postures_persist_ across_restart, shift_tab_migrates_user_root_policy..., plan handoff locale test, file_edit_card_says_when_it_asks_for_lack_of_a_git_repo. - codewhale-tui --test feature_registry: this row passes; the run fails only on another session's uncommitted clipboard-image-prune row, which this commit does not contain. - rustfmt --check on every touched .rs file; check-tui-locale-parity PASS (2823 keys x 15 packs); check-tui-product-vocabulary exit 0; check-readme-translations OK (18, stamp 20d0bb7c0784); check-readme-locales PASS; check-versions OK; check-dead-code-budget PASS (137). check-blocking-calls-budget fails only on another session's untracked crates/engine/src/session_image_prune.rs (not in this commit). - Not run: a live desktop/TUI turn showing the edit card (CW-7663's App acceptance); full workspace suites (final release validation owns them). Tests ran on the shared working tree, which also held other sessions' uncommitted edits; this commit stages only this slice's hunks (private index, HEAD + these changes). Refs CW-7663, CW-7849 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 6 hours ago | |
docs(review): REVIEW.md, the written procedure for reviewing Engine changes [skip ci] Three named passes: correctness against the linked issue (intent, defects, contracts, the AGENTS.md invariants), security (trust boundaries, secrets, sandbox, execpolicy and the approval layers, network policy, dependencies) and contract and compliance (CHANGELOG line per the cw-land step, feature registry, localization, vocabulary, and a table of which existing scripts to run for what a change touched). Severity reuses the blocker, concern and nit levels and the reproduced, traced and suspected evidence tiers that codewhale review already emits (crates/engine/src/tools/review_core.rs), so a person's review and the tool's read the same. Nits are grouped into one list; there is no numeric cap. Review runs by hand and at the frozen release candidate, never as a required check, and for contributors it is advice that never blocks, labels or closes a pull request. Verified: every path, link and script it cites exists at this commit. No CHANGELOG line: contributor process documentation, not a user-visible change. Refs CW-7860 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 8 hours ago | |
docs: point every link at the codewhale-hq organization Hunter moved the Codewhale repositories to github.com/codewhale-hq on 2026-10-05. Rewrite Hmbown/<moved repo> slugs to codewhale-hq/<repo> in docs, READMEs (all 19), website, CHANGELOGs, workflows, issue templates, Cargo/npm/VS Code/nix/winget metadata, install and updater code, the bundled first-party marketplace catalog and their tests: 1,795 references in 434 files, plus four escaped regex literals. Docker images publish to ghcr.io/codewhale-hq/codewhale from the next release. Old URLs keep working through GitHub's transfer redirects (verified live: API releases/latest, HTML releases/latest, release asset downloads, codeload tarballs, git clone), so released clients keep updating. Left unchanged on purpose: Hmbown/codewhale-cu-plugin (not moved yet; its shipped updater refuses redirects), Hmbown/deepseek-skills, cwc and other repos that did not move; package identities (winget Hmbown.CodeWhale, NSIS publisher); vendor/codewhale-ratatui (frozen reviewed package); and the extension-host GitHub adapter with tools/github/report.rs and their parity fixture, which need a bundle rebuild and move together in a follow-up. README translation stamps updated to the new README.md hash. Validation: npm test (wrapper 101/0, SDK 19/0, extension host 398 passed / 0 failed / 7 skipped, web 763/0) and npm run check:web exit 0 (one pre-existing facts-lib.mjs lint warning). cargo check --workspace --tests --all-features --locked: exit 0. cargo test -p codewhale-cli -p codewhale-release -p codewhale-protocol and the touched codewhale-tui modules (client, cloud_dispatch, commands, dispatch_runner, llm_client::mock, oauth, operate, plugins::marketplace, remote_control, remote_setup, tools::mcp_registry, tools::web::fetch, working_set, tui::ui::tests): all ok, 0 failed. check-readme-translations (18 in sync), readme locales, TUI locale parity, product vocabulary, web locales, contributor credit, plugin claims, release-workflows.test.js and check-versions all pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 1 month ago | |
fix(engine): keep injected-route config when preflight fails [skip ci] Fixes the remaining hosted test failures on 549ff01ebb (CI 42381817495). Runtime: a host-provided route with no preflighted client took its config with mem::take before the optional credential preflight, so a failed preflight left the route with a default config and lost its session isolation and approval deadlines. It now clones, so the configured route survives a failure. The existing privacy/timeout assertions are unchanged. Exports: the four capabilities the runtime already serializes (thread_scoped_git_writes, thread_scoped_snapshots, worktrees, job_operations) are restored to the committed JSON schema, the TypeScript declarations and the runtime SDK copy; the JSON matches the Rust-generated contract. Existing expectations realigned with shipped behavior: present is an eager core tool (hook category stays other) in the five tool-surface tests; Native extension entries accept .cjs and .cts; account logout is account-only and keeps provider keys (two TUI tests renamed to say so). The router HTTP-status unit test disables retry because it mounts a single response; runtime retries are unchanged. THIRD_PARTY_NOTICES restores the semver 7.8.5 ISC text the bundle-notice check requires. Both changelogs record the fixes. Verified on this Mac: the 13 hosted failing cases, each run by exact name and each executing exactly one test, 13/13 pass (RUST_MIN_STACK=8388608, hermetic test home, locked/offline/-j1); clippy --lib --bins --all-features over 11 packages exit 0 with zero diagnostics; runtime SDK tests and strict TypeScript passed earlier on these same bytes (exit 0); rustfmt --check and git diff --check pass. The full suite runs in the final hosted validation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> | 13 hours ago | |
fix(action): expose Engine reasoning for released review limits (CW-6869) [skip ci] The installed v0.10.2 binary identifies source 3400ebb5c93b, whose review triage caps small reviews at 4000 output tokens regardless of the environment ceiling. Live runs 40830663408 and 40831324211 exhausted all 4000 tokens as reasoning and correctly published nothing. Current Engine source already removes that fixed cap, but unreleased source is not a substitute for a checksummed release. Add a validated reasoning-effort input, applied through a fresh secret-free isolated Engine configuration. Generated workflows default to off for this released compatibility boundary; users can select an explicit level or auto. Local verification: existing Action tests 8 passed, 0 failed; syntax, generated workflow actionlint and whitespace checks pass. No new tests or code comments; next live acceptance is on the newly pinned source. | 10 days ago | |
fix(providers): identify defaults from each provider's model list A same-line successor replaces a stale pin. grok-4.7 and muse-spark-1.3 are the current models; a different line, such as GPT-6 beside GPT-5.6, does not take over. The provider pane shows one current model per line and spreads a gateway roster across authors, so OrcaRouter no longer opens as a wall of Claude snapshots. Wafer is a selectable OpenAI-compatible host. The public model list is the catalog, GLM-5.3 is the default, and inference uses WAFER_API_KEY. Verification: codewhale-config lib tests for default identity, Grok hydration, web search, and the Wafer descriptor (4 passed). codewhale-agent xAI and Meta default resolution (2 passed). codewhale-tui provider pane default-first (1 passed). codewhale-engine fleet xAI fallback (1 passed). python3 scripts/catalog_models_dev.py defaults audit reported 0 stale. python3 scripts/check-provider-registry.py passed. | 2 hours ago | |
cli: honest --mobile help, and pin the windows-* deny skips Salvaged from the closed tui-redesign branch (PR #6222), commits 296fc88c and 98f290d6. The constant-time compare part of 296fc88c is dropped; #6601 covers it. --mobile help: codewhale app-server --help and the forwarded serve options claimed "--mobile defaults to 0.0.0.0" / "(binds 0.0.0.0)" and that --mobile with no host binds 0.0.0.0 for LAN access. The code does the opposite: resolve_serve_bind_host (crates/tui/src/lib.rs) ignores mobile and defaults to 127.0.0.1, and runtime_api.rs rejects a non-loopback mobile bind. The help, the --host doc comment, a stale test comment, and the same claim in docs/rfcs/REMOTE_SETUP_DESIGN.md now say what the code does. The remaining 0.0.0.0 literals in crates/cli/src/lib.rs are a parse test of an explicit app-server --host 0.0.0.0 (mobile: false), which is still valid. deny.toml: the windows-* family was skipped unpinned, so any new duplicate passed silently. Now pinned to the versions cargo-deny actually encounters. The 0.42.x pins from the original commit are omitted: cargo-deny reports them as unmatched skips on this tree. CARGO_BUILD_JOBS=4 scripts/dev-cargo.sh test -p codewhale-cli --lib 405 passed, 0 failed target/debug/codewhale app-server --help no 0.0.0.0; says loopback-only cargo deny check bans bans ok; warning set identical before/after check-blocking-calls-budget, check-dead-code-budget, check-command-crate-boundaries, split/module_graph.py --check, cargo fmt --all -- --check all pass Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> | 1 month ago | |
Merge PR #7191: refresh Nix input pin [skip ci] chore(deps): bump nixpkgs from 7a0f122 to 31ecbac | 5 days ago | |
misc: replace stdenv.isLinux with stdenv.hostPlatform.isLinux | 2 months ago | |
fix(mcp): qualify the local 0.10.3 rebuild and workspace routing Keep required credential failures explicit before connection, propagate stored OAuth initialization failures, and keep transient desktop browser servers with their admitted workspace. Forward the shared runtime map to the existing Core and child adapters, schedule late registrations through the existing supervisor, and include them in the live manager snapshot. Preserve static precedence, private-network admission, redaction and credential authority. Avoid an unnecessary coordination transaction when a validated session owns no agent or worker records. Preserve owned/read-only/failed-admission fences. Supply the plugin reload workspace translation argument. Heap-pin eight existing interactive awaits: the real plugin confirmation overflowed the 32 MiB owner stack; measured heavy frames shrink by 7,339,536 bytes without changing the stack limit, confirmation or execution ownership. Prepare consistent 0.10.3 development metadata with the incumbent release preparer: 49 local lock records updated, all 698 external registry records and the latest-published-release fact unchanged. This does not publish a release or freeze a final candidate. Verification: ordinary production CLI build PASS (56.31s, 3025 frozen inputs); actual --version codewhale 0.10.3 (dev), binary e5fc64ca47e3. Nine scoped Engine/MCP observations PASS through seven retained and two fresh controls on the unchanged Engine cohort; all eight ordinary dependency fingerprints match this TUI-only rebuild. Native plugin journey PASS 46/46 plus 20 public renderer comparisons: exact two-step trust, literal argv, stale/prefix refusal, trust remains disabled, no plugin execution, exit 0, actual terminal EOF and owned cleanup. One owned catalog GET, zero inference POSTs. Earlier failed runs are preserved. Modified Rust formatting and JSON parsing pass. Receipts: CW/artifacts/engine-0103-execution-20261102/local-0103-rebuild/ LOCAL-QUALIFICATION-V5.json (4601029555d3) and the retained ordinary Native receipt (368289757940). Full fresh-session ACK, actual Child/RLM, paired Desktop, broader Ubuntu and native-platform/final release gates remain open. | 5 days ago | |
refactor(engine): extract the shared runtime from the TUI [skip ci] Move the Engine band, extension host, fixtures and shared test support into codewhale-engine; wire TUI/CLI to that owner. Preserve human-decision construction boundaries and lower reusable test helpers. Remove unused copied dependencies and repair path-based guards, scripts and crate maps. Correct the blocking scanner external-module scope leak; raised counts equal the corrected pre-move source. Refresh embedded built-in hashes after path-only bundle regeneration. Restore the provider-free prompt budget to the exact pre-b984e31290 macOS bytes and representative identities; tool catalogs are unchanged. Portable prompt-fixture pinning remains follow-up work. Local validation: Engine/TUI/CLI clippy --tests --no-deps -D warnings passed with the existing allow-list; production CLI check passed; fmt passed. Focused native run: 705 passed / 83 failed initially; after hash/path repairs, 81 affected cases plus 2 existing build-relocation cases passed (83/83). Thus 786/788 original cases pass; 2 compiled-release-image cases lack input and are not qualified. Frozen input inventories unchanged. macOS test-link unwind-table warnings remain. Four metric tests pass; all 55 budgets pass. Host Node: 413 pass, 7 skip; Bun: 414 pass, 6 skip. Existing scanner checks: 34 + 33 pass. Compiled-delivery synthetic fixtures: 7 pass. Web: 42 pass. Import, blocking, dead-code, coarse-map, version and facts checks pass. CW-7701. No hosted CI, provider call, release build or publication. Stage A part 2 and the old App Server/ratatui dependencies remain separate. | 7 days ago | |
chore: use stable rust toolchain channel Cargo already enforces the workspace MSRV through rust-version, so let rustup select the current stable toolchain instead of pinning contributors to exactly Rust 1.88. Fixes #3570. | 4 months ago |
An open-source coding agent for your terminal that works with any model.
Give Codewhale a task and it reads the repository, edits files, and runs
commands until the task is done or it needs input from you. It works with more
than 40 built-in providers, DeepSeek V4.1 Flash by default, and with models running on
your own machine. /receipts lists the files it changed, the commands it ran,
and the web and MCP calls it made.
Website · Documentation · Changelog · Contributing
简体中文 · 日本語 · Tiếng Việt · Bahasa Indonesia · 한국어 · Español · Português · Русский · Українська · Français · Deutsch · 繁體中文 · हिन्दी · Türkçe · Italiano · Polski · العربية · Català
A 0.10.2 development build with a scripted test model, in Full Access inside a throwaway workspace. The edit, three tests and a sub-agent review ran for real.
View the Codewhale × OrcaRouter offer. Codewhale earns a referral fee from OrcaRouter.
Install
macOS and Linux:
curl -fsSL https://codewhale.net/install.sh | sh
The installer puts checksum-verified codewhale and its short alias codew
in ~/.local/bin. If your shell then says command not found, run the PATH
line the installer prints (details).
codewhale update upgrades it. These commands install the latest release.
This page follows main, so a feature marked with a version arrives in that
release; the changelog lists what each release adds.
Windows, npm, Cargo, and other ways to install
winget install HunterBown.CodeWhale # Windows x64 (or Scoop, or the installer from GitHub Releases)
npm install -g codewhale # wraps the same release binaries
cargo install codewhale-cli --locked # crates.io; can trail GitHub Releases
Prebuilt binaries cover Linux, macOS, and Windows on x64 and arm64. Nix,
Homebrew on Linux, Android/Termux (preview), and manual downloads are in the
installation guide, and containers in
Docker. Stick to one install method per machine; otherwise
two copies end up on PATH and whichever comes first wins.
Quickstart
- Commit or stash your work, then run
codewhalefrom the root of a git repository. By default it asks before each file edit and command; pressShift+Tabonce for Accept Edits to let it edit files in the repository without asking. - Run
/provider(or pressF3), pick a provider, paste its API key, and choose a model. DeepSeek is the default provider. With no key, pick a local runtime instead. If no provider is configured and Ollama is already serving a chat model, Codewhale uses it automatically; from 0.10.2 it offers it when you send your first message. - Type a task:
Fix the failing tests and explain what changed.
Read-only commands run straight away. For any other shell command Codewhale
asks first: y runs it once, a allows commands like it for the rest of the
conversation, n refuses. /undo takes back your last request and its file
changes. /help lists commands and keys.
For scripts and CI, codewhale exec runs one task without the interface. By
default, --auto uses Full Access: tools run without asking, shell commands
have no Codewhale sandbox, and trust mode lets file tools write outside the
workspace. Add --sandbox workspace-write to keep the shell sandbox and
file-tool workspace restrictions, with trust mode off:
codewhale exec --auto --sandbox workspace-write "fix the failing tests and explain what changed"
Modes and permissions
A fresh install starts in Work mode with the Ask permission.
| Switch with | Options | |
|---|---|---|
| Mode | Tab (when the input is empty) or /mode |
Plan reads and searches but changes nothing. Work edits files and runs commands. Operate has the same access as Work, treats your request as a goal, and keeps going until the goal is verified or it needs input from you. |
| Permission | Shift+Tab |
Ask asks before every file edit and every shell command that is not read-only. Accept Edits applies file edits in your git repository without asking and still asks before commands. Auto-Review lets rules and a reviewer model approve routine calls and refuses high-risk ones; switch to Ask to approve those yourself. Full Access never asks and turns off Codewhale's sandbox; repository rules and managed policy still apply. |
See the modes and permissions guide for the details.
What it does
New in 0.10.2
/pet onturns your terminal into an animated whale that shows what the agent is doing, while the message box stays live. Its 980 particles spell the current step in English, Chinese or Japanese./workbar terminalshows the shells the agent is running as they run. Type into one, or pressCtrl+Nfor a shell of your own (macOS and Linux)./undotakes back your whole last request in one step, including every file it changed, and/diffworks in folders without Git.- When a plan is ready, Codewhale asks whether to start Work with Ask or Auto-Review, or keep planning.
/colorgives each chat its own composer color, saved with the session.web_searchcan use DeepSeek's new Search API: set[search] provider = "deepseek"with a DeepSeek key.- Outside Full Access, a
curlorwgetthat would upload a credential never runs without your approval, and a command that hides invisible Unicode is refused.writeno longer replaces a file the agent has not read, or one that changed after it read it.
Models
More than 40 providers are built in, including Anthropic, OpenAI, DeepSeek,
Google, Mistral, Moonshot, OpenRouter, and xAI. Any OpenAI-compatible endpoint
works, and so do local models through Ollama, vLLM, or SGLang. The default is
DeepSeek's deepseek-flash, which DeepSeek moved to DeepSeek-V4.1-Flash-1017
on 2026-10-17; 0.10.1 runs it without an update
(details).
/model switches models between turns, and /model auto picks one for each
turn (/router sets up how). /turn inspect shows which model a turn used,
what it cost and how long it took. codewhale auth chatgpt lets you use a
ChatGPT plan instead of an API key (experimental). See
Providers.
Receipts and undo
/receipts, or codewhale receipts --last after you quit, lists the files
changed, commands run, web and MCP calls, agents started, approvals and who
gave them, and failures. /undo takes back your last request and the files it
changed, in one step and without trust mode. /restore
rolls the whole workspace back to an earlier snapshot; because that overwrites
later edits, it needs /trust on or Full Access. See Receipts.
Exec runs that offer tools are saved in every output format, so
codewhale receipts --last works after exec --auto, including --json.
Answer-only text and --json runs are saved only when resuming or when
conversation compaction starts; use --output-format stream-json to always
save them for receipts or exec --continue.
Longer work
/goal sets an objective that carries across turns. Codewhale can split work
across sub-agents, run a fleet of agents,
or follow a workflow checked into the
repository.
Coming from another agent
Codewhale reads AGENTS.md on its own. Instruction files written for other
tools, such as CLAUDE.md, .cursorrules, or
.github/copilot-instructions.md, load only when you opt in with
project_instruction_imports = ["claude"] (or "cursor", "cline",
"windsurf", "copilot", "all") in your config; see
config.example.toml. Codewhale warns when it finds one
it did not load.
/import-claude prepares an import of your Claude Code settings and MCP
servers for you to review. /plugin install accepts Claude Code plugins
containing skills, commands, agent profiles, and MCP servers, and refuses
plugins that need hooks or LSP servers
(details).
Extensions
Connect MCP servers, add skills and
plugins, and run hooks on session and tool
events. Code mode (experimental, on by default) lets the model write one
execute_tools program that calls several MCP and plugin tools; each call
still meets your approval rules and keeps its receipt. The independently installed Computer
Use plugin (experimental, macOS only) can observe
and operate other apps. It stays off until you review its access and enable it
(guide).
Ways to run it
| Command | What it does |
|---|---|
codewhale |
The interactive terminal app |
codewhale exec "…" |
One task without the interface. On its own it answers without using tools; --auto enables tools with Full Access by default, --sandbox workspace-write restricts them, and --output-format stream-json streams events as JSON |
codewhale web |
A local web UI on 127.0.0.1 (guide) |
codewhale review --pr N |
An advisory review of a GitHub pull request. The GitHub bot setup generates a pinned workflow for automatic reviews and @codewhale review, using your own model key and optional App identity |
codewhale app-server --http |
The Runtime API, a local HTTP API for threads, events, approvals, and each turn's file changes |
codewhale serve --acp |
The Agent Client Protocol over stdio, for editors such as Zed |
The terminal app, exec, web, and the Runtime API share one engine
(architecture). A community-maintained
VS Code extension
connects to it from the sidebar (source).
A native desktop app built on the Runtime API is in development; it has no
public download yet.
Cost and accounts
Codewhale is free and MIT licensed. With your own API key you pay the provider
directly; local models need no key. The footer and /cost show what a session
has cost when the price is known, and an unknown price is shown as unknown,
never as free.
You don't need an account. Keys you add with /provider stay on your machine.
Safety and privacy
In Ask and Auto-Review, commands run in an OS sandbox where the system has
one: Seatbelt on macOS, and bubblewrap on Linux when it is installed.
Windows has no OS sandbox yet, and Full Access turns the sandbox off. Inside
the sandbox, shell commands cannot read credential stores such as ~/.ssh,
~/.aws and .env files; from 0.10.2 the same rule covers terminal sessions
and more file tools. /preview-request shows a redacted preview of the next
request without sending it.
Telemetry is on by default. It sends aggregate counts (version and platform,
session length and outcome, which built-in providers you used, feature and
error counts) with a random install ID that rotates every 90 days, and never
conversations, code, prompts, model names, file or repository names, or
credentials. codewhale config set telemetry false turns
it off. At startup Codewhale also
checks GitHub for a new release; set CODEWHALE_NO_UPDATE_CHECK=1 to skip
that. More in authorization order,
sandboxing, and telemetry.
Documentation
| Start here | Reference |
|---|---|
| Installation | Configuration |
| Providers and local models | Architecture |
| Modes and permissions | Runtime API |
| Keybindings | Plugin authoring |
| GitHub PR review | All documentation |
Community
If a provider is missing or a workflow is awkward, open an issue or send a pull request. Contributors keep credit for the work that lands, and the repository layout shows where things live.
Chat on Discord, or add the maintainer,
Hunter, on WeChat (hunterbown) and ask to join the Whale Brothers group.
History and license
Codewhale started as deepseek-tui and still reads that project's
configuration and sessions. It is independently maintained and not affiliated
with DeepSeek or any other model provider. Thanks to
everyone who has contributed.
MIT. Code adapted from other open-source projects is listed in the third-party notices.
Introduction
Open-source coding agent for your terminal, built in Rust and on a journey of continuous community improvement. Issues and PRs welcome.
Customize your domain