The website already carries the new Codewhale mark (PR #5734:
web/app/icon.svg and its raster derivatives). Bring the remaining
in-repo brand surfaces onto the same source so they match in style.
- crates/tui/src/runtime_web/codewhale-192.png: regenerated from the
canonical web/public/icon-512.png at 192x192 (RGBA). Served at
/assets/codewhale-192.png by runtime_api and used by the runtime web
client's brand mark and empty-state mark; no manifest lists sizes.
- extensions/vscode/media/codewhale.svg: the activity-bar view-container
icon. VS Code renders it as an alpha mask in the theme foreground, so
this is the traced whale silhouette only (same path as web/app/icon.svg,
viewBox cropped square around the whale). No defs, script, or
foreignObject.
- extensions/vscode/media/icon.png + package.json "icon": the marketplace
listing icon (256x256 RGBA, resized from web/public/icon-512.png). The
extension previously declared no marketplace icon.
- crates/tui/src/integrations/dsh/brand.js: the DSH brand lockup's inline
SVG was still the retired Signal Current mark; it now carries the tile
gradient and whale path from web/app/icon.svg. The dsh tests that
pinned the old paths and the 24px svg rule follow the new mark.
Signed-off-by: CodeWhale Bot <hmbown@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: CodeWhale Bot <bot@codewhale.net>
Promotes the fully gated non-benchmark candidate while preserving the benchmark tree exactly from the prior release-PR head.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Version surfaces moved together: workspace Cargo.toml, all 21 crate
dependency pins, Cargo.lock (workspace crates only — zero external changes),
CHANGELOG slice with the 0.9.10 section and compare link, crates/tui
CHANGELOG sync, web facts (derive-facts), npm/codewhale, npm/runtime-sdk,
extensions/vscode, and the remote-smoke default tag.
check-versions.sh: 0 errors. This is the candidate label only — no tag, no
package publication, no release creation.
Internal path-dependency versions, package locks, the tui CHANGELOG
slice and its root compare link, provider label facts for Google and
Antigravity, and the remote-smoke default tag. scripts/release/check-
versions.sh --require-dated-release passes locally.
The release gate caught npm/codewhale, npm/runtime-sdk, and the vscode
extension still on 0.9.7 (and codewhaleBinaryVersion, which resolves
which release assets the wrapper downloads). All now 0.9.8.
Release prep for v0.9.7:
- Bump the workspace, per-crate pins, npm wrapper, and lockfile to 0.9.7.
- Finalize the [0.9.7] CHANGELOG entry: Grok 4.6 as the ordinary catalog
default, OrcaRouter as a named provider, the session snapshot/recovery
split, canonical message copy, and the RUSTSEC-2026-0253 lru/ratatui-core
fix. All factual claims in the entry were checked against the code.
- Document the known parallel-load flake
exec_persistent_service::failed_exec_kills_pending_service_and_exits_nonzero
("service pid file never appeared"); it passes in isolation and is
unrelated to any v0.9.7 change.
- Regenerate the TUI changelog slice and web/lib/facts.generated.ts.
Gates run on this tree: cargo fmt/check/clippy clean; the full workspace
suite completed with --no-fail-fast and exactly one failure (the documented
flake, passing in isolation); publish-crates.sh dry-run and the npm wrapper
smoke passed; the release binary reports 0.9.7 and `codewhale model resolve
grok` resolves grok-4.6 on provider xai.
Release preparation assisted by CodeWhale, following docs/RELEASE_CHECKLIST.md.
Bump the workspace, every published crate, the npm CLI package and its
codewhaleBinaryVersion, the runtime SDK, and the VS Code extension to 0.9.6 —
the four version sources the release workflow cross-checks before it will
tag.
The changelog entry describes v0.9.6 as what it is: a subtractive release.
The guards that interrupted live work, the per-mode prompt doctrine, and the
deterministic second compaction system are gone; a truncated provider
response can no longer be recorded as a finished answer. Most of these were
found by running v0.9.5 against Terminal-Bench 2.1 beside Pi 0.8.41 on the
same model, effort, endpoint, and task digests, then reading the trials
Codewhale lost — so the entry names those trials rather than describing the
fixes in the abstract.
Mistral AI ships in this release; Xavier Pestel (@xavierpestel-ai) is
credited in the contributors section for #5295.
Bump every tagged package and internal dependency pin to 0.9.5, refresh Cargo and npm lock records, regenerate the packaged changelog and web facts, and record the user-visible candidate contract. The changelog deliberately remains marked Unreleased candidate until the rebuilt binary is dogfooded and publication is explicitly approved.
The extension shipped its own slate/sky whale that existed nowhere else in
the product. The canonical mark is Signal Current — `web/app/icon.svg` and
the WHALE_BODY / WHALE_CURRENT constants in `web/components/whale.tsx`,
described there as "from the managed Codewhale product contract."
Replaced with the canonical paths (verified byte-identical to icon.svg) on
the product color tokens: signal gold #F6C453 and current cyan #48D7FF.
A comment names the two other copies so the next person keeps all three in
step rather than inventing a fourth.
`/health` and `/v1/runtime/info` are intentionally unauthenticated, so a
token-protected runtime answers both with 200. The extension read that as
success and showed "Connected" — then every `/v1/*` fetch failed with 401
and the view sat there empty with no explanation.
The info body already carries the real signal (`auth_required`, see
crates/tui/src/runtime_api.rs). Read it: no token plus `auth_required`
now reports auth-required and names the setting that fixes it.
Audited the rest and found it sound: all six contributed commands are
registered and implemented, activationEvents match, `serve --http --host
--port --auth-token` all exist in the real CLI, the default port matches,
the docs URL target exists, timeouts degrade to an honest offline state,
and the webview CSP/nonce/escaping hold.
Verified by Kimi K3 against a live runtime rather than a passing compile:
no token -> auth-required; with token -> connected, version 0.9.4; nothing
listening -> offline; threads parse with keys matching the TS interface.
`vsce package` produces a clean 12-file vsix, rebuilt here to confirm.
Not verified anywhere: rendering inside a real VS Code host. The data
paths and command wiring are exercised, but webview layout and status-bar
placement need `code --install-extension` on a machine with the CLI.
extensions/vscode was 0.8.53, npm/runtime-sdk 0.8.60, and the
verifiers README claimed v0.9.1 while the workspace is 0.9.4. All
three now read 0.9.4. The release.yml version gate previously checked
only workspace + npm/codewhale, which is how the drift survived
release prep; it now also requires runtime-sdk and vscode package
versions to match the tag.
Evidence: cross-surface-tech-debt-audit-2026-08-03.md TL;DR 'Stale
version strings'; §11.3 version-sweep row.
Gate: node -p require(...).version -> 0.9.4 for both packages.
Apply `npm audit fix --package-lock-only` across npm workspaces to
resolve the 17 open Dependabot alerts (7 high, 10 moderate) on the
v0.9.1 merged tree:
- integrations/feishu-bridge: protobufjs 7.6.4 → 7.6.5
- extensions/vscode: brace-expansion 5.0.6 → 5.0.7, js-yaml 4.2.0 → 4.3.0,
fast-uri 3.1.2 → 3.1.4, linkify-it 5.0.1 → 5.0.2
- web: brace-expansion/js-yaml and other transitive dev deps updated to
patched versions; build, lint, tests, and `check:facts` still pass
- root package-lock: refreshed transitive lockfile metadata
Remaining npm audit findings:
- sharp <0.35.0 (via miniflare/next/wrangler) in web and root: no
non-breaking patch available; miniflare pins sharp 0.34.5. Website is
not deployed for v0.9.1, so exposure is build-time only.
- axios in feishu-bridge lockfile is already resolved to 1.18.1; the
Dependabot alerts appear stale against the current lockfile.
All affected workspace checks pass:
- integrations/feishu-bridge: `npm run check && npm run test` — 19 passed
- extensions/vscode: `npm run check` — compiles
- web: `npm run prebuild && npm run check:facts && npm test && npm run lint
&& npm run build` — green
Refs #4713
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Integrate the underwater TUI, message-first Operate, Fleet and Workflow reliability, expanded model/provider catalog, exact custom-route restoration, docs-first site, localization, packaging, and release metadata for the v0.9.0 candidate.
Harden endpoint-bound credential provenance, approval and goal UX, Fleet attempt fencing and crash recovery, large-workspace mention discovery, Kimi budgeting, and release asset/version gates. Include the stopship Fleet and Workflow fixtures used by release dogfood.
Verified with workspace fmt/check/clippy/tests on Rust 1.88, release-script and npm suites, 18-crate publish dry run, production web build, Docker build check, secret scan, dependency audit, and protected-state hash validation.
Bump Wrangler in the root and web package manifests so Miniflare resolves patched Undici, update the VS Code extension lockfile's transitive Undici, and refresh the web DOMPurify lock entry. Verified npm audit is clean in root, web, and extensions/vscode.
Add read-only workspace and branch metadata to runtime thread summaries so VS Code Agent View can show when a thread lane is on another branch. Non-git workspaces return null branch metadata instead of failing.
Refs #2580, #2721.
Credits the existing branch-visibility trail from #1217/#2341 in the changelog.
Harvests the safe Phase 0 VS Code lane from PR #1022 and the Agent View request in #2580 while keeping chat webviews, inline edits, Agent View, and retry/undo runtime endpoints out of this slice.
Credits @lbcheng888 for the earlier extension scaffold and @AiurArtanis plus the v0.9 GUI/VS Code reporters for the request trail.
