Version surfaces moved together: workspace Cargo.toml, all 21 crate
dependency pins, Cargo.lock (workspace crates only — zero external changes),
CHANGELOG slice with the 0.9.10 section and compare link, crates/tui
CHANGELOG sync, web facts (derive-facts), npm/codewhale, npm/runtime-sdk,
extensions/vscode, and the remote-smoke default tag.
check-versions.sh: 0 errors. This is the candidate label only — no tag, no
package publication, no release creation.
Internal path-dependency versions, package locks, the tui CHANGELOG
slice and its root compare link, provider label facts for Google and
Antigravity, and the remote-smoke default tag. scripts/release/check-
versions.sh --require-dated-release passes locally.
Release prep for v0.9.7:
- Bump the workspace, per-crate pins, npm wrapper, and lockfile to 0.9.7.
- Finalize the [0.9.7] CHANGELOG entry: Grok 4.6 as the ordinary catalog
default, OrcaRouter as a named provider, the session snapshot/recovery
split, canonical message copy, and the RUSTSEC-2026-0253 lru/ratatui-core
fix. All factual claims in the entry were checked against the code.
- Document the known parallel-load flake
exec_persistent_service::failed_exec_kills_pending_service_and_exits_nonzero
("service pid file never appeared"); it passes in isolation and is
unrelated to any v0.9.7 change.
- Regenerate the TUI changelog slice and web/lib/facts.generated.ts.
Gates run on this tree: cargo fmt/check/clippy clean; the full workspace
suite completed with --no-fail-fast and exactly one failure (the documented
flake, passing in isolation); publish-crates.sh dry-run and the npm wrapper
smoke passed; the release binary reports 0.9.7 and `codewhale model resolve
grok` resolves grok-4.6 on provider xai.
Release preparation assisted by CodeWhale, following docs/RELEASE_CHECKLIST.md.
Bump the workspace, every published crate, the npm CLI package and its
codewhaleBinaryVersion, the runtime SDK, and the VS Code extension to 0.9.6 —
the four version sources the release workflow cross-checks before it will
tag.
The changelog entry describes v0.9.6 as what it is: a subtractive release.
The guards that interrupted live work, the per-mode prompt doctrine, and the
deterministic second compaction system are gone; a truncated provider
response can no longer be recorded as a finished answer. Most of these were
found by running v0.9.5 against Terminal-Bench 2.1 beside Pi 0.8.41 on the
same model, effort, endpoint, and task digests, then reading the trials
Codewhale lost — so the entry names those trials rather than describing the
fixes in the abstract.
Mistral AI ships in this release; Xavier Pestel (@xavierpestel-ai) is
credited in the contributors section for #5295.
Bump every tagged package and internal dependency pin to 0.9.5, refresh Cargo and npm lock records, regenerate the packaged changelog and web facts, and record the user-visible candidate contract. The changelog deliberately remains marked Unreleased candidate until the rebuilt binary is dogfooded and publication is explicitly approved.
Date the v0.9.4 changelog, preserve contributor credit and unpublished-release truth, and synchronize every crate, npm, lockfile, smoke-test, and generated public-fact version surface. This prepares a source candidate only; it does not tag, publish, or create a release.
Signed-off-by: Hmbown <101357273+Hmbown@users.noreply.github.com>
Bump the Rust workspace, internal dependency pins, npm wrapper, lockfiles, public candidate facts, remote smoke default, generated site facts, and packaged changelog together.\n\nAdd dated release notes for DeepSeek V4 Flash Responses support, the canonical action cutover, safety and durability hardening, and contributor credit. Public published-release facts remain pinned to v0.9.2 until v0.9.3 assets actually exist.
Cuts the [0.9.2] - 2026-07-27 changelog band from [Unreleased] and
runs scripts/release/prepare-release.sh 0.9.2: workspace and crate
versions, internal dependency pins, npm package + binary version,
lockfile, remote-smoke default tag, README install examples, public
fact matrix source-candidate version, crate changelog sync, and
regenerated web facts. check-versions.sh confirms the set agrees.
This is local release preparation only: no tag, no publication, no
push to protected main.
Override Sharp to 0.35.3 in the root and web lockfile graphs, eliminating the inherited libvips advisories without changing provider or runtime behavior.
Validated with clean npm installs, zero-vulnerability audits, web tests/lint/build, and a Wrangler smoke.
Apply `npm audit fix --package-lock-only` across npm workspaces to
resolve the 17 open Dependabot alerts (7 high, 10 moderate) on the
v0.9.1 merged tree:
- integrations/feishu-bridge: protobufjs 7.6.4 → 7.6.5
- extensions/vscode: brace-expansion 5.0.6 → 5.0.7, js-yaml 4.2.0 → 4.3.0,
fast-uri 3.1.2 → 3.1.4, linkify-it 5.0.1 → 5.0.2
- web: brace-expansion/js-yaml and other transitive dev deps updated to
patched versions; build, lint, tests, and `check:facts` still pass
- root package-lock: refreshed transitive lockfile metadata
Remaining npm audit findings:
- sharp <0.35.0 (via miniflare/next/wrangler) in web and root: no
non-breaking patch available; miniflare pins sharp 0.34.5. Website is
not deployed for v0.9.1, so exposure is build-time only.
- axios in feishu-bridge lockfile is already resolved to 1.18.1; the
Dependabot alerts appear stale against the current lockfile.
All affected workspace checks pass:
- integrations/feishu-bridge: `npm run check && npm run test` — 19 passed
- extensions/vscode: `npm run check` — compiles
- web: `npm run prebuild && npm run check:facts && npm test && npm run lint
&& npm run build` — green
Refs #4713
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Promote the workspace, npm wrapper, internal crate pins, generated web
facts, mirrored changelogs, current docs, and the remote-smoke default
from 0.9.0 to 0.9.1.
The 0.9.1 changelog entry covers the local web client, OpenCode Go, the
xAI device-login restore, calendar-anchored hourly automations,
content-watch canonical draft identities, and the remaining runtime and
Windows fixes, with contributor credits for @h3c-hexin, @zhangweiii,
@sternelee, and @seanthefuturegorilla.
check-versions.sh passes; check-published.sh 0.9.1 reports nothing
published, as expected before release.
Signed-off-by: Hunter B <hmbown@gmail.com>
Integrate the underwater TUI, message-first Operate, Fleet and Workflow reliability, expanded model/provider catalog, exact custom-route restoration, docs-first site, localization, packaging, and release metadata for the v0.9.0 candidate.
Harden endpoint-bound credential provenance, approval and goal UX, Fleet attempt fencing and crash recovery, large-workspace mention discovery, Kimi budgeting, and release asset/version gates. Include the stopship Fleet and Workflow fixtures used by release dogfood.
Verified with workspace fmt/check/clippy/tests on Rust 1.88, release-script and npm suites, 18-crate publish dry run, production web build, Docker build check, secret scan, dependency audit, and protected-state hash validation.
- Bump npm/codewhale wrapper to 0.8.66
- Add root package name to package.json / package-lock.json
- Update docs/INSTALL.md v0.8.66 current-lane wording
- Update docs/V0866_RELEASE_LEDGER.md with current SHA/status
- Add v0.8.66 contributor band to docs/CONTRIBUTORS.md
- Clippy cleanup: struct-update syntax in config/tui tests,
type alias for fleet_setup builder tuple, working_set fs::rename
Bump Wrangler in the root and web package manifests so Miniflare resolves patched Undici, update the VS Code extension lockfile's transitive Undici, and refresh the web DOMPurify lock entry. Verified npm audit is clean in root, web, and extensions/vscode.
Add the v0.8.60 website feature spotlight, refresh install copy, sync the TUI changelog, and pin esbuild 0.28.1 across root/web lockfiles for the Dependabot advisory.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #3163.
Adds the @codewhale/runtime-sdk workspace with typed fleet Runtime API helpers, protocol-shaped TypeScript declarations, JSON/SSE event fixture handling, and typed RuntimeCapabilityError failures for create/event-stream endpoints that the Rust API has not exposed yet.
Documents the SDK contract in docs/RUNTIME_API.md and wires npm workspace verification through npm test --workspace @codewhale/runtime-sdk.
