0.10.2 readiness: green main again, then release-blocking fixes

CHANGELOG.md

@@ -27,8 +27,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   from plugins stay on demand. Finishing an OAuth login reconnects just that
   server, and `/mcp reload` redials every server that is not `lazy` and reports
   how many are not connected out of the configured total.
-- Running shell commands open an inspector with their output and status, and
-  `Alt+V` opens the newest running shell (#6931).
+- Running shell commands open an inspector with their output and status. It
+  follows new output until you scroll back, and drops Stop once the command
+  ends. `Alt+V` opens the card you clicked, even after newer cards arrive or a
+  tool run collapses around it. `/jobs wait` and `/jobs poll` open the same
+  inspector instead of freezing the screen for up to 5 s, a shell row in the
+  work dock opens it too, and a task row opens `/task show` instead of failing
+  with "Job … not found" (#6931).
+- In `/setup`, `u` and `d` act only on the working-agreement step. Pressed on
+  another step they no longer close the wizard and switch your agreement off.
+- `/setup` no longer says "You're ready." when no model is connected; its last
+  step asks for a provider and lists the P and C keys it accepts. A rejected
+  API key's reason stays visible at narrow widths.
+- First run with a local Ollama model continues to the trust question and the
+  ready screen instead of ending onboarding, and the next launch no longer
+  starts onboarding again.
+- A turn that ended in failure reads as an error, live and after resume. Retry
+  notices stay in the transcript instead of flashing a red error that hid the
+  recovery.
+- File edits show as patches with their change summary once. Tool status
+  words read `done`, `failed` and `loaded, not run` everywhere, and a tool
+  that only loaded no longer gets a done check.
+- Delegated agents' cards name the tool they are running instead of
+  "Core tool <call id>".
+- Markdown: a line like `#6235 fixed it` is no longer a heading, headings
+  render inline code and emphasis, and tables draw one rule under the header
+  instead of one between every row.
+- The approval card shows its field labels and description in your language in
+  every locale, not only Simplified Chinese.
+- `/mode work` says "Switched to Work mode.", and `/zidong` says it switched to
+  Full Access. `/overview` and `/setup` call the mode Work.
+- The language screen points to `/config locale <tag> --save`, the Korean
+  Never chip says it allows nothing, and the elevation dialog's Abort says it
+  skips only that tool call.
+- Less work on the UI thread and less memory per turn:
+  - the context meter keeps its estimates for unchanged history;
+  - tool calls share the turn's history instead of copying it;
+  - compaction checks pressure with one pass;
+  - write_atomic sweeps a directory for stale temps at most hourly;
+  - the pet costs nothing while hidden.
 - `/resume`, `/load` and other session changes that cannot run yet now list
   what is still busy and how to stop it.
 - Sessions that ended without a clean exit show `interrupted` with their age
@@ -72,6 +109,10 @@ launcher guidance.
 
 ### Added
 
+- `/connect [<provider>]` signs in to a model provider that a plugin adds,
+  inside the TUI, and `/disconnect <provider>` removes that sign-in.
+  `/login` and `/logout` are for your Codewhale account only. Plugins that
+  ship a shell installer can be installed from the plugin view (#6950).
 - `codewhale auth claude` and `/auth claude` add Claude subscription sign-in
   to the existing Anthropic route, with protected owned credentials, refresh
   before requests, a provider-picker choice and local sign-out. API-key billing
@@ -210,6 +251,60 @@ launcher guidance.
 
 ### Fixed
 
+- Windows 10 1607 starts again. 0.10.1 stopped at load with 0xC0000139
+  because `DeriveCapabilitySidsFromName` is missing there; it is now resolved
+  at runtime (#6953).
+- `codewhale resume` no longer refuses a session whose saved history still
+  holds a raw sub-agent handoff (#6954).
+- A saved session over 8 MiB can be resumed and forked again. Journal entries
+  off the current branch are archived instead of refusing the session (#6955).
+- Snapshot restore and `/undo` work with older git, such as the 2.43 that
+  Ubuntu 24.04 ships. They failed there with "only one reference expected".
+- Cancelling your own background shell job no longer reports it as finished
+  or starts a new model turn. Cancelling a job that had already exited keeps
+  its real exit status instead of reading "killed, exit 0".
+- A shell command that moves to the background after 30 seconds shows the
+  same "keep running in /jobs" notice as `Ctrl+B`, and its card no longer
+  shows the instructions written for the model.
+- `todo_write` returns a short receipt (counts and the item in progress) to
+  the model instead of repeating the whole list on every call.
+- Goal usage counts the turn that completes, yields or blocks the goal, so
+  `tokens_used` and `time_used_seconds` no longer stay at 0. `update_goal`
+  accepts a progress estimate with `yield`.
+- Waiting on a running shell job reports how long ago it last printed and
+  whether it is still compiling or already running tests or the program.
+  Stopping a job from `/jobs`, and the completion the model then receives,
+  say whether build artifacts already on disk survive the kill (#6944).
+- A shell command that has printed nothing for a minute still reads as
+  running ("no output for 1m 05s"), keeps its Stop action and is reachable
+  through the Runtime API; only a job whose process is gone after a restart
+  is stale. `/jobs poll` and `/jobs stdin` no longer consume the output the
+  model has not read yet (#6931).
+- `/constitution`: `ratify` checks the digest you reviewed in `suggestions`,
+  so a file that changed after your review is refused as documented; `preview`
+  shows the block exactly as the model receives it; messages no longer claim a
+  ratify or migrate moves the prompt-cache prefix; the setup wizard no longer
+  lists an authority order that contradicts the base prompt, and it caps your
+  own note so saving never cuts its end. The Simplified Chinese manager uses
+  the glossary term 宪章 throughout.
+- The pet shows sub-agents while they run, and a finished one no longer stays
+  "working". Half-block pet sprites are drawn crisply instead of blurred.
+- A provider's retry delay is honored when a 429 carries it in the body
+  instead of a `Retry-After` header (#6923).
+- A Codewhale home reached through a symlink or Windows junction keeps saving
+  artifacts and compacting (#6947).
+- A workflow gate that blocks its own role is rejected when the plan is
+  admitted instead of deadlocking the run (#6945).
+- Auto-Review gives its guardian an output budget a reasoning model can think
+  inside.
+- Skills are deduplicated across roots by file, ignored-key warnings are
+  grouped, in-workspace skill links are followed, and `doctor` warns about a
+  dead `always_load` pin or an unrecognized bundled skill.
+- MCP servers reconnect when a session sync drops the eager connection pool.
+- The shared pet owner exits after ten minutes with no client.
+- Tool headers keep their clipped part visible at narrow widths, `/jobs`
+  prints plain exit codes and a three-line tail, and a collapsed tool output
+  shows a single hidden row instead of a "1 line omitted" marker.
 - ChatGPT sign-in omits the unsupported `originator` query parameter that
   caused an initial `invalid_authorize_request` rejection. PKCE, account
   binding and granted-scope validation remain in the same login flow
@@ -298,6 +393,23 @@ launcher guidance.
   deadline set by its first unsaved event. Tool heartbeats and store polls no
   longer restart that wait, and heartbeats are kept in memory only.
 
+### Known limits
+
+- Windows: when the previous app-server owner died without cleaning up, the
+  next start refuses with "Windows stale-owner recovery is not qualified" and
+  the stale publication has to be removed by hand. Unix recovers on its own
+  ([#6915](https://github.com/codewhale-hq/Codewhale/issues/6915)).
+- Idle CPU has not been measured on FreeBSD or Linux for this release
+  ([#6728](https://github.com/codewhale-hq/Codewhale/issues/6728)).
+- Models.dev prices with context tiers: a turn above a model's first tier can
+  be priced at its base rate. The bundled catalog has no tiered rows, so this
+  can only happen after a live models.dev refresh
+  ([#6396](https://github.com/codewhale-hq/Codewhale/issues/6396)).
+- Shell commands run by delegated agents appear in `/jobs` and the work dock
+  with their owner, not in the agent's own detail view; named terminal
+  sessions live in the terminal dock
+  ([#6931](https://github.com/codewhale-hq/Codewhale/issues/6931)).
+
 ### Maintenance
 
 - CI and test harness only, no change to the shipped binaries. The
@@ -308,10 +420,11 @@ launcher guidance.
 
 ### Contributors
 
-- **[@SparkofSpike](https://github.com/SparkofSpike)** — live network-policy updates and goal milestone hand-back ([#6928](https://github.com/codewhale-hq/Codewhale/pull/6928), [#6930](https://github.com/codewhale-hq/Codewhale/pull/6930)).
+- **[@LIghtJUNction](https://github.com/LIghtJUNction)** — plugin shell install and in-TUI plugin OAuth sign-in ([#6950](https://github.com/codewhale-hq/Codewhale/pull/6950)).
+- **[@SparkofSpike](https://github.com/SparkofSpike)** — live network-policy updates and goal milestone hand-back ([#6928](https://github.com/codewhale-hq/Codewhale/pull/6928), [#6930](https://github.com/codewhale-hq/Codewhale/pull/6930)), and a relocated Codewhale home ([#6947](https://github.com/codewhale-hq/Codewhale/issues/6947)).
 - **[@dajiaohuang](https://github.com/dajiaohuang)** — cache-write token accounting ([#6913](https://github.com/codewhale-hq/Codewhale/pull/6913)).
 - **[@gaord](https://github.com/gaord)** — embedder telemetry surface support ([#6916](https://github.com/codewhale-hq/Codewhale/pull/6916)).
-- **[@Lstarsky0](https://github.com/Lstarsky0)** — localized profile replies ([#6919](https://github.com/codewhale-hq/Codewhale/pull/6919)).
+- **[@Lstarsky0](https://github.com/Lstarsky0)** — localized profile replies ([#6919](https://github.com/codewhale-hq/Codewhale/pull/6919)) and workflow gates that block their own role ([#6952](https://github.com/codewhale-hq/Codewhale/pull/6952)).
 - **[@jayanthvee](https://github.com/jayanthvee)** — Windows npm launcher guidance ([#6906](https://github.com/codewhale-hq/Codewhale/pull/6906)).
 - **[@asto18089](https://github.com/asto18089)** — callback-window reference fix for longer browser sign-in waits ([#6865](https://github.com/codewhale-hq/Codewhale/issues/6865)).
 - **[@BX166](https://github.com/BX166)** — reported three provider failure modes measured on AICraft's own traffic: a cold model that reads as a dead connection, a listed model that fails on every call, and a response cut at the output ceiling that reports `stop` ([#6889](https://github.com/codewhale-hq/Codewhale/issues/6889)).

crates/config/src/user_constitution.rs

@@ -43,10 +43,11 @@
 //!   silently. [`UserConstitution::migrate_file`] writes a backup first so
 //!   [`UserConstitution::rollback_file`] can restore the pre-migration bytes.
 //! - **The prompt projection is byte-stable.**
-//!   [`UserConstitution::cache_projection`] returns exactly the bytes that enter
-//!   the cache-stable prompt prefix plus their digest and measures. Suggested
-//!   clauses, preserved unknown fields, and schema metadata are all outside it,
-//!   so recording advice never invalidates a prompt cache.
+//!   [`UserConstitution::cache_projection`] returns exactly the bytes the model
+//!   receives (as a session message at turn admission, outside the cache-stable
+//!   prompt prefix) plus their digest and measures. Suggested clauses,
+//!   preserved unknown fields, and schema metadata are all outside it, so
+//!   recording advice never changes what the model receives.
 
 use std::collections::BTreeMap;
 use std::fmt::Write;

crates/localization/locales/ca.json

@@ -799,6 +799,7 @@
   "ClipboardSentToTerminal": "S'ha enviat al porta-retalls del terminal (els terminals no ho confirmen)",
   "ClipboardCutKeptText": "S'ha enviat al porta-retalls del terminal; el text es manté perquè els terminals no confirmen les còpies",
   "ClipboardNothingToPaste": "No hi ha res per enganxar: el porta-retalls és buit o no s'ha pogut llegir",
+  "ClipboardCopyFailed": "Ha fallat la còpia al porta-retalls: {error}",
   "KbContextMenu": "Actua sobre el que hi ha sota el punter: copia, enganxa, obre els detalls o un file:line a l'editor, enfoca o atura un agent",
   "KbPointerScroll": "Desplaça la transcripció; sobre el redactor, mou el cursor línia a línia",
   "KbPointerClick": "Activa la fila, el xip o el bloc d'eina sota el punter",
@@ -914,7 +915,7 @@
   "HomePlanModeChecklistTip": "  Presenta un pla i el progrés de tasques, després canvia a Act o Operate",
   "HomeGoalModeTip": "Seguiment d'objectius - Defineix /goal <objectiu> per perseguir objectius",
   "OnboardLanguageTitle": "Tria l'idioma",
-  "OnboardLanguageBlurb": "Tria l'idioma de la interfície. El pots canviar en qualsevol moment amb `/settings set locale <tag>`.",
+  "OnboardLanguageBlurb": "Tria l'idioma de la interfície. El pots canviar en qualsevol moment amb `/config locale <tag> --save`.",
   "OnboardProviderTitle": "Tria el teu proveïdor de models",
   "OnboardProviderBlurb": "Tria on s'executa el teu model. Els proveïdors allotjats necessiten una clau; els runtimes locals poden continuar sense.",
   "KimiCodePlanApiKeyHint": "Per als plans de membresia de Kimi Code, crea la clau vinculada al pla a {console}.",
@@ -1019,7 +1020,6 @@
   "SetupStepConstitutionWhy": "Aquest acord guia el comportament, no els permisos d'execució.",
   "SetupStepVerificationTitle": "Revisió",
   "SetupStepVerificationWhy": "Resumeix l'estat de Setup i mostra quins passos estan verificats, omesos o encara calen acció.",
-  "SetupCheckpointLayerOrder": "Ordre de capes: constitució inclosa -> constitució global d'usuari -> constitució del repo -> instruccions AGENTS/del projecte -> memòria/handoff -> petició actual.",
   "SetupCheckpointDoneBundled": "Punt de control de la constitució complet: s'usa la llei inclosa/per defecte.",
   "SetupCheckpointDoneGuided": "Constitució ratificada — la teva llei permanent s'ha desat. Esmena-la en qualsevol moment amb /constitution.",
   "SetupCheckpointDoneKept": "Constitució conservada — la teva llei existent continua vigent, sense canvis. Esmena-la en qualsevol moment amb /constitution.",
@@ -1230,7 +1230,6 @@
   "ApprovalIntentLabel": "Intenció: ",
   "ApprovalMoreLines": "  … (+{count} línies)",
   "ApprovalAutoDeniedSession": "{tool} denegat automàticament: ja has denegat una sol·licitud coincident en aquest torn. Envia un missatge nou perquè se't torni a preguntar.",
-  "ElevationTitleSandboxDenied": "  ⚠ Sandbox denegat ",
   "ElevationTitleRequired": " Cal elevació del sandbox ",
   "ElevationFieldTool": "  Eina: ",
   "ElevationFieldCmd": "  Cmd:  ",
@@ -1314,6 +1313,10 @@
   "ToolReceiptDone": "fet",
   "ToolReceiptLinesSingular": "1 línia",
   "ToolReceiptLinesPlural": "{count} línies",
+  "TodoStatusPending": "pendent",
+  "TodoStatusInProgress": "en curs",
+  "TodoStatusCompleted": "completada",
+  "TodoStatusCancelled": "cancel·lada",
   "CmdVoiceDescription": "Commuta l'entrada de veu: grava veu i transcriu-la al compositor",
   "CmdVoiceSendDescription": "Commuta l'enviament per veu: digues \"send it\" per enviar",
   "CmdVoiceControlDescription": "Commuta el control per veu: dictat que coneix l'esborrany",
@@ -2455,7 +2458,7 @@
   "NotificationElevationNeeded": "Permet o denega l'accés elevat per a '{tool}'",
   "NotificationDecisionWebHint": "Decideix aquí o al web.",
   "NotificationTurnFailed": "El torn ha fallat",
-  "NotificationProviderFallback": "S'ha canviat a {provider} (alternativa {position}/{total}) després d'un error recuperable del proveïdor.",
+  "NotificationProviderFallback": "S'ha canviat a {provider} (alternativa {position}/{total}), després d'un error recuperable del proveïdor.",
   "ApprovalNeverPostureBlocked": "S'ha bloquejat '{tool}': aquesta sessió no permet eines que requereixen aprovació.",
   "NotificationWebApproved": "Aprovat al web.",
   "NotificationWebDenied": "Denegat al web.",