[dependabot]

Bumps codewhale-hq/Codewhale from c2a4872 to b92540d.

Changelog

Sourced from codewhale-hq/Codewhale's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Runcrate is a bundled provider: runcrate reaches the OpenAI-compatible host at https://api.runcrate.ai/v1 with RUNCRATE_API_KEY, and model ids come from its public GET /v1/models listing. Thanks @​heydryft for the request and the vendor details. (#7085)

• MCP connection status reaches the model: one existing history snapshot now records permitted configured, connecting, failed, authorization-required, unknown and connected servers, with bounded inert names and no raw errors. Stale status and server guidance are withdrawn on contention, configuration/scope changes and restore; observation does not connect servers or promise callable tools. (#6866)

• Bundled-skill policy: [skills.bundled] separates automatic, authoritative and disabled installation from discovery, with per-name selection, disable and explicit-only controls. Aliases share policy; disabled shipped copies reveal user alternatives. Modified and managed files remain intact, and doctor plus /skills inspect show the effective policy. (#7066)

• Configurable skill routing index: [skills] listing_max_description_chars and listing_budget_fraction control the shared parent/child catalogue. Defaults stay 400 characters and 5% of the route window, within the existing total bounds. Load warnings, localized inspect notes and /context explain shortening; full skill loading stays available. (#7073)

• Compact approvals keep their authority visible: cards show three choices and default to Deny. An exact saved rule requires its scope preview on screen. Shortcuts for additional actions require opening Details; a hidden saved-rule choice never falls back to granting the session.

• Quicker everyday navigation: top-level help separates everyday and advanced commands, doctor --all expands path/backend details, and the launch screen labels how to resume recent work. Up selects the newest recent session. Whale cameos stay out of transcript text.

• Session-window diagnostics: the audit log records when a saved window starts a new journal root while retaining the previous branch, helping distinguish window replacement from lost durable history. session.window.rerooted now names a cause (engine_projection, session_restore or unattributed) and also fires when a journal with entries has no active path. (#7142)

• Usage reporting counts models, tokens and tools: when usage reporting is on, each session now also reports, per provider and model, its turns by outcome, input, output and prompt-cache tokens, and turn-time buckets, plus how many times each built-in tool ran and failed. A model is named only when it is in Codewhale's bundled public model catalog; custom, local and fine-tuned names are sent as other, and MCP and plugin tools as mcp or other. No prompts, outputs, tool arguments or paths are sent. Runs under CI or the GitHub Action report the ci session source. The first-run notice is shown once more to describe this. DO_NOT_TRACK=1 now turns usage reporting off for that run, like CODEWHALE_TELEMETRY=0; codewhale config set telemetry false still turns it off for good. See docs/TELEMETRY.md.

• exec and doctor follow the TUI onto local Ollama: with no cloud key and no explicit route, codewhale exec uses a running local Ollama chat model and says so, and codewhale doctor --probe-local checks that route. Nothing is saved. (#7115)

• Thinking starts at auto: new configurations and the built-in default use reasoning_effort = "auto" instead of max; an effort you set is never changed.

• DSH Git review scopes: the extension host brokers bounded, read-only Git metadata to reviewed DSH plugins through a new git_review_scope action (extension-host policy v8).

• Safer uninstall: program removal never edits shell profiles; matching Codewhale PATH blocks are reported for manual cleanup. Data purge requires a receipted removal in the same confirmed run. Both Unix installers reject unsafe or managed destinations before creating them and keep shell profiles unchanged. Uninstall instructions now match the explicit-home purge scope in English and Chinese.

• Nested and deletable threads (Runtime API): a fork (including a backtrack fork) records parent_thread_id, POST /v1/threads accepts one naming an existing thread, and GET /v1/threads/summary returns it so clients can nest child conversations. DELETE /v1/threads/{id} removes an idle thread with its turns, items, events and goal, and its saved session unless another thread shares it or a terminal holds it open; a running thread answers 409.

• Hunk actions in Review (Runtime API): POST /v1/git/stage, /v1/git/unstage and /v1/git/discard take a patch holding hunks of the one path in paths and apply only those hunks through git apply, under the same expect preconditions as whole-path writes. A patch that no longer applies fails with git's message and writes nothing; renames, mode changes and binary patches are refused. The tasks tool can also suggest a task, shown as a Start/Hide card, without starting anything.

• Live /models ceilings reach the route: a provider that states per-model context and output limits in its own /models body now keeps them instead of falling back to the legacy 128K window. OpenAI limit blocks, flat context_length / context_window / max_model_len / max_context_length fields, max_output_tokens / max_completion_tokens, and a relay metadata block (context_limit, context_budget, output_budget) are read; metadata.context_limit outranks context_budget because the first is the model capability and the second the share one deployment accepts. Each field is parsed on its own, so an unreadable one costs only its own candidate instead of hiding the readable fields below it.

• Change mode and permissions while the agent works: Tab, Shift+Tab, /mode, the hotbar and /config mode no longer refuse while a turn is running. A response that is already streaming is not restarted; the change applies at the agent's next step in the same turn (before its next tool batch, at every approval gate, and before its next model request, which carries the new mode notice). The status line says so until it applies. A call still waiting for approval goes back to the model under the new posture, and a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends.

• Steering interrupts thinking: a steer (Ctrl+Enter, or Enter twice after queueing) now closes the in-flight model request at once, whether the model is waiting on headers, reasoning, writing text or emitting a tool call, and continues the same turn with your message. Text already shown is kept as interrupted output; unfinished reasoning and partial tool calls are discarded, never run.

• Modern MCP client: MCP servers now connect through the official MCP SDK (2.4) behind Codewhale's Rust broker by default (mcp_backend = "host"; "rust" stays available for one release). Servers that speak the 2026-07-28 revision are discovered with server/discover; other stdio and HTTP servers fall back to the legacy initialize handshake, and configured SSE servers keep theirs. Rust keeps process, network, credential, catalog, approval and cancellation authority.

• DeepSeek Harness plugins: reviewed DSH plugins (definition API pinned to DSH 0.2.1-rc.2 in a shared compatibility table) run in the Native extension host. Tool output is validated against its declared schema, unsupported options are refused instead of ignored, and plugin commands can submit a prompt with visible plugin attribution. Terminal command receipts are kept in thread snapshots without entering model history. Changing the compatibility table invalidates earlier trust. A newly enabled plugin's tools are offered on the first turn: the turn waits up to 10 seconds for the plugin host to finish loading instead of adding them only from the next turn. Plugin UI views stay disabled, and the import receipt says why: WebKit's network restrictions do not stop WebRTC, so plugin UI waits for an isolated renderer. A plugin tool can call ctx.sessions.flush(exec.agent.session) to have the Engine save the conversation so far before it continues (Runtime, terminal and exec sessions); it reports failure instead of claiming a save. Installing a plugin whose bytes changed after review now returns a 409 conflict instead of a server error. A plugin tool can ask you a question with ctx.userQuestions.ask and gets back the options you picked, your own text, or a skip; the question shows like any other Codewhale question in the terminal and through the Runtime API. A plugin tool can start a child agent with ctx.subagents.startActivation (the spawn provider): the child runs through Codewhale's own sub-agent manager, needs the same approval as the model's agent tool, can carry an extra persona section and a narrower tool list set in its agent/created handler, and returns its result to the plugin.

• MCP catalogs stay fresh: a server's tools, resources, prompts and skills are rediscovered on their own connection when an advertised ttlMs expires or the server sends a list-changed notice. A tool resolved against the old catalog is refused with "retry the call", a removed tool cannot run, and a failed refresh reconnects instead of serving stale entries. Catalogs are never shared across servers, credentials or reconnects.

• MCP Skills extension: servers that advertise the published Skills extension have their skills listed in list_mcp_resources. Listing never activates a skill, and reading a skill file is refused unless its size and sha256 digest match the listing. MCP skills do not yet join /skills.

• Updates install themselves: release-binary installs check for a new release every 6 hours (was 1), download and checksum-verify it in the background, and apply it the next time codewhale starts, never during a session. One line says Updated to v… · What's new: … · Undo: codewhale update --rollback. Until releases are signed, the download waits for your OK (one [y/N] question at the next start, or /update install); a release with a valid Ed25519 manifest signature applies on its own. codewhale update --rollback puts back the version the last update replaced and keeps the rolled-back version from returning automatically. Turn it down with codewhale config set update.mode notify (or off, or CODEWHALE_UPDATE_MODE); an organization's root-owned policy.toml overrides both. Offline and rate-limited checks retry about an hour later instead of on every launch. Package-manager and desktop-app copies only get their manager's command. Builds with the release key refuse a missing or invalid signature, and re-check the staged binary against the signed manifest at start. The checksum manifest now always comes from GitHub Releases; on Linux x64 the CNB mirror can still serve the binary, but only bytes that GitHub's manifest lists.

• One view of every Codewhale on the machine: codewhale doctor has an Installations section and codewhale doctor --installs (--json, --brief) lists every codewhale, codew, codewhale-tui, deepseek and deepseek-tui with its owner: install receipt, package manager (with its exact removal command), the desktop app, a backup, or not ours. Nothing found is ever run. codewhale doctor --fix adds one plan to tidy them: old backups move to ~/.codewhale/recovery/<stamp>/ (kept 30 days, then deleted by a later --fix), an unreceipted codew is brought in line with codewhale, and the directory gets an install receipt; each move prints its undo and codewhale doctor --restore <stamp> reverses the lot. Package-managed, desktop-app, symlinked and foreign files are never touched, and neither is user data. codewhale uninstall now lists other copies with the same classification.

• Uninstall guidance on every install route: codewhale uninstall previews receipt-owned release files and --yes removes only checked files, with the running command last. Both Unix installers and the Windows archive installer record command ownership; self-update renews existing receipts on both. On Windows the running codewhale.exe is renamed and deleted once the command exits. Package-managed copies are left alone, and the command prints their exact removal command: npm with its prefix, Cargo with its root, the Homebrew formula, scoop uninstall codewhale, winget uninstall --id HunterBown.CodeWhale, or the Windows setup's Uninstall.exe. Every other codewhale/codew still on PATH is listed. User data is kept unless you add --purge-data. With --yes it runs only after a receipted installation was removed in that same run, and then deletes only ~/.codewhale (or a CODEWHALE_HOME named .codewhale) and ~/.deepseek/snapshots, refusing symlinks, home ancestors and directories owned by another user. A copy from an older curl | sh installer that wrote no receipt is adopted on --yes when it sits in a known older curl-installer directory: the commands byte-identical to the running program get a receipt and are removed, anything else is preserved, and a symlink or hard link among them stops adoption before any receipt is written. Windows removal is compile-checked but not yet exercised on a Windows host. (Refs #7091)

• GitHub Action reviews: analysis can export a structured Engine review for a separate trusted publisher job. The publisher checks the current PR revision and line anchors, deduplicates its findings, and keeps uncertain or preexisting claims out of inline comments.

• DingTalk bridge: an optional internal-app Stream adapter reuses the same Engine, shared admission and approval helpers. Tenant/staff allowlists, durable acceptance before acknowledgement and retained uncertain deliveries protect recovery. Managed account linking is separate from this advanced self-hosted bridge.

• Answerless output-limit recovery: opt into [reasoning_only] on_output_limit = true to request an answer again after a length stop with no answer or tool call, including hidden reasoning and ordinary Fleet workers. Retries share max_reprompts, retain existing output and control limits, and record request-scoped nudge receipts without adding them to resumed conversation context. RLM keeps its existing stop protocol. Thanks @​M-Maciej for the long-proof Fleet report. (#6990)

• OrcaRouter recommendation: /provider and /model offer a shared partner recommendation with the DeepSeek V4.1 Flash 30% top-up-match link, public referral disclosure and localized offer details. F7 or a click opens the existing pager while retaining the current route.

• Per-scope instruction budgets: global and project standing instructions now have separate token budgets (100,000 estimated tokens each, capped at 25% of the usable context window), every trim, skip or refusal reaches the model and /context report, and [instruction_budget] policy = "refuse" stops a request before dispatch. Other tools' instruction files stay opt-in through project_instruction_imports or claude_fallback, and the table is user config only. Thanks @​7jrxt42BxFZo4iAnN4CX for the design and implementation. (#6526, #7086)

• The TUI Terminal dock now also shows the model's shell commands for the session: each running or recent command is a read-only tab with its live output, beside the interactive shells. "No live terminals" appears only when there are neither.

• Preview: dispatch --computer starts an account cloud conversation that can also be opened in desktop. --thread continues or inspects it; --stop, --approve and --deny control its current task. Explicit --key-stdin installs provider access in the running computer's memory. Retries retain one operation key and the account/VM binding. Existing Agent Work dispatch

... (truncated)

Commits

• b92540d test(engine): give the user-input probe a timer gap Windows cannot eat
• 84acb83 test: refresh the providers golden and install the paired window in two more ...
• fd9f06d fix(cli): gate the hashing module with the only module that uses it
• 36f058c docs: unlink intra-doc references to private items so the docs gate builds
• 3a02722 fix(release): publish codewhale-util before the crates that depend on it
• c96f4ed refactor(runtime): own the workspace drive lease and share its path helpers (...
• e31dcd4 refactor(runtime): own workspace trust, delivery files and session diagnostic...
• 41592ac ci(main): also allow a manual run of the landing gate
• 193cd7a ci(main): run the checked-in preflight on every push to main
• f285377 style: reformat the S2 rewrite sites and repoint the blocking-calls budget
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.