diff --git a/CHANGELOG.md b/CHANGELOG.md index 3506205935..3b27bace9a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,10 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 parsed *before* and would not parse *after* — repairing an already-broken file is the commonest reason to edit source at all, so pre-existing breakage and new files fail open. The check precedes the write, so a rejection leaves - the file untouched and `apply_patch` cannot half-apply (#6204, #6206). + the file untouched and `apply_patch` cannot half-apply (#6204, #6206, #6151). - Rust files that were already `rustfmt`-clean are re-normalized after an edit, so the next patch's anchors still match. Hand-formatted files are never - rewritten, and every failure path skips and lets the edit land (#6205). + rewritten, and every failure path skips and lets the edit land (#6205, #6151). - Native clients can finish provider setup without dropping to the CLI: `DELETE /v1/providers/{id}/key` clears a Codewhale-owned credential through the same shared owner as `codewhale auth clear`, and `GET /v1/providers` @@ -60,9 +60,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 symlinks are never followed. A saved session's oversized tool outputs are served as artifacts at `GET /v1/sessions/{id}/artifacts` and `GET /v1/sessions/{id}/artifacts/{artifact_id}`. (#6163) +- A session that ended mid-turn is no longer invisible to the model. The newest + workspace-scoped session still holding a crash-recovery checkpoint is + surfaced as a one-line `## Prior Session` notice in the session-pinned prompt + prefix — metadata reads only, excluding the live session and any session this + process instance created. Clean sessions get no block, so their prefix bytes + are unchanged. Two bounded read-only tools, `session_search` and + `session_get`, give the model workspace-scoped recall over the same store + (one-line summaries and an 8-message tail, labeled untrusted user data, read + on the blocking pool). Resuming stays the user's decision: the hint tells the + model to offer a continuation, never to silently take one (#5715). +- `codewhale exec --hooks` opts a headless run into the same `HookExecutor` the + TUI builds — global config, reviewed plugin snapshots, and trusted project + `hooks.toml`. Headless runs previously fired no hooks at all. `tool_call_before` + can still deny and `shell_env` still applies; a hook `ask` resolves + fail-closed without a terminal. Fleet worker subprocesses never opt in, and + `permissions.toml` typed rules are unchanged (#6099). +- `codewhale doctor` flags fleet and profile model pins that the provider's own + roster no longer offers. A pin is reported only when a *fresh* cached live + roster for that exact route exists and omits it — stale, failed, or absent + rosters prove nothing and are counted as `unverifiable` rather than raising a + false warning. Each row names the route and every owner of the pin; the pin + is surfaced, never rewritten (#6035). ### Changed +- Configured MCP servers now connect lazily instead of all at session boot. The + pool owns a `connecting` set marked at spawn and cleared on resolution or + abort, so "connecting" is no longer inferred as enabled-minus-connected. The + boot pass scopes to the eager set — `required` servers plus those covered by + `tools.always_load` / `allowed_tools` — and a turn naming an unstarted server + spawns its connects alongside, under the existing five-second deadline. A + configured-but-unstarted server now reads as configured on every surface + (session-boot rows, Extensions tab, launch card), never as connecting. + `docs/MCP.md` documents the lifecycle (#6033). +- The launch card's MCP problems row runs its own remedy. It already printed + `/mcp login ` or `/mcp`; it now joins the shared paint/click/keyboard + ordering, so Up/Down lands on it and Enter or a click types the printed + command into the composer for you to send. Typing beats copying: no clipboard + dependency over SSH, and you see the command before a second Enter runs it + (#6085). + - Computer Use is the only computer-use product in Extensions and `/mcp recommendations`. Cua is no longer suggested as a parallel desktop-control MCP; enable the first-party `computer-use` plugin @@ -8747,7 +8785,7 @@ overflow report and `/theme` picker edge-wrapping patch in #1814. Older releases (v0.8.39 and earlier) are archived in [docs/CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md). -[Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.9.12...HEAD +[Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.9.13...HEAD [0.9.13]: https://github.com/Hmbown/CodeWhale/compare/v0.9.12...v0.9.13 [0.9.12]: https://github.com/Hmbown/CodeWhale/compare/v0.9.11...v0.9.12 [0.9.11]: https://github.com/Hmbown/CodeWhale/compare/v0.9.10...v0.9.11 diff --git a/crates/tui/CHANGELOG.md b/crates/tui/CHANGELOG.md index dac93236ce..abf942a085 100644 --- a/crates/tui/CHANGELOG.md +++ b/crates/tui/CHANGELOG.md @@ -28,10 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 parsed *before* and would not parse *after* — repairing an already-broken file is the commonest reason to edit source at all, so pre-existing breakage and new files fail open. The check precedes the write, so a rejection leaves - the file untouched and `apply_patch` cannot half-apply (#6204, #6206). + the file untouched and `apply_patch` cannot half-apply (#6204, #6206, #6151). - Rust files that were already `rustfmt`-clean are re-normalized after an edit, so the next patch's anchors still match. Hand-formatted files are never - rewritten, and every failure path skips and lets the edit land (#6205). + rewritten, and every failure path skips and lets the edit land (#6205, #6151). - Native clients can finish provider setup without dropping to the CLI: `DELETE /v1/providers/{id}/key` clears a Codewhale-owned credential through the same shared owner as `codewhale auth clear`, and `GET /v1/providers` @@ -60,9 +60,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 symlinks are never followed. A saved session's oversized tool outputs are served as artifacts at `GET /v1/sessions/{id}/artifacts` and `GET /v1/sessions/{id}/artifacts/{artifact_id}`. (#6163) +- A session that ended mid-turn is no longer invisible to the model. The newest + workspace-scoped session still holding a crash-recovery checkpoint is + surfaced as a one-line `## Prior Session` notice in the session-pinned prompt + prefix — metadata reads only, excluding the live session and any session this + process instance created. Clean sessions get no block, so their prefix bytes + are unchanged. Two bounded read-only tools, `session_search` and + `session_get`, give the model workspace-scoped recall over the same store + (one-line summaries and an 8-message tail, labeled untrusted user data, read + on the blocking pool). Resuming stays the user's decision: the hint tells the + model to offer a continuation, never to silently take one (#5715). +- `codewhale exec --hooks` opts a headless run into the same `HookExecutor` the + TUI builds — global config, reviewed plugin snapshots, and trusted project + `hooks.toml`. Headless runs previously fired no hooks at all. `tool_call_before` + can still deny and `shell_env` still applies; a hook `ask` resolves + fail-closed without a terminal. Fleet worker subprocesses never opt in, and + `permissions.toml` typed rules are unchanged (#6099). +- `codewhale doctor` flags fleet and profile model pins that the provider's own + roster no longer offers. A pin is reported only when a *fresh* cached live + roster for that exact route exists and omits it — stale, failed, or absent + rosters prove nothing and are counted as `unverifiable` rather than raising a + false warning. Each row names the route and every owner of the pin; the pin + is surfaced, never rewritten (#6035). ### Changed +- Configured MCP servers now connect lazily instead of all at session boot. The + pool owns a `connecting` set marked at spawn and cleared on resolution or + abort, so "connecting" is no longer inferred as enabled-minus-connected. The + boot pass scopes to the eager set — `required` servers plus those covered by + `tools.always_load` / `allowed_tools` — and a turn naming an unstarted server + spawns its connects alongside, under the existing five-second deadline. A + configured-but-unstarted server now reads as configured on every surface + (session-boot rows, Extensions tab, launch card), never as connecting. + `docs/MCP.md` documents the lifecycle (#6033). +- The launch card's MCP problems row runs its own remedy. It already printed + `/mcp login ` or `/mcp`; it now joins the shared paint/click/keyboard + ordering, so Up/Down lands on it and Enter or a click types the printed + command into the composer for you to send. Typing beats copying: no clipboard + dependency over SSH, and you see the command before a second Enter runs it + (#6085). + - Computer Use is the only computer-use product in Extensions and `/mcp recommendations`. Cua is no longer suggested as a parallel desktop-control MCP; enable the first-party `computer-use` plugin diff --git a/scripts/check-blocking-calls-budget.json b/scripts/check-blocking-calls-budget.json index f117c8b0dd..9ab75beeec 100644 --- a/scripts/check-blocking-calls-budget.json +++ b/scripts/check-blocking-calls-budget.json @@ -344,7 +344,7 @@ "std_fs": 1 }, "crates/tui/src/tools/shell.rs": { - "std_fs": 2, + "std_fs": 3, "thread_sleep": 1 }, "crates/tui/src/tools/shell/tests.rs": { diff --git a/scripts/runtime-contract-budget.json b/scripts/runtime-contract-budget.json index 6a5f23ece0..9eda22cc1b 100644 --- a/scripts/runtime-contract-budget.json +++ b/scripts/runtime-contract-budget.json @@ -1,5 +1,5 @@ { - "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged — re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease. The v0.9.12 plugin prompt-match slice intentionally adds the request_plugin_install tool to the full tool surfaces (plan full: +518 schema bytes / +130 estimated tokens / 29 -> 30 tools) so a strong prompt match can surface the human review CTA; explicit maintainer decision for #5663/#5579. The v0.9.13 profile pins a non-executed bare bash shell so interpreter guidance is reproducible across hosts. The duplicate tts catalog entry is intentionally hidden; speech remains canonical and the alias remains available for saved-transcript dispatch. Explicit v0.9.13 maintainer decision (2026-09-08): after removing 1426 repeated guidance bytes and pinning the bash-v2 fixture, accept only the measured tool byte/token ceilings from all-features macOS source e27735bb63c897f88061c71567701fd971f5d396, verified libtest SHA-256 5e8cbe213f32c4ecdec63494c4de5e31857b4a40134edf7b21a55bca926b1b38: active 13274/3319 in every mode, Plan full 39885/9972, Act/Operate full 67603/16901, with no margin. Against the prior budget, active +390 bytes is agent -41 plus retained bash command syntax +431. Plan full also retains Git commit_plan +253, update_goal progress +583, github bounded local-report guidance +127, review complete-input refusal +35, and send_later dispatching status +14. Act/Operate full instead has github +2151 and additionally speech +230, hidden tts -2120, and tasks/automation exact model-route fields +274 each. The older budget predates v0.9.12: that tag had already removed 361 agent bytes and added the two 274-byte route fields; the retained initial increase versus the tag is 751 source-attributed bytes (agent +320, bash +431), not the +390 budget delta. Only the seven active definitions form the initial request; full catalogs include deferred tools. Estimated tokens use the existing bytes/4 heuristic, not provider usage or billing. Prompt, representative-context, skill-discovery and tool-name identities/ceilings are unchanged. Explicit v0.9.13 maintainer decision (2026-09-09): source ccc5dadfa2279545bf084d37cff3617e41ceaae2 intentionally exposes create_goal, get_goal and update_goal before continuation, so all three initial surfaces now contain ten tools. Measure exact source 4648d148eea64782be857eda6952af2c539cbfcc with the hosted macOS all-features libtest SHA-256 4485c88c7a8b66b8bb9a135807321e417a1e266457ecb74cffc7dfb92f850fc4: four exact provider-free metric tests pass. Active schemas are exactly 17847 bytes / 4462 estimated tokens (+4573 / +1143 for the three eager goal definitions); Plan full is 40597 / 10150 and Act/Operate full is 68315 / 17079, with no margin. The +712 full-catalog bytes are request_user_input guidance +358, update_goal state-change guidance +98, list_dir home-relative path guidance +56, explicit review max_passes schema +197, and three defer_loading true-to-false values +3. The three active name sets/digests, their counts, and measured active/full byte/token ceilings change; full name identities and all prompt, representative-context and skill-discovery measurements remain unchanged. This updates the earlier seven-tool initial-request receipt; bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-10): the +765 active/full tool-schema bytes since source 4648d148ee are exactly source-attributed — the agent tool's followup/parked-child continuation guidance (b6fad79373: +144 action description, +43 message parameter, +169 resume_from parameter) and the read tool's real output budget (e7f7c71e2c: +164 description, +245 for the new max_bytes parameter). No tool enters or leaves any surface: every name-set identity, count, and all prompt, representative-context and skill-discovery measurements are unchanged; only the measured byte/token ceilings move, to active 18612/4653 in every mode, Plan full 41362/10341, and Act/Operate full 69080/17270, with no margin. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-13): source 5bfe88c8e8f45266ea1f9abce87c76b2eed894af intentionally keeps the native workflow tool eager on Plan/Act/Operate first-turn surfaces (DEFAULT_ACTIVE_NATIVE_TOOLS; commit 9e49d0918). Active name sets gain `workflow` (10→11 tools); active schema ceilings move to 29402/7351 with margin pending exact Linux --update lock-in. Full catalogs already advertised workflow; only a small defer_loading true→false spelling bump is reserved (+32 bytes / +8 tokens). Prompt, representative-context, and skill-discovery measurements are unchanged. Do not remove workflow from Plan. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-13, CI lock-in after b4d48e9a4): Linux Lint run 34766373771 measured the intentional eager `workflow` surface at active 31438/7860 in every mode, Plan full 50801/12701, and Act/Operate full 78513/19629. Prior ceilings (29402/7351 active, Plan full 41394/10349, Act/Operate full 69112/17278) under-counted the workflow schema body plus defer_loading true→false on full catalogs; name-set identities are unchanged and `workflow` stays on Plan. Lock ceilings to those measured values with no margin. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced.", + "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged — re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease. The v0.9.12 plugin prompt-match slice intentionally adds the request_plugin_install tool to the full tool surfaces (plan full: +518 schema bytes / +130 estimated tokens / 29 -> 30 tools) so a strong prompt match can surface the human review CTA; explicit maintainer decision for #5663/#5579. The v0.9.13 profile pins a non-executed bare bash shell so interpreter guidance is reproducible across hosts. The duplicate tts catalog entry is intentionally hidden; speech remains canonical and the alias remains available for saved-transcript dispatch. Explicit v0.9.13 maintainer decision (2026-09-08): after removing 1426 repeated guidance bytes and pinning the bash-v2 fixture, accept only the measured tool byte/token ceilings from all-features macOS source e27735bb63c897f88061c71567701fd971f5d396, verified libtest SHA-256 5e8cbe213f32c4ecdec63494c4de5e31857b4a40134edf7b21a55bca926b1b38: active 13274/3319 in every mode, Plan full 39885/9972, Act/Operate full 67603/16901, with no margin. Against the prior budget, active +390 bytes is agent -41 plus retained bash command syntax +431. Plan full also retains Git commit_plan +253, update_goal progress +583, github bounded local-report guidance +127, review complete-input refusal +35, and send_later dispatching status +14. Act/Operate full instead has github +2151 and additionally speech +230, hidden tts -2120, and tasks/automation exact model-route fields +274 each. The older budget predates v0.9.12: that tag had already removed 361 agent bytes and added the two 274-byte route fields; the retained initial increase versus the tag is 751 source-attributed bytes (agent +320, bash +431), not the +390 budget delta. Only the seven active definitions form the initial request; full catalogs include deferred tools. Estimated tokens use the existing bytes/4 heuristic, not provider usage or billing. Prompt, representative-context, skill-discovery and tool-name identities/ceilings are unchanged. Explicit v0.9.13 maintainer decision (2026-09-09): source ccc5dadfa2279545bf084d37cff3617e41ceaae2 intentionally exposes create_goal, get_goal and update_goal before continuation, so all three initial surfaces now contain ten tools. Measure exact source 4648d148eea64782be857eda6952af2c539cbfcc with the hosted macOS all-features libtest SHA-256 4485c88c7a8b66b8bb9a135807321e417a1e266457ecb74cffc7dfb92f850fc4: four exact provider-free metric tests pass. Active schemas are exactly 17847 bytes / 4462 estimated tokens (+4573 / +1143 for the three eager goal definitions); Plan full is 40597 / 10150 and Act/Operate full is 68315 / 17079, with no margin. The +712 full-catalog bytes are request_user_input guidance +358, update_goal state-change guidance +98, list_dir home-relative path guidance +56, explicit review max_passes schema +197, and three defer_loading true-to-false values +3. The three active name sets/digests, their counts, and measured active/full byte/token ceilings change; full name identities and all prompt, representative-context and skill-discovery measurements remain unchanged. This updates the earlier seven-tool initial-request receipt; bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-10): the +765 active/full tool-schema bytes since source 4648d148ee are exactly source-attributed — the agent tool's followup/parked-child continuation guidance (b6fad79373: +144 action description, +43 message parameter, +169 resume_from parameter) and the read tool's real output budget (e7f7c71e2c: +164 description, +245 for the new max_bytes parameter). No tool enters or leaves any surface: every name-set identity, count, and all prompt, representative-context and skill-discovery measurements are unchanged; only the measured byte/token ceilings move, to active 18612/4653 in every mode, Plan full 41362/10341, and Act/Operate full 69080/17270, with no margin. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-13): source 5bfe88c8e8f45266ea1f9abce87c76b2eed894af intentionally keeps the native workflow tool eager on Plan/Act/Operate first-turn surfaces (DEFAULT_ACTIVE_NATIVE_TOOLS; commit 9e49d0918). Active name sets gain `workflow` (10→11 tools); active schema ceilings move to 29402/7351 with margin pending exact Linux --update lock-in. Full catalogs already advertised workflow; only a small defer_loading true→false spelling bump is reserved (+32 bytes / +8 tokens). Prompt, representative-context, and skill-discovery measurements are unchanged. Do not remove workflow from Plan. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.13 maintainer decision (2026-09-13, CI lock-in after b4d48e9a4): Linux Lint run 34766373771 measured the intentional eager `workflow` surface at active 31438/7860 in every mode, Plan full 50801/12701, and Act/Operate full 78513/19629. Prior ceilings (29402/7351 active, Plan full 41394/10349, Act/Operate full 69112/17278) under-counted the workflow schema body plus defer_loading true→false on full catalogs; name-set identities are unchanged and `workflow` stays on Plan. Lock ceilings to those measured values with no margin. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced. Explicit v0.9.14 maintainer decision (2026-09-16): #5715 intentionally adds the two bounded read-only recall tools `session_get` and `session_search` to the Act/Operate full catalogs (50 -> 52 tools), so both full name-set identities and their digests move to 1203d192385fd2b02227ef9e4212e5379bc5cbb813a373f12539406b5958aef1. Plan full is unchanged: the session tools are not offered there. Measured on macOS aarch64 all-features from source 55a9e1b778fa; per the 2026-09-13 precedent the exact byte/token ceilings must be re-locked from a Linux Lint run if CI reports drift. bytes/4 remains an estimate, not measured provider usage or billing. The one-way numeric and exact identity gates remain enforced.", "document_kind": "codewhale.runtime_contract_budget", "representative_context": { "fixture_id": "representative-v1", @@ -86,9 +86,9 @@ "modes": { "act": { "active": { - "bytes": 31438, + "bytes": 31453, "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce", - "tokens_est": 7860, + "tokens_est": 7864, "tool_names": [ "agent", "bash", @@ -105,9 +105,9 @@ "tools": 11 }, "full": { - "bytes": 78513, - "identity_sha256": "1878fd9a724fc9645ff8ef827ad9f2b7124fd511d789e45d97e9d83a0cf866ff", - "tokens_est": 19629, + "bytes": 79531, + "identity_sha256": "1203d192385fd2b02227ef9e4212e5379bc5cbb813a373f12539406b5958aef1", + "tokens_est": 19883, "tool_names": [ "Git", "Run", @@ -141,6 +141,8 @@ "revert_turn", "review", "send_later", + "session_get", + "session_search", "speech", "task_shell_start", "task_shell_wait", @@ -160,14 +162,14 @@ "workflow", "write" ], - "tools": 50 + "tools": 52 } }, "operate": { "active": { - "bytes": 31438, + "bytes": 31453, "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce", - "tokens_est": 7860, + "tokens_est": 7864, "tool_names": [ "agent", "bash", @@ -184,9 +186,9 @@ "tools": 11 }, "full": { - "bytes": 78513, - "identity_sha256": "1878fd9a724fc9645ff8ef827ad9f2b7124fd511d789e45d97e9d83a0cf866ff", - "tokens_est": 19629, + "bytes": 79531, + "identity_sha256": "1203d192385fd2b02227ef9e4212e5379bc5cbb813a373f12539406b5958aef1", + "tokens_est": 19883, "tool_names": [ "Git", "Run", @@ -220,6 +222,8 @@ "revert_turn", "review", "send_later", + "session_get", + "session_search", "speech", "task_shell_start", "task_shell_wait", @@ -239,14 +243,14 @@ "workflow", "write" ], - "tools": 50 + "tools": 52 } }, "plan": { "active": { - "bytes": 31438, + "bytes": 31453, "identity_sha256": "cf523fcd7528ab2e14efffd7fe6b0916a370d6a8b8426d15a159aa823a7b86ce", - "tokens_est": 7860, + "tokens_est": 7864, "tool_names": [ "agent", "bash", @@ -263,9 +267,9 @@ "tools": 11 }, "full": { - "bytes": 50801, + "bytes": 50816, "identity_sha256": "ac8af1f4988199825be7b00b054c258724a44074b1d4e6de6c92ade7c1cffe63", - "tokens_est": 12701, + "tokens_est": 12704, "tool_names": [ "Git", "Web", diff --git a/web/lib/changelog.generated.ts b/web/lib/changelog.generated.ts index f31878cf99..01d6cc98b2 100644 --- a/web/lib/changelog.generated.ts +++ b/web/lib/changelog.generated.ts @@ -25,7 +25,7 @@ export const CHANGELOG: ChangelogRelease[] = [ "version": "Unreleased", "date": null, "unreleased": true, - "compareUrl": "https://github.com/Hmbown/CodeWhale/compare/v0.9.12...HEAD", + "compareUrl": "https://github.com/Hmbown/CodeWhale/compare/v0.9.13...HEAD", "sections": [ { "heading": "Security", @@ -38,21 +38,26 @@ export const CHANGELOG: ChangelogRelease[] = [ "heading": "Added", "items": [ "File edits are parse-gated before the write lands: Rust goes through syn::parse_file for a grammar-exact line:column, and .toml / .json through the parsers already vendored. An edit is refused only when the file parsed *before* and would not parse *after* — repairing an already-broken file is the commonest reason to edit source at all, so pre-existing breakage and new files fail open. The check precedes the write, so a rejection leaves the file untouched and apply_patch…", - "Rust files that were already rustfmt-clean are re-normalized after an edit, so the next patch's anchors still match. Hand-formatted files are never rewritten, and every failure path skips and lets the edit land (#6205).", + "Rust files that were already rustfmt-clean are re-normalized after an edit, so the next patch's anchors still match. Hand-formatted files are never rewritten, and every failure path skips and lets the edit land (#6205, #6151).", "Native clients can finish provider setup without dropping to the CLI: DELETE /v1/providers/{id}/key clears a Codewhale-owned credential through the same shared owner as codewhale auth clear, and GET /v1/providers now carries credentialSource / credentialWritable (plus a reason) so a client disables its control with a truthful explanation instead of letting a write fail late. A credential Codewhale does not own — a literal key in a config file, or an active external consent —…", "The interactive approval card can be bounded: [approval] timeout_seconds resolves an unanswered card to deny when the window elapses — the same fail-closed decision the external approval path takes — and the transcript says the bound denied the call, not the operator. Omitted or 0 keeps today's unbounded wait, so nothing changes unless you opt in (#6101).", "Transcript drag selection copies Markdown source by default: every cell the selection touches serializes through the same canonical path Ctrl-Y and /copy use, partial intersections round out to whole cells joined with blank lines, and the toast names the copied cell count. tui.selection_copy_markdown = false keeps the rendered-text payload (#6156).", - "The Runtime API serves the workspace files a native client browses and edits: GET /v1/workspace/files lists one directory, GET /v1/workspace/files/read returns a bounded byte window with a whole-file SHA-256 revision, and PUT /v1/workspace/files writes atomically through the confined opener with revision-checked overwrites (409 on drift). .git is never served and symlinks are never followed. A saved session's oversized tool outputs are served as artifacts at GET…" + "The Runtime API serves the workspace files a native client browses and edits: GET /v1/workspace/files lists one directory, GET /v1/workspace/files/read returns a bounded byte window with a whole-file SHA-256 revision, and PUT /v1/workspace/files writes atomically through the confined opener with revision-checked overwrites (409 on drift). .git is never served and symlinks are never followed. A saved session's oversized tool outputs are served as artifacts at GET…", + "A session that ended mid-turn is no longer invisible to the model. The newest workspace-scoped session still holding a crash-recovery checkpoint is surfaced as a one-line ## Prior Session notice in the session-pinned prompt prefix — metadata reads only, excluding the live session and any session this process instance created. Clean sessions get no block, so their prefix bytes are unchanged. Two bounded read-only tools, session_search and session_get, give the model…", + "codewhale exec --hooks opts a headless run into the same HookExecutor the TUI builds — global config, reviewed plugin snapshots, and trusted project hooks.toml. Headless runs previously fired no hooks at all. tool_call_before can still deny and shell_env still applies; a hook ask resolves fail-closed without a terminal. Fleet worker subprocesses never opt in, and permissions.toml typed rules are unchanged (#6099).", + "codewhale doctor flags fleet and profile model pins that the provider's own roster no longer offers. A pin is reported only when a *fresh* cached live roster for that exact route exists and omits it — stale, failed, or absent rosters prove nothing and are counted as unverifiable rather than raising a false warning. Each row names the route and every owner of the pin; the pin is surfaced, never rewritten (#6035)." ], - "itemCount": 6 + "itemCount": 9 }, { "heading": "Changed", "items": [ + "Configured MCP servers now connect lazily instead of all at session boot. The pool owns a connecting set marked at spawn and cleared on resolution or abort, so \"connecting\" is no longer inferred as enabled-minus-connected. The boot pass scopes to the eager set — required servers plus those covered by tools.always_load / allowed_tools — and a turn naming an unstarted server spawns its connects alongside, under the existing five-second deadline. A configured-but-unstarted…", + "The launch card's MCP problems row runs its own remedy. It already printed /mcp login or /mcp; it now joins the shared paint/click/keyboard ordering, so Up/Down lands on it and Enter or a click types the printed command into the composer for you to send. Typing beats copying: no clipboard dependency over SSH, and you see the command before a second Enter runs it (#6085).", "Computer Use is the only computer-use product in Extensions and /mcp recommendations. Cua is no longer suggested as a parallel desktop-control MCP; enable the first-party computer-use plugin instead. The bundled plugin is 0.4.0: Return/Enter from type, filtered and paginated get_app_state, focus/get_value, and strategy:\"app\" window-scoped clicks. Shared-desktop pointer gestures stay gated.", "The bundled first-party catalog pins marketplace revision ca6be22, so installing Computer Use from the Extensions listing fetches the same 0.4.0 source and the published notarized 0.4.0 Mac app." ], - "itemCount": 2 + "itemCount": 4 }, { "heading": "Fixed",