v0.10.1 — start here: finishing what 0.10.0 started, and how to help

[Hmbown]

Status (2026-09-22): v0.10.0 is published. 0.10.1 is in planning. 0.10.1 is a patch release: it finishes work 0.10.0 started. It adds no new features and makes no breaking changes. This is a release plan, not a release announcement. A version bump in source does not mean packages or binaries have been published.

What shipped in 0.10.0

• A redesigned terminal workbench, clearer model, provider, fleet and plugin settings, and more reliable session and runtime behavior. It replaces the unpublished 0.9.14 candidate.
• Release notes: v0.10.0. Full history: CHANGELOG.md.
• The v0.10.0 milestone keeps its completion history, including the links carried over from the former v0.9.14 plan.

What 0.10.1 is: finish what we started

Each item below already has one or more partial fixes behind it. 0.10.1 closes those gaps instead of adding scope. CI and release-pipeline fixes land first, because every other change lands through that gate.

Product fixes

• Silent engine freeze (Engine silently freezes mid-run: user messages are persisted but never answered; no error, no log line, no crash entry #6184). Long, tool-heavy runs can stop producing output with nothing logged. The first step is to make a stall report itself: a turn heartbeat, a stall record in crashes/, an on-screen "turn stalled" status, and stream timeouts well under the current 900s default. Engine silently freezes mid-run: user messages are persisted but never answered; no error, no log line, no crash entry #6184 stays open until a real field trace confirms the root cause, so related commits say Refs #6184.
• Empty terminal stop ends the turn (ACP follow-up: empty terminal responses and Full Access discovery #6310). When a model returns a clean stop with no text and no tool call, the turn should retry a bounded number of times and then fail visibly. The same handling must apply on the ACP serve path.
• git_fetch can hang on a credential prompt. Tool-side git spawns should never prompt on the terminal (GIT_TERMINAL_PROMPT=0, SSH in batch mode), and fetch should run under a timeout.
• Composer send cue flickers outside a few terminals (Composer submit chip: finish the paste-burst display fix (code + the test it reverses) #6397). In tmux, VS Code, kitty, Alacritty, GNOME Terminal and over SSH, the [↵] cue flickers on each keystroke. The fix is already written; it needs to land with the updated test.
• Provider routing leaks the root base_url (Delete the legacy root base_url and migrate to [providers.<name>] base_url #6394, Model pins don't propagate: fleet members and agent profiles keep a retired id after the provider moves on #6035). Contributor PR fix(api): expose user-defined [providers.<name>] routes to native clients #6404 lands as its own PR. After that, migrate the root base_url into the matching [providers.<name>] entry and warn, without rewriting, when a pinned model is no longer in the roster.
• Duplicate or lost sessions and threads. Contributor PR fix(tui): stop resume and fork from duplicating threads and sessions #6406 lands as its own PR once its macOS CI result is sorted out. A non-destructive doctor report lists orphaned session records. The decision on which store owns session truth (Session persistence: decide whether session_manager or codewhale-state owns session truth #6144) is recorded now; the rewrite itself waits for 0.11.
• Sub-agent completion events can be dropped. Terminal lifecycle events must always be delivered, so a finished sub-agent never shows as Running.
• Desktop app engine version check. The app should accept any 0.10.x engine, not only exactly 0.10.0.
• /context shows a different number from the meter. Make /context lead with the same estimate the meter and the auto-compact gate use.
• Shipped text that contradicts shipped behavior. Fix stale /debug cache status lines, make remote-setup --apply either work or exit non-zero, and correct the glibc/GNU wording (both Linux assets are static musl).

CI and release pipeline (these land first)

• Make the CI ratchets block pull requests the same way they block main, so a green PR cannot turn main red. Each ratchet gets an update command so the fix lands in the same PR.
• Update the release record automatically after publish, so a new release no longer turns Web Frontend red.
• Run the parity gate in the release candidate, so the tagged SHA is the SHA the candidate validated.
• Keep macOS jobs on fork PRs within the 90-minute limit, and keep the Actions cache under its size cap.
• Stop the PR-to-issue link check from reading "does not close #N" as a closing keyword. Automation applies labels and does not post comments.

Also open in this milestone

• Live Computer Use acceptance (Computer-use plugin: live-install receipt + first look-act loop #5856) and pet acceptance (Pet: qualify the /pet habitat in a real terminal and accept the shared owner across TUI + desktop #6155) still need their own evidence. A successful local build does not close them.

Not in 0.10.1 (planned for 0.11 or later)

ACP sessions on the full turn runtime (#5835), the session-store rewrite (#6144), sub-agent decomposition (#6293), the catalog single-authority work (#6396), the context_status tool (#6217), and test-environment convergence.

Where work is tracked

• The v0.10.1 milestone is the release list. Items above without an issue link get one when work starts.
• Issues mirror to our internal tracker automatically, so please file once.

How PRs land

• Every PR lands through hosted CI. A local pass, a model trial and a published release are separate levels of evidence, and one does not stand in for another.
• Contributor PRs are reviewed and merged as their own PRs, with credit. If your branch needs a rebase or a fix, we help on your branch.
• Write Fixes #N or Closes #N only when the PR really resolves the issue. Otherwise use Refs #N.

How to report

• Bugs: use the bug report template. Include reproduction steps, codew --version (with the build SHA), and the client and operating system you used. For a freeze, say what the turn was doing when it stopped, and attach anything that appeared in crashes/.
• Design feedback: show the screen and describe what you were trying to do, what was unclear, and your window size. Mouse and keyboard behavior both matter.
• Features: use the feature request template. New features are aimed at 0.11, not this patch.

How to help

• Look for agent-ready and good first issue. Before you start, check the latest issue comments and linked PRs.
• Good 0.10.1 starting points: reproducing Engine silently freezes mid-run: user messages are persisted but never answered; no error, no log line, no crash entry #6184 with a trace, trying Composer submit chip: finish the paste-burst display fix (code + the test it reverses) #6397 in your terminal, and testing fix(api): expose user-defined [providers.<name>] routes to native clients #6404 or fix(tui): stop resume and fork from duplicating threads and sessions #6406 against your own config.
• Read CONTRIBUTING.md. Discuss larger changes in an issue first.

[Hmbown]

Tracker organization, 2026-09-13/14. Every open issue now sits on exactly one milestone, and milestones hold issues only (PRs carry none).

• v0.9.13 — the release being cut now (tag v0.9.13 at a0b81f619). Its remaining open issues are the fixed defects that close with the Release page as evidence: the sub-agent fan-out set Sub-agent runtime: nine defects observed in a six-worker fan-out (0.9.13 blocker) #6121–action=status compact projection returns ~50k tokens of nested per-agent payload #6130, Extensions page: re-auth on an MCP server freezes the whole TUI, and the Diagnose button does nothing #5974–Session metrics: the tok/s number doesn't look right — audit the denominator and the token source #5977, Google Gemini problem on "from scratch" installation #6018, Google: thought-signature replay on a non-official route fails with Google's raw 400 instead of an actionable error #6048.
• v0.9.14 — the next release, 67 open. Themes are in the milestone description: catalog-owned model capability and vendor selection (Model capability is decided by hardcoded prefixes and a literal list; it belongs to the catalog #6032, Provider-neutral upstream vendor selection (per-model pin + discovery, beyond OpenRouter) #6029, Model pins don't propagate: fleet members and agent profiles keep a retired id after the provider moves on #6035–Decision recorded: keep both Fleet and agent profiles — the confusion is naming and duplicated fields, not the model #6038, Architecture D-2: unify ModelRegistry with RouteResolver #4166, Architecture: de-hardcode model provider and tool registries #4173); MCP lifecycle (MCP: connect servers lazily at point of use instead of eagerly at boot #6033, MCP OAuth: re-login silently reuses the remote grant, so logout cannot change the authorized workspace #6040, MCP: qualify one negotiated protocol adapter across legacy and current servers #6131, Reconcile the two MCP client stacks (tui/src/mcp vs crates/mcp) #6142, MCP server: retire the DeepSeek-specific tool calls and make the stdio loop async-native #6140); the runtime refactor backlog App-server: finish Runtime client conversion and acceptance #6139–Guard: every reqwest client must go through codewhale_release::tls, never a bare Client::builder() #6153 plus TUI decomposition (TUI decomposition is blocked on crate::config: 118 of 128 modules form one component (727,748 lines) #6034, EPIC-005: CodeWhale TUI Crate Decomposition (Umbrella) #5316, Decompose the mega files: lib.rs (18.7k), config.rs (12.3k), client.rs (11.1k), runtime_threads.rs (9.3k) #5586, Streamline TUI monoliths: split event_loop.rs match into per-domain reducers, slim app.rs #5580, Dead-code sweep phases 2-4: 75 test-only markers, ~242 stale allows, blanket-allow conversions #5587); sub-agent/workflow hardening (Workflow runs fail silently: dispatch/schema errors never surface in the TUI #5528, Sub-agents cannot reliably execute: wall-time deaths lose uncommitted work, provider-route failures block dispatch, shell tooling needs workarounds #5529, Automation runs that need a tool approval die as silent idle-timeout cancels #6118, Compaction survival contract should reject any orphaned tool_result across the whole replacement #6119, feat(goal): goal gates — independent verification of complete/blocked, needs_input/deferred/stalled statuses, post-verify stage, gate resilience (config-optional; default = current behavior) #6013, feat(fleet): adaptive anti-stall + wider read-only shell grammar (defaults, not per-user config) #6015, feat(tui): bound the interactive tool-approval prompt (opt-in timeout, deny on expiry) #6101, feat(exec): let codewhale exec opt into hooks and typed permission rules #6099); session store integrity (save_session silently deletes the oldest transcript once the store reaches MAX_SESSIONS #6136–Design: what should resume do when the target session — or its provider — is gone? #6138, Session recovery is invisible to the model: after a force-quit, the agent cannot find what it was doing #5715); pet acceptance (Pet: qualify the /pet habitat in a real terminal and accept the shared owner across TUI + desktop #6155); security (security sweep 2026-09-11 #6058); declutter and UX (feat(tui): launch-screen MCP block — decide copy/paste (and click) affordances; it is read-only by design today #6085, feat(tui): declutter round 2 — /settings (71 rows), /setup providers (flat 30+), /fleet naming #6087, feat(tui): Session Picker UX — hide empty auto-sessions, highlight current session, page-scroll the list, widen the list pane #6014, /models command returns only partial model list — missing pagination support #6009, Fleet models: provider → model → shortlist → role, with save-in-role and a fleet-aware operator #5915, Fleet/agents: first-class sub-agent and workflow management in the TUI (agents bottom view: live list, per-agent status/elapsed/tokens, focus, message, stop, history over time) #5479).
• v1.0 — product scope before calling it 1.0, undated, 27 open: Responses/dialect architecture (Make Responses API behavior provider-profiled instead of provider-hard-coded #5092, Extract Responses dialect policy behind a language-neutral conformance harness #5093), docs localization epic (EPIC(docs): review, partially restructure, and fully localize documentation to Chinese #5482), semantic code search (feat: semantic codebase_search tool (BM25 or embedding index) #4066, feat: Zvec / zvec-grep (zg) backend for semantic codebase_search (#4066) #5830), CJK input (未适配中文输入法 #2323), steering and session designs (Mid-turn guidance: deliver a committed queued follow-up as a steer at the next checkpoint (peek tool rejected) #5625, Design: unify route-specific tool projection before request dispatch #5633, Design: scope MCP secret providers to the owning runtime #5637, Event-granularity audit: surfaces that stall at turn boundaries despite live per-step sources #5581), parked migrations (One worker system: retire the Keychain product path + single-worker spawn model (remaining scope from PR #5632) #5718, Account link: one model config, auth as a reversible transform, policy separate #6028, Finish or close the parked provider-wire migration #5851, Ollama live catalog: qualify the installed release after #6002 #5848), voice and subscription login (Meta-subscription device-code login (codewhale auth muse-device) #5845, Voice input: on-device STT default, API-key fallback, keybinding + level animation #5846), desktop app (feat(desktop): first-class desktop app for project and agent workflows #4986).
• Backlog — kept ideas with no release commitment (FreeBSD support (npm binary / pkg) #1097, 输出内容中的文件，能不能支持点击后打开预览，这样不用再去目录中找 #2342, Request: zero-sandbox / --no-sandbox mode for local dev #4955, feat: OpenDesign (nexu-io/open-design) compatibility — MCP today, native runtime adapter upstream #5806, Continuous Self-Learning from Dialog (Automatic Skill Evolution) #5860).

Emptied milestones v0.9.10 and v0.9.11 are closed. If you pick something up, say so on the issue; if you think an issue is misfiled, comment there rather than moving it silently.

[Hmbown]

Run summary for the planning issue: the v0.9.14 slice run is complete. Shipped and closed: #6153, #6156, #6159, #6118, #6119, #6136, #6137, #6138 — all in the single milestone PR #6161 (base 3b00c1a; main has since moved to e9b761c, deliberately not rebased). Every other open milestone issue has a fresh status/decision comment from this run (verified mechanism, next slice, or the gate that blocks it) — see the tracker. Gate receipts are in the PR body: nextest workspace 15645/15645, clippy/fmt clean, all Lint scripts pass, npm test + check:web green. Hosted CI on the branch has never run; opening the PR is its first run.

[Hmbown]

Continuation run (2026-09-14): four more slices landed on v0914-chunk1, all in PR #6161 — #6101 (opt-in approval timeout + Timeout receipt), #6147 (the engine's last two unbounded channels bounded), #6040 (prompt=consent on every interactive OAuth login + honest logout messaging), #5528 (failed workflow runs raise a sticky error toast).

Full gates re-run on the branch: cargo fmt --check clean; clippy exit 0; nextest 15654/15654 passed (21 skipped); npm test 470 passed + check:web clean; all Lint scripts + selftests pass (locale parity 2251/2251 x 15); release checks OK.

PR #6161 is currently CONFLICTING with main in three changelog surfaces (CHANGELOG.md, crates/tui/CHANGELOG.md, web/lib/changelog.generated.ts) — reported in the PR body; not rebased per the brief, resolution is a maintainer action. #6009 closed with the documented-contract finding (OpenAI's spec documents no model-list pagination).

[Hmbown]

Maintainer action on PR #6161, 2026-09-14 (Claude Fable 5.1 at Hunter's direction, 0.9.14 takeover). The v0.9.14 slice run's PR was CONFLICTING only on the three changelog surfaces. Resolved by merging main into v0914-chunk1 as a union of both Unreleased sections and regenerating crates/tui/CHANGELOG.md + web/lib/changelog.generated.ts (fc08c80cb0). Hosted CI then flagged one new CodeQL alert (rust/cleartext-logging) in the #6040 regression test, whose assertion message interpolated the OAuth authorization URL; fixed in 16ebe8f390 (message names only the fact under test). All 30 required checks passed; merged as cf37ea81ad, closing #6153, #6156, #6159, #6118, #6119, #6136, #6137, #6138, #6101, #6147, #6040, #5528.

Now in flight on top of that main: #6163 (workspace files + session artifact routes for the GPUI desktop) and #6162 (canceled automation runs get a receipt), each on its own branch awaiting independent verification before landing.

[Hmbown]

v0.9.14 progress note — slices landing on branch v0914-chunk2 (PR #6175):

• Op::SendMessage god-payload → TurnSpec, and prove the UI never awaits send() on the input path #6150 Op::SendMessage payload → TurnSpec (wire format unchanged; residual send().await sites audited)
• Dependency dedupe: reqwest 0.12/0.13, toml/toml_edit, thiserror 1/2, bitflags 1/2, sha2/digest splits #6151 dependency dedupe — base64/shlex unified; remaining duplicates are upstream-pinned (documented on the issue)
• Dead-code sweep phases 2-4: 75 test-only markers, ~242 stale allows, blanket-allow conversions #5587 dead-code sweep — stale-allow normalization + expect conversion landed, budget 369 → 254; blanket-allow and commented-allow phases remain
• feat(fleet): adaptive anti-stall + wider read-only shell grammar (defaults, not per-user config) #6015 fleet anti-stall — in progress: repeated typed denials in the sub-agent worker loop now feed the existing FleetDenialGuard policy

Earlier branch slices: #6099 #6037 #6149 #6141 #6033 #6140 #5715 #6014 #6085, #6132 qualified.

To avoid duplicating work: check PR #6175 and issue assignees before picking up a milestone item; in-progress slices are noted on their issues.

[Hmbown]

The planned release is now 0.10.0, reflecting the broader workbench and settings redesign plus session/runtime improvements. This supersedes the unpublished 0.9.14 candidate; the milestone and its history stay intact.

The issue body above now describes the direction, remaining acceptance checks, and ways to give design feedback. We are also reviewing older issues against current code and product direction: completed or superseded work gets an explicit explanation, while valid gaps stay open. This is a planning update, not a release announcement. Thanks to everyone contributing fixes, reports, and testing.

[Hmbown]

0.10.0 readiness pass, 2026-09-20 — branch claude/trusting-shannon-sgusdh, draft PR #6370, head 2ca42e9, CI green on Lint, Ubuntu, macOS, Windows and the OpenHarmony check.

Landed on the branch:

• main's red legs: README translation lint, and the underwater widget tests that still counted ASCII fish after the native braille poses.
• bug(tests): configured_model_api_tests overflow the test thread stack and abort the tui lib suite #6362: boxed ConfigFile.base, phased store-binding test, explicit 2 MiB guards (no stack ceiling raised).
• Water animation ticks on the draw-cadence tier and the poll aims at the next tick (no 48 ms quantization).
• Extensions: the plugin trust review stays on the panel and the list refreshes after the digest is confirmed.
• PR feat(runtime-api): terminal byte stream (#34), stream resume + idempotent submit (#76), pet agent-count pin (#12) #6361 merged as itself (three generated-file conflicts resolved to main's versions).
• New root cause: the interactive TUI inherited the CLI's SIGPIPE=SIG_DFL, so a stdio MCP server that exits before initialize is written killed the whole session silently (6 of 12 launches on the launch-card fixture). run_tui now ignores SIGPIPE; 0 of 12 after the fix, and the PTY harness prints the killing signal.
• CI gates for the non-Unix terminal-route builds (feat(runtime-api): terminal byte stream (#34), stream resume + idempotent submit (#76), pet agent-count pin (#12) #6361 follow-up).

Not verified in this pass and still open for a human with a native terminal: #6155 (/pet in Kitty), #5856 (Computer Use on macOS), and any real-provider turn. #6184 has status on its thread. Dependabot PRs were left open.

---

Generated by Claude Code