release: v0.8.65 (provider/route + Fleet epics, hardening, version bump)

.cargo/audit.toml

@@ -0,0 +1,21 @@
+# cargo-audit configuration (read by `cargo audit`).
+#
+# The advisories below are all "unmaintained" warnings — NOT security
+# vulnerabilities. Each crate is pulled in transitively only by the `starlark`
+# 0.13.0 family (starlark / starlark_syntax / starlark_map), which crates/tui and
+# crates/whaleflow depend on directly for Starlark-based Fleet/workflow config.
+# `cargo tree -i <crate>` confirms starlark is the sole path for each.
+#
+# There is no fix available without an upstream `starlark` release that drops
+# these deps, and none is exploitable here. They are accepted for now and
+# tracked in this file so `cargo audit` stays clean for genuinely new advisories.
+# Remove an entry once a starlark upgrade/removal drops the transitive dep
+# (re-check with `cargo tree -i derivative` and `cargo audit`).
+#
+# Audit #11, scratchpad/bug-audit-2026-06-24.md.
+[advisories]
+ignore = [
+    "RUSTSEC-2024-0388", # derivative 2.2.0 unmaintained — transitive via starlark 0.13.0
+    "RUSTSEC-2025-0057", # fxhash 0.2.1 unmaintained — transitive via starlark_map 0.13.0
+    "RUSTSEC-2024-0436", # paste 1.0.15 unmaintained — transitive via starlark 0.13.0
+]

AGENTS.md

@@ -6,15 +6,18 @@
   **not** hard-code a device-specific checkout path here — work in whichever
   local checkout you have and always **confirm with
   `git branch --show-current` before editing.**
-- **Active branch:** `codex/v0.8.63-integration` (also at
-  `origin/codex/v0.8.63-integration`) for the current fix/integration lane.
-  If a newer handoff or objective file names a different branch, verify with
-  `git branch --show-current` and follow the live branch.
-- **Workspace version is `0.8.63`** in `Cargo.toml`. Do not bump versions
-  opportunistically; version bumps, tags, release artifacts, publishing, and
-  GitHub Releases require Hunter's explicit approval.
-- **Milestone guidepost:** GitHub milestone `v0.8.63`. Check live state with
-  `gh issue list --repo Hmbown/CodeWhale --milestone "v0.8.63" --state open`.
+- **Active branch:** start from live truth, not a hard-coded lane. Confirm the
+  current fix/integration branch from the latest handoff/objective file and
+  `git branch --show-current`; recent work has landed on `main` through small
+  PRs rather than a long-lived `codex/...` integration branch, so don't assume a
+  named integration branch still exists — verify before relying on it.
+- **Workspace version:** read it from `Cargo.toml` (`[workspace.package]
+  version`); it advances per release lane, so don't trust a number memorized
+  here. Do not bump versions opportunistically; version bumps, tags, release
+  artifacts, publishing, and GitHub Releases require Hunter's explicit approval.
+- **Milestone guidepost:** use the current release milestone named in the active
+  handoff and list it live, e.g.
+  `gh issue list --repo Hmbown/CodeWhale --milestone "<current milestone>" --state open`.
 - **Default branch is `main`.** Never commit directly to `main`; work on the
   active integration branch or a fresh `codex/...` branch/worktree off it for
   an isolated change. Open a PR into `main` only when a unit of work is
@@ -105,7 +108,8 @@
 - Close or update issues and PRs only after verifying the landed commit on the
   relevant branch. If the release branch already contains equivalent behavior,
   leave a clear note linking the commit and describing any remaining delta.
-- For the active release queue, start from the GitHub `v0.8.63` milestone
-  (`gh issue list --repo Hmbown/CodeWhale --milestone "v0.8.63"`) and refresh
-  state before acting. Older per-version triage docs under `docs/` are
+- For the active release queue, start from the current GitHub release milestone
+  named in the active handoff
+  (`gh issue list --repo Hmbown/CodeWhale --milestone "<current milestone>"`) and
+  refresh state before acting. Older per-version triage docs under `docs/` are
   historical reference only.

CHANGELOG.md

@@ -7,21 +7,90 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.65] - 2026-06-24
+
 ### Added
 
+- **Provider/model/route resolution (EPIC #2608).** Canonical provider, model,
+  offering, and route types with a single `RouteResolver` that produces a
+  resolved `ReadyRouteCandidate` (endpoint, wire protocol, model id, context
+  limit, price) for every switch (#3458, #3084, #3384). The executing client is
+  now constructed from the resolved candidate rather than re-derived from config
+  (#3384). A committed, network-free Models.dev-shaped catalog gives models real
+  context windows and pricing, with a secret-free live cache (#3497, #3498,
+  #3385). Offering pricing with provenance is projected onto candidates (#3501,
+  #3085), and route limits feed a route-aware context-budget service (#3508,
+  #3523, #3086).
+- **Fleet execution substrate (EPIC #3154).** Fleet profile types and config
+  (#3469), durable manager resume, workspace agent-profile loading resolved into
+  the worker runtime (#3367), loadout intent carried in task specs (#3512), and
+  receipts that persist the resolved route for inspection (#3154, #3166). Worker
+  status is folded into the unified `/fleet` surface and exposed through the
+  Runtime API.
+- **Provider surfaces.** A `/provider` readiness dashboard with reasoning
+  readiness, an experimental/supported maturity marker, and an "open models for
+  this provider" action (#3083, #2984, #3485); cross-provider `/model` search
+  with scroll and provider type-ahead (#3484, #3075); inline `<think>`
+  reasoning-stream routing with per-provider overrides (#3222); usage telemetry
+  normalized into canonical token classes including Responses cache-miss and
+  reasoning tokens (#2961, #3509); and remote MCP OAuth login with bearer/header
+  auth precedence (#3527).
+- **More providers and routes.** User-defined OpenAI-compatible custom providers
+  via `[providers.<name>]` (#1519); a DeepSeek Anthropic-compatible route (#2963,
+  #3449); a Qianfan route (#3425); Zhipu folded into Z.ai with equal-treatment
+  model normalization (#3539); DashScope/Together fixtures.
 - **Localized mode picker and composer indicators.** The `/mode` picker prompt,
   mode names, and hints, plus the composer's Vim mode indicator, now render in
   all seven shipped locales (model-facing mode labels stay English). Harvested
   from #2239 by @gordonlu.
+- **Website and automation.** A runtime/integrations page, provenance and
+  mirror-trust copy, a fact-drift CI gate, a published install script, and a
+  weekly community digest archive on codewhale.net (#3419, #3421, #3415, #3482,
+  #3420); per-automation mode/shell/trust/approval settings (#3467).
 
 ### Changed
 
+- **Config modularization (#3311).** `ProviderKind` (#3505), harness posture
+  (#3507), and provider default seeds (#3503) moved into dedicated modules, and
+  the `config.rs` monolith split into clean leaf modules (paths, search,
+  model/base-URL constants, sub-agent limits) behind a `pub use` facade.
+  `AppMode` helpers were centralized (#3510), and mode-vs-permission policy is
+  now derived through a single `base_policy_for_mode` resolver instead of
+  scattered mutation (#3386, advisory review-intent behavior preserved).
+- **Leaner tool surface.** Dropped `task_shell_*` from the active set and folded
+  `tool_search_*` (#3463); ablated the in-turn loop_guard and encoded reasoning
+  dispositions (#3462); added the Orchestration disposition to the constitution.
+- **Routing.** Provider/model switches and the capability-aware fallback chain
+  resolve through `RouteResolver`; reasoning effort is normalized for the
+  *resolved* provider; the fallback chain now skips providers that lack auth
+  (#2574); and context window and memory-pressure come from the resolved route
+  (#3086).
+- **UX.** Approval modal gained a group divider and selected-row caret (#3515);
+  picker scroll/type-ahead and selection contrast hardened (#3500); the README
+  was rewritten as an architecture end-cap (#3087); and repo agent guidance was
+  de-hardcoded to live truth.
 - **Restored contributor credit.** Threaded machine-readable credit
   (`docs/CONTRIBUTORS.md` + `.github/AUTHOR_MAP`) for earlier merged work that
   shipped without it, including the `/jobs cancel-all` action and the npm
   retry-timeout hint (#1538) by @jieshu666, and the community ACP adapter
   reference by @rockeverm3m.
 
+### Fixed
+
+- **Release hygiene.** The strict `cargo clippy --workspace --all-targets --locked
+  -- -D warnings` gate passes; `npm run build` no longer dirties the generated
+  web facts; the site sets `metadataBase`; the community digest page parses each
+  record independently and localizes its chrome; and `cargo audit` is clean with
+  the starlark-transitive unmaintained advisories documented.
+- **Routing and mode correctness.** Ordinary prompt text is no longer
+  interpreted as a mode switch (#3387, #3491); model candidates are scoped to the
+  active provider; Together-owned DeepSeek routes are accepted (#3426); insecure
+  `http://` custom endpoints raise an advisory warning (#1519); and the Fleet
+  setup planner's role/model selection now drives the generated profile.
+- **Runtime stability.** MCP connection drops are explicit (#3524), HTTP API
+  calls reuse a shared MCP pool (#3532), and per-agent sub-agent mailbox
+  telemetry is throttled to cut UI lag (#3454).
+
 ## [0.8.64] - 2026-06-22
 
 ### Added
@@ -2361,6 +2430,7 @@ overflow report and `/theme` picker edge-wrapping patch in #1814.
 Older releases (v0.8.39 and earlier) are archived in [docs/CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md).
 
 [Unreleased]: https://github.com/Hmbown/CodeWhale/compare/v0.8.64...HEAD
+[0.8.65]: https://github.com/Hmbown/CodeWhale/compare/v0.8.64...v0.8.65
 [0.8.64]: https://github.com/Hmbown/CodeWhale/compare/v0.8.63...v0.8.64
 [0.8.63]: https://github.com/Hmbown/CodeWhale/compare/v0.8.62...v0.8.63
 [0.8.62]: https://github.com/Hmbown/CodeWhale/compare/v0.8.61...v0.8.62

CLAUDE.md

@@ -38,16 +38,17 @@ for Claude-based agents working in this repository.
 
 ## Current Release Work
 
-- The active branch for this release lane is `codex/v0.8.63-integration`
-  (also at `origin/codex/v0.8.63-integration`). This repo lives on multiple
-  devices, so do not hard-code a checkout path; work in whichever local
-  checkout you have and confirm with `git branch --show-current` before
-  editing. Never commit directly to `main`.
-- The workspace version is `0.8.63`. Do not tag, publish, create a GitHub
-  Release, push release artifacts, or merge to `main` without Hunter's
-  explicit approval.
-- Base release triage on the GitHub `v0.8.63` milestone
-  (`gh issue list --repo Hmbown/CodeWhale --milestone "v0.8.63" --state open`)
+- Confirm the active branch for the current release lane from the latest handoff
+  and `git branch --show-current`; recent work has landed on `main` through small
+  PRs rather than a long-lived `codex/...` integration branch. This repo lives on
+  multiple devices, so do not hard-code a checkout path; work in whichever local
+  checkout you have and confirm the branch before editing. Never commit directly
+  to `main`.
+- Read the workspace version from `Cargo.toml`; it advances per release lane. Do
+  not tag, publish, create a GitHub Release, push release artifacts, or merge to
+  `main` without Hunter's explicit approval.
+- Base release triage on the current GitHub release milestone named in the active
+  handoff (`gh issue list --repo Hmbown/CodeWhale --milestone "<current>" --state open`)
   unless Hunter gives a newer branch/milestone.
 - Work the queue in this order: release blockers, recently approved PRs, clean
   PRs with small scope, blocked PRs with obvious fixes, dirty PRs that can be

Cargo.toml

@@ -20,7 +20,7 @@ default-members = ["crates/cli", "crates/app-server", "crates/tui"]
 resolver = "2"
 
 [workspace.package]
-version = "0.8.64"
+version = "0.8.65"
 edition = "2024"
 # Rust 1.88 stabilized `let_chains` in `if`/`while` conditions, which the
 # codebase relies on extensively. Cargo enforces this so users on older

README.ja-JP.md

@@ -44,8 +44,8 @@ nix run github:Hmbown/CodeWhale
 scoop install codewhale        # または GitHub Releases の NSIS インストーラ
 
 # GitHub に安定して到達できない場合の CNB ミラー
-cargo install --git https://cnb.cool/codewhale.net/codewhale --tag v0.8.64 codewhale-cli --locked --force
-cargo install --git https://cnb.cool/codewhale.net/codewhale --tag v0.8.64 codewhale-tui --locked --force
+cargo install --git https://cnb.cool/codewhale.net/codewhale --tag v0.8.65 codewhale-cli --locked --force
+cargo install --git https://cnb.cool/codewhale.net/codewhale --tag v0.8.65 codewhale-tui --locked --force
 
 # 旧 Homebrew 互換。formula の改名が完了するまで deepseek-tui 名のままです
 brew tap Hmbown/deepseek-tui