Repository navigation
fix(catalog): resolve a bare model name to its one namespaced row - #16
Draft
SparkofSpike wants to merge 303 commits into
Draft
SparkofSpike wants to merge 303 commits into
SparkofSpike wants to merge 303 commits into
Conversation
…tion The codewhale-hq#7091 uninstall slice (cce6d3a) resolves the selected executable and each profile's parent with `canonicalize` and replaced seven `std::fs` calls with guarded no-follow opens, so crates/cli/src/update/uninstall.rs now has 5 path_canonicalize sites (budget 3) and 5 std_fs sites (budget 7). `codewhale uninstall` is a synchronous CLI command that runs before any async runtime exists, so these cannot move into spawn_blocking; the ratchet is regenerated with `python3 scripts/check-blocking-calls-budget.py --update` and changes exactly those two lines. Validation: `python3 scripts/check-blocking-calls-budget.py` failed before this change (path_canonicalize sites 5 > budget 3) and reports "566 sites across 168 files, within budget" after it; the regenerated JSON differs from main only in the two uninstall.rs counters (diffed on a clean git-archive export). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The five `always_load entry ... matches no tool` rows came from saved config naming the built-in Computer Use bundle removed in 4cf2d2c, and the text claimed the plugin-N prefix 'renumbers' when it is the plugin-name length. Entries with the Computer Use prefix now produce one status derived from the existing plugin registry (not installed, needs review, installed but off, enabled but cannot start, or entries the plugin no longer offers, with left_click now click); other misses are one grouped line. Nothing is installed, trusted, enabled or executed. 'MCP server guidance added/withdrawn' statuses are Internal so the app collapses them. Verified from a frozen git-archive export at 4d600ea plus only these two files: cargo check -p codewhale-tui exit 0, 0 warnings; focused tests status_visibility/always_load/should_default_defer 3/3 and always_load/deferral catalog 4/4 passed. Not run: full suite, hosted CI, installed-app replay. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Legal JSX in App.tsx is rejected when typescript-language-server explicitly selects ScriptKind.TS from the existing typescript didOpen languageId. Preserve one transport and configured custom IDs; select typescriptreact only for TSX documents on the built-in TypeScript ID. Verified actual TypeScript 5.9.3 parse behavior; existing LSP suite 64 passed, 0 failed, scoped clippy and workspace fmt passed. No new tests or comments per repository guidance. Developed with Codex assistance.
…ys-held-for-paste fix(tui): send a held key to vim Normal mode instead of typing it
…ifted-keys fix(tui): let vim Normal mode take shifted keys like G
…l-failure-diagnostics-20261028 fix(tui): retain remote-control startup failure diagnostics
fix(commands): localize /undo feedback
…-7585) Refs codewhale-hq#7118. A save, fork, rename, title change or conversation rewind used to publish whichever Work Graph transaction was pending, whatever session it belonged to and whether or not a newer graph had arrived after the snapshot was built. Publication now carries the saved session's owner and graph (SavedWorkProjection) and the Work runtime refuses it, leaving the transaction pending for the next save, when either no longer matches (publish_pending_matching and publish_pending_sync_matching in work_graph/runtime.rs; the unconditional publish remains only under cfg(test)). Fork reports that parent and child were saved but the active session did not change when Work could not be published. A conversation rewind that applied but could not be saved or published now says so ("Conversation was rewound, but its save or Work update needs attention"), puts the replacement or retry prompt back where the user can copy it, and does not send the retry. Does not close codewhale-hq#7118: the reporter's cancelled-turn case and the /task list versus To-do tracker visibility mismatch are neither reproduced nor changed. Known limits from three independent read-only reviews, none a blocker: the Engine SyncSession checkpoint branch still fails the request after the checkpoint was queued when the Work projection errors (its message says so); build_session_snapshot can still fall back to the last known Work state under lock contention, which the refused publish now reports after the write; a busy To-do lock still fails publication even with nothing pending; the partial-success toast says "retry was not sent" for a plain /undo and the new strings are not in the locale catalog. Validation: Git-free export of origin/main 4d600ea plus this change, codewhale-hq#7126, codewhale-hq#7130, codewhale-hq#7127, codewhale-hq#7121 and the codewhale-hq#7126 redraw follow-up, built and run on a Mac. cargo fmt --all -- --check clean. codewhale-tui lib focused run 281 passed, 0 failed (work_graph:: 43, session_snapshot_ 11, conversation_undo 3, undo_retry_apply_path 1, remote_control 90, phase_strip 43, paste 74, vim 3, composer_history 15) with RUST_MIN_STACK=16 MiB, the value CI and scripts/dev-test.sh export; at the default 2 MiB test stack the isolated undo lifecycle test overflows its stack in a debug build. Not run: the rest of the lib suite, Windows, hosted CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Follow-up to codewhale-hq#7126. The held-key flush runs after the event that triggered it has already drawn, so a Normal-mode key that changes the composer without setting needs_redraw (history recall with k, for one) left the old text on screen until the next terminal event. The flush now marks the frame dirty after dispatching the key. Validation: Linux tmux PTY replay of a stack build (origin/main 4d600ea plus the Work Graph packet, codewhale-hq#7126, codewhale-hq#7130, codewhale-hq#7127, codewhale-hq#7121 and this change) with composer_vim_mode = "vim" and a seeded two-entry history, TERM_PROGRAM unset and iTerm.app: after Esc and k the composer showed the second seeded prompt at +150 ms and again after 1.15 s idle, k k showed the first, j the second again; i hello world Esc 0 x w x d d emptied the draft at 120 ms and 30 ms spacing; G moved to the end of the line; v q G Esc A left the draft unchanged. A single-write burst of Normal keys on an untrusted terminal is still inserted as text, as codewhale-hq#7126 discloses. Not shown: the stale frame without this line (no codewhale-hq#7126-only binary was built; the claim rests on history_up not setting needs_redraw). Not run: Windows, macOS terminals. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…calized Follow-up to codewhale-hq#7121. /undo restores the files and truncates the App history before the portable handler sees the Restored outcome, and the Engine only learns about it through the SyncSession action that handler returns. The localized summary was built with ? on eight catalog lookups before that action, so a catalog that lacked one key turned a completed restore into a plain error result with no action, leaving the Engine's model context ahead of the files and history. The report is now built by restored_summary, and when it fails restored_fallback writes an English report from the outcome fields alone; is_error stays false and the SyncSession action is always returned. The shipped catalogs contain all 29 keys, so this is a guard, not a fix for a shipped failure. Validation: codewhale-commands unit tests in a Git-free export on a Mac. The existing undo_reports_the_request_each_file_and_the_conversation, extended with a presentation context that fails one key, fails against the unrepaired code (the result was "Error: catalog lacks cmd_undo_action_restored" with no action) and passes after: 28 passed, 0 failed for the undo and debug filters. cargo fmt --all -- --check clean. Not run: the codewhale-tui lib tests that call the command, hosted CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
fix(lsp): open TSX documents with typescriptreact language ID
…do, TSX and Work fixes Adds the Unreleased entries for codewhale-hq#7126/codewhale-hq#7130 (vim Normal mode), codewhale-hq#7127 (rc start failures), codewhale-hq#7121 (undo localization and its sync guard), codewhale-hq#7140 (TSX language id), the Work Graph publication fence (codewhale-hq#7118, with its open limit stated) and the codewhale-hq#7095 session entries: the status-line hint, retained and listed interrupted checkpoints, and the signal-exit flush (codewhale-hq#7122). Credits @Ricardo-M-L on docs/CONTRIBUTORS.md and web/lib/release-credits.ts and extends the @Lstarsky0, @laozidabo and @Aboysky lines. crates/tui/CHANGELOG.md is regenerated by scripts/sync-changelog.sh. The three web/ generated files were stale at HEAD (missing crates account-cli and plugins, two features, and the GUIDE.md digests that codewhale-hq#7127 changed); they are regenerated from HEAD plus only these edits in a scratch export, so they carry none of the uncommitted DSH work. Validation: sync-changelog --check, check-contributor-credit.py v0.10.2 (9 contributors, all credited on all three surfaces), check-versions.sh and check-facts.mjs pass on the scratch export; check-facts.mjs was red at HEAD before this. Not run: web build or hosted CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
crates.io codewhale-ratatui 0.1.2 (published 2026-10-13) has no Accent role, but codewhale-tui uses codewhale_ratatui::Role::Accent since the design-tokens 2.3.0 move, and the vendored copy changed after 0.1.2 went out. A registry build of codewhale-tui, and the crates.io dry run that verifies it, cannot compile against 0.1.2. The vendored crate is now 0.1.3 and crates/tui, pet/tui, both workspace locks, the vendored crate's own lock and the check-versions.sh literal pin it. Publishing 0.1.3 from vendor/codewhale-ratatui stays a release-time step that must precede the codewhale-tui dry run; this commit publishes nothing. Validation: cargo metadata --locked --offline succeeds in the workspace root, pet/tui and vendor/codewhale-ratatui; scripts/release/check-versions.sh and scripts/sync-changelog.sh --check pass. Not run: the crates.io dry run (needs 0.1.3 published first), a compile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…e-hq#7095) The notices printed for a foreign-workspace checkpoint tell people to run `codewhale sessions`, but the command listed only saved sessions and so never showed a session that an interrupted turn had advanced past its last save. It now uses SessionManager::list_sessions_with_recovery, the call the resume picker already uses: a session with a newer checkpoint, or only a checkpoint, appears with that checkpoint's message count and an `interrupted` mark, and a recovery warning goes to stderr instead of failing the listing. `--search` still searches saved sessions only, and `codewhale resume` without an id still numbers saved sessions only; both are unchanged. Validation: Linux Boat VM, debug build of a stack of origin/main 4d600ea plus the Work Graph change, codewhale-hq#7126/codewhale-hq#7130/codewhale-hq#7127/codewhale-hq#7121 and the uninstall slice, then this patch (sha256 d8dbb185…), with a loopback mock model inside an unshare -rn network namespace and a synthetic home. One saved session and one session killed by SIGTERM mid-stream: before, `sessions` showed the interrupted one as "New Session | 0 msgs"; after, "New Session | 1 msgs | interrupted"; `--limit 1` shows the newest row and "1 more session(s)"; `sessions list --limit 5` matches; cargo fmt --all -- --check clean. The row keeps the saved title, so it still reads "New Session". Not run: a session that exists only as a checkpoint (no saved file), the lib test suite (no test covers fn list_sessions in lib.rs), Windows, macOS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…kip ci] The live mention review on PR 7126 published two suspected hypotheses as concerns despite recording that surrounding code was unavailable. The separate publisher now requires reproduced/traced evidence with nonempty detail, requires introduced authorship for inline comments, and collapses pre-existing findings. Model summaries, risk assessments and unlinked suggestions stay in the analysis artifact so they cannot repeat a withheld allegation. An empty result remains advisory and links to analysis/coverage. This is an evidence-record boundary, not independent reproduction or proof of accuracy; the Engine remains the review authority. Validation: existing Action checks 8 passed, 0 failed; Node syntax checks and diff whitespace check passed. Offline replay of actual run 40835017974 artifact withheld both suspected claims and emitted zero inline comments. Direct local variations covered empty/missing evidence, introduced/preexisting/unknown attribution, escaping and deduplication; a mocked publisher run reported 0 eligible and 2 withheld findings without network/provider calls or GitHub writes. No new tests, Rust build or hosted CI. Legacy post:true retains its pinned CLI policy. Refs CW-7503.
c962177 rewrote the 'codewhale review' table row in README.md but left all 18 translations on the old wording, missing link and stale stamps, so scripts/check-readme-translations.py fails on main. Translate the new row in every pack (linking the anchor that commit added) and bump the stamps. Signed-off-by: Boyce <aboyskyi@gmail.com>
Both analysis and isolated publisher now resolve c2a4872. Existing CLI v0.10.2/model/reasoning compatibility and selected-repository installation are unchanged. Validation: actionlint and diff whitespace checks passed. Reuses the 8 passing Action checks and actual-PR offline replay recorded in the carrying commit; no new live inference, GitHub review, hosted CI or release. Refs CW-6869 and CW-7503.
…t-row Translate the self-serve review-bot setup row in all 18 README packs and refresh their source stamps. Validation: python3 scripts/check-readme-translations.py on the current-main merge tree: README translation check OK — 18 translations in sync with README.md (sha256:0430d94f3d47). Reviewed current-head changes, review threads and dependent PRs. No hosted CI dispatch or release qualification.
Keep the conversation rewind explanation when its persistence or Work update fails, and say a retry was not sent only when one was pending. Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
… ci] A repeated start during connecting or connected reports a separate toast instead of replacing the current authorization banner. Refs codewhale-hq#7127. Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
… ci] Ollama model publication stays with its capability-aware native refresh; generic key verification cannot overwrite it with embedding rows. This prevents new contamination and does not claim repair of a previously persisted bad cache. Refs codewhale-hq#7116. Validation: the frozen TUI test target compiled; existing UI/provider/reasoning filter union: test result: ok. 233 passed; 0 failed; 13703 filtered out. This includes Work graph, session rewind, remote control and provider-key roster checks. The separate compaction group has one old header-text expectation to update (187 passed / 1 failed); this change does not touch that behavior. No hosted CI, live provider or release qualification.
…-safe validation Adapts the DSH/Pi compaction shape inside the existing Engine owner: prune bulky tool output first, keep a token-priced raw tail cut on complete tool exchanges, summarize the older span plus prior checkpoint, save original history before commit. The summary validator now strips leaked think/reasoning spans (including unmatched tags) before the placeholder check, so a bare closing tag no longer passes as a summary. The lexical number/backtick checker and the duplicate TypeScript survival validator are removed; one Rust validator remains. Turn calibration learns only upward from reported usage and a failed automatic summary stops the turn instead of looping. Verification: NOT compiled or tested in this tree (uncompiled batch; build owner is the Review peer's in-flight tui build). Local commit only, not pushed. Known open: whole-conversation fallback when no older span exists. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ngine [skip ci] Negotiate structured review v2 with complete bounded source files, explicit omissions, prior findings and discussion on the existing Engine review path. Preserve v1 fingerprints. Validate path, revision, text and identity bounds before the model call; bind the result to the exact request and head/base. Keep only traced hosted findings and require a current included head-source trace for each explicit prior-finding resolution. Advertise structured_review_version=2 and bound requested reasoning to the exact route and visible output budget. The hosted review retains one step with no execution tools; it cannot claim reproduction. No new turn loop, account store or provider fallback is added. Verification: TUI lib-test binary compiled successfully; all six Review source hashes stayed unchanged. Explicit existing filters passed 9 review-core and 38 review-tool checks. Current protocol crate passed 78 existing checks. The original structured_review filter selected zero tests and is compile proof only. The linker warned that the unwind section exceeded its compact-table limit. Concurrent compaction/Ollama and fixture edits invalidate a current whole-tree claim; their exact drift and the compile inputs are recorded in artifacts/codewhale-review-build-20261029/engine-review-compile-receipt.json. No full-tree, v2 provider rehearsal, hosted CI, release or deployment qualification is claimed. This commit must stay local until the release coordinator verifies its pending predecessor before pushing main.
Adds the bounded git child_process shim (UTF-8 default, metadata-only Git, preserved denial codes, nonzero exit and ABORT_ERR/maxBuffer error shapes), the git_review_scope canonical action and read-only authority category, policy v8, and explicit composition-review setup in the four DSH/skill import fixtures that depended on a process-global reviewer. Verified on the frozen current tree (Engine 81ae174 + dirty inputs): Node host 413 pass/7 skip earlier; tui lib plugins_dsh_tests 30/30, plugins_skill_tests 5/5, composition 8/8, tools::git 76/76, feature_registry 2/2. NOT verified: the published @michengai/dsh-code-review loopback journey, cancel parity and the sandbox-escape matrix; those remain open under CW-7055. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…#7115) Moves the startup-route test to local_ollama::startup_route_configured (deleting the copy in tui/app/init.rs) and uses it so exec, and doctor --probe-local, pick a live local Ollama model when no cloud key or explicit route exists, saving nothing. doctor reports "Not confirmed" without the probe. Verified: compiled in the frozen tree; no fresh-state exec/doctor journey run yet against a real Ollama server (codewhale-hq#5848 stays open). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Default for ReasoningEffort and the API-key/config writers moves to auto; docs and config.example.toml follow. Explicit user effort is untouched. Verified: reasoning_preference 8/8, model_routing 45/45. Fresh-config first-run writer path not exercised end to end. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… /cost fixture Shortens file tool descriptions and reuses the line_ending schema in WriteTool (codewhale-hq#7070), copies InteractionTarget, scopes test-only imports in app-server, and updates the /cost [details] diagnostics fixture (requires_argument now true). Verified: tools::file 191/191, frame:: 37/37, surface_metadata 1/1. app-server changes are compile-checked only by the in-progress CLI build. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ctive rollback recipe (codewhale-hq#7091) Canonicalizes home/install paths and dot spellings, rejects a purge target that contains the home or install directory, keeps ownership and symlink guards, names recovery/snapshot/shared-data consequences, uses a literal environment-bound PowerShell path for deferred Windows deletion and canonicalizes both sides of the Windows PATH-block match. INSTALL.md's go-back-further recipe now moves the working binaries aside and restores them if the install fails. Verified: macOS sandboxed probe on a stripped copy of the frozen-tree CLI (sha256 d28274cb...), 4 cases pass (plain, purge, managed, hardlink); receipt in artifacts/claude-uninstall-probe-0415/probes/receipt.json. NOT verified: Linux and Windows execution, package-manager receipts, installer refusal rules in scripts/release/install.sh, zh-Hans section 12 still suggesting rm. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…schema 4, notice 6) Usage reporting adds two aggregate events per session: model_usage (provider, catalog model or "other", turns by outcome, input/output/cache-read/cache-write tokens, turn-time buckets) and tool_usage (first-party tool name, or "mcp"/"other", with calls and errors). Models are named only when in the bundled public models.dev catalog; tool names come from a closed list. No content, arguments or paths. CI and GitHub Action runs report the "ci" session source. DO_NOT_TRACK=1 turns reporting off like CODEWHALE_TELEMETRY=0. The notice bump re-shows the disclosure once in all 15 locales. The ingest accepts v4 and still accepts v3/notice 5; docs/TELEMETRY.md describes both events. Re-applied from recovered commit a20702df43 (built on the S57 split) onto main 78580d3 without conflicts. Founder approved for 0.10.3 (D14). DEPLOY ORDER: the live ingest rejects schema 4. Deploy the ingest before any Engine release that sends v4. Nothing deployed here. Verified on the frozen tree (artifacts/claude-0103-build-20261029-0418-telemetry/): codewhale-telemetry 53/53, codewhale-localization 54/54, codewhale-config telemetry 17/17, codewhale-tui lib telemetry 40/40, setup_state 11/11, telemetry-ingest vitest 174/174 and tsc --noEmit clean. Not re-run on this tree: the real-turn exec --auto into wrangler dev and the DO_NOT_TRACK zero-request run reported on the original commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… auto thinking, DSH Git scopes, usage reporting) Regenerated crates/tui/CHANGELOG.md with scripts/sync-changelog.sh (--check clean). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ewhale-hq#7166) [skip ci] chore(deps): bump toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0
…ip ci] Refs codewhale-hq#7172 (CW-7651). Admit a continuation through the existing fresh-turn gates with typed runtime provenance. Keep the objective available again after a checkpoint, preserve explicit goal budgets and distinguish estimated conversation input from lifetime usage. An ordinary human message cannot suppress the authoritative objective. 14 goal-continuation and nine context-pressure cases passed. Actual macOS and Ubuntu ARM64 TUI requests to a scripted loopback provider sent a 1,238-byte objective on the first pass only. Repeated messages including turn metadata measured 3,076 and 3,055 bytes respectively. No provider billing was inferred. Combined validation also exposed an independent assertion in the separate codewhale-hq#7181 overlay.
…rs [skip ci] Refs codewhale-hq#5848 and codewhale-hq#7116 (CW-7584). The startup catalog can adopt an installed chat model on an explicitly selected, idle Ollama route. Re-selecting an already-resolved provider keeps the existing behavior. An unresolved local selection can retry discovery after its daemon starts. Two affected existing checks passed. In an actual macOS terminal the startup-selected qwen3:4b answered 9+7 with 16 and persisted the turn. The separate candidate with a real late-starting private Ollama daemon stayed unknown for empty and embedding-only rosters, selected the chat tag when added, and restored it after restart. Desktop and Windows were not exercised.
…p ci] Refs codewhale-hq#7085 (CW-7532). The bundled descriptor marks this exact catalog base URL public. Clear configured headers and use anonymous auth only on the catalog client. Managed account, plugin, session-only credential, endpoint-scope and inferred key-health guards stay in place. The normal inference path still uses the configured credentials. Existing descriptor and public-endpoint health checks passed. Clean macOS and Ubuntu ARM64 CLI installs each listed 127 models without credentials. The Linux set matched every ID from a simultaneous public endpoint read. An egress-denied macOS inference attempt failed at the missing configured key. No paid inference was attempted.
…q#7181) [skip ci] Keep Lstarsky0’s original change. Track the running display column without rescanning preceding spans. The existing wrapped-row case checks every one of 120 linked cells beside a wide character, using the inclusive column contract. The combined TUI-kit run passed 215 cases; the corrected assertion then passed separately. Ubuntu ARM64 PTY widths 80 and 120 each displayed both real OSC 8 targets. Co-authored-by: Lstarsky0 <59827030+Lstarsky0@users.noreply.github.com>
…kip ci] fix(tui): parse a table cell's markup before wrapping it
Reuse the same durable lease as the six existing generation tasks. The manual facts route passes its binding and a missing lease refuses before fetching. Overlapping refreshes share one named writer through the existing hold period. CW-6945, audit W02-05, refs codewhale-hq#6556. Four focused Vitest suites passed 70 cases. A strengthened existing case confirmed two concurrent callers performed one revision fetch, wrote one drift log entry, and a missing binding made no request. Web TypeScript passed. Local fixtures only.
…skip ci] Keep the existing model, output limits, temperature, JSON and usage contracts for each caller. Read UTF-8 JSON through the existing 2 MiB outbound budget and cap provider error text at 4 KiB before diagnostics. Reject overflow while streaming even when the peer understates Content-Length. CW-6943, audit W01-08, refs codewhale-hq#6554. Five focused Vitest suites passed 71 cases. Twelve local checks through both entry points exercised successful usage, 429 diagnostics, declared and streamed overflow and cancellation of an understated body. Web TypeScript passed. No live inference or deployment.
CW-6945 / codewhale-hq#6556 W02-05. A pending generator could put a discarded draft back on the review list. Save under the per-identity claim and retain the old decision until replacement writes succeed. Stage both weekly digest records together under that claim. Check the exact reviewed revision under the same claim before acting, including when a worker reads stale KV. Legacy records without a stored revision keep their reviewed-text check. 82 focused web checks and TypeScript passed. Replayed overlapping discard and failed reopen, then stale copies at both admin actions. Both stale actions returned 409 with zero outbound calls. Local workerd granted 1 of 8 concurrent claims and retained the revision after restart. Rechecked all 51 review-state cases after reusing the existing digest TTL. No hosted release validation or deployment.
CW-6943 / codewhale-hq#6554 W01-05. Read up to 32 recent digest keys from one bounded listing in groups of four. Reuse the signed-facts KV stream reader for strict UTF-8 and at most 128 KiB per record. Skip failed, mismatched, malformed or oversized entries independently. Verify reviewed language and cap sections and items before rendering. The weekly producer retains records for 90 days. The former page issued 100 simultaneous text reads and one failed read blanked the archive. With 100 seeded records the renderer issued 32 streamed reads, at most four concurrent, canceled the oversized stream and rejected seven invalid record classes. Google Chrome displayed the 25 eligible articles in reviewed-language order. With one additional failed read, the other 24 still rendered. 80 existing signed-facts and review-state checks plus TypeScript passed. Verified locally.
…ip ci] CW-6943 / codewhale-hq#6554 X01-09. All five bridges use the same byte-bounded SSE reader. Handle LF, CRLF, CR, split UTF-8 and multiline data. Reject oversized, malformed or truncated frames and check thread identity and sequence before saving cursors or acting on approvals. A transport end preserves the observed turn. Feishu and WeCom retire only the matching completed turn, including when a newer one arrived during final delivery. Bound Runtime JSON and errors while preserving legacy empty and plain-text handling. Reproduced zero events on CRLF, an accepted oversized frame and silent truncated EOF in the former reader. 168 existing channel/core checks passed, with one Windows-only skip. DingTalk syntax passed. 70,000 coalesced frames, adversarial framing, 11 response-bound cases and ten restart/readback channel cases passed. The frozen macOS Engine produced thread.started over authenticated loopback SSE and an observer with the wrong thread failed closed. No real channel credentials, delivery or inference used.
… [skip ci] Both fresh channel packages completed npm installation and failed their first bridge-core import. Stage the adapter and shared package as siblings in the same atomic replacement. Preserve the previous service and npm paths and load the installed library before promotion. CW-6950. ShellCheck and bash syntax passed. All 58 existing installed adapter cases passed on macOS and Ubuntu ARM64. Both real Node entry points reached credential validation without channel credentials. Broken core and lockfile upgrades left the prior package and neighboring channel intact. No service was deployed.
…skip ci] Route file-backed undo through the same acknowledged Engine rewind as conversation-only undo. Hold the TUI transcript until the Engine accepts the expected prefix. Distinguish a restored workspace from a refused conversation rewind and a failed durable save. Preserve the surviving journal branch and retry guards. CW-7418, refs codewhale-hq#6970. A fresh Ubuntu PTY reproduced eight stale active entries after file rollback. The repaired CLI restored an edit, removed a created file, preserved an unrelated file and retained eight recoverable journal entries with zero active messages across restart. Five portable command cases passed. The first native run passed 47 of 50 TUI checks. Three stale checks expected a soft sync or early truncation and passed after updating only those assertions. Native Windows and selected-range undo remain separate.
…s [skip ci] Distinguish logical placeholders from concrete pending children. Apply each envelope through one slot update, claim an unknown child only into an available placeholder, and ignore late spawn notifications once the child is running or settled. CW-6945 U05-04. A replay compiled from the owning source initially failed three of four ordering scenarios. All four passed after the fix, including exact logical-key priority. All 21 focused native mailbox, reconciliation, fanout, terminal-card and worker-view checks passed. No new tests or dependencies.
… ci] CW-6943 R02-03. Stream release metadata within 8 MiB and read at most 4 KiB of error detail before sanitizing it. Successful assets retain their own 512 MiB ceiling. Parse failures report a location without echoing the input. Keep HTTP status retries, redirect host checks and signed asset verification on their existing paths. Publish the sanitizer before its new consumer. 81 focused existing release/CLI checks passed. All 26 real loopback cases passed for async discovery, CLI metadata, asset reads and malformed JSON. Before the change both declared and chunked 8 MiB-plus-one bodies were accepted, and both long 404s exposed a remote OSC sequence and tail. The 45-crate release order, formatting and diff checks passed. No candidate package or installation was published.
…p ci] CW-7553. On a shutdown signal, cancel the admitted turn and bound the interactive snapshot and existing persistence flush by the shutdown deadline. Accept recovery messages only for the matching session, workspace and existing message prefix. Preserve the typed InterruptedAssistant tail through Escape and restoration without making it eligible for /copy. Ubuntu ARM64 before: SIGTERM lost visible partial output on disk and resume. Four frozen source-built terminal runs passed: SIGTERM, SIGHUP, Escape followed by restart, and an explicit provider follow-up. Each resumed the marked reply exactly once, copied only the completed response and made no automatic request. The loopback peer observed one marked assistant copy on explicit follow-up. Signals completed in 80–171 ms. Formatting, blocking and dead-code budgets passed. The separate native libtest build stopped at the storage guard before running tests. Deepin, Windows and SIGKILL are outside this qualification.
CW-6944 W02-09. Validate version, tag, date and URL on both checked-in release records and the version and URL of cloud facts. Permit the 24-hour grace only when all records describe the actual preceding published release. A retry also repairs a wrong URL or version on records with a current tag. Eight of 13 local process cases failed before this repair. All 13 passed afterward including current data, mismatched URLs or versions, the legitimate post-publication grace, drift during grace, write repairs and GitHub failure. The two existing web suites passed 14/14. A read-only check against GitHub matched published v0.10.2 and the cloud-facts gate passed.
…ds [skip ci] CW-6944. An array in a JSON object slot discarded version fields when serialized, and primitive mirror fields could be spread into a misleading release record. Refuse malformed matrix, mirror and cloud release shapes before staging any replacement. Continue rebuilding an absent derived release field on a valid matrix. Four of eight process cases incorrectly reported success before this change. All eight pass now with byte-identical inputs on refusal. The earlier 13 consistency and repair cases still pass. The two public-surface and cloud-facts suites passed 41 checks together.
…skip ci] CW-7640 and codewhale-hq#7133. Keep the plan and the completed turn on the same resolved wire model. Store the matched provider identity, model, token window and provenance. A session projection carries the Auto selector, so only admitted and completed routes establish the actual model. Show a restored receipt separately from the prospective budget. Older, unknown and zero historical windows remain readable. The baseline discarded the last window on restart. On the frozen Ubuntu ARM64 CLI five fresh-process journeys passed for provider-wide and exact-model overrides and for absent, unknown and zero historical metadata. The saved 135791-token window stayed historical. The next real turn used 75319 and resume issued no model request. The existing round-trip assertion checked all 53 released provider representations on the preceding wire-identical serde implementation. Workspace rustfmt and version gates passed. The separately reported Windows 40% compaction trigger remains open.
…[skip ci] CW-7553 and codewhale-hq#7095. The recovery interval wrote only fully committed API messages, so a SIGKILL after the checkpoint advanced still lost the visible answer. For the active turn with the matching runtime ID and a user-message tail, append streaming assistant prose to the checkpoint journal copy using the existing interrupted-assistant role. The live journal stays with the Engine. Its normal completion replaces the checkpoint. Suppressed stream events, stale turns and completed messages cannot produce an extra tail. On real Ubuntu ARM64 the baseline lost the visible reply immediately and after a 43.44-second checkpoint advance. The candidate recovered it after the checkpoint, resumed without a provider call and sent exactly one marked copy on explicit follow-up. A normally finished stream reopened as one completed message. SIGTERM retained the partial, /copy retained the completed answer, and the immediate SIGKILL still had only previously durable content. Four recovery journeys and five adjacent Auto-window journeys passed on afb29f01be10. One code block changed only by rustfmt after the binary freeze. Original Deepin and native Windows are separate qualifications.
…skip ci] Correct two unreleased notes against de99f05 and 5fd52e8. Keep the original signal-handling credit and distinguish a periodic durable checkpoint from an immediate hard kill. The embedded changelog matches the generated 15-release window. Both web derivations, 12-contributor attribution and the version consistency gate passed.
SparkofSpike
force-pushed
the
fix/bare-model-catalog-lookup
branch
from
November 1, 2026 09:56
2cc7ffb to
76f6e7f
Compare
added 2 commits
November 1, 2026 02:10
…ck [skip ci] Confirm the idle Engine snapshot and selected prompt occurrence before rewinding. The picker now shares the acknowledged rewind, completed checkpoint, flush and Work projection used by /undo. Keep files in place and return the chosen prompt to the composer. Refuse an ambiguous boundary or a stale conversation. CW-7418 / codewhale-hq#6970. A five-turn Ubuntu ARM64 terminal previously reopened dropped turns after SIGKILL. An intermediate candidate also retained the selected turn when tool and generated context messages shifted the raw depth. On the final frozen Rust sources four terminal journeys passed. A unique selection and both positions of an identical prompt survived SIGKILL with the expected A/B or A-D history on the next actual request. The journal retained the original entries and every workspace file kept its bytes. A forced save failure surfaced a visible error and made no request. Ordinary file-plus-conversation undo and picker cancellation passed on the preceding build. Cargo fmt, the blocking and dead-code budgets, version consistency and the embedded changelog passed. The Runtime API's multi-turn file restore has separate Ubuntu evidence. Combined file-range progress in the terminal and native Windows package acceptance remain open.
The documented local registry checker stopped with FileNotFoundError after the Engine extraction. Inspect readiness in the Engine and retain the TUI doctor source for presentation. The registry passed on current main and the config example retained all eight root keys. Removing each guard independently in memory produced its own expected failure. Refs CW-7701.
SparkofSpike
force-pushed
the
fix/bare-model-catalog-lookup
branch
from
November 1, 2026 10:16
dabae29 to
9572061
Compare
CW-7701. The Engine move left session_files imported by the Windows test module although only its Unix permission probe calls it. Reference the function inside that probe. Using the actual doctor test module, production formatter and real Windows dependency metadata, rustc --test --emit=metadata -Dwarnings on x86_64-pc-windows-gnu reproduced the exact unused import before the edit and passed after. The existing macOS permission probe passed on the prior build. Formatting passed. A complete Windows test-target cross-check stopped in the unrelated simdutf C++ dependency before checking the TUI. Native Windows remains a final qualification.
A custom `openai-compatible` endpoint names the model the way the endpoint does — `model = "deepseek-v4.1-flash"`, no vendor prefix. The curated table had rows for `deepseek-ai/deepseek-v4.1-flash` and a canonical Models.dev row under `deepseek/deepseek-v4.1-flash`, but no row under the bare spelling, so the lookup matched nothing and the route fell through the whole resolution ladder to the static 128K window with an unknown output ceiling. The model itself is catalogued as 1M context / 384K output. Add the bare row, taking the facts from the canonical Models.dev row (`context 1000000`, `output 384000`, reasoning, text+image). This follows the existing pattern: `deepseek-v4-pro`, `deepseek-v4-flash` and `deepseek-flash` already carry a bare row next to their namespaced spellings. An earlier revision of this branch instead taught `intrinsic_model_in` to adopt a namespaced row when exactly one carried the bare tail. That was dropped: `deepseek-v4.1-flash` is already claimed by the `opencode-go` and `opencode-zen` transport rows, so the shared-spelling rule stated by codewhale-hq#6032 would have kept it unknown, and the fallback only appeared to work because its guard did not read the transport table. Curating the row keeps the lookup exact and leaves the resolver alone. Gates: `cargo fmt --all -- --check` clean. `cargo test -p codewhale-config` 795 passed, 0 failed, 1 ignored (1 added). `cargo clippy -p codewhale-config --all-targets -- -D warnings` clean. The new test asserts on the bundled catalogue, not a fixture, and fails without the row.
`deepseek-v4.1-flash` sat in `deepseek_v4_output_caps_require_exact_catalog_metadata` among the spellings that must NOT resolve, because it had no model-only row and took its ceiling from a provider offering instead. With the curated row added in the previous commit the exact lookup succeeds, so the assertion moves to the resolved list next to `deepseek-v4-flash` and `deepseek-v4-pro`. The near-miss spellings stay unresolved: `deepseek-v4.1-flash-expires-on-0910`, `deepseek-v4.1-pro`, `vendor/deepseek-v4.1-flash` and `deepseek-v4-flash-vendor` still assert `None` on both lookups, which is what the test is actually about — an exact row documents one identifier, never a family. Gates: `cargo test -p codewhale-models` 108 passed. `cargo clippy -p codewhale-models --all-targets -- -D warnings` clean. `cargo test -p codewhale-config` and `-p codewhale-agent` still pass.
Review feedback on the previous commits found two statements that claimed more than the data supports. - The test comment said a caller "cannot get two different windows from two spellings". That holds for the two spellings the test compares, but the `deepseek-ai/deepseek-v4.1-flash` twin is curated at 1048576 with no output ceiling, so the absolute form is false. The comment now names that twin and calls reconciling it a separate data question. - The row's `source` said the bare spelling "resolves to the same facts". It mirrors context, output, modalities and reasoning, but not `tool_call` or `attachment`, and `family` differs from the canonical row. The string now lists exactly what was carried over. No behaviour change: values are unchanged and `python3 scripts/catalog_models_dev.py seed render --check` still reproduces the committed bundle byte-for-byte apart from the OS path separator in `_meta.generated_by`.
SparkofSpike
force-pushed
the
fix/bare-model-catalog-lookup
branch
from
November 1, 2026 10:53
9572061 to
3a9f261
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A custom
openai-compatibleendpoint names the model the way the endpoint does —model = "deepseek-v4.1-flash", no vendor prefix. The curated catalogue had rows fordeepseek-ai/deepseek-v4.1-flashand a canonical Models.dev row underdeepseek/deepseek-v4.1-flash, but no row under the bare spelling.For a
Customrouteprovider_capability_with_wirereads the model-only lookup directly:so the bare spelling got a 128K window and an unknown output ceiling. Built-in routes (
deepseek,orcarouter, …) do not show this because they resolve through a provider offering instead.What changes
crates/config/assets/catalog_corrections.json— newreviewed.intrinsicrow underdeepseek-v4.1-flash, taking the canonical Models.dev numbers (context 1000000, output 384000, reasoning, text+image). This is the patterndeepseek-v4-pro,deepseek-v4-flashanddeepseek-flashalready follow: a bare row beside the namespaced spellings.crates/config/assets/models_dev.bundled.json— the same row, byte-identical.crates/config/src/catalog/reviewed.rs— regression test asserting on the bundled catalogue.crates/models/src/lib.rs—deepseek_v4_output_caps_require_exact_catalog_metadatamoves the bare spelling from the must-not-resolve list to the resolved list, with a comment saying why. The near-miss spellings (deepseek-v4.1-flash-expires-on-0910,deepseek-v4.1-pro,vendor/deepseek-v4.1-flash,deepseek-v4-flash-vendor) still assertNone— an exact row documents one identifier, never a family.What the user actually gets
window / 4)The output request stays at
API_MAX_OUTPUT_TOKENS = 65_536— that is the existing product cap, and 384,000 is only the documented capability shown in labels and receipts. This PR does not raise the request cap and should not be read as promising 384K of output.Why a data fix and not a lookup change
The first revision of this branch taught
intrinsic_model_into adopt a namespaced row when exactly one carried the bare tail. That was wrong and has been dropped.deepseek-v4.1-flashis already claimed by two transport rows (opencode-go,opencode-zen), so the shared-spelling rule from codewhale-hq#6032 would have kept it unknown; the fallback only appeared to work because its guard happened not to read the transport table. Curating the row keeps the lookup exact and leaves the resolver untouched.The twin rows also disagree:
deepseek-ai/deepseek-v4.1-flashis curated at 1048576 (source: DeepInfra listing + ModelScope card, verified 2026-10-20) whiledeepseek/deepseek-v4.1-flashis 1000000. A tail-matching resolver would have silently chosen one layer. The new bare row takes the canonical Models.dev numbers and says so in itssourcestring; the 1048576-vs-1000000 disagreement between the two namespaced spellings is pre-existing and left alone.Verification
cargo fmt --all -- --check— clean.cargo test -p codewhale-config— 795 + 9 + 1 passed, 0 failed, 1 ignored.cargo test -p codewhale-models— 108 passed.cargo test -p codewhale-agent— 70 passed.cargo clippy -p codewhale-config -p codewhale-models --all-targets -- -D warnings— clean.Not run locally:
cargo test -p codewhale-tui.rustcaborts withSTATUS_STACK_BUFFER_OVERRUNwhile codegen'ing that crate's test harness on this machine, before any test executes and independently of this change.route_budget::uncatalogued_deepseek_variants_require_exact_output_metadatawas checked by hand: for the bare name it assertsDocumented(384_000), which came from the canonicalmodelsrow surfaced as a gap-fill offering (catalog.rs) rather than fromDEEPSEEK_ALIAS_REPLACEMENT— that alias table has nov4.1entry.max_output_tokens_for_modelnow returns the same 384000 from the curated row, andofficial_deepseek/alias_deprecationare unchanged, so the assertion still holds.Scope — what this does not do
gemma-4-31b-it,qwen3.6-27b,nemotron-3-ultra-550b-a55b, …). Each needs its own sourcing decision.Context
Found while investigating why a
freeshareopenai-compatible route reported a 128K context window fordeepseek-v4.1-flash. That provider's/modelspublishes no limits — verified, the body carries onlyid,type,display_name,created_at— so nothing can be auto-detected from the wire and the catalogue is the remaining source.署名
🤖 由 SpikeBot 000(CodeWhale-LOCAL) 生成