Prepare CodeWhale v0.8.68 release candidate

CHANGELOG.md

@@ -7,12 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.8.68] - 2026-07-12
+## [0.8.68] - 2026-07-13
 
-The underwater release: the TUI's default shell is replaced end to end, the
-runtime keeps its guarantees, and the whole new layer ships localized. The
-entries below cover the full candidate; the pre-candidate section that
-follows records what had already landed on main for 0.8.68 by 2026-07-10.
+Release-candidate notes for the underwater release: the TUI's default shell is
+replaced end to end, the runtime keeps its guarantees, and the new layer is
+prepared with localized coverage. These notes describe the code prepared for
+v0.8.68; they are not evidence that the public tag or package artifacts have
+been published. The pre-candidate section that follows records what had already
+landed on main for 0.8.68 by 2026-07-10.
 
 ### Changed — the underwater shell
 
@@ -86,6 +88,33 @@ follows records what had already landed on main for 0.8.68 by 2026-07-10.
   `Alt+[`, `Alt+]`, `Alt+L`, `Alt+?`), and give theme, Help, model, and
   config rows direct mouse paths with the same activation as Enter.
 
+### Changed — release-candidate integration
+
+- Make worker delegation route-aware and identity-safe: workers receive a
+  small role-scoped system prompt instead of stale parent/model boilerplate,
+  faster routes resolve through the configured provider, and opening a worker
+  shows its complete available transcript. Remove `token_budget` from the
+  ordinary model-facing Agent schema so agents do not micromanage ad-hoc
+  launches; explicit legacy calls remain readable for compatibility.
+- Mature `/config` interaction for enumerated and boolean settings with
+  pickers/toggles, mouse-wheel scrolling, stable focus, and configured-provider
+  selection. Startup mode is now only Agent or Plan; legacy `operate`/`yolo`
+  settings migrate to Agent with permission posture represented separately.
+- Show where effective permission policy comes from and keep profile,
+  environment, project, managed, and requirements-controlled posture read-only
+  in the in-session editor. Runtime presets edit only proven user-owned root
+  settings and no longer persist temporary environment overlays.
+- Restore the original four-line whale mark and make ambient ocean motion
+  coherent across the full scroll surface: one continuous ombre, eased fish
+  that face their direction of travel, fish in otherwise blank scrollback, and
+  explicit reduced-motion and animation controls.
+- Keep model reasoning in the transcript rather than the Tasks strip, retain
+  the live header status indicator, separate worker and success colors, and use
+  the same rail grammar for both work-strip and transcript scrollbars.
+- Present the default Z.AI Coding Plan route, including child routes, as
+  subscription quota instead of estimated per-token dollars. No undocumented
+  account endpoint is called by this change.
+
 ### Added
 
 - Korean (ko) UI locale with full key parity and onboarding/setup wiring
@@ -113,6 +142,20 @@ follows records what had already landed on main for 0.8.68 by 2026-07-10.
 
 ### Fixed
 
+- Resolve the sub-agent completion/cancellation race with one terminal-state
+  claim: cancellation suppresses late mailbox/parent/UI delivery, while a
+  completed result remains publicly running until its notification is safely
+  delivered.
+- Keep Workflow panel controls from stealing ordinary composer letters. Enter,
+  Delete, Up/Down, and Esc own panel actions; typed characters return focus to
+  the composer and start the message normally.
+- Preserve the composer prompt gutter from the first typed character through
+  wrapping, scrolling, cursor placement, and mouse hit-testing so the `>` does
+  not disappear or make input appear to jump.
+- Emit terminal-native OSC 8 metadata for rendered URLs without placing escape
+  payload bytes in the measured text, keeping long links visible, selectable,
+  and clickable in supporting terminals.
+
 - Keep headless structured output terminal-clean: `codewhale exec` engines
   no longer emit interactive terminal-title/taskbar OSC sequences, so
   `--output-format stream-json` stdout stays parseable, escape-free JSONL.

CODEWHALE_0_8_68_TRACKER.md

@@ -1,12 +1,15 @@
 # CodeWhale 0.8.68 — Workflow + Stability Patch Release
 
-> **Status (2026-07-12): Historical.** v0.8.68 shipped on 2026-07-10; this
-> tracker is superseded by the shipped release. Caution for readers: the
-> Wave-7 "Multitask" rows below are marked Done but describe work that was
-> **rolled back before ship** — Multitask never shipped and leftover settings
-> normalize to Operate (`crates/tui/src/tui/app.rs`, mode picker). The
-> "deferred to 0.9.0" lists remain useful as a raw next-major backlog feed;
-> the release label itself is a maintainer decision.
+> **Status (2026-07-13): Historical planning record for an unpublished release
+> candidate.** v0.8.68 has not yet been tagged or publicly published. The
+> checkmarks and verdicts below record planning at different points in time;
+> they are not completion, test, merge, or release evidence. Use the current
+> [v0.8.68 release-candidate ledger](docs/releases/v0.8.68-release-candidate.md)
+> for release truth. In particular, the Wave-7 "Multitask" rows describe work
+> that was rolled back; Multitask is not a startup mode, and legacy
+> `operate`/`yolo` settings normalize to Agent with permission posture stored
+> separately. The "deferred to 0.9.0" lists remain useful only as raw backlog
+> input; milestone and release scope remain maintainer decisions.
 >
 > **What this is.** Local tracker + handoff for the CodeWhale 0.8.68 release
 > candidate. It documents what's in scope, what's deferred to 0.9.0, and the

HANDOFF_v0.8.68_completion.md

@@ -1,13 +1,15 @@
 # CodeWhale 0.8.68 Handoff — Finish the Landing
 
-> **Status (2026-07-12): Historical / completed.** Every actionable item below
-> either landed by v0.8.68 (multipart/brotli removal, palette migration,
-> allowed_tools deletion, tools_file/removed_messages cleanup, double-Enter
-> steer) or was deliberately superseded — item 7's "remove `todo_*` aliases at
-> 0.9.0" went the other way: #4132 keeps `todo_*`/`checklist_*` as hidden
-> replay aliases, so do not execute it. The DO-NOT-DELETE module table below
-> remains a standing guardrail. The companion `opportunities.md` was never
-> committed; its link is dangling by design.
+> **Status (2026-07-13): Historical handoff, not completion proof.** v0.8.68 is
+> still an unpublished release candidate. Paths, branch counts, checkmarks, and
+> verification claims below describe the checkout that produced this handoff;
+> do not use them as evidence for the current candidate. Use the current
+> [v0.8.68 release-candidate ledger](docs/releases/v0.8.68-release-candidate.md)
+> instead. Some listed work is now present in the candidate and some was
+> superseded — notably, #4132 keeps `todo_*`/`checklist_*` as hidden replay
+> aliases, so do not execute the old instruction to remove them. The
+> DO-NOT-DELETE table remains a standing guardrail. The companion
+> `opportunities.md` was never committed; its link is dangling by design.
 >
 > ~~**Companion document:** [`opportunities.md`](../../opportunities.md)~~ (not
 > in the repository) — this file was the *what to do next*; the catalog behind

crates/cli/src/lib.rs

@@ -167,8 +167,8 @@ struct Cli {
     no_mouse_capture: bool,
     #[arg(long = "skip-onboarding")]
     skip_onboarding: bool,
-    /// YOLO mode: auto-approve all tools
-    #[arg(long)]
+    /// Legacy compatibility alias for Act + Full Access.
+    #[arg(long, hide = true)]
     yolo: bool,
     /// Continue the most recent interactive session for this workspace.
     #[arg(short = 'c', long = "continue")]

crates/tui/CHANGELOG.md

@@ -7,12 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.8.68] - 2026-07-12
+## [0.8.68] - 2026-07-13
 
-The underwater release: the TUI's default shell is replaced end to end, the
-runtime keeps its guarantees, and the whole new layer ships localized. The
-entries below cover the full candidate; the pre-candidate section that
-follows records what had already landed on main for 0.8.68 by 2026-07-10.
+Release-candidate notes for the underwater release: the TUI's default shell is
+replaced end to end, the runtime keeps its guarantees, and the new layer is
+prepared with localized coverage. These notes describe the code prepared for
+v0.8.68; they are not evidence that the public tag or package artifacts have
+been published. The pre-candidate section that follows records what had already
+landed on main for 0.8.68 by 2026-07-10.
 
 ### Changed — the underwater shell
 
@@ -86,6 +88,33 @@ follows records what had already landed on main for 0.8.68 by 2026-07-10.
   `Alt+[`, `Alt+]`, `Alt+L`, `Alt+?`), and give theme, Help, model, and
   config rows direct mouse paths with the same activation as Enter.
 
+### Changed — release-candidate integration
+
+- Make worker delegation route-aware and identity-safe: workers receive a
+  small role-scoped system prompt instead of stale parent/model boilerplate,
+  faster routes resolve through the configured provider, and opening a worker
+  shows its complete available transcript. Remove `token_budget` from the
+  ordinary model-facing Agent schema so agents do not micromanage ad-hoc
+  launches; explicit legacy calls remain readable for compatibility.
+- Mature `/config` interaction for enumerated and boolean settings with
+  pickers/toggles, mouse-wheel scrolling, stable focus, and configured-provider
+  selection. Startup mode is now only Agent or Plan; legacy `operate`/`yolo`
+  settings migrate to Agent with permission posture represented separately.
+- Show where effective permission policy comes from and keep profile,
+  environment, project, managed, and requirements-controlled posture read-only
+  in the in-session editor. Runtime presets edit only proven user-owned root
+  settings and no longer persist temporary environment overlays.
+- Restore the original four-line whale mark and make ambient ocean motion
+  coherent across the full scroll surface: one continuous ombre, eased fish
+  that face their direction of travel, fish in otherwise blank scrollback, and
+  explicit reduced-motion and animation controls.
+- Keep model reasoning in the transcript rather than the Tasks strip, retain
+  the live header status indicator, separate worker and success colors, and use
+  the same rail grammar for both work-strip and transcript scrollbars.
+- Present the default Z.AI Coding Plan route, including child routes, as
+  subscription quota instead of estimated per-token dollars. No undocumented
+  account endpoint is called by this change.
+
 ### Added
 
 - Korean (ko) UI locale with full key parity and onboarding/setup wiring
@@ -113,6 +142,20 @@ follows records what had already landed on main for 0.8.68 by 2026-07-10.
 
 ### Fixed
 
+- Resolve the sub-agent completion/cancellation race with one terminal-state
+  claim: cancellation suppresses late mailbox/parent/UI delivery, while a
+  completed result remains publicly running until its notification is safely
+  delivered.
+- Keep Workflow panel controls from stealing ordinary composer letters. Enter,
+  Delete, Up/Down, and Esc own panel actions; typed characters return focus to
+  the composer and start the message normally.
+- Preserve the composer prompt gutter from the first typed character through
+  wrapping, scrolling, cursor placement, and mouse hit-testing so the `>` does
+  not disappear or make input appear to jump.
+- Emit terminal-native OSC 8 metadata for rendered URLs without placing escape
+  payload bytes in the measured text, keeping long links visible, selectable,
+  and clickable in supporting terminals.
+
 - Keep headless structured output terminal-clean: `codewhale exec` engines
   no longer emit interactive terminal-title/taskbar OSC sequences, so
   `--output-format stream-json` stdout stays parseable, escape-free JSONL.

crates/tui/locales/en.json

@@ -256,7 +256,7 @@
     "KbCompactInspector": "Open compact session context inspector",
     "KbLastMessagePager": "Open pager for the last message (when input is empty)",
     "KbSelectedDetails": "Show raw detail for the selected tool or message; Ctrl+O opens the whole-turn overview",
-    "KbToolDetailsPager": "Show raw detail for the selected item (v / Alt+V)",
+    "KbToolDetailsPager": "Show raw detail for the selected item (Alt+V)",
     "KbThinkingPager": "Open Turn Inspector",
     "KbLiveTranscript": "Open live transcript overlay (Ctrl+Shift+T; sticky-tail auto-scroll)",
     "KbBacktrackMessage": "Backtrack to a previous user message (Left/Right step, Enter to rewind)",
@@ -476,7 +476,7 @@
     "SetupRuntimePresetNormalAgentTitle": "Normal agent",
     "SetupRuntimePresetNormalAgentDescription": "Agent by default, approval prompts, shell visible.",
     "SetupRuntimePresetHighTrustTitle": "High-trust local",
-    "SetupRuntimePresetHighTrustDescription": "YOLO by default for trusted local work; no hidden constitution mutation.",
+    "SetupRuntimePresetHighTrustDescription": "Full Access by default for trusted local work; no hidden constitution mutation.",
     "SetupRuntimePresetPreviewTitle": "Runtime Posture Preset Preview",
     "SetupRuntimePresetSafetyFloor": "Safety floor: auth/OAuth failures, blocked policy outcomes, publish-like actions, and hold-for-review gates can still stop the run.",
     "SetupRuntimePresetApplyHint": "Press A to preview this exact diff; press A again after preview to apply it.",
@@ -773,6 +773,7 @@
     "PhaseIdle": "idle",
     "PhaseDraft": "draft",
     "PhaseWorking": "working",
+    "PhaseVerifying": "verifying",
     "PhaseWaitingOnYou": "waiting on you",
     "PhaseDone": "done",
     "PhaseFailed": "failed",
@@ -842,13 +843,18 @@
     "FleetRosterOperatorFirst": "operator first · resolved routes",
     "FleetRosterOperatorRow": "operator",
     "FleetReadyNotice": "Fleet is ready · /fleet opens roles · /fleet setup customizes routes",
+    "FleetProfileIdentityVerifyFailed": "Could not verify existing profile identities ({error}); fix the named file before saving.",
+    "FleetProfileIdConflict": "Profile id `{id}` is already used by {path}; redraft with a different role or remove the old file first.",
+    "FleetProfileProviderUnconfigured": "Profile pins provider `{provider}`, which has no configured credentials ({env}); set it up in /provider before saving.",
     "WorkflowStatusWaiting": "waiting",
     "WorkflowDebrief": "debrief: {done}/{total} settled · {failed} failed · {cancelled} cancelled · {elapsed}",
     "SidebarTasksLabel": "Tasks",
     "SidebarTodoLabel": "To-do",
     "SidebarOpenControl": "open",
     "SidebarStopControl": "stop",
     "SidebarDestructiveArmed": "Destructive action armed — press Enter to confirm or clear the draft to cancel",
+    "WorkSurfaceStopConfirmControl": "confirm",
+    "WorkSurfaceStoppingControl": "stopping",
     "ComposerSlashMenuHint": " enter:run · tab:complete · ↑↓:select · esc:keep typing ",
     "ApprovalRepoLawBadge": "REPO LAW",
     "ApprovalRepoLawTitle": "Repository constitution",

crates/tui/locales/es-419.json

@@ -256,7 +256,7 @@
     "KbCompactInspector": "Abrir inspector compacto de contexto de la sesión",
     "KbLastMessagePager": "Abrir paginador para el último mensaje (cuando la entrada está vacía)",
     "KbSelectedDetails": "Mostrar el detalle sin procesar de la herramienta o mensaje seleccionado; Ctrl+O abre la vista general de todo el turno",
-    "KbToolDetailsPager": "Mostrar el detalle sin procesar del elemento seleccionado (v / Alt+V)",
+    "KbToolDetailsPager": "Mostrar el detalle sin procesar del elemento seleccionado (Alt+V)",
     "KbThinkingPager": "Abrir Inspector de turno",
     "KbLiveTranscript": "Abrir superposición de transcripción en vivo (auto-scroll)",
     "KbBacktrackMessage": "Retroceder al mensaje anterior del usuario (izquierda/derecha, Enter para rebobinar)",
@@ -476,7 +476,7 @@
     "SetupRuntimePresetNormalAgentTitle": "Agente normal",
     "SetupRuntimePresetNormalAgentDescription": "Agent por defecto, prompts de aprobación, shell visible.",
     "SetupRuntimePresetHighTrustTitle": "Local de alta confianza",
-    "SetupRuntimePresetHighTrustDescription": "YOLO por defecto para trabajo local confiable; sin mutación oculta de constitution.",
+    "SetupRuntimePresetHighTrustDescription": "Acceso total por defecto para trabajo local confiable; sin mutación oculta de constitution.",
     "SetupRuntimePresetPreviewTitle": "Previsualización de preset de postura de runtime",
     "SetupRuntimePresetSafetyFloor": "Piso de seguridad: fallos de auth/OAuth, resultados bloqueados por política, acciones tipo publish y gates de revisión aún pueden detener la ejecución.",
     "SetupRuntimePresetApplyHint": "Presiona A para previsualizar este diff exacto; presiona A otra vez después de la previsualización para aplicarlo.",
@@ -773,6 +773,7 @@
     "PhaseIdle": "inactivo",
     "PhaseDraft": "borrador",
     "PhaseWorking": "trabajando",
+    "PhaseVerifying": "verificando",
     "PhaseWaitingOnYou": "esperándote",
     "PhaseDone": "listo",
     "PhaseFailed": "falló",
@@ -842,13 +843,18 @@
     "FleetRosterOperatorFirst": "operador primero · rutas resueltas",
     "FleetRosterOperatorRow": "operador",
     "FleetReadyNotice": "Fleet está lista · /fleet abre los roles · /fleet setup personaliza las rutas",
+    "FleetProfileIdentityVerifyFailed": "No se pudieron verificar las identidades de perfiles existentes ({error}); corrige el archivo indicado antes de guardar.",
+    "FleetProfileIdConflict": "El id de perfil `{id}` ya está en uso por {path}; redacta de nuevo con otro rol o elimina primero el archivo antiguo.",
+    "FleetProfileProviderUnconfigured": "El perfil fija el proveedor `{provider}`, que no tiene credenciales configuradas ({env}); configúralo en /provider antes de guardar.",
     "WorkflowStatusWaiting": "esperando",
     "WorkflowDebrief": "resumen: {done}/{total} resueltos · {failed} fallidos · {cancelled} cancelados · {elapsed}",
     "SidebarTasksLabel": "Tareas",
     "SidebarTodoLabel": "Pendientes",
     "SidebarOpenControl": "abrir",
     "SidebarStopControl": "detener",
     "SidebarDestructiveArmed": "Acción destructiva armada — presiona Enter para confirmar o limpia el borrador para cancelar",
+    "WorkSurfaceStopConfirmControl": "confirmar",
+    "WorkSurfaceStoppingControl": "deteniendo",
     "ComposerSlashMenuHint": " enter:ejecutar · tab:completar · ↑↓:seleccionar · esc:seguir escribiendo ",
     "ApprovalRepoLawBadge": "LEY DEL REPO",
     "ApprovalRepoLawTitle": "Constitución del repositorio",