Codewhale's guardrail fixes are on main, not in v0.10.1

On 17 and 18 October 2026, commits on the main branch of codewhale-hq/Codewhale changed how this terminal coding agent treats file reads, sub-agents, workflow approval, and sandboxed commands. The changelog’s Unreleased section describes the fixes. They are fixed on main, due in the next release.

The newest GitHub release is v0.10.1, published 8 October 2026 at 01:47 UTC. The changelog dates that section 7 October. The changelog at that tag has an empty Unreleased section, so these items were not in the release. On 18 October the tag list still ended at v0.10.1, and the npm registry still had 0.10.1 as latest, published 8 October at 01:49 UTC. There was no 0.10.2. Commit 2a7149a (17 October, 22:08 UTC) says a frozen 0.10.2 release candidate and main both ran a command with no warning where bubblewrap could not start. That line sits inside the fix. It is not a published tag.

What the changelog says was open

The wording in this section is the maintainers’ changelog. It describes what those code paths could do. It is not a report that someone used them against a real user, and this batch is not in the repository’s published advisory list.

The changelog says validate_data, review, and verify read files such as a workspace .env, or in trust mode ~/.aws/credentials, without the read deny-list. A TOML error from validate_data could quote a line back to the model, and review and verify sent the whole file to the provider. grep_files on one file, rlm open with a file path, and the cache-maximal working set also returned deny-listed lines.

A turn’s allow-list, from exec --allowed-tools, a Runtime API allowed_tools value, or command frontmatter, narrowed only the parent. A sub-agent “got the full tool surface, including bash, write and edit.” A nodes workflow could start with no approval card, the card could say “Read-only plan”, and the receipt recorded the run as approved, because nested agent and branch fields were missed. A tool_call_before hook answering ask was overridden by an earlier “approve for session” grant.

terminal_* PTY sessions used a default sandbox with no credential deny-list, so on macOS they could read ~/.ssh or ~/.aws while bash could not. On Linux they skipped bubblewrap. codewhale exec also failed to print the warning that shell commands will run unrestricted: with no backend configured, the check treated the missing backend as present, and the command ran with no notice on stderr.

write, apply_patch with replace, and the older write_file paths now refuse to replace an existing file that is unread or stale. fim_edit honors the deny-list and refuses to write if the file changed while a completion was running. The changelog says that used to overwrite the person’s edit. Three data-loss paths are also closed: loading an older export over a newer session, a journal append cut short by a full disk or a kill, and deleting a legacy crash checkpoint when the migration fails.

What the project is

The README describes a Rust terminal agent under the MIT license, with more than 40 provider routes, including Anthropic, DeepSeek, Google, Mistral, Moonshot, OpenAI, OpenRouter, and xAI, plus Ollama, vLLM, or SGLang. Commands run in an OS sandbox where that works: Seatbelt on macOS, bubblewrap on Linux when it is installed and working. Usage-count telemetry is on by default. The documented opt-out is codewhale config set telemetry false.

The rebrand note says the name codewhale starts at v0.8.41. The project began as deepseek-tui. The README says it is provider-neutral, independently maintained, and not affiliated with any model provider. On 18 October 2026 the GitHub API reported 41,099 stars and 3,568 forks, at time of writing.

Who committed the fixes

Seven commits, 2a7149a, 92f900e, 5d1c8ad, 4fa8fdd, 4e1dd02, 8f6727d, and 3815a5a, are authored as CodeWhale Bot ([email protected]) between 17 October at 22:08 UTC and 18 October at 00:24 UTC. Each ends with Co-Authored-By: Claude Opus 5.5. Of the latest 100 commits on the commits API, from 16 October at 10:57 UTC through 18 October at 05:25 UTC, 72 are that bot with no GitHub login attached, 14 are Hunter Bown (Hmbown), and 75 carry the same co-author line. The messages call the pass a 17 October safety hunt.

An older record sits beside this. The security-advisories API returned 13 advisories published from 9 May through 16 July 2026, including critical run_tests and task_create reports and a git_show argument-injection file write. The advisories page lists them. They are earlier, and they are not this October batch.

What to check on any coding agent

A guard that only some tools honor is the pattern in the changelog. On any agent that reads files and starts commands, check three things: whether a turn’s allow-list reaches the sub-agents it starts, whether every read path (review, verify, a single-file search) hits the deny-list, and whether PTY sessions get the same credential deny-list and OS sandbox as the shell. Here, the fixes for those gaps are on main, due in the next release, and are not in v0.10.1.

Related on this site: Moli, Rig’s coding-agent plugins, and Perplexity’s SPACE sandbox.