chore(release): merge v0.9.0-stewardship into v0.8.54

Includes Paulo's command parity and Gherkin E2E harnesses,
HUQIANTAO's concurrency/security fixes, LeoAlex0's runtime_prompt
slim, reidliu41's hotbar persistence, HarmonyOS scaffolding,
Whaleflow foundation crate, and all v0.9.0 stabilization work.

crates/cli/Cargo.toml

@@ -15,12 +15,6 @@ path = "src/main.rs"
 name = "codew"
 path = "src/bin/codew_legacy_shim.rs"
 
-# Legacy alias — forwards to `codewhale` and prints a deprecation notice.
-# Will be removed in v0.9.0.
-[[bin]]
-name = "deepseek"
-path = "src/bin/deepseek_legacy_shim.rs"
-
 [dependencies]
 anyhow.workspace = true
 clap.workspace = true
@@ -38,6 +32,7 @@ dirs.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 reqwest = { workspace = true, features = ["blocking"] }
+rustls.workspace = true
 semver.workspace = true
 tokio.workspace = true
 sha2.workspace = true

crates/cli/src/bin/deepseek_legacy_shim.rs

@@ -1,61 +0,0 @@
-//! Legacy `deepseek` alias.
-//!
-//! Forwards argv to the `codewhale` dispatcher and prints a one-line
-//! deprecation notice to stderr on each invocation. This binary exists
-//! for one release cycle to give existing installs a smooth path to the
-//! new name; it will be removed in v0.9.0. See `docs/REBRAND.md` for the
-//! full migration story.
-
-use std::env;
-use std::process::Command;
-
-fn main() {
-    eprintln!(
-        "warning: `deepseek` is deprecated; run `codewhale` instead. \
-         This alias will be removed in v0.9.0."
-    );
-    let args: Vec<String> = env::args_os()
-        .skip(1)
-        .map(|a| a.to_string_lossy().into_owned())
-        .collect();
-
-    let status = match spawn_codewhale(&args) {
-        Ok(s) => s,
-        Err(e) => {
-            eprintln!(
-                "error: failed to spawn `codewhale`: {e}. Is it on PATH? \
-                 Install with `cargo install codewhale-cli` or via npm/Homebrew."
-            );
-            std::process::exit(127);
-        }
-    };
-    std::process::exit(status.code().unwrap_or(1));
-}
-
-fn spawn_codewhale(args: &[String]) -> std::io::Result<std::process::ExitStatus> {
-    // Try PATH first.
-    match Command::new("codewhale").args(args).status() {
-        Ok(s) => return Ok(s),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Err(e) => return Err(e),
-    }
-
-    // On Windows, after an update the sibling `codewhale.exe` may be in the
-    // same directory as this shim but not on PATH (#2006).
-    #[cfg(windows)]
-    {
-        if let Ok(exe_path) = env::current_exe()
-            && let Some(dir) = exe_path.parent()
-        {
-            let sibling = dir.join("codewhale.exe");
-            if sibling.is_file() {
-                return Command::new(sibling).args(args).status();
-            }
-        }
-    }
-
-    Err(std::io::Error::new(
-        std::io::ErrorKind::NotFound,
-        "codewhale not found on PATH or in sibling directory",
-    ))
-}

crates/cli/src/lib.rs

@@ -471,7 +471,13 @@ struct AppServerArgs {
 
 const MCP_SERVER_DEFINITIONS_KEY: &str = "mcp.server_definitions";
 
+fn install_rustls_crypto_provider() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+}
+
 pub fn run_cli() -> std::process::ExitCode {
+    install_rustls_crypto_provider();
+
     match run() {
         Ok(()) => std::process::ExitCode::SUCCESS,
         Err(err) => {
@@ -2965,6 +2971,7 @@ mod tests {
             api_key_source: Some(RuntimeApiKeySource::Keyring),
             base_url: "https://openai-compatible.example/v4".to_string(),
             auth_mode: Some("api_key".to_string()),
+            insecure_skip_tls_verify: false,
             output_mode: None,
             log_level: None,
             telemetry: false,
@@ -3024,6 +3031,7 @@ mod tests {
             api_key_source: Some(RuntimeApiKeySource::ConfigFile),
             base_url: "https://api.deepseek.com/beta".to_string(),
             auth_mode: Some("api_key".to_string()),
+            insecure_skip_tls_verify: false,
             output_mode: None,
             log_level: None,
             telemetry: false,
@@ -3079,6 +3087,7 @@ mod tests {
             api_key_source: Some(RuntimeApiKeySource::Keyring),
             base_url: "https://api.moonshot.ai/v1".to_string(),
             auth_mode: Some("api_key".to_string()),
+            insecure_skip_tls_verify: false,
             output_mode: None,
             log_level: None,
             telemetry: false,
@@ -3145,6 +3154,7 @@ mod tests {
             api_key_source: None,
             base_url: "https://openai-compatible.example/v4".to_string(),
             auth_mode: None,
+            insecure_skip_tls_verify: false,
             output_mode: None,
             log_level: None,
             telemetry: false,
@@ -3240,6 +3250,7 @@ mod tests {
                 api_key_source: Some(RuntimeApiKeySource::Keyring),
                 base_url: "http://localhost:8000/v1".to_string(),
                 auth_mode: Some("api_key".to_string()),
+                insecure_skip_tls_verify: false,
                 output_mode: None,
                 log_level: None,
                 telemetry: false,

crates/cli/src/update.rs

@@ -20,6 +20,12 @@ use std::io::Write;
 
 /// Run the self-update workflow.
 pub fn run_update(beta: bool, check_only: bool, proxy_arg: Option<String>) -> Result<()> {
+    #[cfg(target_env = "ohos")]
+    {
+        let _ = (beta, check_only, proxy_arg);
+        bail!("self-update is not supported on HarmonyOS/OpenHarmony yet");
+    }
+
     let current_exe =
         std::env::current_exe().context("failed to determine current executable path")?;
     let targets = update_targets_for_exe(&current_exe);
@@ -353,6 +359,8 @@ pub(crate) fn validate_and_build_proxy(proxy_str: &str) -> Result<Proxy> {
 }
 
 fn update_http_client(proxy: Option<&Proxy>) -> Result<reqwest::blocking::Client> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let mut builder = reqwest::blocking::Client::builder();
     if let Some(proxy) = proxy {
         builder = builder.proxy(proxy.clone());