diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9adad377..8fce7638 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-04-28
+
+### Added
+- OS keyring-backed auth storage with `deepseek auth` subcommands, migration from plaintext config, provider-aware key resolution, and doctor visibility. (#134)
+- Egress network policy with allow/deny/prompt decisions, deny-wins matching, audit logging, and enforcement hooks for network-capable tools. (#135)
+- Side-git workspace snapshots, `/restore`, and `revert_turn` so agent edits can be rolled back without moving the user's repository HEAD. (#137)
+- Esc-Esc backtrack over prior user turns, desktop turn-complete notifications, Alt+V tool-details access, safer command-prefix auto-allow matching, bundled `skill-creator`, and `/skill install` management for community skills. (#131, #132, #133, #138, #139, #140)
+
+### Changed
+- Split more engine/tool primitives into focused modules and workspace crates, including shared tool result primitives and extracted turn/capacity flow. (#67, #74)
+
+### Tests
+- Added mock LLM and skill-install integration coverage for streaming turns, reasoning replay, tool-call loops, network policy, and skill validation. (#69, #140)
+
 ## [0.6.5] - 2026-04-27
 
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index 54e74853..492586db 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1011,7 +1011,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-agent"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "deepseek-config",
  "serde",
@@ -1019,7 +1019,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-app-server"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -1042,7 +1042,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-config"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "deepseek-secrets",
@@ -1055,7 +1055,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-core"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1074,7 +1074,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-execpolicy"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "deepseek-protocol",
@@ -1083,7 +1083,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-hooks"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1097,7 +1097,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-mcp"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "deepseek-protocol",
@@ -1107,7 +1107,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-protocol"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -1115,7 +1115,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-secrets"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "dirs",
  "keyring",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-state"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1140,7 +1140,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-tools"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1153,7 +1153,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-tui"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "arboard",
@@ -1213,7 +1213,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-tui-cli"
-version = "0.6.7"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1236,7 +1236,7 @@ dependencies = [
 
 [[package]]
 name = "deepseek-tui-core"
-version = "0.6.7"
+version = "0.7.0"
 
 [[package]]
 name = "deranged"
diff --git a/Cargo.toml b/Cargo.toml
index 4ff789c8..4057c352 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,7 +19,7 @@ default-members = ["crates/cli", "crates/app-server", "crates/tui"]
 resolver = "2"
 
 [workspace.package]
-version = "0.6.7"
+version = "0.7.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/Hmbown/DeepSeek-TUI"
diff --git a/crates/agent/Cargo.toml b/crates/agent/Cargo.toml
index ef1904e2..584ae0d6 100644
--- a/crates/agent/Cargo.toml
+++ b/crates/agent/Cargo.toml
@@ -7,5 +7,5 @@ repository.workspace = true
 description = "Model/provider registry and fallback strategy for DeepSeek workspace architecture"
 
 [dependencies]
-deepseek-config = { path = "../config", version = "0.6.0" }
+deepseek-config = { path = "../config", version = "0.7.0" }
 serde.workspace = true
diff --git a/crates/app-server/Cargo.toml b/crates/app-server/Cargo.toml
index 6f30e6c8..5eeaa525 100644
--- a/crates/app-server/Cargo.toml
+++ b/crates/app-server/Cargo.toml
@@ -10,15 +10,15 @@ description = "Codex-style app-server transport for DeepSeek workspace architect
 anyhow.workspace = true
 axum.workspace = true
 clap.workspace = true
-deepseek-agent = { path = "../agent", version = "0.6.0" }
-deepseek-config = { path = "../config", version = "0.6.0" }
-deepseek-core = { path = "../core", version = "0.6.0" }
-deepseek-execpolicy = { path = "../execpolicy", version = "0.6.0" }
-deepseek-hooks = { path = "../hooks", version = "0.6.0" }
-deepseek-mcp = { path = "../mcp", version = "0.6.0" }
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
-deepseek-state = { path = "../state", version = "0.6.0" }
-deepseek-tools = { path = "../tools", version = "0.6.0" }
+deepseek-agent = { path = "../agent", version = "0.7.0" }
+deepseek-config = { path = "../config", version = "0.7.0" }
+deepseek-core = { path = "../core", version = "0.7.0" }
+deepseek-execpolicy = { path = "../execpolicy", version = "0.7.0" }
+deepseek-hooks = { path = "../hooks", version = "0.7.0" }
+deepseek-mcp = { path = "../mcp", version = "0.7.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
+deepseek-state = { path = "../state", version = "0.7.0" }
+deepseek-tools = { path = "../tools", version = "0.7.0" }
 serde.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 5f4204c5..6acedfcb 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -14,13 +14,13 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 clap_complete.workspace = true
-deepseek-agent = { path = "../agent", version = "0.6.0" }
-deepseek-app-server = { path = "../app-server", version = "0.6.0" }
-deepseek-config = { path = "../config", version = "0.6.0" }
-deepseek-execpolicy = { path = "../execpolicy", version = "0.6.0" }
-deepseek-mcp = { path = "../mcp", version = "0.6.0" }
-deepseek-secrets = { path = "../secrets", version = "0.6.0" }
-deepseek-state = { path = "../state", version = "0.6.0" }
+deepseek-agent = { path = "../agent", version = "0.7.0" }
+deepseek-app-server = { path = "../app-server", version = "0.7.0" }
+deepseek-config = { path = "../config", version = "0.7.0" }
+deepseek-execpolicy = { path = "../execpolicy", version = "0.7.0" }
+deepseek-mcp = { path = "../mcp", version = "0.7.0" }
+deepseek-secrets = { path = "../secrets", version = "0.7.0" }
+deepseek-state = { path = "../state", version = "0.7.0" }
 chrono.workspace = true
 dirs.workspace = true
 serde.workspace = true
diff --git a/crates/config/Cargo.toml b/crates/config/Cargo.toml
index 5a3473e6..d02f5275 100644
--- a/crates/config/Cargo.toml
+++ b/crates/config/Cargo.toml
@@ -8,7 +8,7 @@ description = "Config schema and precedence model for DeepSeek workspace archite
 
 [dependencies]
 anyhow.workspace = true
-deepseek-secrets = { path = "../secrets", version = "0.6.0" }
+deepseek-secrets = { path = "../secrets", version = "0.7.0" }
 dirs.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 7c9fe70f..db130447 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -9,14 +9,14 @@ description = "Core runtime boundaries for DeepSeek workspace architecture"
 [dependencies]
 anyhow.workspace = true
 chrono.workspace = true
-deepseek-agent = { path = "../agent", version = "0.6.0" }
-deepseek-config = { path = "../config", version = "0.6.0" }
-deepseek-execpolicy = { path = "../execpolicy", version = "0.6.0" }
-deepseek-hooks = { path = "../hooks", version = "0.6.0" }
-deepseek-mcp = { path = "../mcp", version = "0.6.0" }
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
-deepseek-state = { path = "../state", version = "0.6.0" }
-deepseek-tools = { path = "../tools", version = "0.6.0" }
+deepseek-agent = { path = "../agent", version = "0.7.0" }
+deepseek-config = { path = "../config", version = "0.7.0" }
+deepseek-execpolicy = { path = "../execpolicy", version = "0.7.0" }
+deepseek-hooks = { path = "../hooks", version = "0.7.0" }
+deepseek-mcp = { path = "../mcp", version = "0.7.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
+deepseek-state = { path = "../state", version = "0.7.0" }
+deepseek-tools = { path = "../tools", version = "0.7.0" }
 serde_json.workspace = true
 tokio.workspace = true
 uuid.workspace = true
diff --git a/crates/execpolicy/Cargo.toml b/crates/execpolicy/Cargo.toml
index edde6f9a..d65a39ea 100644
--- a/crates/execpolicy/Cargo.toml
+++ b/crates/execpolicy/Cargo.toml
@@ -8,5 +8,5 @@ description = "Execution policy and approval model parity for DeepSeek workspace
 
 [dependencies]
 anyhow.workspace = true
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
 serde.workspace = true
diff --git a/crates/hooks/Cargo.toml b/crates/hooks/Cargo.toml
index ebd9f004..9d2eda9a 100644
--- a/crates/hooks/Cargo.toml
+++ b/crates/hooks/Cargo.toml
@@ -10,7 +10,7 @@ description = "Hook dispatch and notifications parity for DeepSeek workspace arc
 anyhow.workspace = true
 async-trait.workspace = true
 chrono.workspace = true
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/mcp/Cargo.toml b/crates/mcp/Cargo.toml
index a70ab4d2..46a9dc07 100644
--- a/crates/mcp/Cargo.toml
+++ b/crates/mcp/Cargo.toml
@@ -8,6 +8,6 @@ description = "MCP server lifecycle and tool proxy compatibility for DeepSeek wo
 
 [dependencies]
 anyhow.workspace = true
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/tools/Cargo.toml b/crates/tools/Cargo.toml
index 296474c5..90947d5b 100644
--- a/crates/tools/Cargo.toml
+++ b/crates/tools/Cargo.toml
@@ -9,7 +9,7 @@ description = "Tool invocation lifecycle, schema validation, and scheduler paral
 [dependencies]
 anyhow.workspace = true
 async-trait.workspace = true
-deepseek-protocol = { path = "../protocol", version = "0.6.0" }
+deepseek-protocol = { path = "../protocol", version = "0.7.0" }
 serde.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
diff --git a/crates/tui/Cargo.toml b/crates/tui/Cargo.toml
index 6a69dceb..9cda4780 100644
--- a/crates/tui/Cargo.toml
+++ b/crates/tui/Cargo.toml
@@ -13,8 +13,8 @@ path = "src/main.rs"
 [dependencies]
 anyhow = "1.0.100"
 arboard = "3.4"
-deepseek-secrets = { path = "../secrets", version = "0.6.0" }
-deepseek-tools = { path = "../tools", version = "0.6.0" }
+deepseek-secrets = { path = "../secrets", version = "0.7.0" }
+deepseek-tools = { path = "../tools", version = "0.7.0" }
 async-stream = "0.3.6"
 async-trait = "0.1"
 bytes = "1.11.0"
diff --git a/npm/deepseek-tui/package.json b/npm/deepseek-tui/package.json
index 9890e4e8..03a7ca55 100644
--- a/npm/deepseek-tui/package.json
+++ b/npm/deepseek-tui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "deepseek-tui",
-  "version": "0.6.7",
-  "deepseekBinaryVersion": "0.6.7",
+  "version": "0.7.0",
+  "deepseekBinaryVersion": "0.7.0",
   "description": "Install and run deepseek and deepseek-tui binaries from GitHub release artifacts.",
   "author": "Hmbown",
   "license": "MIT",
diff --git a/scripts/release/check-versions.sh b/scripts/release/check-versions.sh
index cab67183..ff509d8e 100755
--- a/scripts/release/check-versions.sh
+++ b/scripts/release/check-versions.sh
@@ -7,7 +7,8 @@
 #      crate must inherit `version.workspace = true`.
 #   2. `npm/deepseek-tui/package.json` `version` matches the workspace
 #      `version` in the root `Cargo.toml`.
-#   3. `Cargo.lock` is in sync with the manifests (`cargo metadata --locked`
+#   3. Internal `deepseek-*` path dependency pins match the workspace version.
+#   4. `Cargo.lock` is in sync with the manifests (`cargo metadata --locked`
 #      fails if not).
 set -euo pipefail
 
@@ -31,7 +32,18 @@ if [[ "${workspace_version}" != "${npm_version}" ]]; then
   fail=1
 fi
 
-# 3) Cargo.lock in sync.
+# 3) Internal path dependency pins.
+internal_dep_drift="$(
+  grep -nE 'deepseek-[a-z-]+[[:space:]]*=[[:space:]]*\{[^}]*version[[:space:]]*=[[:space:]]*"' crates/*/Cargo.toml \
+    | grep -v "version[[:space:]]*=[[:space:]]*\"${workspace_version}\"" || true
+)"
+if [[ -n "${internal_dep_drift}" ]]; then
+  echo "::error::Internal deepseek-* path dependency versions must match workspace version ${workspace_version}:" >&2
+  echo "${internal_dep_drift}" >&2
+  fail=1
+fi
+
+# 4) Cargo.lock in sync.
 if ! cargo metadata --locked --format-version 1 --no-deps >/dev/null 2>&1; then
   echo "::error::Cargo.lock is out of sync with the manifests. Run 'cargo update -p deepseek-tui' or 'cargo build' and commit the result." >&2
   fail=1