chore: v0.58.0

[fylorn]

Release for #251, #252, #263, #265, #268 and #272, with the pre-release fixes in #273.

• Bump the workspace version to 0.58.0 (Cargo.toml, and the 19 workspace crates in Cargo.lock).
• Add release-notes/0.58.0.md: an opening paragraph, the upgrade notes, and one section per feature.
• CONTROL_API_VERSION (34) and the request store SCHEMA (25) are already at their release values on main. This PR does not change them.

Upgrade notes in brief

• Protocol 31 → 34. Lite 2026.10.0 (core 0.57.1, protocol 31) does not connect to 0.58.0. sudo twcore upgrade --version 0.57.1 --restart switches a server back.

• Schema 23 → 25: the request history is cleared on first start.

• security.hidden_text and security.output_limit are removed, and a config that still has either does not load. Only changed settings are written, so the affected users are those who set:

  • Hidden characters to Off or Enforce, or turned off one of its two rules;
  • Output limit to Observe or Enforce, or changed its 100,000 limit.

  The fix is to reset those settings, or to delete the two keys under security:.

  Checked against v0.57.1:

  • a fresh config has no security section (init.rs);
  • the control plane writes only non-default modes, rule lists and max_chars, and removing the last key also removes the emptied parent sections;
  • on 0.58.0, security: {hidden_text: …} fails with unknown field hidden_text, and an empty security: loads.

• Protocol and message-code changes are listed against v0.57.1. The code lists come from diffing msg-codes.txt between the tag and main: 67 added (two of them test-only), 14 removed, 3 of those pairs renames.

• Building from source needs a WebAssembly-capable clang.

• Behavior notes:

  • compaction is now content-screened;
  • tool-call excerpts are masked;
  • stored bodies are redacted;
  • retention settings take effect now that the hidden hourly cleanup is gone;
  • the default plugins are written into the config on first start.

The release notes contain no CJK characters, which scripts/release_notes_test.py enforces, so the settings are named by their English labels in Lite.

Checks

• python3 scripts/release_notes_test.py
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• env -u HTTP_PROXY -u HTTPS_PROXY cargo test --workspace: 2601 passed, 0 failed, 7 ignored

All runs used RUSTFLAGS="-D warnings". Cargo.toml changes, so the enterprise job runs against ThinkWatch dev. It is expected to be red until ThinkWatch#72 lands after the tag, as on main since #268.

🤖 Generated with Claude Code