loadout-ai 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 ## Unreleased
 
+## 0.8.0 - 2026-09-02
+
+### Security
+
+- Reject a remote registry bundle whose `digest` is not a SHA-256 hex string,
+  and verify the resolved cache path stays under the cache root, before any
+  recursive delete. A crafted digest could previously escape the cache and
+  delete an arbitrary user-accessible directory.
+- Fail closed in the safety scanner. Files that are oversized, unreadable, or
+  too deeply nested are reported as a blocking `uninspectable` finding instead
+  of being skipped silently, so an unreviewable file can no longer produce a
+  clean report.
+- Apply a timeout, byte cap, and file cap to every repository fetch by default
+  rather than only when a caller opts in, and bound registry responses by time
+  and decoded size.
+
+### Fixed
+
+- Parse the handoff log line by line. A single truncated write previously made
+  the whole inbox appear empty; good lines now survive and the corrupt line is
+  reported.
+- Settle handoff tasks on `error` and `cancel` as well as `done`, via an
+  explicit `resolves` field, so a failed task no longer stays pending forever.
+- Migrate handoff instruction blocks already written into `CLAUDE.md` and
+  `AGENTS.md` that still name retired commands.
+- Report installed skills as a count of skills rather than a sum of every
+  nested file, which overstated 44 skills as 584 items.
+
+### Changed
+
+- Generate shell completions from the Commander command tree so they cannot
+  advertise commands the CLI does not register.
+- Rebuild `loadout route` around a routing policy the user owns
+  (`~/.loadout/routing.json`, three buckets) instead of a fixed phase-to-tier
+  table, and narrow the model catalog to the current Claude and GPT-5.6 tiers.
+- Collapse handoff to a single command that sets itself up on first use.
+
+### Added
+
+- `scripts/check-documented-commands.mjs` in the evidence gate: documentation
+  may no longer reference a command the CLI does not have.
+
+## 0.7.0 - 2026-08-31
+
+### Added
+
+- First-party skills (`loadout skills list|install|remove`) shipping
+  `loadout-router` and `loadout-curator`, so Loadout is usable from inside an
+  agent conversation rather than only from a terminal.
+
+### Changed
+
+- Retire 15 redundant or dead-end commands, taking the surface from 66 to 26.
+- Group the 86 flat modules in `src/core` into eight domains.
+- Drop "Boost" from the mode names and explain that Maximum stays disabled.
+
+## 0.6.0 - 2026-08-31
+
+### Added
+
+- `loadout route`, recommending a model tier for a task with real pricing.
+- `loadout handoff`, a shared task log between Claude Code and Codex.
+
+### Changed
+
+- Rewrite `loadout doctor` output around a health grade and actionable next
+  steps rather than a per-component dump.
+
+### Fixed
+
+- Resolve `LOADOUT_VERSION` from both source and built layouts.
+
 ## 0.5.9 - 2026-07-21
 
 ### Fixed

package/README.md

@@ -39,29 +39,27 @@ Loadout — grade A: Healthy and up to date
 
 ✓ Claude Code
   ~/.claude/skills
-  582 items | supports: skill, command, agent, mcp, plugin, root
+  43 skills | supports: skill, command, agent, mcp, plugin, root
 ✓ Codex
   ~/.agents/skills
-  83 items | supports: skill, command, agent, mcp, plugin, root
+  30 skills | supports: skill, command, agent, mcp, plugin, root
 
-$ loadout route implement the payment webhook handler
-Phase:    implement
-Tier:     Standard (balanced)
-Models:   Claude Sonnet 5 ($3/$15)
-          GPT-5.6 Terra ($2/$12)
-Agents:   claude-code, codex
-Why:      Implementation is high-volume; standard models score within 5% of frontier
+$ loadout route
+Default routing policy (not saved yet)
 
-Conserve: drop to fast tier (GPT-5.6 Luna at $0.2/$1.2)
-          May need more iterations on complex logic; fine for CRUD and boilerplate
+  hard    Claude Opus 5    $5/$25 per M
+          architecture, security, migrations, tricky debugging, risky review
+  normal  Claude Sonnet 5  $3/$15 per M
+          most implementation, ordinary debugging, refactors
+  cheap   GPT-5.6 Luna     $0.2/$1.2 per M
+          tests, docs, boilerplate, renames, mechanical edits
 
-Hand off:
-  loadout handoff send codex 'implement the payment webhook handler'
+Change it:  loadout route --set normal=gpt-5.6-terra
 ```
 
-Three things most agent tools do not do: it knows which agents you actually have,
-it prices the tradeoff before you spend the tokens, and every mutating command
-previews first and snapshots before it writes.
+The routing policy is a file you own, not a table I decided for you. Loadout
+knows which agents you actually have, prices the tradeoff before you spend the
+tokens, and previews and snapshots every write.
 
 ## Install
 
@@ -76,7 +74,7 @@ The second command detects your agents and previews the 30-skill Stable loadout.
 Nothing changes until you approve it. If anything goes wrong, start with the
 [user test guide](./docs/USER_TEST_GUIDE.md).
 
-For a reproducible install, pin the release: `npm install --global loadout-ai@0.7.0`.
+For a reproducible install, pin the release: `npm install --global loadout-ai@0.8.0`.
 
 ## Use it from inside your agent
 
@@ -106,15 +104,19 @@ If you pay for both Claude and a ChatGPT plan, the two agents cannot see each
 other. Loadout gives them a shared, append-only task log:
 
 ```bash
-loadout handoff init
-loadout handoff send codex "write unit tests for auth" --context "see src/auth.ts"
-loadout handoff pickup --yes
+loadout handoff codex "write unit tests for auth" --context "see src/auth.ts"
 ```
 
-`pickup` writes a small managed block into `CLAUDE.md` and `AGENTS.md` telling each
-agent to check `loadout handoff inbox <agent>` at the start of a session. Only the
-text between the `loadout:handoff` markers is managed; the rest of your file is left
-alone, and re-running replaces that block instead of duplicating it.
+That is the whole thing. The first send creates the log and adds a short managed
+block to `CLAUDE.md` and `AGENTS.md` telling each agent to check its inbox at the
+start of a session. Only the text between the `loadout:handoff` markers is
+managed; the rest of your file is left alone.
+
+```bash
+loadout handoff codex      # what is waiting for codex
+loadout handoff            # everything pending, both directions
+loadout handoff --done 4f2a1c
+```
 
 ## How it works
 
@@ -147,12 +149,10 @@ $ loadout rollback
 Restored snapshot <snapshot-id>
 
 $ loadout route design the authentication system
-Phase:    plan
-Tier:     Frontier (deep reasoning)
-Models:   Claude Opus 5 ($5/$25)
-          GPT-5.6 Sol ($5/$30)
-Agents:   claude-code
-Why:      Architecture and decomposition need deep reasoning to avoid costly rework
+Task:   design the authentication system
+
+Bucket: hard — architecture, security, migrations, tricky debugging, risky review
+Use:    Claude Opus 5  ($5/$25 per M)
 
 $ loadout doctor
 loadout doctor — HEALTHY
@@ -451,7 +451,7 @@ Loadout does not claim there is one universally “best” configuration. Recomm
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-08-31):** [238 repositories observed](./docs/DISCOVERED.md), including 219 uncataloged review candidates and 19 repositories already in the inspected catalog.
+**Discovery snapshot (generated 2026-09-02):** [239 repositories observed](./docs/DISCOVERED.md), including 221 uncataloged review candidates and 18 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
 The checked-in discovery report proves only its dated snapshot, not the success of every scheduled run. Use `loadout discover --source all --queue`, `loadout review-queue`, and `loadout candidate inspect owner/repository` to inspect candidates before catalog promotion.
@@ -494,7 +494,7 @@ Configured CI platforms describe a manually triggered workflow, not evidence tha
 
 <!-- loadout:support-summary:end -->
 
-Configured paths and disposable filesystem lifecycle tests do not prove that native applications recognize or execute installed skills. Use `loadout capabilities --inspect` for the local component matrix.
+Configured paths and disposable filesystem lifecycle tests do not prove that native applications recognize or execute installed skills. Use `loadout doctor --verbose` for the local component matrix.
 
 ## Command reference
 
@@ -519,7 +519,7 @@ Start at the top and stop whenever Loadout does everything you need.
 |       15 | Installs Loadout's own skill into your agents                   | `loadout skills install loadout-router --yes`                |
 |       16 | Recommends the right model and agent for a task                 | `loadout route design the auth system`                       |
 |       17 | Shows the full model catalog with pricing                       | `loadout route --models`; `loadout route --cost`             |
-|       18 | Sends a task to another agent via file-based handoff            | `loadout handoff send codex "write tests for auth"`          |
+|       18 | Sends a task to another agent via file-based handoff            | `loadout handoff codex "write tests for auth"`               |
 |       19 | Checks agent health, permissions, and setup                     | `loadout doctor`; `loadout doctor --verbose`                 |
 |       20 | Lists and installs isolated runtime tools such as Graphify      | `loadout tool`; `loadout tool graphify`                      |
 |       21 | Lists snapshots or restores the latest managed change           | `loadout rollback --list`; `loadout rollback`                |