loadout-ai 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## Unreleased
 
+## 0.9.2 - 2026-09-06
+
+### Changed
+
+- Coordination discussion output now removes duplicate lifecycle noise, shows a
+  single outcome section, and identifies the provider in every provider error.
+- Maximum Library preparation now skips packages that cannot be safely prepared
+  and clearly reports that the remaining reviewed library can still install.
+
+### Fixed
+
+- Bound overlong provider-synthesized decisions to the coordination event limit
+  instead of failing after all paid discussion turns have completed.
+- Materialize multi-path ownership claims once per normalized path so snapshots
+  and status output do not repeat the full claim for every path.
+- Close the Claude Code subprocess stdin explicitly, avoiding its empty-input
+  wait before a bounded coordination turn begins.
+- Forward cancellation and timeout signals natively to both Claude Code and the
+  Codex SDK so a timed-out paid turn cannot keep running while Loadout starts a
+  replacement turn.
+- Restore files before reapplying read-only directory modes and reject snapshot
+  modes containing special permission bits.
+- Preserve strictly increasing coordination sequence order after checkpoint
+  compaction.
+- Treat all reviewed commits for a shared catalog repository as valid when
+  detecting upstream catalog drift.
+- Apply the default repository timeout to generic HTTPS and SSH Git sources as
+  well as catalog GitHub sources.
+
+### Security
+
+- Expand deterministic instruction-injection signatures and document the
+  repository-grounded threat model in `loadout-threat-model.md`.
+
+## 0.9.1 - 2026-09-05
+
 ### Added
 
 - Snapshot capture and restore preserve Unix file permission modes, with

package/README.md

@@ -86,7 +86,7 @@ The second command detects your agents and previews the 30-skill Stable loadout.
 Nothing changes until you approve it. If anything goes wrong, start with the
 [user test guide](./docs/USER_TEST_GUIDE.md).
 
-For a reproducible install, pin the release: `npm install --global loadout-ai@0.9.1`.
+For a reproducible install, pin the release: `npm install --global loadout-ai@0.9.2`.
 
 ## Use it from inside your agent
 
@@ -306,7 +306,7 @@ Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-09-05):** [238 repositories observed](./docs/DISCOVERED.md), including 222 uncataloged review candidates and 16 repositories already in the inspected catalog.
+**Discovery snapshot (generated 2026-09-06):** [237 repositories observed](./docs/DISCOVERED.md), including 221 uncataloged review candidates and 16 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
 ## Trust and limits