loadout-ai 0.9.3 → 0.9.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -2,6 +2,33 @@
2
2
 
3
3
  ## Unreleased
4
4
 
5
+ ## 0.9.5 - 2026-10-06
6
+
7
+ ### Fixed
8
+
9
+ - Skills that link to their repository's shared `references/` folder now
10
+ install with those files copied beside them, so the links resolve.
11
+ - A shared `references/` folder that is a symlink is ignored, so a package
12
+ cannot copy files from elsewhere on disk into an installed skill.
13
+
14
+ ### Security
15
+
16
+ - Patched dependency advisories, including proxy-addr (critical) and
17
+ source-map-js and brace-expansion (high), and moved vitest to 4.1.11.
18
+
19
+ ## 0.9.4 - 2026-09-07
20
+
21
+ ### Changed
22
+
23
+ - Updated the Stable first-run flow to show detailed safety findings before
24
+ applying and require explicit acknowledgement of the currently reported
25
+ instruction-like files.
26
+
27
+ ### Fixed
28
+
29
+ - Serialized coordination lock recovery within a process so competing
30
+ recoverers cannot enter the same critical section simultaneously.
31
+
5
32
  ## 0.9.3 - 2026-09-07
6
33
 
7
34
  ### Changed
package/README.md CHANGED
@@ -29,21 +29,23 @@ You need Node.js 20 or newer and Git.
29
29
 
30
30
  ```bash
31
31
  npm install --global loadout-ai
32
- loadout setup --mode stable
32
+ loadout setup --mode stable --details
33
33
  ```
34
34
 
35
35
  The second command detects your coding agents and previews the 30-skill Stable
36
36
  loadout. It does not change agent files. Review the plan, then apply it:
37
37
 
38
38
  ```bash
39
- loadout setup --mode stable --yes
39
+ loadout setup --mode stable --yes --approve-risk
40
40
  loadout status
41
41
  ```
42
42
 
43
43
  Loadout saves a rollback snapshot before applying changes. Run
44
44
  `loadout rollback` to restore the previous managed state.
45
45
 
46
- > `Preview complete; nothing was changed. Re-run with --yes to install this exact screened plan.`
46
+ `--approve-risk` acknowledges the instruction-like files reported by the current
47
+ Stable preview. Use it only after reading those findings; it does not replace the
48
+ preview or the pinned-source checks.
47
49
 
48
50
  A later `--yes` invocation recomputes the plan from pinned sources and current agent and filesystem state; it does not persist or prove identity with the earlier preview.
49
51
 
@@ -123,9 +125,9 @@ and coordination without making you relay every command.
123
125
  For a reproducible install, pin the current release:
124
126
 
125
127
  ```bash
126
- npm install --global loadout-ai@0.9.3
127
- loadout setup --mode stable
128
- loadout setup --mode stable --yes
128
+ npm install --global loadout-ai@0.9.5
129
+ loadout setup --mode stable --details
130
+ loadout setup --mode stable --yes --approve-risk
129
131
  loadout status
130
132
  ```
131
133
 
@@ -162,12 +164,12 @@ trusting third-party content.
162
164
  ## Demo
163
165
 
164
166
  <p align="center">
165
- <a href="https://www.youtube.com/watch?v=opNqJKX7xMw">
166
- <img src="https://img.youtube.com/vi/opNqJKX7xMw/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
167
+ <a href="https://www.youtube.com/watch?v=5NS5jcSlxm8">
168
+ <img src="https://img.youtube.com/vi/5NS5jcSlxm8/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
167
169
  </a>
168
170
  </p>
169
171
 
170
- **[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=opNqJKX7xMw).**
172
+ **[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=5NS5jcSlxm8).**
171
173
 
172
174
  ## Why Loadout
173
175
 
@@ -248,7 +250,7 @@ Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected
248
250
 
249
251
  <!-- loadout:daily-discovery:start -->
250
252
 
251
- **Discovery snapshot (generated 2026-09-07):** [237 repositories observed](./docs/DISCOVERED.md), including 221 uncataloged review candidates and 16 repositories already in the inspected catalog.
253
+ **Discovery snapshot (generated 2026-10-06):** [237 repositories observed](./docs/DISCOVERED.md), including 219 uncataloged review candidates and 18 repositories already in the inspected catalog.
252
254
  <!-- loadout:daily-discovery:end -->
253
255
 
254
256
  ## Agent support
@@ -269,28 +271,40 @@ Configured CI platforms describe a manually triggered workflow, not evidence tha
269
271
 
270
272
  ## Command reference
271
273
 
272
- | Goal | Command |
273
- | ---------------------------------- | ---------------------------------------------------------- |
274
- | Guided first run | `loadout guide` |
275
- | Preview or apply Stable | `loadout setup --mode stable` · add `--yes` to apply |
276
- | Inspect managed skills | `loadout status` · `loadout library` |
277
- | Recommend for this repository | `loadout recommend --project .` |
278
- | Activate a project-specific set | `loadout optimize --project . --limit 30` |
279
- | Scan or update | `loadout scan` · `loadout update` |
280
- | Send a task | `loadout handoff codex "write tests"` |
281
- | Use a handoff template | `loadout handoff codex src/auth.ts --template write-tests` |
282
- | Preview two-agent ownership | `loadout coord start --agents claude-code,codex` |
283
- | Inspect coordination state | `loadout coord snapshot codex` |
284
- | Detect shared contract candidates | `loadout coord detect` |
285
- | Turn a decision into tasks | `loadout coord discuss implement <thread-id>` |
286
- | Start the coordination MCP server | `loadout serve` |
287
- | Health check | `loadout doctor` |
288
- | Restore the previous managed state | `loadout rollback` |
289
- | Preview complete removal | `loadout uninstall` |
290
- | Full CLI reference | `loadout --help` · `loadout advanced` |
274
+ | Goal | Command |
275
+ | ---------------------------------- | ---------------------------------------------------------------------------------- |
276
+ | Guided first run | `loadout guide` |
277
+ | Preview or apply Stable | `loadout setup --mode stable --details` · then `--yes --approve-risk` after review |
278
+ | Inspect managed skills | `loadout status` · `loadout library` |
279
+ | Recommend for this repository | `loadout recommend --project .` |
280
+ | Activate a project-specific set | `loadout optimize --project . --limit 30` |
281
+ | Scan or update | `loadout scan` · `loadout update` |
282
+ | Send a task | `loadout handoff codex "write tests"` |
283
+ | Use a handoff template | `loadout handoff codex src/auth.ts --template write-tests` |
284
+ | Preview two-agent ownership | `loadout coord start --agents claude-code,codex` |
285
+ | Inspect coordination state | `loadout coord snapshot codex` |
286
+ | Detect shared contract candidates | `loadout coord detect` |
287
+ | Turn a decision into tasks | `loadout coord discuss implement <thread-id>` |
288
+ | Start the coordination MCP server | `loadout serve` |
289
+ | Health check | `loadout doctor` |
290
+ | Restore the previous managed state | `loadout rollback` |
291
+ | Preview complete removal | `loadout uninstall` |
292
+ | Full CLI reference | `loadout --help` · `loadout advanced` |
291
293
 
292
294
  Most mutating commands are previews first. Add `--yes` only after reviewing the plan.
293
295
 
296
+ ## What's next
297
+
298
+ | Feature | What it unlocks |
299
+ | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
300
+ | **Async discuss** | `coord discuss` turns stored as events — agents debate across sessions, neither has to be live at the same time |
301
+ | **GitHub Actions sync** | `loadout sync` in CI applies the committed skill selection — every team member and every CI run gets an identical curated set |
302
+ | **Handoff templates** | reusable task blueprints (`--template write-tests`, `--template refactor-module`) with pre-configured verify commands |
303
+ | **Cross-repo handoff** | pass a task from one repository to another with bundled context — useful when frontend and backend live in separate repos |
304
+ | **Cost ledger** | track provider turns spent per discussion, project, and week so quota usage stays visible |
305
+ | **Agent-generated skills** | agent notices a repeated pattern and proposes a new skill directly into the catalog |
306
+ | **Outcome-based skill ratings** | record local install outcomes so rankings improve from real usage rather than star counts |
307
+
294
308
  ## Development
295
309
 
296
310
  ```bash