loadout-ai 0.9.4 → 0.9.5

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+## 0.9.5 - 2026-10-06
+
+### Fixed
+
+- Skills that link to their repository's shared `references/` folder now
+  install with those files copied beside them, so the links resolve.
+- A shared `references/` folder that is a symlink is ignored, so a package
+  cannot copy files from elsewhere on disk into an installed skill.
+
+### Security
+
+- Patched dependency advisories, including proxy-addr (critical) and
+  source-map-js and brace-expansion (high), and moved vitest to 4.1.11.
+
 ## 0.9.4 - 2026-09-07
 
 ### Changed

package/README.md

@@ -125,7 +125,7 @@ and coordination without making you relay every command.
 For a reproducible install, pin the current release:
 
 ```bash
-npm install --global loadout-ai@0.9.4
+npm install --global loadout-ai@0.9.5
 loadout setup --mode stable --details
 loadout setup --mode stable --yes --approve-risk
 loadout status
@@ -164,12 +164,12 @@ trusting third-party content.
 ## Demo
 
 <p align="center">
-  <a href="https://www.youtube.com/watch?v=opNqJKX7xMw">
-    <img src="https://img.youtube.com/vi/opNqJKX7xMw/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
+  <a href="https://www.youtube.com/watch?v=5NS5jcSlxm8">
+    <img src="https://img.youtube.com/vi/5NS5jcSlxm8/maxresdefault.jpg" alt="Watch the 72-second Loadout demo" width="880">
   </a>
 </p>
 
-**[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=opNqJKX7xMw).**
+**[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=5NS5jcSlxm8).**
 
 ## Why Loadout
 
@@ -250,7 +250,7 @@ Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected
 
 <!-- loadout:daily-discovery:start -->
 
-**Discovery snapshot (generated 2026-09-07):** [237 repositories observed](./docs/DISCOVERED.md), including 221 uncataloged review candidates and 16 repositories already in the inspected catalog.
+**Discovery snapshot (generated 2026-10-06):** [237 repositories observed](./docs/DISCOVERED.md), including 219 uncataloged review candidates and 18 repositories already in the inspected catalog.
 <!-- loadout:daily-discovery:end -->
 
 ## Agent support
@@ -293,6 +293,18 @@ Configured CI platforms describe a manually triggered workflow, not evidence tha
 
 Most mutating commands are previews first. Add `--yes` only after reviewing the plan.
 
+## What's next
+
+| Feature                         | What it unlocks                                                                                                               |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| **Async discuss**               | `coord discuss` turns stored as events — agents debate across sessions, neither has to be live at the same time               |
+| **GitHub Actions sync**         | `loadout sync` in CI applies the committed skill selection — every team member and every CI run gets an identical curated set |
+| **Handoff templates**           | reusable task blueprints (`--template write-tests`, `--template refactor-module`) with pre-configured verify commands         |
+| **Cross-repo handoff**          | pass a task from one repository to another with bundled context — useful when frontend and backend live in separate repos     |
+| **Cost ledger**                 | track provider turns spent per discussion, project, and week so quota usage stays visible                                     |
+| **Agent-generated skills**      | agent notices a repeated pattern and proposes a new skill directly into the catalog                                           |
+| **Outcome-based skill ratings** | record local install outcomes so rankings improve from real usage rather than star counts                                     |
+
 ## Development
 
 ```bash