0.6.0 - 2026-10-12

Release Notes

Added

• Add an unresolved dispatch: line to the review-context --brief header for added methods
  that implement an existing member name without any resolved caller, with bounded head receiver
  call sites. The brief note now says that it is static and that repository checks still run
  before concluding. The bundled skill traces inputs of new registry, interface, enum or config
  variants into unchanged validating or storing code, requires an executed check for a no-issues
  verdict and a minimal witness for findings, since a green suite does not cover new variants.

• Add a Claude Code runtime to the local review evaluations, isolated and accounted like the
  Codex runtime, and a reposcout-guided arm whose task names the skill; guided and neutral
  results are never pooled. Add generated complex TypeScript review stages
  (complex-development, sealed complex-holdout, complex-holdout-b and complex-holdout-c)
  of about 500 files with 15k–100k-token diffs and a 1,200-second episode limit. Sandboxed runs
  also provide common file utilities such as mkdir, mktemp, rm, tar and diff.

• Add review-context --brief, a compact Table/Markdown review brief with changed definitions,
  diff hunks, direct consumers, nonzero analysis gaps of the changed files and head-snapshot doc
  mentions within a 4,096-token default ceiling; an explicit --budget always wins. Identifier
  renames repeated across hunks fold into rule summaries with their sites only where every site
  provably renames an in-tree binding of its file, and whole declarations moved unchanged fold
  into summaries naming their destinations. Hunks explained by other repeated edits show only
  their changed lines; deviations from a repeated edit, reorders, indentation changes in
  indentation-sensitive languages and moves between test and non-test files stay visible. Old
  spellings still present in head are listed for verification. Direct importers without resolved
  call/reference evidence, such as Python modules, list bounded usage lines that name the change's
  identifiers. Omitted hunks are counted exactly and listed or grouped with
  git diff --no-indent-heuristic commands on resolved commits; JSON output is unchanged.

• Add bounded external fixture bundles, shared signed review identities and fixed development,
  heldout and three-case follow-up schedules for larger local Codex evaluations, preserving all historical
  cases and results. Qualification and real model results remain separate from harness tests.

• Add opt-in Codex review evaluations over disposable synthetic repositories, with independent
  domain oracles, isolated baseline/RepoScout/skill comparisons, blinded quality adjudication and
  complete assigned-run reporting. Historical negative results remain intact; evaluator tests
  and smaller source outputs are not presented as evidence of model-token savings.

Changed

• Describe the bundled skill by review task (judging merge or ship safety, explaining what
  changed, finding defects, regressions and risks) and name review-context --brief before
  git diff or git log. For exploring a codebase, planning work or choosing files to read, the
  description names reposcout --agent-summary . before ls, find or grep sweeps and still
  lists symbol lookup, definition reads, dependencies and change impact, so agents choose RepoScout
  for review and exploration questions without being told to.
  The review step explains rename sites, compact [Rn] hunks and the brief's fetch commands, and
  asks agents to check that moved code's names resolve the same at the destination. Each finding
  cites the documented rule or base behavior it breaks, the breaking head line and one affected
  caller on the active path.
• Start committed reviews in the bundled skill with one review-context --brief call and read
  only what it leaves open. Listed consumers are leads: before concluding that nothing breaks,
  agents check each call site in context or run the tests that exercise it.
• Add the committed two-revision review procedure to the bundled skill next to its repository
  scouting, source, context-planning, health, configuration-consent, reporting and CLI-trust
  guidance, and move committed-review details into their own reference. Load detailed guides only
  for needed unfamiliar semantics; preserve pinned source, exact quotations, trust boundaries and
  uncertainty without a mandatory guide-reading chain. When the CLI is missing, the skill tells
  the user and continues without it.
• Prefer body-free Table orientation in the committed-review skill when its revision handles,
  relationships and uncertainty fields answer the reading question. Keep JSON for automation,
  exact structured details and literal source, without requiring duplicate format requests or
  changing CLI defaults. Deterministic output-size checks do not establish model-token savings.
• Reuse pinned source provenance in committed reviews and choose validation for unresolved
  questions. Keep working/staged/deep-review routes available without treating extra replay
  breadth as better review quality or requiring a fixed tool sequence.

Fixed

• Resolve call and reference sites outside every declaration, such as module-level code, route
  registrations and anonymous test callbacks (describe/it), from a synthetic (module) source
  (kind module) in review-context instead of reporting them as missing-owner. JavaScript and
  TypeScript catch parameters, for…of/for…in declarations, shorthand destructuring and arrow
  parameters now shadow same-named imports. consumers does not return module-scope sources as
  hits because they have no readable declaration. Analyzer version 26 refreshes cached facts.

• Resolve Python from package import module imports through PEP 420 namespace packages (no
  __init__.py) to the imported module files, so graph, impact and review consumers include
  those importers. On regular packages, from package import name keeps the __init__.py
  dependency and also links an existing name submodule. Missing modules below a scanned package
  directory now count as unresolved imports instead of silently disappearing. Bumped the cached
  analyzer version to 25.

• Render review-context Table and Markdown diff and source bodies with real newlines instead of
  literal \n, still escaping other control characters.

• Keep live evaluation campaigns, detailed reports, controller evidence and private grading
  packets outside Git checkouts. Add a strict typed public-summary export and a lightweight
  publication policy that rejects raw results, archives and local authoring records.

• Bound external review-fixture reads before loading source bytes, rejecting excessive byte/file
  counts and nonregular files. Make counter-scope calibration an explicit private input instead
  of relying on a controller-specific runtime fingerprint.

• Retain affordable direct changed-declaration references before weaker body-free review-context
  metadata under output pressure, including resolved test callers. Human formats admit needed
  revision/hash handles together with each reference, including handles beyond the initial
  candidate prefix; failed packets roll back without losing smaller alternatives. Source
  selection, coverage, output caps and JSON shape remain unchanged. Explicit source/diff requests
  retain their established body allocation.

• Accept semantically verified clean review answers with the empty or partial evidence arrays
  permitted by their visible contract. Preserve strict checks on supplied quotations, revisions,
  findings and execution claims, and retain original grades alongside versioned offline corrections.

• Require a distinct tool network namespace as well as a denied socket probe, retaining the
  observed namespace, operation and error. Preserve attributable normalized costs before an
  invalid review follow-up in separate partial-cost summaries without inventing complete totals
  or adding cumulative counters twice; original evaluation exports remain unchanged.

• Pin and copy the review evaluator's required runtimes, including Node outside /usr/bin, and
  verify launcher/import availability before consuming a model assignment. Preserve redacted
  private failure phases and pin differences, stop batches on shared prerequisite failures, and
  count failed main-arm episodes as incomplete pairs without rewriting historical outcomes.

• State the review episode's zero-based step ID and retained-evidence indexing convention in
  delivered evaluation prompts and answer schemas. Preserve the ambiguous campaign's original
  strict grades as excluded calibration; do not rewrite answers or relax source checks.

• Confirm owned evaluation processes have fully exited before accepting transient missing-process
  observations, bind retained execution fences to their PID namespace, and preserve private
  observation diagnostics. Keep failed campaigns and separate recovery evidence intact.

• Align prepared review fixtures' Git index with each pinned head, including follow-up revisions,
  and adjudicate alternative witness representations without treating their shape as a proven
  behavior error. Preserve affected observed campaigns as excluded calibration evidence.

Install reposcout 0.6.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.6.0/reposcout-installer.sh | sh

Download reposcout 0.6.0

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
[reposcout-x86_64...

0.5.0 - 2026-10-07

Release Notes

Added

• Add opt-in synthetic development scenarios for review preparation, investigations, repository
  health and bounded evidence reuse, with an exclusively manual GitHub workflow. A separate Linux
  measurement tool records known-source cold/warm query costs and individual CLI peak RAM.

• Add explicit read --range FILE START END for exact, inclusive physical-line excerpts. Small
  module bindings and changed imports can be retrieved without repeating unrelated function
  bodies; existing snapshot/hash checks, source deduplication and output limits remain shared.
  Ranges preserve exact bytes, expose requested bounds and never silently clip at EOF or budget.

• Add explicit read --file FILE for complete, budgeted source including module imports and
  registration tables. Batched file and definition reads share captured identities, snapshot and
  hash checks, source deduplication and output limits; compact defaults remain unchanged.

Changed

• Update the bundled agent skill for explicit file/range reads, snapshot/hash identity and
  reuse of unchanged source, including the limits of bounded import-context reads.

Fixed

• Update transitive source-map-js to 1.2.2 in frontend build/test tooling to fix
  CVE-2026-93749 (indexed source-map denial of service), without dependency overrides.
• Keep frontend linting compatible with TypeScript 7 app builds by using Microsoft's TypeScript 6
  API compatibility package for ESLint and the local import-alias rule. App compilers remain on
  TypeScript 7 with the full existing lint checks.

Install reposcout 0.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.5.0/reposcout-installer.sh | sh

Download reposcout 0.5.0

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.4.1 - 2026-10-05

Release Notes

Fixed

• Read historical Git-tree and index source independently of current source-parent symlinks,
  retaining Git file-mode checks, current ignore/exclusion policy, hash checks and worktree
  no-follow protection.
• Preserve changed-file identities under tight review-context output budgets by reducing large
  declaration/range lists first, with per-side omission counts, and removing oversized identities
  before smaller independent changes when whole entries still cannot fit. Reconsider omitted
  impact/context evidence and requested bodies when eviction frees enough output space.
• Retain both revisions' declaration and caller evidence for pure body insertions and deletions
  in review-context, matching counterparts through unchanged declaration headers rather than
  treating adjacent declarations as changed.

Install reposcout 0.4.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.4.1/reposcout-installer.sh | sh

Download reposcout 0.4.1

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.4.0 - 2026-10-04

Release Notes

Added

• Add review-context for revision-pinned PR preparation: base/head change inventory and changed
  declarations, per-revision static impact, test hints, whole-file source-token costs, and an
  optional budgeted reading list with explicit source/diff delivery. Analysis gaps, selection
  exclusions and output omissions remain separate. The command uses the user's tokenizer and
  leaves all agent allocation and work splitting to the caller.

Changed

• Refresh tiktoken-rs and thiserror through their existing dependency constraints. Bump the
  cached analyzer version to 24 so per-file facts are recomputed with the updated tokenizer and
  regex backends; default/configured encoding selection and JSON schema 2.0 remain unchanged.
• Require successful Rust and release-helper CI for the exact tagged commit before release builds;
  a missing or incomplete latest run now stops publication immediately. Release helper fixtures
  run on every main push and on relevant pull requests.
• Use macOS 15 for Apple Silicon release builds and Ubuntu 24.04 for global release jobs while
  retaining Ubuntu 22.04 for the Linux binary compatibility baseline. Refresh cargo-dist to 0.33.0,
  cargo-auditable to 0.7.6, the Rust toolchain action snapshot, and pnpm within version 11.
• Build downloadable macOS development binaries only on main pushes and manual Rust CI runs.
  Keep internal release transport artifacts for seven days and omit the dist binary upload on PR
  plan-only runs.

Fixed

• Remove vulnerable braces from frontend lint tooling by replacing the import-alias plugin
  with a tested local rule, retaining alias enforcement and fixes. Update brace-expansion
  through its existing constraints; no audit ignores or dependency overrides are added.
• Preserve unknown PR change mappings when either revision cannot be captured and retain resolved
  references under incomplete mapping with an explicit file-based change basis, prioritizing
  external callers over internal references; keep unrelated resolver configurations out of the
  reading list and retain both revisions' relations under
  output limits. Show identity and typed evidence in human output, enforce cooperative review
  deadlines through analysis and rendering, and explicitly exclude ambiguous Unix backslash
  paths from graph inputs without losing their source/change evidence.
• Fail release portability checks when otool or objdump fails, and run a tiny scan from each
  packed binary before publication. Require both target archives, checksums, installer, SBOM,
  source archive, and manifest before attestation and release.
• Trigger Frontend CI when its own workflow changes, and prevent ordinary CI checkouts from
  retaining Git credentials.

Install reposcout 0.4.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.4.0/reposcout-installer.sh | sh

Download reposcout 0.4.0

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.3.3 - 2026-09-25

Release Notes

Changed

• Bumped the cached analyzer version to 23 for corrected per-function cognitive complexity and
  nesting facts; the JSON report schema remains 2.0.

Fixed

• Keep Rust and Go else if chains at one nesting level while preserving the higher cost of
  explicitly nested if blocks.
• Count Boolean operator sequences once through transparent parentheses, including Rust let
  chains and GDScript and/or expressions. Operator changes and negated groups remain distinct;
  Boolean expressions inside calls or nested functions retain their own scope.

Install reposcout 0.3.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.3.3/reposcout-installer.sh | sh

Download reposcout 0.3.3

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.3.2 - 2026-09-22

Release Notes

Fixed

• Anchor ordinary Unix source reads to an open root directory and open files nonblocking, so
  concurrent parent symlink swaps cannot redirect analysis and FIFO replacements cannot stall it.
• Preserve longer exact duplicates behind heavily repeated prefixes. Type-1 candidate sampling
  and work limits now expose partiality in diagnostics, capabilities, work scope, agent summaries,
  and production-duplication completeness.
• Enforce ignore-file byte, line-count and line-length limits through one shared policy for scans,
  worktree queries, index and revision snapshots. Invalid or unreadable ignore rules exclude their
  affected scope and report a partial scan instead of silently widening discovery.
• Refresh daemon targets beneath ancestors named target, dist, node_modules, or .git.
  Reload effective configuration for each scan and watch relevant Git refs, HEAD, index, grafts and
  excludes, including metadata outside linked worktrees. Failed configuration reloads preserve
  the last successful report.
• Keep separate analysis cache files for each profile, preserving hits when alternating commands.
  Repository cache resets remove all profiles and the legacy cache file; writes stay best-effort.
• Validate nested dashboard report and graph payloads, schema compatibility and revision numbers
  before accepting API responses. Malformed refreshes retain the last valid report with an error.

Install reposcout 0.3.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.3.2/reposcout-installer.sh | sh

Download reposcout 0.3.2

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.3.1 - 2026-09-22

Release Notes

Added

• Added first-class C# analysis with tree-sitter line and marker facts, callable complexity,
  imports, symbol/definition outlines, structured duplication, unique local namespace graph edges,
  and conservative local type relationships.

Changed

• Bumped the cached analyzer version to 22 for C# parse-derived facts; the additive report schema
  remains 2.0.

Fixed

• Keep scans, source and snapshot reads, changed-definition queries, and definition plans working
  when the OS analysis cache cannot be written, including in read-only sandboxes. Cache failures
  stay silent in ordinary output; opt-in debug logs include the failed cache path and cause.
• Recognize .jsonl files as JSON inventory instead of reporting them as unsupported. Existing
  .jsonc recognition remains covered by the same regression test.

Security

• Updated rustls to 0.23.45 and rustls-webpki to 0.103.15 to remediate
  RUSTSEC-2026-0285 in the HTTPS update client.

Install reposcout 0.3.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.3.1/reposcout-installer.sh | sh

Download reposcout 0.3.1

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.3.0 - 2026-09-13

Release Notes

Added

• Added deterministic body-free find candidates, bounded definition plan with explicit source,
  and conservative Rust/JavaScript/TypeScript/TSX consumer queries with content-checked read targets.
• Added bounded SARIF, Cargo/rustc JSON and text diagnostic input as existing-context seeds,
  preserving independent input/scan coverage and compact agent-summary output.
• Added offline six-feature evaluation fixtures, canonical usage accounting and a separate
  externally attested native Codex window adapter, plus a 38-run observed pilot.
  All bounded answer checks passed; the pilot does not establish net token savings.

Changed

• Bumped analyzer version to 21 for shared lexical, definition-planning and call/reference facts,
  including corrected non-function reference extraction;
  schema 2.0 and ordinary body-free scouting defaults remain unchanged.

• Updated the tree-sitter runtime to 0.27.0 and adapted child-count indexing to its API.
  Analyzer version 19 invalidates cached parse-derived facts for the updated parser recovery
  behavior; grammar versions and JSON schema 2.0 remain unchanged.

Fixed

• Kept explicit plan source requests aligned with the budget-projected selections and file identities.
• Included unknown-format and unreadable files in lexical-search coverage without double-counting
  recognized unsupported formats; exact name/path matches survive bounded lexical term storage.
• Resolved captured non-call value references to supported non-function declarations in consumer
  queries while preserving function-only calls and conservative shadowing/scope checks.

Install reposcout 0.3.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.3.0/reposcout-installer.sh | sh

Download reposcout 0.3.0

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.2.3 - 2026-09-12

Release Notes

Added

• Added Unix-only changes queries for body-free changed-definition selection and explicit
  --source delivery across working, staged and direct revision comparisons. Snapshot reads via
  read --snapshot worktree|index|REF retain pinned content identity, including deleted source.
  --changed-definitions adds separately bounded body-free evidence to change-summary/review;
  capture, mapping/work-limit and output gaps remain distinct.

• Added Unix-only explicit read queries for known worktree definitions by file and exact symbol or line,
  batch targets under a shared token/byte output budget, and optional body-free file outlines.
  Content hashes, stale checks, ambiguity and omission states preserve the boundaries of each
  response; ordinary scouting and context defaults stay body-free. Non-Unix builds reject source
  and outline queries before source I/O; capabilities expose platform availability.

Changed

• Bumped the cached analyzer version to 18 for precise definition facts. The additive machine
  contract retains schema 2.0 and reuses the ordinary analysis/cache pipeline.

Fixed

• Protected the parent directory of an existing-file changes target against output writes,
  preventing an output path from overwriting a sibling source file.

Documentation

• Updated the bundled skill with direct known-definition and changed-definition routes,
  snapshot selection, explicit source delivery, shared budgets and coverage-aware follow-up.

Install reposcout 0.2.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.2.3/reposcout-installer.sh | sh

Download reposcout 0.2.3

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.2.2 - 2026-09-07

Release Notes

Added

• Integrated Godot 4 scouting: GDScript and shader AST metrics/duplication; scene, resource, and
  project inventory; signal/property/constant/scene-node lookup; project-scoped resource, UID,
  global-class and autoload dependency context; and GUT/GdUnit4 enabled-plugin test-presence hints.
  Godot data formats remain outside code health by default. The canonical fixture matrix now
  covers 36 formats, and daemon graphs retain project/UID configuration per immutable revision.

Changed

• Bumped the cached analyzer version to 17 for Godot facts and symbol kinds; the additive machine
  contract retains schema 2.0. Daemon watchers ignore generated .godot/ events.

Install reposcout 0.2.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/gordon1210/reposcout/releases/download/v0.2.2/reposcout-installer.sh | sh

Download reposcout 0.2.2

File	Platform	Checksum
reposcout-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
reposcout-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum