v0.9.2

Changed

• The repository moved from jamiesun/scoot to the
  scootship organization
  (scootship/scoot). All references
  were updated accordingly ([#202]): the release workflow now publishes to
  scootship/homebrew-tap and scootship/apt-tap, install.sh defaults to
  scootship/scoot, and the install instructions across the README, release
  footer, and bilingual docs use brew install scootship/tap/... and the
  scootship.github.io/apt-tap apt source.

---

Install

curl -fsSL https://raw.githubusercontent.com/scootship/scoot/main/install.sh | sh

Add SCOOT_INSTALL_EDGE=1 to the same command to also install the optional
scoot-edge fleet companion (never installed unless requested).

macOS (Homebrew):

brew install scootship/tap/scoot          # the agent
brew install scootship/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)
brew install scootship/tap/scoot-edge      # optional fleet companion (pulls in scoot)

Debian/Ubuntu (apt, amd64/arm64/armhf):

curl -fsSL https://scootship.github.io/apt-tap/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/scootship-apt-tap.gpg
echo "deb [signed-by=/usr/share/keyrings/scootship-apt-tap.gpg] https://scootship.github.io/apt-tap stable main" | sudo tee /etc/apt/sources.list.d/scootship-apt-tap.list
sudo apt update
sudo apt install scoot          # the agent
sudo apt install scoot-wasm     # optional Wasm compute-unit host (pulls in scoot)
sudo apt install scoot-edge     # optional fleet companion (pulls in scoot)

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive (the optional
standalone Wasm host) and a separate scoot-edge-* archive (the optional
fleet companion). The zero-dependency core scoot binary never embeds either.

v0.9.1

Fixed

• The GitHub release notes footer (.github/release-footer.md) still said
  apt packaging was scoot-edge only and only showed an apt install scoot-edge example. It now matches the Homebrew block above it and lists
  all three packages (scoot, scoot-wasm, scoot-edge), reflecting the
  apt coverage shipped in v0.9.0.

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

Add SCOOT_INSTALL_EDGE=1 to the same command to also install the optional
scoot-edge fleet companion (never installed unless requested).

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)
brew install jamiesun/tap/scoot-edge      # optional fleet companion (pulls in scoot)

Debian/Ubuntu (apt, amd64/arm64/armhf):

curl -fsSL https://jamiesun.github.io/apt-tap/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/jamiesun-apt-tap.gpg
echo "deb [signed-by=/usr/share/keyrings/jamiesun-apt-tap.gpg] https://jamiesun.github.io/apt-tap stable main" | sudo tee /etc/apt/sources.list.d/jamiesun-apt-tap.list
sudo apt update
sudo apt install scoot          # the agent
sudo apt install scoot-wasm     # optional Wasm compute-unit host (pulls in scoot)
sudo apt install scoot-edge     # optional fleet companion (pulls in scoot)

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive (the optional
standalone Wasm host) and a separate scoot-edge-* archive (the optional
fleet companion). The zero-dependency core scoot binary never embeds either.

v0.9.0

Added

• The apt release job now packages the core scoot binary and the
  optional scoot-wasm host as .debs alongside the existing scoot-edge
  package, all pushed to the shared
  jamiesun/apt-tap repository.
  scoot-wasm and scoot-edge now declare an apt Depends: scoot
  (matching the dependency already expressed by their Homebrew formulae),
  so apt install scoot-wasm/scoot-edge pulls in the core agent
  automatically.

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

Add SCOOT_INSTALL_EDGE=1 to the same command to also install the optional
scoot-edge fleet companion (never installed unless requested).

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)
brew install jamiesun/tap/scoot-edge      # optional fleet companion (pulls in scoot)

Debian/Ubuntu (apt, scoot-edge only, amd64/arm64/armhf):

curl -fsSL https://jamiesun.github.io/apt-tap/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/jamiesun-apt-tap.gpg
echo "deb [signed-by=/usr/share/keyrings/jamiesun-apt-tap.gpg] https://jamiesun.github.io/apt-tap stable main" | sudo tee /etc/apt/sources.list.d/jamiesun-apt-tap.list
sudo apt update && sudo apt install scoot-edge

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive (the optional
standalone Wasm host) and a separate scoot-edge-* archive (the optional
fleet companion). The zero-dependency core scoot binary never embeds either.

v0.8.0

Security

• Model-triggered bash calls now run with a scrubbed subprocess environment:
  ambient variables whose name matches KEY/TOKEN/SECRET/PASSWORD/
  PASSWD/CREDENTIAL, plus the configured backend.api_key_env, are dropped
  before the child process starts. Previously bash subprocesses inherited the
  full parent environment, so a shell command could read out the backend API
  token or other ambient credentials it was never granted (#190).
• guarded mode's local-read guard now also denies known secret-bearing paths
  — the resolved token file, a distinct configured backend.api_key_file, and
  common credential fragments such as .ssh, .env, id_rsa, token,
  secret, credentials — the same check readonly already enforced.
  Previously this path check only ran in readonly, so the default guarded
  mode could file_read a secret file straight through (#191).
• Tool call input, tool observation, thought, final replies, and PostToolUse
  audit-hook payloads are now scanned for known secret values (the resolved
  backend token and the value of any ambient secret-named env var) and
  redacted to [REDACTED] before they reach the audit log, trace output, or
  structured event sink. Previously these channels recorded raw text
  verbatim, so a secret surfaced by any tool call could be durably persisted
  in logs/audit.jsonl. The live conversation history sent back to the model
  is unaffected — only recording/observability channels are redacted (#189).

Added

• The audit log (logs/audit.jsonl) now rotates into a bounded, gap-tracked
  chain of numbered generations (logs/audit.jsonl.<gen>) instead of a single
  destructively-overwritten .1 backup. A durable logs/audit.jsonl.gen
  sidecar tracks the current generation across process restarts; up to
  [audit].max_retained_generations (default 8, override
  SCOOT_AUDIT_MAX_RETAINED_GENERATIONS) retired generations are kept, and any
  eviction beyond that cap is durably recorded in
  logs/audit.jsonl.gaps.jsonl rather than silently disappearing. scoot doctor now reports audit.retention as WARN if any gap was ever
  recorded. This removes the audit-history data-loss blocker that a future
  scoot-edge audit shipper would otherwise hit (#187).
• scoot-edge E2 job dispatch: scoot-edge dispatch (one-shot) and
  scoot-edge run --enable-jobs (folded into the heartbeat loop) poll a GET
  job lease, schema-validate each envelope, and execute accepted jobs as
  scoot --unattended -e "<goal>" --session-id job-<job_id> with cwd confined
  to a required --job-root (never $HOME or /). Both require --job-root
  and --lease-url; either missing, or --lease-url not HTTPS without
  --allow-insecure-http, is a config error (exit 2), matching the existing
  --center-url/token gate. A bounded, persistent idempotency store
  (edge/idem.jsonl, capped by --idem-cap, default 500) re-acks a
  redelivered idem_key's prior outcome instead of re-running the job, and
  every phase transition (accepted → done/failed/rejected) is both
  POSTed as a job_event and appended to an edge-side provenance log
  (logs/edge-audit.jsonl), correlated by session_id to Scoot's own run
  audit. A new core --session-id <id> flag on scoot -e lets a caller pin
  the session file name instead of the default UUID, which is what makes this
  job_id ↔ session_id correlation possible (#186).
• scoot-edge E3 packaging (complete): the release workflow builds,
  archives (scoot-edge-<target>.tar.gz + .sha256), and publishes a
  scoot-edge Homebrew formula (brew install jamiesun/tap/scoot-edge,
  depending on scoot) for every tagged release, mirroring the existing
  scoot-wasm packaging. install.sh gained an opt-in SCOOT_INSTALL_EDGE
  variable that additionally downloads and installs scoot-edge alongside
  core scoot; it is never installed unless explicitly requested. A new
  optional apt job (gated by APT_TAP_TOKEN, mirroring the Homebrew job's
  HOMEBREW_TAP_TOKEN) builds a .deb per Linux architecture and pushes it
  to the shared jamiesun/apt-tap
  repository, which owns the GPG signing key and publishes the signed apt
  index to GitHub Pages on every push, closing out #171.

Documentation

• Fixed docs, README, and book examples that showed the unattended one-shot
  clamp as scoot -e --unattended <goal> — a rejected argv order, since
  -e/--eval greedily consumes the very next token as the goal string.
  Examples and prose now consistently show the accepted
  scoot --unattended -e "<goal>" order (#192).

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

Add SCOOT_INSTALL_EDGE=1 to the same command to also install the optional
scoot-edge fleet companion (never installed unless requested).

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)
brew install jamiesun/tap/scoot-edge      # optional fleet companion (pulls in scoot)

Debian/Ubuntu (apt, scoot-edge only, amd64/arm64/armhf):

curl -fsSL https://jamiesun.github.io/apt-tap/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/jamiesun-apt-tap.gpg
echo "deb [signed-by=/usr/share/keyrings/jamiesun-apt-tap.gpg] https://jamiesun.github.io/apt-tap stable main" | sudo tee /etc/apt/sources.list.d/jamiesun-apt-tap.list
sudo apt update && sudo apt install scoot-edge

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive (the optional
standalone Wasm host) and a separate scoot-edge-* archive (the optional
fleet companion). The zero-dependency core scoot binary never embeds either.

v0.7.0

Added

• Unattended one-shot policy clamp (scoot -e --unattended): the E2 keystone
  prerequisite for scoot-edge job dispatch. An unattended -e run now computes
  its effective policy in-child as
  correctUnattended(privilegeMin(requested, edge.max_job_policy)), so argv (and a
  future wire) can only ever lower policy below the local ceiling, never raise it.
  A new local-only [edge].max_job_policy config knob (default readonly, override
  SCOOT_EDGE_MAX_JOB_POLICY) is the ceiling; an optional --policy <mode> may
  only lower it. The correctUnattended/privilegeMin lattice
  (readonly ⊑ guarded ⊑ unrestricted, deliberately not the Mode enum order)
  is now the single source of truth shared with the scheduler's effectiveMode.
• scoot-edge (E1) gains a continuous run heartbeat loop: it dials out and
  POSTs a status heartbeat on a --interval-ms cadence until stopped, with a
  bounded jittered exponential backoff on transient failure (the loop never
  crashes and never opens a listener) and an optional --max-posts bound for
  supervised/bounded runs. Each iteration uses a reset-per-post arena so an
  unbounded run holds bounded memory. The heartbeat can also carry an opt-in,
  advisory node capability descriptor (--report-capabilities, off by
  default; --label / --skill plus SCOOT_EDGE_LABELS / SCOOT_EDGE_SKILLS
  feed it) for capability-aware routing — advertising never grants authority, the
  local policy ceiling still gates every job.
• scoot-edge run now shuts down gracefully on SIGINT/SIGTERM: it finishes
  the in-flight heartbeat, then exits 0 instead of being hard-killed, making it a
  well-behaved systemd/launchd service. One-shot commands gained stable, documented
  exit codes (0 success, 1 dial-out POST failed, 2 config/usage error, 3
  local-status collection failed), so a failed/missing scoot daemon status --json
  child now prints a clean message instead of a raw error trace.

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive: the optional
standalone Wasm host. The zero-dependency core scoot binary never embeds it.

v0.6.0

Added

• Project-wide audit agent skill (project-audit) that scores ten dimensions
  of repository health (docs↔functionality, security, config consistency,
  bilingual parity, build/test, memory discipline, public-API surface, …) into a
  single reproducible report (#168).

• scoot-edge E1 status heartbeat for the optional edge fleet agent, plus the
  E0 boundary documentation for the optional scoot-edge deployment (#172, #173).

• WebAssembly spec conformance tests for the bundled scoot-wasm engine. A
  curated subset of the official WebAssembly/testsuite (pinned at revision
  193e551f) is converted offline with wast2json and committed under
  test/wasm-spec/, then replayed against the engine by an always-run
  zig build test target. The core stays zero-dependency (fixtures are embedded
  via @embedFile; no toolchain needed at test time). See
  docs/WASM_TOOLS.md for the
  included/excluded coverage and how to regenerate (#163).

• Opt-in PostToolUse-style audit/observability hook ([audit.hook]). After a
  tool action completes (executed or policy-denied), an external Wasm package
  (manifest kind audit, compute-only) receives a structured JSON event for an
  external SIEM/analytics/org-audit pipeline. Purely observational — never gates
  execution — and best-effort: any failure/timeout is counted and surfaced as a
  flush warning, never fatal. Default off (#137).

• Structured ReACT event sink for protocol adapters: an optional in-process
  observer receives typed lifecycle events (thinking, step, observation,
  policy_deny, final, …) so embedders can build protocol adapters without parsing
  trace text (#156).

• Opt-in PreToolUse-style policy hook at the unified guard() chokepoint
  ([tools.policy_hook]). After built-in checks allow an action, an external
  Wasm policy package (manifest kind policy, compute-only) may further restrict
  it — allow→deny only, never relaxing a built-in deny. Fail-closed on any
  failure/timeout/invalid output, audited, and reflected by scoot policy check.
  Default off (#136).

Fixed

• scoot-wasm: iNN.trunc_fMM_s/u no longer traps on fractional inputs whose
  truncated (toward-zero) integral value is in range — e.g.
  i32.trunc_f64_s(-2147483648.9). The range check now runs after truncation
  instead of against the raw operand, matching the spec (surfaced by the new
  conformance suite, #163).
• scoot-wasm: hardened the loader/interpreter against hostile bytecode by
  replacing unreachable-by-construction unreachable sites with explicit decode
  errors and traps, and removed an OOM→panic path in the WASI test host (#174,
  #181).

Security

• Tightened the agent boundary guardrails so untrusted tool output cannot widen
  authority (#176).

Documentation

• Compute-unit build guidance, trigger/discovery notes for Wasm tools, and the
  scoot-edge E0 boundary doc (#170, #172).

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive: the optional
standalone Wasm host. The zero-dependency core scoot binary never embeds it.

v0.5.0

Added

• Added a committed playground/ test environment that exercises full action
  coverage end-to-end against a real backend (#161).
• scoot-wasm now executes floating-point Wasm (W4): f32/f64 arithmetic
  (add/sub/mul/div), unary ops (abs/neg/ceil/floor/trunc/nearest/sqrt),
  min/max/copysign, ordered comparisons, int/float conversions, and both
  trapping (iNN.trunc_fMM_s/u) and saturating (iNN.trunc_sat_fMM_s/u)
  truncation, alongside the already-supported bulk memory.copy/memory.fill.
  NaN results are canonicalized for deterministic output across hosts, while
  abs/neg/copysign preserve exact bit patterns; nearest rounds ties to even
  and the zero sign is preserved. The static type validator now type-checks the
  float opcodes too, so float modules load and run end-to-end. A robustness
  suite now feeds truncated, byte-corrupted, and random/hostile module bytes
  through the loader and asserts every input yields a structured load error or
  trap instead of crashing. Full spec-conformant validation beyond the
  supported subset remains a later phase (#100).
• Added a native wasm_tool Agent action for compute-only local Wasm packages.
  It validates the package boundary, requires entry = "_start" plus
  policy.toml granting only compute, and runs the configured scoot-wasm
  host argv directly instead of giving the model a broad bash command.
  With the default host config, Scoot now prefers a sibling scoot-wasm next to
  the running scoot binary before falling back to PATH.
• Added a copyable Wasm compressor plugin template, a deterministic redactor
  compressor example, and scripts/check-wasm-examples.sh to build, validate,
  and smoke-test the example packages.
• scoot-wasm now performs a W3 static function-body type validation pass for
  the current host subset before execution. It checks operand/control stack
  shapes, block/loop/if signatures, branch labels, direct and indirect call
  signatures, local/global access, memory/table presence, and immutable globals,
  so malformed type/index errors fail module loading instead of reaching the
  interpreter. Full spec-conformant validation beyond the supported subset is
  still a later phase (#100).
• scoot-wasm now runs wasm32-wasi command modules over a minimal WASI
  preview1 subset (W2): scoot-wasm wasi <module.wasm> [args...] instantiates
  the module, runs _start, pipes this process's stdin to fd 0, forwards the
  module's stdout/stderr, and exits with its proc_exit status. The exposed
  surface is a pure data-transform sandbox: the only channels are stdin
  (fd_read, fd 0), stdout/stderr (fd_write, fd 1/2), argv (args_*), and
  proc_exit. No environment, clock, randomness, filesystem, or network is
  exposed — environ_*, clock_time_get, random_get, and every other WASI
  import trap by construction, so a plugin's output is a pure function of its
  (stdin, argv). Out-of-bounds guest pointers return EFAULT and non-stdio fds
  return EBADF. This is the intended subprocess host for external compression
  plugins (#100).
• scoot-wasm now executes integer Wasm functions (W1): a dependency-free Zig
  stack machine with structured control flow (block/loop/if/else/br/br_if/
  br_table/return/call/call_indirect), i32/i64 arithmetic, a bounds-checked
  64 KiB-page linear memory (load/store, memory.size/grow), globals, a funcref
  table, and active data/element segments. Every fault is a structured trap
  (unreachable, divide-by-zero, integer overflow, out-of-bounds memory/table,
  indirect-call type mismatch) bounded by fuel, call-depth, and memory-page
  limits. Invoke with scoot-wasm run <module.wasm> <export> [int args...].
  The engine is compiled only into the standalone scoot-wasm binary
  (-Dwasm-host=true); the zero-dependency core never links it. Full
  spec-conformant validation beyond the supported subset remains a later
  phase (#100).
• Release workflow now publishes a separate scoot-wasm-<target>.tar.gz archive
  (plus .sha256) for every target, built in the same job via
  -Dwasm-host=true. The optional standalone Wasm compute-unit host is now a
  downloadable artifact, not a build-from-source-only binary.
• Added a Homebrew tap publish job (brew install jamiesun/tap/scoot and
  brew install jamiesun/tap/scoot-wasm). The scoot-wasm formula depends on
  scoot, so installing the host also installs the agent; the default
  wasm_host then resolves scoot-wasm from PATH. The job no-ops unless a
  HOMEBREW_TAP_TOKEN secret is set, mirroring the optional Docker Hub publish.

Changed

• Release archives now ship a single ReleaseSafe flavor per target instead of
  both ReleaseSafe and ReleaseSmall. Users who need a smaller binary compile
  from source with -Doptimize=ReleaseSmall; the published release notes carry a
  permanent footer documenting this and the optional Wasm host.

Removed

• Dropped the -small (ReleaseSmall) release artifacts and the installer's
  SCOOT_INSTALL_FLAVOR variable. install.sh now downloads the single
  published flavor.
• Narrowed the Wasm plugin sandbox to stdin/stdout/stderr/argv as a new hard
  rule: no filesystem, network, clock, or randomness authority (#164).

Documentation

• Rewrote the README to be human-friendly and concept-first, and refreshed the
  infographic with an isometric hero image (#160, #165).
• Removed the redundant README language link and translated remaining Chinese
  comments and strings to English (#146, #153).

---

Install

curl -fsSL https://raw.githubusercontent.com/jamiesun/scoot/main/install.sh | sh

macOS (Homebrew):

brew install jamiesun/tap/scoot          # the agent
brew install jamiesun/tap/scoot-wasm      # optional Wasm compute-unit host (pulls in scoot)

Build flavors

Prebuilt archives are ReleaseSafe only (runtime safety checks on). If you
need a smaller binary, compile from source:

zig build -Doptimize=ReleaseSmall   # smallest, fewer safety checks

Each target also ships a separate scoot-wasm-* archive: the optional
standalone Wasm host. The zero-dependency core scoot binary never embeds it.

v0.4.0

Added

• Embedded runs now emit session-correlated audit events and write per-session
  JSONL state, making API-driven runs replayable and easier to inspect (#140).
• Added read-only session and audit commands: scoot sessions list,
  scoot session show <id>, and scoot audit show <session-id> (#141).
• Added the foreground scoot serve stdio NDJSON protocol with run,
  session.list, session.get, and audit.query methods for local app-server
  integrations (#142).

Changed

• Hardened the serve and daemon lifecycle: stdio run uses request-scoped
  result allocation and default retry semantics, and daemon stop only signals
  a process when the pid matches the recorded running daemon state (#143).

v0.3.0

Added

• Docker releases now publish multi-platform Linux images for linux/amd64,
  linux/arm64, and linux/arm/v7 to GHCR, with optional Docker Hub publishing
  when Docker Hub credentials are configured. The default image uses a minimal
  BusyBox/musl runtime and matching Alpine runtime tags use an -alpine suffix.
• scoot setup interactive command generates a config directory in a few
  prompts (config dir with overwrite confirmation, backend base_url/model,
  token source via env/0600 file/command, max_turns, policy), creates the
  runtime tree, and writes config.toml without ever inlining the token —
  the fast path for provisioning multiple isolated instances on one host.
• Release workflow now publishes explicit ReleaseSmall assets with -small
  suffixes for every supported target.
• Installer supports SCOOT_INSTALL_FLAVOR=small to select the small release
  artifact instead of the default ReleaseSafe artifact.
• Native recall action can retrieve exact earlier messages from the current
  session transcript archive after active context compaction (#99).
• Stable embedding API surface now separates the public package root from the
  CLI/internal module and includes a compiled minimal embed example (#106).
• backend.store config key and SCOOT_BACKEND_STORE override to opt into
  Responses API server-side response persistence; defaults to off so Scoot
  stays stateless and local-first (#110).
• Client-side MCP support through a guarded mcp_call meta-action and
  [[mcp.servers]] config. The client now supports stdio, Streamable HTTP, and
  legacy SSE transports behind the same config and policy seam, including
  per-server header authentication via environment-backed values (#103).
• External context compressor plugins can now be selected with
  agent.compactor = "plugin:<name>" and configured under
  [agent.compactor_plugin.<name>]. Packages reuse the wasm_tool descriptor
  boundary with kind = "compressor" and run as bounded subprocesses with
  extractive/drop fallback (#98).

Changed

• Scoot now speaks only the OpenAI Responses API (/v1/responses): leading
  system messages map to the top-level instructions field, the rest become the
  input array, and transport is stateless by default (full input resent each
  turn) so local context compaction stays in control. Requires a Responses-capable
  backend such as Ollama >= 0.13.3, vLLM, or OpenAI (#110).
• Guarded mode now confines file writes to the project root by default, wraps
  tool observations in an explicit untrusted-data boundary, and requires an
  opt-in for repository-carried <cwd>/.agents/skills (#113).
• Context compaction now goes through a Compressor strategy seam with drop
  retained as the smallest fallback strategy (#97).
• Added the built-in extractive compactor and agent.compactor /
  SCOOT_AGENT_COMPACTOR selection (#97).

Removed

• OpenAI Chat Completions transport, the backend.api selector, and the
  SCOOT_BACKEND_API override; the Responses API is now the only transport.
  Configs that still set api are ignored with a one-line deprecation warning
  (#110).
• The backend.prompt_cache hint and SCOOT_BACKEND_PROMPT_CACHE override
  (with the Anthropic-style cache_control breakpoint); the instructions
  field is natively prompt-cached, so the manual hint is obsolete. Stale keys are
  ignored with a deprecation warning (#110).

Fixed

• -e and REPL runs now get per-process session transcript ids instead of
  appending every run to shared cli.jsonl and repl.jsonl files (#95).
• Default agent configuration now enables a conservative context budget with
  extractive compaction, while context_budget_bytes = 0 still explicitly
  disables the guard (#96).
• Catastrophic shell-command detection now also catches whitespace-obfuscated
  fork-bomb patterns (#113).
• GitHub workflows now pin action references to commit SHAs and verify the
  downloaded Zig toolchain tarball checksum before extraction (#113).
• MCP stdio tests now use per-process temp directories, so the parallel
  zig build test artifacts no longer race on shared /tmp paths (#122).
• MCP SSE transport now enforces a single cumulative timeout across the entire
  session (connection setup, receiveHead, every POST, and every event read) so
  a server that accepts the connection but never sends headers, or that dribbles
  one event just before each per-event deadline, can no longer hang the agent
  indefinitely (#123).
• MCP remote header values sourced from environment variables (value_env) are
  now checked for CR/LF, closing a header-injection gap where the literal
  value and prefix were validated but the resolved env value was not (#124).
• MCP stdio transport now bounds the child-process stdin write with the
  configured timeout. Previously a server that never drained its stdin blocked
  the write forever once the OS pipe buffer filled with the model-controlled
  request, and the defer child.kill cleanup could never run (#125).
• zig build test now runs its three test artifacts sequentially instead of
  in parallel, so tests that share hardcoded /tmp/scoot_* paths across
  binaries no longer race (one binary's deleteTree removing a file another is
  mid-exec on); compilation still parallelizes (#127).

v0.2.0

Added

• SCOOT_* environment overrides for zero-config and CI runs (#67)
• Windowed file_read support with offset/limit line ranges (#78)
• Context compaction at the configured context budget instead of aborting the run (#81)
• Optional grep context lines around matches (#82)
• Config-gated prompt-cache breakpoint for stable model prompts (#84)
• Zero-dependency outline action for low-token file skeletons (#85)
• POSIX release installer that downloads, verifies, and installs the matching binary (#90)
• Run summaries on stderr after CLI/REPL runs, including event counts, tool calls, policy denies, backend status, and transcript path (#59)
• Minute-level 5-field UTC cron scheduling for schedule.jobs (#65)

Changed

• ~/.agents/skills discovery is now opt-in while project-local and Scoot-local skills remain enabled (#87)
• Repeated read-only observations are deduplicated within a run (#83)
• Agent observations are token-optimized by stripping ANSI, using head/tail windows, and enforcing token caps (#80)
• Per-turn thoughts are no longer persisted in run history (#79)
• Runtime directories and JSONL audit/session files now use owner-only permissions, and JSONL files rotate to .1 at a bounded size (#60, #61)
• GitHub workflows now use Node 24-compatible actions and shell-based Zig setup (#63)
• build_options is imported by the executable root module as well as the library module (#64)
• parseStep now tolerates compatibility backends that wrap the step JSON in a Markdown code fence or emit multiple concatenated JSON objects, executing only the first step while keeping single-step ReACT semantics

Fixed

• Language switching now lives in the mdBook navigation icon bar (#86)
• Invalid enum-like SCOOT_* overrides now warn and keep the previous value instead of silently changing policy/mode/level (#68)
• confine_writes now rejects a pre-existing symlink at the final write path component (#69)

Documentation

• Added maintained changelogs and made release notes derive from them (#66)
• Improved README and user-guide structure, including installer docs, design philosophy, best-practice cases, and daemon/run-mode guidance (#90)
• Added Scoot logo and favicon assets, plus an animated documentation landing mark (#91)
• Folded the logo into the README/mdBook infographic and removed duplicate standalone logo blocks (#92)