- Directories you add to a session. A Claude Code session can reach beyond the repo it started in (
/add-dir, orclaude --add-dir), and Otōto now works there too: an absolute path inside an added directory, or naming one in a question, is enough. It serves only what the session lists, never your whole home directory. A path outside all of them gets a note saying to add its directory with/add-dirfirst. - Secrets stay out. Environment files (
.env; not.env.example), private keys, credentials files (.netrc,.npmrc,.aws/credentials, …) and Terraform state are no longer read or listed by Otōto, so they never reach a model server. Claude Code's own tools are unaffected.read_secrets = trueinconfig.tomlturns this off. - Your files are yours only. The run log, the live trace and
config.tomlare readable by you alone, and so is~/.ototo; files from earlier betas are tightened on first use, andototo doctorwarns about any that are not. - The dashboard needs its link. Its data now needs a key only you can read, so other users on the machine cannot see your questions and answers through it. Open it once with the link
ototo uiprints (ototo ui --linkprints it again); the page remembers it. A bookmark of the plain address says how to get the link. - Harder to steer through the code. The small model is told that what it reads in a repository is data, never instructions, and text in a file shaped like its own control tokens can no longer open a turn of its own.
ototo doctorwarns when a model server or collector on another machine is reached over plain HTTP, and shows the check command (check_cmd) edits run, if one is set.- Signed checksums. Each release now comes with
ototo-<version>-<commit>.SHA256SUMSand its.sig. To check a download, save the key line from https://ototo.dev/release-key.txt asrelease-key.txt, then:ssh-keygen -Y verify -f release-key.txt -I ototo-release -n ototo-release -s <sums>.sig < <sums>andshasum -a 256 -c <sums>(sha256sum -con Linux). - For organisations:
ototo managed --installwith--base-urland--modelnow enforces those model servers, so users cannot send code elsewhere;--allow-user-endpointslets them add their own.
source & further reading
ototo.dev — original article
Otōto 2026.21.2
Otōto 2026.21.1
Otōto 2026.21