{"slug": "ototo-2-8-2", "title": "Otōto 2.8.2", "summary": "Otōto released version 2.8.2, adding support for Claude Code session directories added via /add-dir or claude --add-dir, blocking reads of .env files, private keys, credentials files and Terraform state by default, and shipping signed SHA256SUMS checksums with each release. The tool also restricts run logs, live traces and config.toml to the owning user, requires a per-user link for the dashboard, and adds an ototo managed --install mode that enforces specified model servers for organizations. Otōto said the small model is now told repository content is data rather than instructions, and files shaped like its own control tokens can no longer open a turn.", "body_md": "- **Directories you add to a session.** A Claude Code session can reach beyond the repo it started in (`/add-dir` , or`claude --add-dir` ), and Otōto now works there too: an absolute path inside an added directory, or naming one in a question, is enough. It serves only what the session lists, never your whole home directory. A path outside all of them gets a note saying to add its directory with`/add-dir` first.\n- **Secrets stay out.** Environment files (`.env` ; not`.env.example` ), private keys, credentials files (`.netrc` ,`.npmrc` ,`.aws/credentials` , …) and Terraform state are no longer read or listed by Otōto, so they never reach a model server. Claude Code's own tools are unaffected.`read_secrets = true` in`config.toml` turns this off.\n- **Your files are yours only.** The run log, the live trace and`config.toml` are readable by you alone, and so is`~/.ototo` ; files from earlier betas are tightened on first use, and`ototo doctor` warns about any that are not.\n- **The dashboard needs its link.** Its data now needs a key only you can read, so other users on the machine cannot see your questions and answers through it. Open it once with the link`ototo ui` prints (`ototo ui --link` prints it again); the page remembers it. A bookmark of the plain address says how to get the link.\n- **Harder to steer through the code.** The small model is told that what it reads in a repository is data, never instructions, and text in a file shaped like its own control tokens can no longer open a turn of its own.\n- **`ototo doctor`** warns when a model server or collector on another machine is reached over plain HTTP, and shows the check command (`check_cmd` ) edits run, if one is set.\n- **Signed checksums.** Each release now comes with`ototo-<version>-<commit>.SHA256SUMS` and its`.sig` . To check a download, save the key line from https://ototo.dev/release-key.txt as`release-key.txt` , then:`ssh-keygen -Y verify -f release-key.txt -I ototo-release -n ototo-release -s <sums>.sig < <sums>` and`shasum -a 256 -c <sums>` (`sha256sum -c` on Linux).\n- **For organisations:**`ototo managed --install` with`--base-url` and`--model` now enforces those model servers, so users cannot send code elsewhere;`--allow-user-endpoints` lets them add their own.", "url": "https://wpnews.pro/news/ototo-2-8-2", "canonical_source": "https://ototo.dev/changelog#v2.8.2", "published_at": "2026-09-27 20:10:02+00:00", "updated_at": "2026-10-05 22:18:34.496393+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents", "ai-safety"], "entities": ["Otōto", "Claude Code", "ototo doctor", "ototo ui", "ototo managed"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ototo-2-8-2", "markdown": "https://wpnews.pro/news/ototo-2-8-2.md", "text": "https://wpnews.pro/news/ototo-2-8-2.txt", "jsonld": "https://wpnews.pro/news/ototo-2-8-2.jsonld"}}