yokoten · 横展

yokoten · 横展

A guide for the journey. A guard at the bridge.

A free command-line tool that keeps AI coding agents safe and walks you, step by step, along the road good software teams use — so anyone can build software the right way.

One person and a few AI agents, building to a professional team's standard. yokoten was built this way.

Quick start View on GitHub
12345

The dream

Everyone can build software the way good teams do: the whole cycle, from plan to release and beyond. Someone new to programming starts on the right road on day one, and walks it safely with AI agents.

The guard
keeps you safe on the way. A risky command is stopped before it runs, and the agent is told why.
The guide
teaches you the road. doctor knows which of five stages your project is at, and names the one next step.
The dream
is where the road goes: you build the way good teams build, and learn it by doing it.

Yokoten (横展) is Toyota’s word for rolling one line’s fix out to every line. Here, a lesson one project learns becomes a check that every project gets.

What changes on day one

Your agent tries to…Without yokotenWith yokoten
force-push, or tag a releaseWithout yokotenit happensWith yokotenstopped before it runs, and told whycodetest
“fix” a failing test by editing the testWithout yokotenthe test passes, the bug staysWith yokotennot allowed in a fixcodetest
commit your email, a server IP, your cityWithout yokotenit goes publicWith yokotenthe commit stops; the report names the file and line, never the textcodetest
open a pull requestWithout yokotenas you, with all your rightsWith yokotenas a bot; nothing merges without youcodetest
work in another projectWithout yokotenstarts from zeroWith yokotenhears what that project is missing, and offers to set it upcodetest

See it at work

Three moments from a session. Step through them.

claude code · pre-tool hook
git push --tagsyokoten: git push --tags pushes tags. Only the owner decides when to release. If the owner asked for this, they start the session with YOKOTEN_RELEASE_APPROVAL set.

The agent tries to push a release tag. The hook stops it before it runs, and the agent reads why.

The road

Software teams work in a loop: plan, build, check, review, release. yokoten takes you along it one stage at a time. Every stage is something the yokoten repo already does, so you can see it working.

  1. doctor: stage 1 · safety net

    Safety netyou are here

    You never have to work out where you are. doctor reads your project’s files and says it, for example stage 1 of 5, safety net. A new project starts at stage 1. The order is advice, not a gate.

    You learn
    rules the agents read, checks that stop them
    See it here
    AGENTS.md

  2. doctor: stage 2 · issues and pull requests

    Issues and pull requests

    You learn
    every change has a reason; CI passes before it merges; labels, milestones, a board

  3. doctor: stage 3 · release

    Release

    You learn
    clear commit messages, a changelog, version numbers
    See it here
    CHANGELOG.md

  4. doctor: stage 4 · a team of agents

    A team of agents

    You learn
    a bot, workers, a reviewer; you stay the boss
    See it here
    the guide

  5. doctor: stage 5 · going public

    Going public

    You learn
    a privacy check over all history, security settings, protected branches
    See it here
    security policy

The road to the dream

Each milestone covers more of the cycle, for more people and more tools.

  1. Now, before 26 Oct 2026

    doctor walks you along the road; a release flow; checks on GitHub settings; npx yokoten; the same guard in Codex and Gemini CLI

    M0

  2. Meta hackathon, 26 Oct – 3 Nov

    an agent that reads an old project and drafts how to adopt yokoten; Muse Code support

    M1

  3. Next

    Gitea and other code hosts; a short spec before larger changes; the OpenSSF Best Practices badge as public proof

    issues

Every step is planned in the open: the board shows what is being built today, and the milestones show what comes next.

Quick start

You need Node 22.18 or later. Nothing else: no build step, no dependencies.

sh
git clone https://github.com/coo1white/yokotennode yokoten/bin/yokoten.ts install  # once per computercd your-projectnode ~/.local/share/yokoten/bin/yokoten.ts init  # once per project

Then open the project in Claude Code. It tells you which stage you are at, and the one next step.

A one-command npx yokoten comes with the npm release.

Check it works

In your project, run doctor. It shows the whole road and marks the next step:

sh
node .yokoten/bin/yokoten.ts doctoryokoten 0.1.0, self-test okthe road: stage 1 of 5, safety net  1. safety net    done        rules    done        tool-hook    done        commit-check    done        runtime    next        tests: CI does not run the tests; add a step that runs `npm test` …  2. issues and pull requests    …

Shortened. Your steps will differ.

To see the guard stop something without running anything, hand it a pretend tool call:

sh
echo '{"tool_name":"Bash","tool_input":{"command":"git push --tags"}}' | node .yokoten/bin/yokoten.ts hookyokoten: git push --tags pushes tags. Only the owner decides when to release. If the owner asked for this, they start the session with YOKOTEN_RELEASE_APPROVAL set.

Nothing is pushed: the hook only reads the call. Exit code 2 means “blocked”.

What it can’t do

Honest limits, from the guide:

  • The guards read command text. A command put together in pieces gets past them. They catch mistakes and drift; they aren’t a lock. The lock is on the server: branch protection, code owners, and a bot that can’t release or change CI.
  • Server settings aren’t checked yet. doctor lists the three steps for the owner. Checking them through the API is planned.
  • Claude Code first. The guard also runs in Codex and Gemini CLI, but nobody has yet seen it block a real session there (#30). Muse Code support is planned.

The full list in the guide

Learn more

Start on the right road

Four lines, once. Or ask your agent to do it.

sh
git clone https://github.com/coo1white/yokotennode yokoten/bin/yokoten.ts install  # once per computercd your-projectnode ~/.local/share/yokoten/bin/yokoten.ts init  # once per project
yokoten · 横展

yokoten · 横展

带你上路， 替你守桥。

一个免费的命令行工具：护住你的 AI 编程 agent，一步一步带你走好团队走的那条路，让每个人都能用对的方式做软件。

一个人 + AI，也按专业团队的标准开发。yokoten 自己就是这样做出来的。

快速开始 在 GitHub 上看
12345

梦想

人人都能像好团队那样做软件，从计划到发版、再到维护，整个流程都走得通。编程新手从第一天就走在对的路上，有 AI agent 陪着，也不会摔跤。

守卫
让你一路走得安全。危险的命令还没执行就被拦下，agent 也知道为什么。
向导
教你认路。doctor 知道你的项目走到了五关里的哪一关，只告诉你下一步。
梦想
是这条路通向的地方：你像好团队那样做软件，而且是亲手做着学会的。

「横展」是丰田的说法：一条产线找到的对策，推广到所有产线。在这里，一个项目踩过的坑，会变成每个项目都有的检查。

装上的第一天，有什么不同

AI 想做的事没有 yokoten有 yokoten
force push，或者自己打 tag 发版没有 yokoten直接执行有 yokoten执行前被拦下，并告诉它原因代码测试
测试不过，就去改测试没有 yokoten测试“绿了”，bug 还在有 yokoten修 bug 时不准改测试代码测试
提交时带上你的邮箱、服务器 IP、城市没有 yokoten公开出去有 yokoten提交被拦下；报告只说哪个文件第几行，不把内容打出来代码测试
开 PR没有 yokoten用你的账号，权限和你一样大有 yokoten用 bot 开，没有你同意合不进去代码测试
换到另一个项目没有 yokoten从零开始有 yokoten先知道这个项目缺什么，并主动帮你补上代码测试

看它怎么干活

一次会话里的三个瞬间，点一下看下一个。

claude code · pre-tool hook
git push --tagsyokoten: git push --tags pushes tags. Only the owner decides when to release. If the owner asked for this, they start the session with YOKOTEN_RELEASE_APPROVAL set.

agent 想推一个发版 tag。hook 在命令执行前就把它拦下，并告诉它原因。

（yokoten 的提示是英文的，因为 AI 读英文最稳。）

一路往前走

软件团队的工作是一个循环：计划、开发、检查、审查、发版。yokoten 带你一关一关走。每一关 yokoten 自己的仓库都已经在用，你可以直接看到它是怎么运转的。

  1. doctor: stage 1 · safety net

    安全网你在这里

    你不用自己判断走到了哪儿。doctor 会看项目里的文件，直接告诉你，比如 stage 1 of 5, safety net（第 1 关，安全网）。新项目从第 1 关开始。顺序只是建议，不会卡住你。

    学会什么
    AI 要读的规则，能拦住它的检查
    在这里看
    AGENTS.md

  2. doctor: stage 2 · issues and pull requests

    先开 issue，再走 PR

    学会什么
    每次改动都有原因；CI 通过才合并；标签、milestone、看板
    在这里看
    issue、PR、看板

  3. doctor: stage 3 · release

    发版

    学会什么
    清楚的提交信息、CHANGELOG、版本号
    在这里看
    CHANGELOG.md

  4. doctor: stage 4 · a team of agents

    带一支 AI 团队

    学会什么
    bot、worker、审查；你始终是老板
    在这里看
    使用指南

  5. doctor: stage 5 · going public

    公开

    学会什么
    检查全部历史里的隐私、安全设置、分支保护
    在这里看
    安全说明

通往梦想的路

每个里程碑都覆盖更多开发环节，让更多人、更多工具用得上。

  1. 现在，2026 年 10 月 26 日前

    doctor 带你一关一关走；发版流程；检查 GitHub 设置；npx yokoten；Codex 和 Gemini CLI 也能拦住危险操作

    M0

  2. Meta 黑客松，10 月 26 日 – 11 月 3 日

    一个能读懂老项目、起草接入方案的 agent；支持 Muse Code

    M1

  3. 之后

    Gitea 等其他代码托管平台；大改动前先写一份简短的方案；拿 OpenSSF Best Practices 徽章，公开证明做到了

    issue

每一步都公开规划：看板上能看到今天在做什么，milestone 里能看到接下来做什么。

快速开始

只需要 Node 22.18 或更高版本，别的都不用装：不用构建，也没有依赖。

sh
git clone https://github.com/coo1white/yokotennode yokoten/bin/yokoten.ts install  # 每台电脑一次cd your-projectnode ~/.local/share/yokoten/bin/yokoten.ts init  # 每个项目一次

然后用 Claude Code 打开这个项目，它会告诉你走到了哪一关，下一步做什么。

等 npm 版发布后，一条 npx yokoten 就能装好。

确认装好了

在项目里跑一下 doctor。它会列出整条路，并标出下一步：

sh
node .yokoten/bin/yokoten.ts doctoryokoten 0.1.0, self-test okthe road: stage 1 of 5, safety net  1. safety net    done        rules    done        tool-hook    done        commit-check    done        runtime    next        tests: CI does not run the tests; add a step that runs `npm test` …  2. issues and pull requests    …

有删减，你看到的步骤会不一样。

想看守卫拦东西，又不想真的执行什么？给它一个假装的工具调用：

sh
echo '{"tool_name":"Bash","tool_input":{"command":"git push --tags"}}' | node .yokoten/bin/yokoten.ts hookyokoten: git push --tags pushes tags. Only the owner decides when to release. If the owner asked for this, they start the session with YOKOTEN_RELEASE_APPROVAL set.

什么都不会被推送：hook 只是读一下这个调用。退出码 2 表示「拦下了」。

它做不到的事

如实说明，摘自使用指南：

  • 守卫只看命令文本。把命令拆开再拼起来就能绕过。它防的是失误和走样，不是一把锁。真正的锁在服务器上：分支保护、代码负责人，以及一个没有发版权限、改不了 CI 的 bot。
  • 还不检查服务器设置。doctor 目前只列出主人要做的三步，通过 API 自动检查还在计划中。
  • 先支持 Claude Code。守卫在 Codex 和 Gemini CLI 里也能跑，但还没有人在真实会话里看到它拦下过命令（#30）。Muse Code 的支持还在计划中。

使用指南里的完整说明

了解更多

从对的路上出发

四行命令，只装一次。也可以让 agent 来装。

sh
git clone https://github.com/coo1white/yokotennode yokoten/bin/yokoten.ts install  # 每台电脑一次cd your-projectnode ~/.local/share/yokoten/bin/yokoten.ts init  # 每个项目一次