Node.js security releases (October 2026): update Node to 22.23.4, 24.22.1 or 26.12.1 before you use yokoten
yokoten
Docs Four layers

The guide

Four layers

Source: docs/guide.md · v0.1.2

Layer What How
Machine Skills, agents, and two user-level hooks, the same on every computer yokoten install, or the Claude Code plugin
Project Rules, the commit check, the tool-call hook, CI, issue and PR templates, Dependabot (monthly, one pull request), a security policy yokoten init, then the yokoten skill for an old project
Server Branch and tag rulesets, squash merge, code owners, a bot with limited rights, the security switches Set once by the owner; doctor lists the steps
Rules AGENTS.md: twelve core rules, plus the project’s own Every rule names its check

An old project isn’t a blank slate. Some of its habits are better than ours. So the yokoten skill goes through the practices one at a time with you, and each one gets a decision: as-is, lighter (and what’s left out), or not now (with the reason and when to look again). “Not now” goes into yokoten.json, and doctor stops asking.

A first draft of the table

yokoten adopt drafts that table before the talk starts. It reads the project’s files and says what the project does today for each step: done, missing, partial or unknown. Partial means the project has its own way, such as husky hooks, or a CI that doesn’t run yokoten. Unknown means yokoten can’t check the step from here, such as a server setting; yokoten doctor reads it. A model then proposes a decision and a one-sentence reason for each row.

  • The model gets only those short facts. It never gets file contents.
  • yokoten runs its privacy check on the request first. On a hit, it sends nothing.
  • With no key, a failed call or a bad answer, rules draft the table instead: done or missing is as-is, partial is lighter, unknown is as-is once doctor has checked it. The output says which one drafted it.
  • adopt never writes a file. You still decide every row.
  • A partial row is not lost when you run init: it imports AGENTS.md from your CLAUDE.md, and it adds the commit check to husky’s pre-commit.

The model runs on Meta’s model API, through its OpenAI-compatible endpoint (https://api.meta.ai/v1, model muse-spark-1.3). Set LLAMA_API_KEY or MODEL_API_KEY to your key. LLAMA_API_BASE and LLAMA_MODEL point it at any other OpenAI-compatible endpoint and model.