Node.js security releases (October 2026): update Node to 22.23.4, 24.22.1 or 26.12.1 before you use yokoten
yokoten
Docs What changes on day one

The guide

What changes on day one

Source: docs/guide.md · v0.1.2

Your agent tries to… Without yokoten With yokoten
force-push, or tag a release it happens stopped before it runs, and told why
“fix” a failing test by editing the test the test passes, the bug stays not allowed in a fix
commit your email, a server IP, your city it goes public the commit stops; the report names the file and line, never the text
post your email or a token in an issue or a pull request it goes public stopped before it is sent, and told what to change
open a pull request as you, with all your rights as a bot; nothing merges without you
work in another project starts from zero sees what that project is missing, and offers to set it up

All of this is on from the start, for everyone: you don’t answer a question or edit a file to be safe. Every setting that changes it has a way back to the default. Record 0014 says how yokoten decides what it does by itself, what it asks first, and what it never does.