Node.js security releases (October 2026): update Node to 22.23.4, 24.22.1 or 26.12.1 before you use yokoten
yokoten
Docs When it stops something

When it stops something

When yokoten stops a command

yokoten stops a command before it runs, and prints why. Nothing was done, so there is nothing to undo. This is a real stop:

STOPPEDexit 2
$ git push -f origin main yokoten stopped this: git push -f forces the push [force-push]   Why       A plain force push can throw away work that someone else pushed.   Instead   Use --force-with-lease, which stops when the remote has work you            have not seen.   More      https://github.com/yokoten-labs/yokoten/blob/main/docs/guide.md#the-core-rules

How to read a stop

Every stop has the same four parts:

yokoten stopped this:
The command, what it would do, and the rule's name in brackets.
Why
What could go wrong.
Instead
The safe way to do it, or who must do it.
More
Where the rule is explained.

What to tell your agent

Usually nothing. Your agent reads the same lines and takes the Instead route on its own.

When the Instead line says only you can do it, such as a release, the agent stops and leaves it to you. Do that step yourself, when you are ready.

What it protects

yokoten protects five things. All five are on in every project after npx yokoten, with nothing to set.

  • Your work: a force push, a hard reset, deleting .git, and other ways to lose work.
  • Your secrets: a commit that adds a key, a private email or an IP address.
  • Your releases: a new tag, a package publish, or making a repo public. Only you decide when to release.
  • The code you run: a download that a program would run before anyone reads it.
  • The guard itself: skipping the commit check, or switching it off.

If a stop looks wrong

Open an issue on GitHub and paste the line that starts with yokoten stopped this:. Leave out keys, emails and server names.

Open an issue →