---
title: "What it doesn't do"
description: "「What it doesn't do」：yokoten 使用指南的一章。"
canonical: https://yokoten.app/zh-tw/docs/guide/what-it-doesnt-do
lang: en
source: https://github.com/yokoten-labs/yokoten/blob/v0.1.2/docs/guide.md
ref: "v0.1.2"
---

> For AI agents: the documentation index is at https://yokoten.app/llms.txt. To set up yokoten in a project, follow https://yokoten.app/agents.md.

> 這一頁還沒有繁體中文版，下面是英文原文。

# What it doesn't do

Honest limits:

- **The guards read command text.** They read bash syntax (quotes, heredocs, `bash -c`,
  substitutions), and they block when they can't tell what runs. A command assembled in
  pieces still gets past them. They catch mistakes and drift; they aren't a lock. The
  lock is on the server: branch protection, code owners, and a bot without the rights to
  release or change CI. A worker's shell write to a lead-only file is stopped only when
  the guard sees the file in the command: a path from a variable or stdin (`xargs rm`,
  `find -exec`, `git apply < x.patch`), or a script that writes it, gets past. A shell
  write to `.git/config` or `.githooks` has the same gaps, and so does a write after a `cd`
  to a folder the guard can't read (`cd "$x" && echo >> config`). A program other than git,
  gh, yokoten or a shell may run git with the home folder it was given: an npm script, a
  `make` target or a shell function (`HOME=/tmp/x npm run commit`). An indirect name
  (`export $name=x`) gets past too.
- **A worker's settings are read on the command line only.** The guard stops a setting
  that moves a folder or makes a program run other code (`PATH`, `GIT_DIR`, `LD_PRELOAD`,
  `NODE_OPTIONS`) when it is typed in the command. A script the worker writes and then runs
  can set any of them: that is out of the guard's reach, and the desk fence is the boundary
  for a worker's processes.
  A project lets its workers set its own test settings in `worker.settings`.
- **gh's token is hidden only from plain commands.** A script written to a file and then
  run is not read. A script that reads gh's own files or the system keyring, or a
  variable name built in pieces, still gets the token. So does a program that prints the
  whole environment (`env`, `printenv`, `set`, `/proc/self/environ`): refusing those
  would break too much. An alias you made before is not read either. Then the agent can
  call GitHub around the guard. The real fix is that the token is not in the agent's
  environment. For a worker, that is a desk with no token at all (#637). For the lead, the
  lock is again the server: branch protection, and a token without the rights to merge or
  release.
- **Server settings are read on GitHub only.** Another host shows the steps that only the
  host can judge as **can't check**, with what each one asks ([What a session sees](https://yokoten.app/zh-tw/docs/guide/what-a-session-sees.md)). `doctor` does not check the bot's rights yet.
- **Claude Code first.** Agents follow Claude Code's format.
  Skills are the open SKILL.md format, so `install` also puts them in `~/.agents/skills`,
  where Codex, Gemini CLI, Copilot, Cursor and other agents find them. The tool-call
  guard also runs in Copilot CLI, Antigravity CLI, Codex, Muse Code, DeepSeek Harness, Gemini CLI and OpenCode: see
  [Works with](https://yokoten.app/zh-tw/docs/guide/works-with.md) for which runs were seen to block (#30). `doctor` reports
  the other agents' hooks, and the user hooks once `~/.codex` or `~/.gemini` exists, but
  does not count them as missing: a project may use none of these agents. The rules are plain `AGENTS.md`, which
  Claude Code reads when a project has no `CLAUDE.md`, and so do most other agents. Muse
  Code reads `AGENTS.md` too.
- **DeepSeek Harness is not guarded on Windows yet.** dsh runs hooks in PowerShell there,
  and the guard is a POSIX shell command (#332). The guard also sees only `bash`, `pwsh`,
  `edit` and `write`. A profile that mounts dsh's optional `str_replace_editor` or the
  experimental `terminal_send` can edit files or type into a shell unchecked.

---

上一章: [Privacy](https://yokoten.app/zh-tw/docs/guide/privacy.md)
下一章: [Status](https://yokoten.app/zh-tw/docs/guide/status.md)