@juspay/yama 2.6.0 → 2.7.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.7.1](https://github.com/juspay/yama/compare/v2.7.0...v2.7.1) (2026-06-15)
+
+
+### Bug Fixes
+
+* **v2:** bump neurolink to 9.70.7 and fix review/config correctness bugs ([d0c62f7](https://github.com/juspay/yama/commit/d0c62f767bb3f38fed0bc5dcc1a64845529ec3b6))
+
+# [2.7.0](https://github.com/juspay/yama/compare/v2.6.0...v2.7.0) (2026-06-11)
+
+
+### Features
+
+* **setup:** add one-command GitHub integration setup script ([6a014b0](https://github.com/juspay/yama/commit/6a014b05ccf12e4ca362316e5f69c9441a93618f))
+
 # [2.6.0](https://github.com/juspay/yama/compare/v2.5.0...v2.6.0) (2026-06-04)
 
 

package/dist/index.d.ts

@@ -12,6 +12,6 @@ export { MemoryManager } from "./v2/memory/MemoryManager.js";
 export type { LocalReviewFinding, LocalReviewRequest, LocalReviewResult, ReviewRequest, ReviewMode, ReviewResult, ReviewUpdate, ReviewSession, ReviewStatistics, IssuesBySeverity, TokenUsage, UnifiedReviewRequest, } from "./v2/types/v2.types.js";
 export type { YamaConfig, YamaInitOptions, YamaConfig as YamaV2Config, AIConfig, MCPServersConfig, ReviewConfig, DescriptionEnhancementConfig, MemoryConfig, } from "./v2/types/config.types.js";
 export type { GetPullRequestResponse, GetPullRequestDiffResponse, GetIssueResponse, SearchCodeResponse, } from "./v2/types/mcp.types.js";
-export declare const VERSION = "2.2.1";
+export declare const VERSION: string;
 export { createYama as default } from "./v2/core/YamaV2Orchestrator.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -2,6 +2,7 @@
  * Yama - AI-Native Code Review
  * Main export file
  */
+import { createRequire } from "node:module";
 // ============================================================================
 // Core Exports
 // ============================================================================
@@ -19,7 +20,26 @@ export { MemoryManager } from "./v2/memory/MemoryManager.js";
 // ============================================================================
 // Version Information
 // ============================================================================
-export const VERSION = "2.2.1";
+/**
+ * Single source of truth for the Yama version: read from package.json at runtime
+ * (this module sits one level below package.json in both src/ and dist/, so the
+ * relative require resolves in dev and in the published build). Falls back to a
+ * sentinel if the file can't be read, instead of drifting from a hardcoded
+ * literal.
+ */
+function resolveVersion() {
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require("../package.json");
+        return typeof pkg.version === "string" && pkg.version.length > 0
+            ? pkg.version
+            : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+export const VERSION = resolveVersion();
 // ============================================================================
 // Default Export
 // ============================================================================

package/dist/v2/config/ConfigLoader.js

@@ -16,12 +16,16 @@ export class ConfigLoader {
      */
     async loadConfig(configPath, instanceOverrides) {
         console.log("📋 Loading Yama configuration...");
+        // Final precedence (lowest → highest):
+        //   defaults < file < env < instance overrides
+        // Environment variables intentionally override the committed config file
+        // (the standard expectation). Env overrides are re-applied AFTER the file
+        // merge; they are idempotent and only mutate values when the env var is
+        // actually set (see applyEnvironmentOverrides / applyMemoryOverrides), so
+        // they never clobber file values with undefined.
         // Layer 1: Start with default config
         let config = DefaultConfig.get();
-        // Layer 2: Apply environment variable overrides
-        // Lowest user-provided layer in SDK mode precedence.
-        config = this.applyEnvironmentOverrides(config);
-        // Layer 3: Load from file if provided or search for default locations
+        // Layer 2: Load from file if provided or search for default locations
         const filePath = await this.resolveConfigPath(configPath);
         if (filePath) {
             console.log(`   Reading config from: ${filePath}`);
@@ -32,6 +36,9 @@ export class ConfigLoader {
         else {
             console.log("   Using default configuration (no config file found)");
         }
+        // Layer 3: Apply environment variable overrides AFTER the file so env wins
+        // over the committed config (consistently for both ai.* and memory.*).
+        config = this.applyEnvironmentOverrides(config);
         config.memory = this.applyMemoryOverrides(config.memory);
         // Layer 4: Apply SDK instance overrides (highest priority)
         if (instanceOverrides) {

package/dist/v2/config/DefaultConfig.js

@@ -17,7 +17,8 @@ export class DefaultConfig {
                 provider: "auto",
                 model: "gemini-2.5-pro",
                 temperature: 0.2,
-                maxTokens: 128000,
+                // Sane output ceiling (NeuroLink clamps further per-model server-side).
+                maxTokens: 32000,
                 enableAnalytics: true,
                 enableEvaluation: false,
                 timeout: "15m",
@@ -36,7 +37,8 @@ export class DefaultConfig {
                     provider: "auto",
                     model: "gemini-2.5-flash",
                     temperature: 0.1,
-                    maxTokens: 32000,
+                    // Lighter sub-task: sane output ceiling (NeuroLink clamps further per-model server-side).
+                    maxTokens: 16000,
                     timeout: "5m",
                     cacheResults: true,
                 },

package/dist/v2/core/LearningOrchestrator.d.ts

@@ -34,6 +34,17 @@ export declare class LearningOrchestrator {
      * Parse structured response from AI output
      */
     private parseStructuredLearnings;
+    /**
+     * Validate that a candidate value (typically `response.structuredData`) is a
+     * usable learning-extraction object. Returns it typed when it carries a
+     * `learnings` array, otherwise null so callers fall back to text parsing.
+     */
+    private coerceLearningOutput;
+    /**
+     * Fallback parser: extract the learning-extraction JSON from the raw response
+     * text (may be wrapped in a ```json code block).
+     */
+    private parseLearningOutputFromText;
     /**
      * Initialize NeuroLink with observability
      */

package/dist/v2/core/LearningOrchestrator.js

@@ -11,6 +11,7 @@ import { KnowledgeBaseManager } from "../learning/KnowledgeBaseManager.js";
 import { MemoryManager } from "../memory/MemoryManager.js";
 import { getProviderToolset, } from "../providers/ProviderToolset.js";
 import { buildObservabilityConfigFromEnv, validateObservabilityConfig, } from "../utils/ObservabilityConfig.js";
+import { clampMaxTokens } from "../utils/tokenLimits.js";
 export class LearningOrchestrator {
     neurolink;
     mcpManager;
@@ -77,7 +78,7 @@ export class LearningOrchestrator {
                 provider: this.config.ai.provider,
                 model: this.config.ai.model,
                 temperature: 0.1,
-                maxTokens: 50000,
+                maxTokens: clampMaxTokens(50000),
                 timeout: this.config.ai.timeout,
                 context: {
                     operation: "learning-fetch-comments",
@@ -96,7 +97,7 @@ export class LearningOrchestrator {
                 provider: this.config.ai.provider,
                 model: this.config.ai.model,
                 temperature: 0.2,
-                maxTokens: 10000,
+                maxTokens: clampMaxTokens(10000),
                 timeout: "2m",
                 disableTools: true, // No tools needed for extraction phase
                 context: {
@@ -164,7 +165,7 @@ export class LearningOrchestrator {
                         provider: this.config.ai.provider,
                         model: this.config.ai.model,
                         temperature: 0.1,
-                        maxTokens: 100,
+                        maxTokens: clampMaxTokens(100),
                         disableTools: true,
                         context: {
                             userId: ownerId,
@@ -377,16 +378,15 @@ Analyze the PR data above and extract learnings.
      */
     parseStructuredLearnings(response, prId) {
         try {
-            const content = (response.content || "");
-            // Find JSON in response (may be in code block)
-            const jsonMatch = content.match(/```json\s*([\s\S]*?)\s*```/) ||
-                content.match(/\{[\s\S]*\}/);
-            if (!jsonMatch) {
-                console.log("   ⚠️ No JSON found in extraction response");
+            // Prefer the provider's structured output (NeuroLink populates
+            // `structuredData` when the model returns a parsed object) before falling
+            // back to hand-parsing the raw text. This avoids brittle regex extraction
+            // when a clean object is already available.
+            const structured = this.coerceLearningOutput(response.structuredData);
+            const parsed = structured ?? this.parseLearningOutputFromText(response);
+            if (!parsed) {
                 return [];
             }
-            const jsonStr = jsonMatch[1] || jsonMatch[0];
-            const parsed = JSON.parse(jsonStr);
             // Log summary if available
             if (parsed.summary) {
                 const devComments = parsed.summary.totalIndependentDevComments || 0;
@@ -413,6 +413,51 @@ Analyze the PR data above and extract learnings.
             return [];
         }
     }
+    /**
+     * Validate that a candidate value (typically `response.structuredData`) is a
+     * usable learning-extraction object. Returns it typed when it carries a
+     * `learnings` array, otherwise null so callers fall back to text parsing.
+     */
+    coerceLearningOutput(candidate) {
+        if (candidate &&
+            typeof candidate === "object" &&
+            Array.isArray(candidate.learnings)) {
+            return candidate;
+        }
+        return null;
+    }
+    /**
+     * Fallback parser: extract the learning-extraction JSON from the raw response
+     * text (may be wrapped in a ```json code block).
+     */
+    parseLearningOutputFromText(response) {
+        const content = (response.content || "");
+        // Extract JSON without backtracking-prone regexes (ReDoS-safe): locate the
+        // fenced ```json block (or the first '{' .. last '}' span) via linear string
+        // scans instead of polynomial regex matching on uncontrolled model output.
+        let jsonStr = null;
+        const fenceToken = "```json";
+        const fenceStart = content.indexOf(fenceToken);
+        if (fenceStart !== -1) {
+            const afterFence = fenceStart + fenceToken.length;
+            const fenceEnd = content.indexOf("```", afterFence);
+            if (fenceEnd !== -1) {
+                jsonStr = content.slice(afterFence, fenceEnd).trim();
+            }
+        }
+        if (!jsonStr) {
+            const objStart = content.indexOf("{");
+            const objEnd = content.lastIndexOf("}");
+            if (objStart !== -1 && objEnd > objStart) {
+                jsonStr = content.slice(objStart, objEnd + 1);
+            }
+        }
+        if (!jsonStr) {
+            console.log("   ⚠️ No JSON found in extraction response");
+            return null;
+        }
+        return JSON.parse(jsonStr);
+    }
     // ============================================================================
     // Private Methods
     // ============================================================================
@@ -513,7 +558,7 @@ Consolidate the learnings as instructed. Return the complete updated knowledge b
             provider: this.config.ai.provider,
             model: this.config.ai.model,
             temperature: 0.2,
-            maxTokens: 30000,
+            maxTokens: clampMaxTokens(30000),
         });
         // Parse and update the knowledge base
         const newContent = (response.content || "");

package/dist/v2/core/MCPServerManager.js

@@ -4,6 +4,7 @@
  */
 import { join } from "path";
 import { MCPServerError } from "../types/v2.types.js";
+import { isMutatingGitTool as isMutatingGitToolShared } from "../utils/toolPolicy.js";
 /**
  * Default remote HTTP endpoint for GitHub's hosted MCP server.
  * Overridable via `mcpServers.github.url`.
@@ -146,9 +147,12 @@ export class MCPServerManager {
             .filter((name) => typeof name === "string");
     }
     isMutatingGitTool(toolName) {
-        // Handles plain names (git_commit) and prefixed names (local-git.git_commit).
-        const normalized = toolName.split(/[.:/]/).pop() || toolName;
-        return /^git_(commit|push|add|checkout|create_branch|merge|rebase|cherry_pick|reset|revert|tag|rm|clean|stash|apply)\b/i.test(normalized);
+        // Delegate to the shared fail-closed allow-list policy: any git_* tool not
+        // on the read-only allow-list is treated as mutating. This closes the gaps
+        // the old regex blocklist missed (git_branch, git_mv, git_pull, git_fetch,
+        // git_restore, git_switch, git_remote). Prefix handling (local-git.git_*)
+        // is performed inside the shared helper.
+        return isMutatingGitToolShared(toolName);
     }
     /**
      * Setup Bitbucket MCP server (hardcoded, always enabled)

package/dist/v2/core/YamaV2Orchestrator.d.ts

@@ -2,7 +2,7 @@
  * Yama Orchestrator
  * Main entry point for AI-native autonomous code review
  */
-import { LocalReviewRequest, LocalReviewResult, ReviewRequest, ReviewResult, ReviewMode, ReviewUpdate, UnifiedReviewRequest } from "../types/v2.types.js";
+import { LocalReviewRequest, LocalReviewResult, ReviewRequest, ReviewResult, ReviewMode, UnifiedReviewRequest } from "../types/v2.types.js";
 import { YamaInitOptions } from "../types/config.types.js";
 export declare class YamaOrchestrator {
     private neurolink;
@@ -40,10 +40,6 @@ export declare class YamaOrchestrator {
      * Local SDK mode review from git diff (no PR/MCP dependency).
      */
     reviewLocalDiff(request: LocalReviewRequest): Promise<LocalReviewResult>;
-    /**
-     * Stream review with real-time updates (for verbose mode)
-     */
-    streamReview(request: ReviewRequest): AsyncIterableIterator<ReviewUpdate>;
     /**
      * Start review and then enhance description in the same session
      * This allows the AI to use knowledge gained during review to write better descriptions
@@ -75,6 +71,21 @@ export declare class YamaOrchestrator {
     private createToolContext;
     private createLocalToolContext;
     private setToolContext;
+    /**
+     * Run a NeuroLink generate() call with a small bounded retry on transient
+     * errors (wires up the previously-unused `ai.retryAttempts` config). Retries
+     * up to `retryAttempts` times (>=1 total attempt) with a short exponential
+     * backoff. Non-transient errors (e.g. auth/validation) fail fast on the first
+     * attempt so we don't paper over real misconfiguration.
+     */
+    private generateWithRetry;
+    /**
+     * Heuristic transient-error classifier for retry decisions. Conservative:
+     * matches common network / rate-limit / timeout / 5xx signals and leaves
+     * everything else (auth, validation, 4xx) as non-retryable.
+     */
+    private isTransientError;
+    private delay;
     /**
      * Parse AI response into structured review result
      */
@@ -89,6 +100,12 @@ export declare class YamaOrchestrator {
     private extractJsonPayload;
     private normalizeFindings;
     private normalizeSeverity;
+    /**
+     * Map an arbitrary value to a known severity, or null if it is not one of the
+     * recognised levels. Unlike normalizeSeverity this does NOT default to MINOR,
+     * so callers can distinguish "unknown" from a real level.
+     */
+    private coerceSeverity;
     private countFindingsBySeverity;
     private normalizeDecision;
     /**
@@ -125,7 +142,14 @@ export declare class YamaOrchestrator {
      */
     private extractSummary;
     /**
-     * Calculate cost estimate from token usage
+     * Calculate cost estimate from an AI response.
+     *
+     * Prefers NeuroLink's own analytics cost (`response.analytics.cost`, a USD
+     * number computed per-provider/model when enableAnalytics is true — Yama sets
+     * it). The previous implementation hardcoded Gemini-2.0-Flash pricing
+     * ($0.25/$1.00 per 1M) for EVERY provider, which is ~12-15x too low for Claude.
+     * Only when the analytics cost is unavailable do we fall back to a clearly
+     * labeled rough estimate based on the { input, output } token usage.
      */
     private calculateCost;
     private toSafeNumber;
@@ -137,7 +161,11 @@ export declare class YamaOrchestrator {
     private getPRToolFilteringOptions;
     /**
      * Query-level read-only filtering for local-git MCP tools.
-     * Uses regex-based mutation detection instead of hardcoded tool-name lists.
+     *
+     * Uses the shared, fail-closed `isMutatingGitTool` helper (any git_* tool not
+     * on the read-only allow-list is treated as mutating) so the orchestrator,
+     * explorer, and MCP manager all agree on what is read-only. The previous local
+     * regex silently missed mutating tools like git_branch / git_mv / git_pull.
      */
     private getLocalToolFilteringOptions;
     private normalizeToolName;

package/dist/v2/core/YamaV2Orchestrator.js

@@ -13,6 +13,9 @@ import { ContextExplorerService } from "../exploration/ContextExplorerService.js
 import { ProviderDetector, } from "../utils/ProviderDetector.js";
 import { getProviderToolset } from "../providers/ProviderToolset.js";
 import { buildObservabilityConfigFromEnv, validateObservabilityConfig, } from "../utils/ObservabilityConfig.js";
+import { clampMaxTokens } from "../utils/tokenLimits.js";
+import { isMutatingGitTool } from "../utils/toolPolicy.js";
+import { VERSION } from "../../index.js";
 export class YamaOrchestrator {
     neurolink;
     explorer = null;
@@ -153,13 +156,14 @@ export class YamaOrchestrator {
             // Execute autonomous AI review
             console.log("🤖 Starting autonomous AI review...");
             console.log("   AI will now make decisions and execute actions autonomously\n");
-            // Review call: RETRIEVE memory (for context), but DON'T STORE
-            const aiResponse = await this.neurolink.generate({
+            // Review call: RETRIEVE memory (for context), but DON'T STORE.
+            // Wrapped in a bounded retry (ai.retryAttempts) for transient failures.
+            const aiResponse = await this.generateWithRetry(() => this.neurolink.generate({
                 input: { text: instructions },
                 provider: this.config.ai.provider,
                 model: this.config.ai.model,
                 temperature: this.config.ai.temperature,
-                maxTokens: this.config.ai.maxTokens,
+                maxTokens: clampMaxTokens(this.config.ai.maxTokens),
                 timeout: this.config.ai.timeout,
                 skipToolPromptInjection: true,
                 ...this.getPRToolFilteringOptions(instructions),
@@ -172,7 +176,7 @@ export class YamaOrchestrator {
                 memory: { read: true, write: false },
                 enableAnalytics: this.config.ai.enableAnalytics,
                 enableEvaluation: this.config.ai.enableEvaluation,
-            });
+            }), "code-review");
             this.recordToolCallsFromResponse(sessionId, aiResponse);
             // Extract and parse results
             const result = this.parseReviewResult(aiResponse, startTime, sessionId);
@@ -217,12 +221,12 @@ export class YamaOrchestrator {
             const instructions = await this.promptBuilder.buildLocalReviewInstructions(request, this.config, diffContext);
             const toolContext = this.createLocalToolContext(sessionId, pseudoRequest, diffContext);
             this.setToolContext(toolContext);
-            const aiResponse = await this.neurolink.generate({
+            const aiResponse = await this.generateWithRetry(() => this.neurolink.generate({
                 input: { text: instructions },
                 provider: this.config.ai.provider,
                 model: this.config.ai.model,
                 temperature: this.config.ai.temperature,
-                maxTokens: Math.min(this.config.ai.maxTokens, 16_000),
+                maxTokens: clampMaxTokens(this.config.ai.maxTokens),
                 timeout: this.config.ai.timeout,
                 enableAnalytics: this.config.ai.enableAnalytics,
                 enableEvaluation: this.config.ai.enableEvaluation,
@@ -242,7 +246,7 @@ export class YamaOrchestrator {
                         headRef: diffContext.headRef,
                     },
                 },
-            });
+            }), "local-review");
             this.recordToolCallsFromResponse(sessionId, aiResponse);
             const result = this.parseLocalReviewResult(aiResponse, sessionId, startTime, request, diffContext);
             // Stored as generic session payload for debugging/export parity.
@@ -254,61 +258,6 @@ export class YamaOrchestrator {
             throw error;
         }
     }
-    /**
-     * Stream review with real-time updates (for verbose mode)
-     */
-    async *streamReview(request) {
-        await this.ensureInitialized("pr", request.configPath, request);
-        const sessionId = this.sessionManager.createSession(request);
-        try {
-            const bootstrapStandards = await this.getBootstrappedStandards(request, sessionId);
-            // Build instructions
-            const instructions = await this.promptBuilder.buildReviewInstructions(request, this.config, bootstrapStandards, this.detectedProvider);
-            // Create tool context
-            const toolContext = this.createToolContext(sessionId, request);
-            this.setToolContext(toolContext);
-            // Stream AI execution
-            yield {
-                type: "progress",
-                timestamp: new Date().toISOString(),
-                sessionId,
-                data: {
-                    phase: "context_gathering",
-                    progress: 0,
-                    message: "Starting review...",
-                },
-            };
-            // Note: NeuroLink streaming implementation depends on version
-            // This is a placeholder for streaming functionality
-            const aiResponse = await this.neurolink.generate({
-                input: { text: instructions },
-                provider: this.config.ai.provider,
-                model: this.config.ai.model,
-                skipToolPromptInjection: true,
-                ...this.getPRToolFilteringOptions(instructions),
-                context: {
-                    sessionId,
-                    userId: this.getUserId(request),
-                },
-                memory: { enabled: false },
-                enableAnalytics: true,
-            });
-            yield {
-                type: "progress",
-                timestamp: new Date().toISOString(),
-                sessionId,
-                data: {
-                    phase: "decision_making",
-                    progress: 100,
-                    message: "Review complete",
-                },
-            };
-        }
-        catch (error) {
-            this.sessionManager.failSession(sessionId, error);
-            throw error;
-        }
-    }
     /**
      * Start review and then enhance description in the same session
      * This allows the AI to use knowledge gained during review to write better descriptions
@@ -345,7 +294,7 @@ export class YamaOrchestrator {
                 provider: this.config.ai.provider,
                 model: this.config.ai.model,
                 temperature: this.config.ai.temperature,
-                maxTokens: this.config.ai.maxTokens,
+                maxTokens: clampMaxTokens(this.config.ai.maxTokens),
                 timeout: this.config.ai.timeout,
                 skipToolPromptInjection: true,
                 ...this.getPRToolFilteringOptions(reviewInstructions),
@@ -378,7 +327,7 @@ export class YamaOrchestrator {
                     provider: this.config.ai.provider,
                     model: this.config.ai.model,
                     temperature: this.config.ai.temperature,
-                    maxTokens: this.config.ai.maxTokens,
+                    maxTokens: clampMaxTokens(this.config.ai.maxTokens),
                     timeout: this.config.ai.timeout,
                     skipToolPromptInjection: true,
                     ...this.getPRToolFilteringOptions(enhanceInstructions),
@@ -494,7 +443,7 @@ export class YamaOrchestrator {
             branch: request.branch,
             dryRun: request.dryRun || false,
             metadata: {
-                yamaVersion: "2.2.1",
+                yamaVersion: VERSION,
                 startTime: new Date().toISOString(),
             },
         };
@@ -511,7 +460,7 @@ export class YamaOrchestrator {
             repository: request.repository || request.repo,
             dryRun: request.dryRun || false,
             metadata: {
-                yamaVersion: "2.2.1",
+                yamaVersion: VERSION,
                 startTime: new Date().toISOString(),
                 repoPath: diffContext.repoPath,
                 diffSource: diffContext.diffSource,
@@ -524,6 +473,70 @@ export class YamaOrchestrator {
         this.currentToolContext = context;
         this.neurolink.setToolContext(context);
     }
+    /**
+     * Run a NeuroLink generate() call with a small bounded retry on transient
+     * errors (wires up the previously-unused `ai.retryAttempts` config). Retries
+     * up to `retryAttempts` times (>=1 total attempt) with a short exponential
+     * backoff. Non-transient errors (e.g. auth/validation) fail fast on the first
+     * attempt so we don't paper over real misconfiguration.
+     */
+    async generateWithRetry(run, label) {
+        const configured = this.config.ai.retryAttempts;
+        const maxAttempts = typeof configured === "number" && Number.isFinite(configured)
+            ? Math.max(1, Math.floor(configured))
+            : 1;
+        let lastError;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                return await run();
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt >= maxAttempts || !this.isTransientError(error)) {
+                    throw error;
+                }
+                const backoffMs = Math.min(1000 * 2 ** (attempt - 1), 8000);
+                console.warn(`   ⚠️  ${label} generate attempt ${attempt}/${maxAttempts} failed ` +
+                    `(${error.message}); retrying in ${backoffMs}ms...`);
+                await this.delay(backoffMs);
+            }
+        }
+        // Unreachable in practice (loop either returns or throws), but keeps types happy.
+        throw lastError instanceof Error ? lastError : new Error(String(lastError));
+    }
+    /**
+     * Heuristic transient-error classifier for retry decisions. Conservative:
+     * matches common network / rate-limit / timeout / 5xx signals and leaves
+     * everything else (auth, validation, 4xx) as non-retryable.
+     */
+    isTransientError(error) {
+        const message = (error instanceof Error ? error.message : String(error ?? "")).toLowerCase();
+        if (!message) {
+            return false;
+        }
+        return (message.includes("timeout") ||
+            message.includes("timed out") ||
+            message.includes("etimedout") ||
+            message.includes("econnreset") ||
+            message.includes("econnrefused") ||
+            message.includes("enotfound") ||
+            message.includes("eai_again") ||
+            message.includes("socket hang up") ||
+            message.includes("network") ||
+            message.includes("rate limit") ||
+            message.includes("rate_limit") ||
+            message.includes("too many requests") ||
+            message.includes("429") ||
+            message.includes("500") ||
+            message.includes("502") ||
+            message.includes("503") ||
+            message.includes("504") ||
+            message.includes("overloaded") ||
+            message.includes("temporarily unavailable"));
+    }
+    delay(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
     /**
      * Parse AI response into structured review result
      */
@@ -544,11 +557,13 @@ export class YamaOrchestrator {
             summary: this.extractSummary(aiResponse),
             duration,
             tokenUsage: {
-                input: this.toSafeNumber(aiResponse?.usage?.inputTokens),
-                output: this.toSafeNumber(aiResponse?.usage?.outputTokens),
-                total: this.toSafeNumber(aiResponse?.usage?.totalTokens),
+                // NeuroLink 9.70.x usage shape is { input, output, total } — NOT
+                // inputTokens/outputTokens/totalTokens (those always resolved to 0).
+                input: this.toSafeNumber(aiResponse?.usage?.input),
+                output: this.toSafeNumber(aiResponse?.usage?.output),
+                total: this.toSafeNumber(aiResponse?.usage?.total),
             },
-            costEstimate: this.calculateCost(aiResponse.usage),
+            costEstimate: this.calculateCost(aiResponse),
             sessionId,
         };
     }
@@ -571,28 +586,52 @@ export class YamaOrchestrator {
      */
     parseLocalReviewResult(aiResponse, sessionId, startTime, request, diffContext) {
         const rawContent = aiResponse?.content || aiResponse?.outputs?.text || "";
-        const parsed = this.extractJsonPayload(rawContent);
+        // Prefer NeuroLink's already-parsed structuredData (output.format "json")
+        // before re-parsing the raw content string by hand; fall back to the
+        // hand-parse so older shapes / non-JSON outputs still work.
+        const structured = aiResponse?.structuredData &&
+            typeof aiResponse.structuredData === "object" &&
+            !Array.isArray(aiResponse.structuredData)
+            ? aiResponse.structuredData
+            : null;
+        const parsed = structured ?? this.extractJsonPayload(rawContent);
+        const jsonTruncated = aiResponse?.jsonTruncated === true;
         const usage = aiResponse?.usage || {};
         const tokenUsage = {
-            input: this.toSafeNumber(usage.inputTokens),
-            output: this.toSafeNumber(usage.outputTokens),
-            total: this.toSafeNumber(usage.totalTokens),
+            // NeuroLink 9.70.x usage shape is { input, output, total }.
+            input: this.toSafeNumber(usage.input),
+            output: this.toSafeNumber(usage.output),
+            total: this.toSafeNumber(usage.total),
         };
         if (!parsed) {
-            const fallbackIssue = {
-                id: "OUTPUT_FORMAT_VIOLATION",
-                severity: "MAJOR",
-                category: "review-engine",
-                title: "Model did not return structured JSON",
-                description: "Local review response was unstructured (likely tool-call trace or partial output), so findings cannot be trusted.",
-                suggestion: "Retry with a tool-calling capable model or reduce review scope (smaller diff / includePaths) to keep responses structured.",
-            };
+            // Distinguish a truncated response (model ran out of output budget mid-JSON)
+            // from a genuinely malformed one, and advise raising maxTokens in that case
+            // rather than emitting the generic format-violation guidance.
+            const fallbackIssue = jsonTruncated
+                ? {
+                    id: "OUTPUT_TRUNCATED",
+                    severity: "MAJOR",
+                    category: "review-engine",
+                    title: "Model output was truncated before valid JSON completed",
+                    description: "The local review response was cut off (jsonTruncated), so the JSON could not be parsed and findings cannot be trusted.",
+                    suggestion: "Raise ai.maxTokens (output budget) and/or reduce review scope (smaller diff / includePaths) so the structured JSON can finish.",
+                }
+                : {
+                    id: "OUTPUT_FORMAT_VIOLATION",
+                    severity: "MAJOR",
+                    category: "review-engine",
+                    title: "Model did not return structured JSON",
+                    description: "Local review response was unstructured (likely tool-call trace or partial output), so findings cannot be trusted.",
+                    suggestion: "Retry with a tool-calling capable model or reduce review scope (smaller diff / includePaths) to keep responses structured.",
+                };
             const issuesBySeverity = this.countFindingsBySeverity([fallbackIssue]);
             return {
                 mode: "local",
                 decision: "CHANGES_REQUESTED",
                 summary: this.sanitizeLocalSummary(rawContent) ||
-                    "Local review could not produce structured JSON output.",
+                    (jsonTruncated
+                        ? "Local review output was truncated before valid JSON completed."
+                        : "Local review could not produce structured JSON output."),
                 issues: [fallbackIssue],
                 enhancements: [],
                 statistics: {
@@ -605,7 +644,7 @@ export class YamaOrchestrator {
                 },
                 duration: Math.round((Date.now() - startTime) / 1000),
                 tokenUsage,
-                costEstimate: this.calculateCost(aiResponse?.usage),
+                costEstimate: this.calculateCost(aiResponse),
                 sessionId,
                 schemaVersion: request.outputSchemaVersion || "1.0",
                 metadata: {
@@ -642,7 +681,7 @@ export class YamaOrchestrator {
             },
             duration: Math.round((Date.now() - startTime) / 1000),
             tokenUsage,
-            costEstimate: this.calculateCost(aiResponse?.usage),
+            costEstimate: this.calculateCost(aiResponse),
             sessionId,
             schemaVersion: request.outputSchemaVersion || "1.0",
             metadata: {
@@ -728,7 +767,11 @@ export class YamaOrchestrator {
         return findings
             .map((raw, index) => {
             const value = (raw || {});
-            const severity = this.normalizeSeverity(value.severity);
+            const ruleKey = (typeof value.rule === "string" && value.rule) ||
+                (typeof value.category === "string" && value.category) ||
+                (typeof value.id === "string" && value.id) ||
+                undefined;
+            const severity = this.normalizeSeverity(value.severity, ruleKey);
             if (!severity) {
                 return null;
             }
@@ -758,9 +801,28 @@ export class YamaOrchestrator {
         })
             .filter((item) => item !== null);
     }
-    normalizeSeverity(severity) {
+    normalizeSeverity(severity, ruleKey) {
+        // Calibration: allow projectStandards.severityOverrides to remap a finding's
+        // severity by its rule/category key (defensive — config is optional and the
+        // override value is itself validated against the known severity set). This
+        // takes precedence over the model-reported severity.
+        const overrides = this.config.projectStandards?.severityOverrides;
+        if (overrides && ruleKey) {
+            const overridden = this.coerceSeverity(overrides[ruleKey]);
+            if (overridden) {
+                return overridden;
+            }
+        }
+        return this.coerceSeverity(severity) ?? "MINOR";
+    }
+    /**
+     * Map an arbitrary value to a known severity, or null if it is not one of the
+     * recognised levels. Unlike normalizeSeverity this does NOT default to MINOR,
+     * so callers can distinguish "unknown" from a real level.
+     */
+    coerceSeverity(severity) {
         if (typeof severity !== "string") {
-            return "MINOR";
+            return null;
         }
         const value = severity.toUpperCase();
         if (value === "CRITICAL" ||
@@ -769,7 +831,7 @@ export class YamaOrchestrator {
             value === "SUGGESTION") {
             return value;
         }
-        return "MINOR";
+        return null;
     }
     countFindingsBySeverity(findings) {
         const counts = {
@@ -821,24 +883,24 @@ export class YamaOrchestrator {
         // set_pr_approval + legacy names) byte-for-byte.
         const toolCalls = session.toolCalls || [];
         const ts = getProviderToolset(this.detectedProvider);
-        let requestedChanges;
-        let approved;
+        // ORDER-AWARE: the LAST decisive review-status / approval tool call wins, so
+        // a later approval correctly overrides an earlier request-changes (and vice
+        // versa). The previous logic let any "BLOCKED" stick regardless of order,
+        // reporting BLOCKED even when the AI changed its mind and approved afterward.
+        let lastDecision;
         for (const tc of toolCalls) {
             const decision = ts.interpretDecision({
                 toolName: tc?.toolName,
                 args: tc?.args || {},
             });
-            if (decision === "BLOCKED") {
-                requestedChanges = true;
-            }
-            else if (decision === "APPROVED") {
-                approved = true;
+            if (decision === "BLOCKED" || decision === "APPROVED") {
+                lastDecision = decision;
             }
         }
-        if (requestedChanges === true) {
+        if (lastDecision === "BLOCKED") {
             return "BLOCKED";
         }
-        if (approved === true) {
+        if (lastDecision === "APPROVED") {
             return "APPROVED";
         }
         // Default to changes requested if unclear
@@ -925,7 +987,10 @@ export class YamaOrchestrator {
             suggestions: 0,
         };
         commentCalls.forEach((call) => {
-            const text = call.args?.comment_text || "";
+            // Comment body field differs per provider: Bitbucket comment tools use
+            // `comment_text`, GitHub comment tools use `body`. Read either so severity
+            // counts work for both (GitHub previously always counted 0).
+            const text = call.args?.comment_text ?? call.args?.body ?? "";
             if (text.includes("🔒 CRITICAL") || text.includes("CRITICAL:")) {
                 counts.critical++;
             }
@@ -949,17 +1014,31 @@ export class YamaOrchestrator {
         return aiResponse.content || aiResponse.text || "Review completed";
     }
     /**
-     * Calculate cost estimate from token usage
+     * Calculate cost estimate from an AI response.
+     *
+     * Prefers NeuroLink's own analytics cost (`response.analytics.cost`, a USD
+     * number computed per-provider/model when enableAnalytics is true — Yama sets
+     * it). The previous implementation hardcoded Gemini-2.0-Flash pricing
+     * ($0.25/$1.00 per 1M) for EVERY provider, which is ~12-15x too low for Claude.
+     * Only when the analytics cost is unavailable do we fall back to a clearly
+     * labeled rough estimate based on the { input, output } token usage.
      */
-    calculateCost(usage) {
+    calculateCost(aiResponse) {
+        const analyticsCost = aiResponse?.analytics?.cost;
+        if (typeof analyticsCost === "number" && Number.isFinite(analyticsCost)) {
+            return Number(analyticsCost.toFixed(6));
+        }
+        const usage = aiResponse?.usage;
         if (!usage) {
             return 0;
         }
-        // Rough estimates (update with actual pricing)
-        const inputCostPer1M = 0.25; // $0.25 per 1M input tokens (Gemini 2.0 Flash)
-        const outputCostPer1M = 1.0; // $1.00 per 1M output tokens
-        const inputTokens = this.toSafeNumber(usage.inputTokens);
-        const outputTokens = this.toSafeNumber(usage.outputTokens);
+        // ROUGH FALLBACK ONLY — provider/model agnostic placeholder pricing used
+        // when NeuroLink analytics cost is unavailable. Not accurate for any
+        // specific model; treat as an order-of-magnitude estimate.
+        const inputCostPer1M = 0.25;
+        const outputCostPer1M = 1.0;
+        const inputTokens = this.toSafeNumber(usage.input);
+        const outputTokens = this.toSafeNumber(usage.output);
         const inputCost = (inputTokens / 1_000_000) * inputCostPer1M;
         const outputCost = (outputTokens / 1_000_000) * outputCostPer1M;
         const totalCost = inputCost + outputCost;
@@ -985,7 +1064,27 @@ export class YamaOrchestrator {
         if (mode === "off") {
             return {};
         }
-        const hasJiraSignal = /\b[A-Z]{2,}-\d+\b/.test(inputText) || /\bjira\b/i.test(inputText);
+        // Jira issue-key signal. The naive /\b[A-Z]{2,}-\d+\b/ over-matched common
+        // non-Jira tokens (UTF-8, SHA-256, SHA256-..., CVE-2024, ISO-8601, RFC-3339),
+        // wrongly keeping Jira tools enabled. Exclude a small denylist of those
+        // prefixes so the match stays conservative (still keeps tools when a real
+        // ABC-123 style key — or the literal word "jira" — is present).
+        const jiraKeyPattern = /\b([A-Z]{2,})-\d+\b/g;
+        const nonJiraKeyPrefixes = new Set([
+            "UTF",
+            "SHA",
+            "SHA256",
+            "SHA512",
+            "MD5",
+            "CVE",
+            "ISO",
+            "RFC",
+            "UTC",
+            "GMT",
+            "BASE64",
+        ]);
+        const hasJiraKey = Array.from(inputText.matchAll(jiraKeyPattern), (m) => m[1]).some((prefix) => !nonJiraKeyPrefixes.has(prefix));
+        const hasJiraSignal = hasJiraKey || /\bjira\b/i.test(inputText);
         if (hasJiraSignal) {
             return {};
         }
@@ -1013,7 +1112,11 @@ export class YamaOrchestrator {
     }
     /**
      * Query-level read-only filtering for local-git MCP tools.
-     * Uses regex-based mutation detection instead of hardcoded tool-name lists.
+     *
+     * Uses the shared, fail-closed `isMutatingGitTool` helper (any git_* tool not
+     * on the read-only allow-list is treated as mutating) so the orchestrator,
+     * explorer, and MCP manager all agree on what is read-only. The previous local
+     * regex silently missed mutating tools like git_branch / git_mv / git_pull.
      */
     getLocalToolFilteringOptions() {
         try {
@@ -1021,15 +1124,17 @@ export class YamaOrchestrator {
             if (!Array.isArray(externalTools)) {
                 return {};
             }
-            const mutatingGitToolPattern = /^git_(commit|push|add|checkout|create_branch|merge|rebase|cherry_pick|reset|revert|tag|rm|clean|stash|apply)\b/i;
             // High-volume read operations can flood context with huge payloads.
             const highVolumeGitToolPattern = /^git_(diff|diff_staged|diff_unstaged|log|show)\b/i;
             const excludeTools = externalTools
                 .filter((tool) => tool?.serverId === "local-git")
                 .map((tool) => tool?.name)
                 .filter((name) => typeof name === "string")
-                .filter((name) => mutatingGitToolPattern.test(this.normalizeToolName(name)) ||
-                highVolumeGitToolPattern.test(this.normalizeToolName(name)));
+                .filter((name) => {
+                const normalized = this.normalizeToolName(name);
+                return (isMutatingGitTool(normalized) ||
+                    highVolumeGitToolPattern.test(normalized));
+            });
             if (excludeTools.length === 0) {
                 return {};
             }
@@ -1239,7 +1344,7 @@ export class YamaOrchestrator {
         console.log(`
     ⚔️  YAMA - AI-Native Code Review Guardian
 
-    Version: 2.2.1
+    Version: ${VERSION}
     Mode: Autonomous AI-Powered Review
     Powered by: NeuroLink + MCP Tools
     `);

package/dist/v2/exploration/ContextExplorerService.js

@@ -6,6 +6,8 @@ import { MCPServerManager } from "../core/MCPServerManager.js";
 import { KnowledgeBaseManager } from "../learning/KnowledgeBaseManager.js";
 import { buildObservabilityConfigFromEnv, validateObservabilityConfig, } from "../utils/ObservabilityConfig.js";
 import { getProviderToolset, } from "../providers/ProviderToolset.js";
+import { clampMaxTokens, MAX_EXTRACTION_TOKENS } from "../utils/tokenLimits.js";
+import { isMutatingGitTool } from "../utils/toolPolicy.js";
 import { ExplorerPromptBuilder } from "./ExplorerPromptBuilder.js";
 import { RulesContextLoader } from "./RulesContextLoader.js";
 export class ContextExplorerService {
@@ -78,7 +80,7 @@ export class ContextExplorerService {
             provider: this.config.ai.explore.provider || this.config.ai.provider,
             model: this.config.ai.explore.model || this.config.ai.model,
             temperature: this.config.ai.explore.temperature ?? this.config.ai.temperature,
-            maxTokens: this.config.ai.explore.maxTokens || this.config.ai.maxTokens,
+            maxTokens: clampMaxTokens(this.config.ai.explore.maxTokens ?? this.config.ai.maxTokens),
             timeout: this.config.ai.explore.timeout || this.config.ai.timeout,
             skipToolPromptInjection: true,
             ...this.getToolFilteringOptions(runtimeContext.mode),
@@ -98,7 +100,7 @@ export class ContextExplorerService {
             provider: this.config.ai.explore.provider || this.config.ai.provider,
             model: this.config.ai.explore.model || this.config.ai.model,
             temperature: 0.1,
-            maxTokens: Math.min(this.config.ai.explore.maxTokens || this.config.ai.maxTokens, 12_000),
+            maxTokens: clampMaxTokens(this.config.ai.explore.maxTokens ?? this.config.ai.maxTokens, MAX_EXTRACTION_TOKENS),
             timeout: "2m",
             disableTools: true,
             context: {
@@ -202,11 +204,17 @@ export class ContextExplorerService {
     static MUTATION_TOOL_NAMES = new Set(["bitbucket", "github"].flatMap((provider) => getProviderToolset(provider).mutationToolNames.map((name) => name.toLowerCase())));
     shouldExcludeTool(mode, toolName) {
         const normalized = this.normalizeToolName(toolName);
+        // Provider (non-git) mutation tools — Bitbucket/GitHub write tools derived
+        // from each provider toolset — are always excluded for the read-only
+        // explore subagent.
         if (ContextExplorerService.MUTATION_TOOL_NAMES.has(normalized.toLowerCase())) {
             return true;
         }
+        // Git tools are filtered with the shared fail-closed allow-list in local
+        // mode (any git_* tool not on the read-only list is treated as mutating),
+        // closing the gaps the old regex missed (git_branch, git_mv, git_pull, …).
         if (mode === "local") {
-            return /^git_(commit|push|add|checkout|create_branch|merge|rebase|cherry_pick|reset|revert|tag|rm|clean|stash|apply)\b/i.test(normalized);
+            return isMutatingGitTool(toolName);
         }
         return false;
     }

package/dist/v2/prompts/ReviewSystemPrompt.js

@@ -50,6 +50,7 @@ ${toolUsageSection}
     <level name="MAJOR"    emoji="⚠️">Blocks if multiple. MUST include a real-code suggestion. Logic bugs, perf issues, broken APIs.</level>
     <level name="MINOR"    emoji="💡">Request changes. Suggestion optional. Quality, naming, duplication.</level>
     <level name="SUGGESTION" emoji="💬">Informational. Optimizations and improvements.</level>
+    <marker-rule>EVERY posted inline comment body MUST BEGIN with its severity marker as the very first token, exactly one of: "🔒 CRITICAL:", "⚠️ MAJOR:", "💡 MINOR:", "💬 SUGGESTION:". Write the marker verbatim (emoji + level + colon) before any other text — it is how issues are counted, so an omitted or altered marker is not counted.</marker-rule>
   </severity-levels>
 
   <anti-patterns>

package/dist/v2/providers/ProviderToolset.js

@@ -140,7 +140,9 @@ class BitbucketToolset {
          history-dependent behavior — <!-- EXPLORE_BEGIN -->call explore_context with a precise
          task and wait for its evidence before commenting<!-- EXPLORE_END --><!-- EXPLORE_DISABLED_BEGIN -->use search_code or get_file_content to verify before commenting<!-- EXPLORE_DISABLED_END -->.
       d. For every confirmed issue, call add_comment immediately with line_number and
-         line_type from the diff JSON. Include a real-code suggestion for CRITICAL/MAJOR.
+         line_type from the diff JSON. Begin comment_text with the exact severity marker as
+         its first token — "🔒 CRITICAL:", "⚠️ MAJOR:", "💡 MINOR:", or "💬 SUGGESTION:" —
+         then the message. Include a real-code suggestion for CRITICAL/MAJOR.
       e. Move to the next file. Never request another file's diff before finishing the
          current one. Never request a multi-file diff.
 
@@ -330,8 +332,10 @@ class GitHubToolset {
          history-dependent behavior — <!-- EXPLORE_BEGIN -->call explore_context with a precise
          task and wait for its evidence before commenting<!-- EXPLORE_END --><!-- EXPLORE_DISABLED_BEGIN -->use search_code or get_file_contents to verify before commenting<!-- EXPLORE_DISABLED_END -->.
       d. For every confirmed issue, call add_comment_to_pending_review immediately with
-         path, line, subjectType="LINE", and body taken from the diff. Include a real-code
-         suggestion in body for CRITICAL/MAJOR.
+         path, line, subjectType="LINE", and body taken from the diff. Begin body with the
+         exact severity marker as its first token — "🔒 CRITICAL:", "⚠️ MAJOR:", "💡 MINOR:",
+         or "💬 SUGGESTION:" — then the message. Include a real-code suggestion in body for
+         CRITICAL/MAJOR.
       e. Move to the next file. Never jump between files mid-review.
 
     STEP 5 — Decision (submit the review)

package/dist/v2/utils/tokenLimits.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Centralized output-token limits for NeuroLink generate() calls.
+ *
+ * Yama previously passed `ai.maxTokens` (defaulting to 128000) straight to
+ * generate(). 128000 is a context-window size, not an output cap — no model
+ * emits that many output tokens, and on the non-streaming Vertex+Claude path it
+ * historically tripped the Anthropic SDK's "Streaming is required" guard
+ * (expected time > 10 min for maxTokens > ~21333). NeuroLink >= 9.70 clamps
+ * per-model server-side, but Yama still clamps to a sane ceiling so configs can
+ * never pass absurd values and behavior is consistent across every call site
+ * (previous clamps were inconsistent: 16_000 in one place, 12_000 in another,
+ * and unclamped in the main review path).
+ */
+/** Sane default output-token ceiling for review/generation calls. */
+export declare const MAX_OUTPUT_TOKENS = 32000;
+/** Smaller ceiling for lightweight structured-extraction passes. */
+export declare const MAX_EXTRACTION_TOKENS = 12000;
+/**
+ * Clamp a requested maxTokens value to a safe ceiling.
+ *
+ * Returns `cap` when the requested value is missing, non-finite, or non-positive
+ * so callers always end up with a usable, bounded number.
+ */
+export declare function clampMaxTokens(requested: number | undefined | null, cap?: number): number;
+//# sourceMappingURL=tokenLimits.d.ts.map

package/dist/v2/utils/tokenLimits.js

@@ -0,0 +1,32 @@
+/**
+ * Centralized output-token limits for NeuroLink generate() calls.
+ *
+ * Yama previously passed `ai.maxTokens` (defaulting to 128000) straight to
+ * generate(). 128000 is a context-window size, not an output cap — no model
+ * emits that many output tokens, and on the non-streaming Vertex+Claude path it
+ * historically tripped the Anthropic SDK's "Streaming is required" guard
+ * (expected time > 10 min for maxTokens > ~21333). NeuroLink >= 9.70 clamps
+ * per-model server-side, but Yama still clamps to a sane ceiling so configs can
+ * never pass absurd values and behavior is consistent across every call site
+ * (previous clamps were inconsistent: 16_000 in one place, 12_000 in another,
+ * and unclamped in the main review path).
+ */
+/** Sane default output-token ceiling for review/generation calls. */
+export const MAX_OUTPUT_TOKENS = 32_000;
+/** Smaller ceiling for lightweight structured-extraction passes. */
+export const MAX_EXTRACTION_TOKENS = 12_000;
+/**
+ * Clamp a requested maxTokens value to a safe ceiling.
+ *
+ * Returns `cap` when the requested value is missing, non-finite, or non-positive
+ * so callers always end up with a usable, bounded number.
+ */
+export function clampMaxTokens(requested, cap = MAX_OUTPUT_TOKENS) {
+    if (typeof requested !== "number" ||
+        !Number.isFinite(requested) ||
+        requested <= 0) {
+        return cap;
+    }
+    return Math.min(requested, cap);
+}
+//# sourceMappingURL=tokenLimits.js.map

package/dist/v2/utils/toolPolicy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared tool-safety policy helpers.
+ *
+ * Centralizes git mutation detection so the orchestrator, the explorer, and the
+ * MCP server manager all agree on what is read-only. Uses a fail-closed
+ * allow-list: any `git_*` tool NOT on the read-only list is treated as mutating.
+ * The previous per-file blocklists silently missed mutating tools such as
+ * `git_branch`, `git_mv`, `git_pull`, `git_fetch`, `git_restore`, `git_switch`,
+ * and `git_remote`, leaving them exposed in "read-only" review modes.
+ */
+/** Strip server/namespace prefixes, e.g. "local-git:git_status" -> "git_status". */
+export declare function normalizeToolName(name: string): string;
+/** Git MCP tools that only READ repository state and are always safe to expose. */
+export declare const READ_ONLY_GIT_TOOLS: ReadonlySet<string>;
+/**
+ * Returns true if the given tool is a git tool that can MUTATE repository state.
+ *
+ * Fail-closed: any `git_*` tool not on the read-only allow-list is treated as
+ * mutating. Non-git tools return false — callers handle provider-specific
+ * mutation tool lists (e.g. Bitbucket/GitHub write tools) separately.
+ */
+export declare function isMutatingGitTool(toolName: string): boolean;
+//# sourceMappingURL=toolPolicy.d.ts.map

package/dist/v2/utils/toolPolicy.js

@@ -0,0 +1,39 @@
+/**
+ * Shared tool-safety policy helpers.
+ *
+ * Centralizes git mutation detection so the orchestrator, the explorer, and the
+ * MCP server manager all agree on what is read-only. Uses a fail-closed
+ * allow-list: any `git_*` tool NOT on the read-only list is treated as mutating.
+ * The previous per-file blocklists silently missed mutating tools such as
+ * `git_branch`, `git_mv`, `git_pull`, `git_fetch`, `git_restore`, `git_switch`,
+ * and `git_remote`, leaving them exposed in "read-only" review modes.
+ */
+/** Strip server/namespace prefixes, e.g. "local-git:git_status" -> "git_status". */
+export function normalizeToolName(name) {
+    return name.split(/[.:/]/).pop() || name;
+}
+/** Git MCP tools that only READ repository state and are always safe to expose. */
+export const READ_ONLY_GIT_TOOLS = new Set([
+    "git_status",
+    "git_log",
+    "git_show",
+    "git_diff",
+    "git_diff_staged",
+    "git_diff_unstaged",
+    "git_blame",
+]);
+/**
+ * Returns true if the given tool is a git tool that can MUTATE repository state.
+ *
+ * Fail-closed: any `git_*` tool not on the read-only allow-list is treated as
+ * mutating. Non-git tools return false — callers handle provider-specific
+ * mutation tool lists (e.g. Bitbucket/GitHub write tools) separately.
+ */
+export function isMutatingGitTool(toolName) {
+    const name = normalizeToolName(toolName).toLowerCase();
+    if (!name.startsWith("git_")) {
+        return false;
+    }
+    return !READ_ONLY_GIT_TOOLS.has(name);
+}
+//# sourceMappingURL=toolPolicy.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/yama",
-  "version": "2.6.0",
+  "version": "2.7.1",
   "description": "Enterprise-grade Pull Request automation toolkit with AI-powered code review and description enhancement",
   "keywords": [
     "pr",
@@ -90,7 +90,8 @@
     "check:all": "npm run lint && npm run format --check && npm run validate && npm run validate:commit"
   },
   "dependencies": {
-    "@juspay/neurolink": "^9.42.0",
+    "@juspay/neurolink": "^9.70.7",
+    "@juspay/hippocampus": "^0.1.7",
     "langfuse": "^3.35.0",
     "@nexus2520/bitbucket-mcp-server": "2.0.4",
     "@nexus2520/jira-mcp-server": "^1.1.1",