mu-agent 0.2.10 → 0.2.12

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [0.2.12] - 2026-10-25
+
+**0.2.12: in judge mode, `tool.approval` approves a check (`isCheckChain`) at needed 0.7; everything else keeps 0.8.**
+
+### Changed
+
+- `tool.approval` (version 2) approves a check at `needed` ≥ 0.7 (`CHECK_APPROVE_AT`); everything else keeps `APPROVE_AT` 0.8. The permission gate passes `check` when the call is a shell call that `isCheckChain` accepts: every part is a check (`CHECK_RUN`: `npm|pnpm|yarn|bun [run] test|build|check|lint|typecheck`, `vitest`, `jest`, `pytest`, `tsc`, `eslint`, `biome`, `ruff`, `mypy` and others, directly, after `npx`/`bunx`/`pnpm exec`/`yarn` or `python3 -m`; `cargo|go|dotnet|swift|make|deno test|build|check|vet|clippy`; `node --test`; `test.sh` in the project, run as `./`, by path or with `sh`/`bash`), a `cd`, or a read-only command as `isReadOnlyChain` reads it, with at least one check. A check may be preceded by `env` and `PYTHONPATH`, `CI`, `NODE_ENV`, `FORCE_COLOR`, `NO_COLOR` or `RUST_BACKTRACE` (no `$` in the value), and may write its output to a file under `/tmp`. It must run in the conversation's folder: a `cd` elsewhere, or a `bg_start` `cwd` elsewhere, rules it out, as does PowerShell. `gradle` and `mvn` are left out (`mvn deploy`). The judge's state is unchanged; it is not told. `beyond` and `unrelated` still ask. Recorded with MiMo v2.6 Pro on 0.2.11: `cd <cwd> && npm run check 2>&1` (needed 0.78) and `cd <cwd> && ./test.sh >/tmp/pi-test.log 2>&1; echo "exit=$?"; grep … | tail -10` (0.79) asked the user.
+
+## [0.2.11] - 2026-10-25
+
+**0.2.11: in judge mode, read-only git commands go ahead after a `cd` into the project, and more of git counts as read-only.**
+
+### Fixed
+
+- Read-only shell commands (`isReadOnlyChain`, used by the permission gate, the constraint gate and checkpoints) take the conversation's folder: a `cd` to it, spelled from the root (no `..`, `~`, `$` or wildcard; links resolved), keeps git read-only. Any other `cd` still makes git count as a change. `bg_start` with a `cwd` outside the folder now makes git count as a change too; before, `bg_start {command: "git status", cwd: "/elsewhere"}` passed as read-only.
+- Git is read by subcommand, as git spells it (`git STATUS` can run `alias.status`). Read-only: `status`, `log`, `diff`, `show`, `blame`, `rev-parse`, `ls-files`, `describe`, `shortlog`, `rev-list`, `ls-tree`, `cat-file`, `merge-base`, `name-rev`, `for-each-ref`, `show-ref`, `diff-tree`, `diff-index`, `diff-files`, `version`, `grep` without `-O`/`--open-files-in-pager`; `branch` and `tag` with listing options only, and names only after `--list`/`-l`, `--contains`, `--merged`, `--points-at` (or `-n` for tags); `stash list|show`, `worktree list`, `remote` (`-v`, `get-url`); `config get|list`, `--get*`/`--list`, or one name. Before the subcommand only `--no-pager`, `-P` and `--no-optional-locks`. `--output` (also cut short) still writes. Recorded with MiMo v2.6 Pro: `cd <cwd> && git diff` and `cd <cwd> && git branch --show-current && git status --short | head` went to the judge (needed 0.79, under 0.8) and then to the user.
+
 ## [0.2.10] - 2026-10-24
 
 **0.2.10 has no changes to the agent. It keeps the version in step with the 0.2.10 desktop app.**

package/README.md

@@ -1,6 +1,6 @@
 # mu
 
-**A coding agent with a judgment kernel.** It hands its routine decisions to a small, fast judge model, so the main model can keep its attention on the work.
+**Most of what a coding agent decides isn't code.** Does this output matter? Is this command safe? Is the work really done? mu hands these yes/no calls to a small judge model at 40 decision points, so fewer tokens go to waste, fewer approvals get clicked through unread, and fewer runs stop halfway.
 
 > Source, docs and the desktop app: [github.com/qybaihe/mu](https://github.com/qybaihe/mu).