mu-agent 0.2.11 → 0.2.12

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [0.2.12] - 2026-10-25
+
+**0.2.12: in judge mode, `tool.approval` approves a check (`isCheckChain`) at needed 0.7; everything else keeps 0.8.**
+
+### Changed
+
+- `tool.approval` (version 2) approves a check at `needed` ≥ 0.7 (`CHECK_APPROVE_AT`); everything else keeps `APPROVE_AT` 0.8. The permission gate passes `check` when the call is a shell call that `isCheckChain` accepts: every part is a check (`CHECK_RUN`: `npm|pnpm|yarn|bun [run] test|build|check|lint|typecheck`, `vitest`, `jest`, `pytest`, `tsc`, `eslint`, `biome`, `ruff`, `mypy` and others, directly, after `npx`/`bunx`/`pnpm exec`/`yarn` or `python3 -m`; `cargo|go|dotnet|swift|make|deno test|build|check|vet|clippy`; `node --test`; `test.sh` in the project, run as `./`, by path or with `sh`/`bash`), a `cd`, or a read-only command as `isReadOnlyChain` reads it, with at least one check. A check may be preceded by `env` and `PYTHONPATH`, `CI`, `NODE_ENV`, `FORCE_COLOR`, `NO_COLOR` or `RUST_BACKTRACE` (no `$` in the value), and may write its output to a file under `/tmp`. It must run in the conversation's folder: a `cd` elsewhere, or a `bg_start` `cwd` elsewhere, rules it out, as does PowerShell. `gradle` and `mvn` are left out (`mvn deploy`). The judge's state is unchanged; it is not told. `beyond` and `unrelated` still ask. Recorded with MiMo v2.6 Pro on 0.2.11: `cd <cwd> && npm run check 2>&1` (needed 0.78) and `cd <cwd> && ./test.sh >/tmp/pi-test.log 2>&1; echo "exit=$?"; grep … | tail -10` (0.79) asked the user.
+
 ## [0.2.11] - 2026-10-25
 
 **0.2.11: in judge mode, read-only git commands go ahead after a `cd` into the project, and more of git counts as read-only.**

package/judge/mu/index.js

@@ -33205,7 +33205,16 @@ function harmlessRedirect(text9, at, both) {
   if (!text9.startsWith("/dev/null", index) || !/^(?:[\s;&|]|$)/.test(text9.slice(end, end + 1))) return void 0;
   return end - 1;
 }
-function simpleCommands(text9) {
+function fileRedirect(text9, at, writes) {
+  let index = at + 1;
+  if (text9[index] === ">") index++;
+  while (text9[index] === " " || text9[index] === "	") index++;
+  const name = /^[\w./@%+,:=-]+/.exec(text9.slice(index))?.[0];
+  if (!name || !/^(?:[\s;&|]|$)/.test(text9.slice(index + name.length, index + name.length + 1))) return void 0;
+  writes.push(name);
+  return index + name.length - 1;
+}
+function simpleCommands(text9, writes) {
   if (text9.includes("\r")) return void 0;
   const commands = [];
   let words2 = [];
@@ -33238,7 +33247,7 @@ function simpleCommands(text9) {
         endCommand();
       } else if (next === ">") {
         endWord();
-        const end = harmlessRedirect(text9, index + 1, true);
+        const end = harmlessRedirect(text9, index + 1, true) ?? (writes ? fileRedirect(text9, index + 1, writes) : void 0);
         if (end === void 0) return void 0;
         index = end;
       } else return void 0;
@@ -33247,7 +33256,7 @@ function simpleCommands(text9) {
         word = "";
         started = false;
       } else endWord();
-      const end = harmlessRedirect(text9, index, false);
+      const end = harmlessRedirect(text9, index, false) ?? (writes ? fileRedirect(text9, index, writes) : void 0);
       if (end === void 0) return void 0;
       index = end;
     } else if (char === "'") {
@@ -33292,17 +33301,21 @@ function isReadOnlyChain(command, powershell = false, cwd, start = cwd) {
   if (!commands?.some((words2) => words2.length > 0)) return false;
   let elsewhere = startsElsewhere(cwd, start);
   return commands.every((words2) => {
-    const [program] = words2;
-    if (program === void 0 || program === "true" || program === "false" || program === ":") return true;
-    if (program === "cd") {
-      const [, to, ...more] = words2;
-      elsewhere = cwd === void 0 || to === void 0 || more.length > 0 || !isAbsolute2(to) || /[$*?[~]/.test(to) || to.split(/[\\/]/).includes("..") || !samePlace(to, cwd);
-      return true;
-    }
-    if (program === "find") return !words2.some((word) => FIND_ACTS.test(word));
-    return readOnlyProgram(words2.join(" "), elsewhere);
+    if (words2[0] !== "cd") return readOnlyPart(words2, elsewhere);
+    elsewhere = !cdHome(words2, cwd);
+    return true;
   });
 }
+function cdHome(words2, cwd) {
+  const [, to, ...more] = words2;
+  return cwd !== void 0 && to !== void 0 && more.length === 0 && isAbsolute2(to) && !/[$*?[~]/.test(to) && !to.split(/[\\/]/).includes("..") && samePlace(to, cwd);
+}
+function readOnlyPart(words2, elsewhere) {
+  const [program] = words2;
+  if (program === void 0 || program === "true" || program === "false" || program === ":") return true;
+  if (program === "find") return !words2.some((word) => FIND_ACTS.test(word));
+  return readOnlyProgram(words2.join(" "), elsewhere);
+}
 function isMutatingCall(toolName, input, cwd) {
   if (READ_ONLY_TOOLS.has(toolName)) return false;
   if (isShellTool(toolName)) return !isReadOnlyChain(String(input.command ?? ""), toolName === "powershell", cwd);
@@ -33315,6 +33328,33 @@ var CHECK_COMMAND = /\b(?:vitest|jest|pytest|mocha|ava|tsc|eslint|biome|ruff|myp
 function isCheckCommand(command) {
   return CHECK_COMMAND.test(command);
 }
+var CHECK_RUN = /^(?:(?:(?:npx|bunx)\s+|(?:pnpm|yarn)\s+(?:exec\s+)?|python3?\s+-m\s+)?(?:vitest|jest|pytest|mocha|ava|tsc|eslint|biome|ruff|mypy|rspec|phpunit|ctest|tox|nox)|(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|build|check|lint|typecheck)|(?:cargo|go|dotnet|swift|make|deno)\s+(?:test|build|check|vet|clippy)|node\s+--test|(?:(?:ba)?sh\s+(?:\.\/)?|\.\/)(?:[\w-][\w.-]*\/)*test\.sh|(?:[\w-][\w.-]*\/)+test\.sh)(?:\s|$)/;
+var CHECK_SETTING = /^(?:PYTHONPATH|CI|NODE_ENV|FORCE_COLOR|NO_COLOR|RUST_BACKTRACE)=[^$]*$/;
+function tempFile(name) {
+  return /^\/(?:private\/)?tmp\//.test(name) && !name.split("/").includes("..");
+}
+function isCheckChain(command, powershell = false, cwd, start = cwd) {
+  if (powershell) return false;
+  const writes = [];
+  const commands = simpleCommands(command.trim(), writes);
+  if (!commands || !writes.every(tempFile)) return false;
+  let elsewhere = startsElsewhere(cwd, start);
+  let checks = 0;
+  const parts = commands.every((words2) => {
+    if (words2[0] === "cd") {
+      elsewhere = !cdHome(words2, cwd);
+      return true;
+    }
+    let at = words2[0] === "env" ? 1 : 0;
+    while (at < words2.length && CHECK_SETTING.test(words2[at])) at++;
+    if (CHECK_RUN.test(words2.slice(at).join(" "))) {
+      checks++;
+      return !elsewhere;
+    }
+    return at === 0 && readOnlyPart(words2, elsewhere);
+  });
+  return parts && checks > 0;
+}
 
 // packages/kyrn-judge/src/decisions/board-read.ts
 var MAX_EVENTS = 16;
@@ -57281,9 +57321,10 @@ import { join as join48, resolve as resolve14, sep as sep3 } from "node:path";
 
 // packages/kyrn-judge/src/decisions/tool-approval.ts
 var APPROVE_AT = 0.8;
+var CHECK_APPROVE_AT = 0.7;
 var toolApproval = defineDecision({
   id: "tool.approval",
-  version: 1,
+  version: 2,
   cacheImpact: "none",
   latency: "inline",
   capabilities: "relate",
@@ -57303,11 +57344,12 @@ var toolApproval = defineDecision({
   buildState(input) {
     return { tool_call: input.call, where: input.where, task: input.task, user_message: input.userMessage };
   },
-  policy(answers) {
+  policy(answers, input) {
     const { choice, probabilities } = answers.verdict;
     if (isEscapeOption(choice)) return "unsure";
     const p = probabilities?.[choice];
-    if (choice === "needed") return p === void 0 || p >= APPROVE_AT ? "approve" : "unsure";
+    const line2 = input.check ? CHECK_APPROVE_AT : APPROVE_AT;
+    if (choice === "needed") return p === void 0 || p >= line2 ? "approve" : "unsure";
     return choice === "beyond" || choice === "unrelated" ? choice : "unsure";
   },
   // Nobody could look at it: the user decides.
@@ -57707,6 +57749,9 @@ function registerPermissions(runtime, roots) {
       return { approved: asked2 && (decision2.judged ?? decision2.outcome) === "allow", reason: "flagged" };
     }
     const frame = runtime.frame;
+    const input = event.input;
+    const powershell = event.toolName === "powershell" || event.toolName === "bg_start" && process.platform === "win32";
+    const check = need.kind === "shell" && isCheckChain(String(input.command ?? ""), powershell, ctx.cwd, shellStart(event.toolName, input, ctx.cwd));
     const decision = await runtime.engine.decide(
       toolApproval,
       {
@@ -57716,7 +57761,8 @@ function registerPermissions(runtime, roots) {
         ),
         userMessage,
         call,
-        where: need.kind === "outside" ? "outside the project folder" : need.kind === "shell" || need.kind === "run" ? "a program run in the project folder" : need.kind === "delegate" ? "subagents working on the project" : "an action outside this computer or program, such as a web page or a connected service"
+        where: need.kind === "outside" ? "outside the project folder" : need.kind === "shell" || need.kind === "run" ? "a program run in the project folder" : need.kind === "delegate" ? "subagents working on the project" : "an action outside this computer or program, such as a web page or a connected service",
+        check
       },
       { signal: ctx.signal }
     );

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "mu-agent",
-	"version": "0.2.11",
+	"version": "0.2.12",
 	"description": "mu: most of what a coding agent decides isn't code. mu hands 40 kinds of yes/no calls to a small judge model: fewer wasted tokens, fewer approvals on autopilot, fewer runs that stop halfway. Built on pi.",
 	"type": "module",
 	"bin": {
@@ -42,6 +42,6 @@
 	"muBuild": {
 		"pi": "1.3.0",
 		"judge": "0.1.0",
-		"commit": "3679ea8db"
+		"commit": "3285d1f30"
 	}
 }