yala-agentic-toolkit

Imported from MalekYala/yala-agentic-toolkit (AGENTS.md). Install upstream with npx skills add MalekYala/yala-agentic-toolkit. Copyright stays with the author.

AGENTS.md — using yala-toolkit from a coding-harness agent

529 standalone Python/Go/Bash/TS utilities for system, network, security, AI, infra, and dev work. This file is the routing table; everything else is discoverable at runtime.

Setup (once per checkout)

python -m venv .venv && source .venv/bin/activate
pip install -e .            # slim base; extras: .[browser], .[crawl], .[voice], .[db], .[crypto], .[all]

Discovery — do NOT read category READMEs (they cost thousands of tokens)

yala find <task words>            # top ~10 matching tools, one-liners (cheapest, start here)
yala find <query> --json          # same, machine-readable
yala info <tool>                  # tool's docstring + exact run command
yala list <category>              # tools in one category
cat tools/data/manifest.json      # full manifest: every tool + mutates/json_output/flags

Invocation

yala <category> <tool> [args...]   # preferred; tool names are hyphenated
yala <tool> [args...]              # works when the name is unique
python src/<category>/<tool>.py …  # direct invocation always works too

Conventions contract (rely on these)

• Every tool supports --help; yala <cat> <tool> --help forwards to it.
• Mutating tools support --dry-run ("mutates": true in the manifest). Always dry-run first when changing files/state.
• Data-producing tools generally support --json ("json_output": true in the manifest) — prefer it for parsing.
• Secrets come from environment variables only, never CLI args.
• Exit codes: 0 success, 1 finding/failure (scanners exit 1 when they find something — that is not a crash), 2 usage error.
• Dual-use tools (network-recon, network-tunneling, api-tools hardening, sqli-defense probes, load testing) are authorized-use only — targets must be owned or explicitly authorized.

Category routing table

Notes for harness builders

• tools/data/manifest.json carries per-tool mutates / json_output flags — use them to gate confirmations before running mutating tools.
• yala propagates the tool's own exit code; yala itself exits 2 on dispatch errors (unknown/ambiguous tool).
• New tools must be added to tools/data/tool_index.json, then python tools/gen_readmes.py regenerates READMEs + registry + manifest; python tools/gen_readmes.py --check fails CI on any drift.

Testing (contributing)

Three pytest tiers, all under tests/:

Run everything: python -m pytest tests/. A bare checkout without pytest can still run the smoke suite via python tests/validate.py (legacy wrapper).

GitNexus — Code Intelligence

This project is indexed by GitNexus as yala-toolkit (5273 symbols, 11337 relationships, 300 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.

If any GitNexus tool warns the index is stale, run npx gitnexus analyze in terminal first.

Always Do

• MUST run impact analysis before editing any symbol. Before modifying a function, class, or method, run gitnexus_impact({target: "symbolName", direction: "upstream"}) and report the blast radius (direct callers, affected processes, risk level) to the user.
• MUST run gitnexus_detect_changes() before committing to verify your changes only affect expected symbols and execution flows.
• MUST warn the user if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
• When exploring unfamiliar code, use gitnexus_query({query: "concept"}) to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
• When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use gitnexus_context({name: "symbolName"}).

When Debugging

1. gitnexus_query({query: "<error or symptom>"}) — find execution flows related to the issue
2. gitnexus_context({name: "<suspect function>"}) — see all callers, callees, and process participation
3. READ gitnexus://repo/yala-toolkit/process/{processName} — trace the full execution flow step by step
4. For regressions: gitnexus_detect_changes({scope: "compare", base_ref: "main"}) — see what your branch changed

When Refactoring

• Renaming: MUST use gitnexus_rename({symbol_name: "old", new_name: "new", dry_run: true}) first. Review the preview — graph edits are safe, text_search edits need manual review. Then run with dry_run: false.
• Extracting/Splitting: MUST run gitnexus_context({name: "target"}) to see all incoming/outgoing refs, then gitnexus_impact({target: "target", direction: "upstream"}) to find all external callers before moving code.
• After any refactor: run gitnexus_detect_changes({scope: "all"}) to verify only expected files changed.

Never Do

• NEVER edit a function, class, or method without first running gitnexus_impact on it.
• NEVER ignore HIGH or CRITICAL risk warnings from impact analysis.
• NEVER rename symbols with find-and-replace — use gitnexus_rename which understands the call graph.
• NEVER commit changes without running gitnexus_detect_changes() to check affected scope.

Tools Quick Reference

Impact Risk Levels

Resources

Self-Check Before Finishing

Before completing any code modification task, verify:

1. gitnexus_impact was run for all modified symbols
2. No HIGH/CRITICAL risk warnings were ignored
3. gitnexus_detect_changes() confirms changes match expected scope
4. All d=1 (WILL BREAK) dependents were updated

Keeping the Index Fresh

After committing code changes, the GitNexus index becomes stale. Re-run analyze to update it:

npx gitnexus analyze

If the index previously included embeddings, preserve them by adding --embeddings:

npx gitnexus analyze --embeddings

To check whether embeddings exist, inspect .gitnexus/meta.json — the stats.embeddings field shows the count (0 means no embeddings). Running analyze without --embeddings will delete any previously generated embeddings.

Claude Code users: A PostToolUse hook handles this automatically after git commit and git merge.

CLI