Skip to content

byoa v0.2.1 — workspace safety

Choose a tag to compare

View all tags
@UnixUserDev UnixUserDev released this 19 Oct 16:43
· 4 commits to main since this release
v0.2.1
60c2f7a

byoa v0.2.1 — workspace safety

Install (use a release artifact, not the source tree)

Standalone (needs Node >= 26; no npm install):

mkdir -p ~/.local/lib/byoa ~/.local/bin
tar -xzf byoa-0.2.1-linux-x64.tar.gz -C ~/.local/lib/byoa
ln -sf ~/.local/lib/byoa/byoa ~/.local/bin/byoa
byoa --version

Keep the extracted directory together: the launcher resolves @opentui/core from the
node_modules beside it.

npm-installable tarball:

npm install -g ./byoa-0.2.1-npm.tgz
byoa --version

Safety: $HOME is not a workspace

The workspace is the sandbox's single read-write mount. Launching from your home directory used
to hand the model your entire home. $HOME, /home and / are now refused:

refusing to use /home/unixuser as the workspace: it is your home directory.
cd into a project, pass --cwd <dir>, or --allow-home to override.

Point it at a project:

cd ~/Projects/something
byoa --tui --provider lmstudio --model google/gemma-4-e4b

--allow-home exists for the rare deliberate case, not as the default.

Inside the namespace the workspace is the only real path — $HOME is not mounted, so a task that
cd ..s out of the workspace finds an empty skeleton root, not your files.

Also fixed in 0.2.1

  • Piped or empty stdin no longer leaves an unsettled top-level await (exit 13 with a Node warning).
  • -p "" is a usage error instead of silently dropping into the REPL.
  • A database path that cannot be opened prints one line instead of a stack trace.

Included since 0.2.0

TUI (--tui), core loop, OpenAI-compatible + Anthropic providers (plus local servers), sessions
with resume, shell/file tools, bubblewrap sandbox with a read-allowlist skeleton root, three
prompt tiers, and namespaced Obsidian-backed memory.

Requirements

  • Node.js >= 26
  • Linux with bubblewrap; strict (default) refuses to run unwrapped without it.

Quality

216 tests, 0 skipped, including real-bubblewrap isolation tests and headless OpenTUI render tests;
tsc --noEmit clean.

AI-generated with OpenCode — primary model: DeepSeek V4.1 Flash.

Assets 4
Loading