@kyo-so/cli 0.1.0 → 0.3.0

package/dist/bin/kyoso.js

@@ -169495,18 +169495,21 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
 });
 
 // src/cli/main.ts
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 
 // src/cli/args.ts
 function parseArgs(argv) {
   const [command = "help", ...rest] = argv;
+  const positionals = [];
   const flags = {};
   for (let index = 0;index < rest.length; index += 1) {
     const item = rest[index];
     if (!item)
       continue;
-    if (!item.startsWith("--"))
+    if (!item.startsWith("--")) {
+      positionals.push(item);
       continue;
+    }
     const key = item.slice(2);
     const next = rest[index + 1];
     const value = next && !next.startsWith("--") ? next : true;
@@ -169521,7 +169524,7 @@ function parseArgs(argv) {
       flags[key] = [String(existing), String(value)];
     }
   }
-  return { command, flags };
+  return { command, positionals, flags };
 }
 function stringFlag(flags, key) {
   const value = flags[key];
@@ -169597,7 +169600,7 @@ function languageFromPath(path) {
 
 // src/cli/doctor.ts
 import { accessSync } from "node:fs";
-import { delimiter } from "node:path";
+import { delimiter as delimiter2 } from "node:path";
 
 // src/config/loadConfig.ts
 import { access as access2, readFile as readFile3 } from "node:fs/promises";
@@ -184010,7 +184013,11 @@ var agentSchema = exports_external.object({
   command: exports_external.string(),
   args: exports_external.array(exports_external.string()).default([]),
   model: exports_external.string().optional(),
-  role: exports_external.enum(["implementation_reviewer", "architecture_security_reviewer"]),
+  role: exports_external.enum([
+    "implementation_reviewer",
+    "architecture_security_reviewer",
+    "combined_reviewer"
+  ]),
   timeoutMs: exports_external.number().int().positive().default(120000),
   env: exports_external.record(exports_external.string(), exports_external.string()).default({}),
   auth: exports_external.object({
@@ -184290,7 +184297,7 @@ var REDACTION = "[KYOSO_REDACTED]";
 var DEFAULT_AGENT_TIMEOUT_MS = 120000;
 var RAW_OUTPUT_MAX_CHARS = 16384;
 var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-var KYOSO_VERSION = "0.1.0";
+var KYOSO_VERSION = "0.3.0";
 
 // src/security/sanitizeText.ts
 var SENSITIVE_TEXT_PATTERNS = [
@@ -184547,13 +184554,475 @@ function hasEnv(env, key) {
   return typeof env[key] === "string" && env[key].trim().length > 0;
 }
 
+// src/cli/setup.ts
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { cp, mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { delimiter, dirname as dirname4, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+async function runSetup(options) {
+  const client = parseClient(options.client);
+  const runner = parseRunner(options.runner);
+  const command = options.command ? parseCommandSpec(options.command) : commandForRunner(runner);
+  const context = {
+    cwd: options.cwd,
+    home: options.env?.HOME ?? homedir2(),
+    env: options.env ?? process.env,
+    write: options.write,
+    scope: options.global ? "global" : "project",
+    mcpCommand: command,
+    sourceSkillDir: resolveBundledSkillDir()
+  };
+  if (!client)
+    return renderSetupOverview(context);
+  if (client === "codex")
+    return renderResults(await setupCodex(context));
+  return renderResults(await setupClaudeCode(context));
+}
+function commandForRunner(runner) {
+  if (runner === "bunx") {
+    return { command: "bunx", args: ["@kyo-so/cli", "mcp"] };
+  }
+  return { command: "npx", args: ["-y", "@kyo-so/cli", "mcp"] };
+}
+function buildCodexMcpToml(command) {
+  return [
+    "[mcp_servers.kyoso]",
+    `command = ${JSON.stringify(command.command)}`,
+    `args = ${JSON.stringify(command.args)}`,
+    'env_vars = ["OPENAI_API_KEY", "CODEX_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"]',
+    "startup_timeout_sec = 20",
+    "tool_timeout_sec = 360",
+    "enabled = true",
+    ""
+  ].join(`
+`);
+}
+function buildClaudeMcpEntry(command) {
+  return {
+    command: command.command,
+    args: command.args,
+    env: {
+      OPENAI_API_KEY: "${OPENAI_API_KEY}",
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY}",
+      CLAUDE_CODE_OAUTH_TOKEN: "${CLAUDE_CODE_OAUTH_TOKEN}"
+    }
+  };
+}
+function skillDestination(client, scope, cwd, home) {
+  if (client === "codex") {
+    const root2 = scope === "global" ? home : cwd;
+    return join2(root2, ".agents", "skills", "kyoso-review");
+  }
+  const root = scope === "global" ? home : cwd;
+  return join2(root, ".claude", "skills", "kyoso-review");
+}
+function detectSetup(options) {
+  const home = options.home ?? homedir2();
+  return {
+    codex: {
+      mcp: hasCodexMcp(join2(home, ".codex", "config.toml")),
+      skill: existsSync(join2(options.cwd, ".agents", "skills", "kyoso-review", "SKILL.md")) || existsSync(join2(home, ".agents", "skills", "kyoso-review", "SKILL.md"))
+    },
+    "claude-code": {
+      mcp: hasClaudeMcp(join2(options.cwd, ".mcp.json")) || hasClaudeMcp(join2(home, ".claude.json")),
+      skill: existsSync(join2(options.cwd, ".claude", "skills", "kyoso-review", "SKILL.md")) || existsSync(join2(home, ".claude", "skills", "kyoso-review", "SKILL.md"))
+    }
+  };
+}
+async function setupCodex(context) {
+  return [
+    await ensureCodexMcp(context),
+    await ensureSkill({
+      title: "Codex skill",
+      sourceDir: context.sourceSkillDir,
+      destinationDir: skillDestination("codex", context.scope, context.cwd, context.home),
+      write: context.write
+    }),
+    ...singleAgentAdvice(context, "codex")
+  ];
+}
+async function setupClaudeCode(context) {
+  return [
+    await ensureClaudeMcp(context),
+    await ensureSkill({
+      title: "Claude Code skill",
+      sourceDir: context.sourceSkillDir,
+      destinationDir: skillDestination("claude-code", context.scope, context.cwd, context.home),
+      write: context.write
+    }),
+    ...singleAgentAdvice(context, "claude-code")
+  ];
+}
+async function ensureCodexMcp(context) {
+  const configPath = join2(context.home, ".codex", "config.toml");
+  const snippet = buildCodexMcpToml(context.mcpCommand);
+  const current = await readOptionalFile(configPath);
+  if (hasCodexMcpContent(current)) {
+    return {
+      title: "Codex MCP",
+      status: "skipped",
+      path: configPath,
+      detail: "existing [mcp_servers.kyoso] kept"
+    };
+  }
+  const detail = diffForAppend(configPath, snippet);
+  if (!context.write) {
+    return { title: "Codex MCP", status: "dry-run", path: configPath, detail };
+  }
+  const separator = current.length > 0 && !current.endsWith(`
+`) ? `
+
+` : "";
+  await mkdir3(dirname4(configPath), { recursive: true });
+  await writeFile3(configPath, `${current}${separator}${snippet}`, "utf8");
+  return {
+    title: "Codex MCP",
+    status: current.length > 0 ? "updated" : "created",
+    path: configPath,
+    detail
+  };
+}
+async function ensureClaudeMcp(context) {
+  if (context.scope === "global") {
+    return ensureClaudeGlobalMcp(context);
+  }
+  const configPath = join2(context.cwd, ".mcp.json");
+  const current = await readJsonObject(configPath);
+  const mcpServers = recordValue(current.mcpServers);
+  if (isRecord4(mcpServers.kyoso)) {
+    return {
+      title: "Claude Code MCP",
+      status: "skipped",
+      path: configPath,
+      detail: "existing mcpServers.kyoso kept"
+    };
+  }
+  const next = {
+    ...current,
+    mcpServers: {
+      ...mcpServers,
+      kyoso: buildClaudeMcpEntry(context.mcpCommand)
+    }
+  };
+  const detail = diffForJson(configPath, current, next);
+  if (!context.write) {
+    return {
+      title: "Claude Code MCP",
+      status: "dry-run",
+      path: configPath,
+      detail
+    };
+  }
+  await writeFile3(configPath, `${JSON.stringify(next, null, 2)}
+`, "utf8");
+  return {
+    title: "Claude Code MCP",
+    status: Object.keys(current).length > 0 ? "updated" : "created",
+    path: configPath,
+    detail
+  };
+}
+function ensureClaudeGlobalMcp(context) {
+  const configPath = join2(context.home, ".claude.json");
+  if (hasClaudeMcp(configPath)) {
+    return {
+      title: "Claude Code MCP",
+      status: "skipped",
+      path: configPath,
+      detail: "existing mcpServers.kyoso kept"
+    };
+  }
+  const json2 = JSON.stringify(buildClaudeMcpEntry(context.mcpCommand));
+  const args = ["mcp", "add-json", "kyoso", json2, "--scope", "user"];
+  const commandLine = ["claude", ...args.map(shellQuote)].join(" ");
+  if (!context.write) {
+    return {
+      title: "Claude Code MCP",
+      status: "dry-run",
+      path: configPath,
+      detail: commandLine
+    };
+  }
+  const result = spawnSync("claude", args, { encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(result.stderr || result.stdout || "claude mcp add-json failed");
+  }
+  return {
+    title: "Claude Code MCP",
+    status: "updated",
+    path: configPath,
+    detail: commandLine
+  };
+}
+async function ensureSkill(options) {
+  const destinationSkill = join2(options.destinationDir, "SKILL.md");
+  if (existsSync(destinationSkill)) {
+    return {
+      title: options.title,
+      status: "skipped",
+      path: options.destinationDir,
+      detail: "existing kyoso-review skill kept"
+    };
+  }
+  const detail = [
+    `copy ${options.sourceDir}`,
+    `to   ${options.destinationDir}`
+  ].join(`
+`);
+  if (!options.write) {
+    return {
+      title: options.title,
+      status: "dry-run",
+      path: options.destinationDir,
+      detail
+    };
+  }
+  await mkdir3(dirname4(options.destinationDir), { recursive: true });
+  await cp(options.sourceDir, options.destinationDir, {
+    recursive: true,
+    force: false
+  });
+  return {
+    title: options.title,
+    status: "created",
+    path: options.destinationDir,
+    detail
+  };
+}
+function renderSetupOverview(context) {
+  const detected = detectSetup({ cwd: context.cwd, home: context.home });
+  return [
+    "Kyoso setup",
+    "",
+    "Clients",
+    `  codex: MCP ${statusWord(detected.codex.mcp)}, skill ${statusWord(detected.codex.skill)}`,
+    `  claude-code: MCP ${statusWord(detected["claude-code"].mcp)}, skill ${statusWord(detected["claude-code"].skill)}`,
+    "",
+    "Commands",
+    "  kyoso setup codex [--write] [--runner npx|bunx] [--global]",
+    "  kyoso setup claude-code [--write] [--runner npx|bunx] [--global]",
+    "",
+    `Default MCP command: ${context.mcpCommand.command} ${context.mcpCommand.args.join(" ")}`,
+    "Dry-run is the default. Add --write to modify files."
+  ].join(`
+`);
+}
+function renderResults(results) {
+  return [
+    "Kyoso setup",
+    "",
+    ...results.flatMap((result) => [
+      `${result.title}: ${result.status}${result.path ? ` (${result.path})` : ""}`,
+      ...result.detail ? indent(result.detail).split(`
+`) : []
+    ])
+  ].join(`
+`);
+}
+function parseClient(client) {
+  if (client === undefined)
+    return;
+  if (client === "codex" || client === "claude-code")
+    return client;
+  throw new Error(`Invalid setup client "${client}". Expected codex or claude-code.`);
+}
+function parseRunner(runner) {
+  if (runner === undefined || runner === "npx")
+    return "npx";
+  if (runner === "bunx")
+    return "bunx";
+  throw new Error(`Invalid --runner value "${runner}". Expected npx or bunx.`);
+}
+function parseCommandSpec(value) {
+  const parts = splitCommand(value);
+  const [command, ...args] = parts;
+  if (!command)
+    throw new Error("--command must not be empty");
+  return { command, args };
+}
+function splitCommand(value) {
+  const parts = [];
+  let current = "";
+  let quote;
+  for (const char of value.trim()) {
+    if (quote) {
+      if (char === quote) {
+        quote = undefined;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current.length > 0) {
+        parts.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (quote)
+    throw new Error("--command has an unterminated quote");
+  if (current.length > 0)
+    parts.push(current);
+  return parts;
+}
+function resolveBundledSkillDir() {
+  const start = dirname4(fileURLToPath(import.meta.url));
+  let current = start;
+  for (let depth = 0;depth < 5; depth += 1) {
+    const candidate = join2(current, ".agents", "skills", "kyoso-review");
+    if (existsSync(join2(candidate, "SKILL.md")))
+      return candidate;
+    current = dirname4(current);
+  }
+  throw new Error("Bundled kyoso-review skill was not found in this package.");
+}
+async function readOptionalFile(path) {
+  try {
+    return await readFile4(path, "utf8");
+  } catch (error51) {
+    if (isMissingPathError2(error51))
+      return "";
+    throw error51;
+  }
+}
+async function readJsonObject(path) {
+  const content = await readOptionalFile(path);
+  if (content.trim().length === 0)
+    return {};
+  const parsed = JSON.parse(content);
+  if (!isRecord4(parsed))
+    throw new Error(`${path} must contain a JSON object`);
+  return parsed;
+}
+function hasCodexMcp(path) {
+  return existsSync(path) && hasCodexMcpContent(readTextSync(path));
+}
+function hasCodexMcpContent(content) {
+  return /^\s*\[mcp_servers\.(?:"kyoso"|kyoso)]\s*$/m.test(content);
+}
+function hasClaudeMcp(path) {
+  if (!existsSync(path))
+    return false;
+  try {
+    const parsed = JSON.parse(readTextSync(path));
+    return jsonHasKyosoMcp(parsed);
+  } catch {
+    return false;
+  }
+}
+function jsonHasKyosoMcp(value) {
+  if (!isRecord4(value))
+    return false;
+  if (isRecord4(value.mcpServers) && isRecord4(value.mcpServers.kyoso)) {
+    return true;
+  }
+  return Object.values(value).some((child) => jsonHasKyosoMcp(child));
+}
+function readTextSync(path) {
+  return readFileSync(path, "utf8");
+}
+function recordValue(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function diffForAppend(path, snippet) {
+  return [
+    `--- ${path}`,
+    `+++ ${path}`,
+    "@@",
+    ...snippet.split(`
+`).map((line) => `+${line}`)
+  ].join(`
+`);
+}
+function diffForJson(path, before, after) {
+  const beforeText = JSON.stringify(before, null, 2).split(`
+`);
+  const afterText = JSON.stringify(after, null, 2).split(`
+`);
+  return [
+    `--- ${path}`,
+    `+++ ${path}`,
+    "@@",
+    ...beforeText.map((line) => `-${line}`),
+    ...afterText.map((line) => `+${line}`)
+  ].join(`
+`);
+}
+function statusWord(value) {
+  return value ? "ok" : "missing";
+}
+function singleAgentAdvice(context, client) {
+  if (client === "claude-code" && !commandExists("codex", context.env)) {
+    return [
+      {
+        title: "Single-agent config",
+        status: "skipped",
+        detail: [
+          "codex was not found on PATH. To use Claude only, add:",
+          "agents: {",
+          "  codex: { enabled: false },",
+          "}",
+          "Claude will run as combined_reviewer and cross-model verification will be marked unavailable."
+        ].join(`
+`)
+      }
+    ];
+  }
+  if (client === "codex" && !commandExists("claude", context.env)) {
+    return [
+      {
+        title: "Single-agent config",
+        status: "skipped",
+        detail: [
+          "claude was not found on PATH. To use Codex only, add:",
+          "agents: {",
+          "  claude: { enabled: false },",
+          "}",
+          "Codex will run as combined_reviewer and cross-model verification will be marked unavailable."
+        ].join(`
+`)
+      }
+    ];
+  }
+  return [];
+}
+function indent(value) {
+  return value.split(`
+`).map((line) => `  ${line}`).join(`
+`);
+}
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_./:=@{}$,-]+$/.test(value))
+    return value;
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function commandExists(command, env) {
+  const paths = env.PATH?.split(delimiter) ?? [];
+  return paths.some((path) => existsSync(join2(path, command)));
+}
+function isMissingPathError2(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+
 // src/cli/doctor.ts
 async function runDoctor(options) {
   const env = options.env ?? process.env;
   const loaded = await loadConfig(options);
   const lines = ["Kyoso doctor", "", "Runtime"];
-  lines.push(`  Bun: ${commandExists("bun", env) ? "ok" : "warning not found"}`);
-  lines.push(`  Node/npm: ${commandExists("npm", env) ? "ok" : "warning npm not found"}`);
+  lines.push(`  Bun: ${commandExists2("bun", env) ? "ok" : "warning not found"}`);
+  lines.push(`  Node/npm: ${commandExists2("npm", env) ? "ok" : "warning npm not found"}`);
   lines.push("", "Config");
   lines.push(`  kyoso.config.ts: ${loaded.configPath ? `found ${loaded.configPath}` : "not found; using defaults"}`);
   lines.push(`  trusted config: ${formatTrustStatus(loaded.configTrustStatus)}`);
@@ -184561,14 +185030,36 @@ async function runDoctor(options) {
     lines.push(`  config hash: ${loaded.configHash}`);
   for (const warning of loaded.warnings)
     lines.push(`  warning: ${warning}`);
+  const setup = detectSetup({ cwd: options.cwd, home: env.HOME });
   lines.push("", "MCP", "  stdio server: ok");
+  lines.push(`  Codex registration: ${setup.codex.mcp ? "ok" : "missing"}`);
+  lines.push(`  Claude Code registration: ${setup["claude-code"].mcp ? "ok" : "missing"}`);
+  if (!setup.codex.mcp) {
+    lines.push("    next: run `npx @kyo-so/cli setup codex --write`");
+  }
+  if (!setup["claude-code"].mcp) {
+    lines.push("    next: run `npx @kyo-so/cli setup claude-code --write`");
+  }
+  lines.push("", "Skills");
+  lines.push(`  Codex kyoso-review: ${setup.codex.skill ? "ok" : "missing"}`);
+  lines.push(`  Claude Code kyoso-review: ${setup["claude-code"].skill ? "ok" : "missing"}`);
+  if (!setup.codex.skill) {
+    lines.push("    next: run `npx @kyo-so/cli setup codex --write`");
+  }
+  if (!setup["claude-code"].skill) {
+    lines.push("    next: run `npx @kyo-so/cli setup claude-code --write`");
+  }
   lines.push("", "ACP agents");
+  const agentCommandExists = {
+    codex: commandExists2(loaded.config.agents.codex.command, env),
+    claude: commandExists2(loaded.config.agents.claude.command, env)
+  };
   for (const agent of ["codex", "claude"]) {
     const config2 = loaded.config.agents[agent];
-    const exists3 = commandExists(config2.command, env);
+    const exists3 = agentCommandExists[agent];
     lines.push(`  ${agent === "codex" ? "Codex" : "Claude"}: ${exists3 ? "ok" : "warning command not found"}`);
     lines.push(`    command: ${[config2.command, ...config2.args].join(" ")}`);
-    if (!exists3 && config2.command === "npx" && commandExists("bunx", env)) {
+    if (!exists3 && config2.command === "npx" && commandExists2("bunx", env)) {
       lines.push('    hint: replace command "npx" with "bunx" in kyoso.config.ts');
     }
     if (agent === "claude") {
@@ -184588,6 +185079,11 @@ async function runDoctor(options) {
       lines.push("    auth: detected or delegated");
     }
   }
+  if (agentCommandExists.codex !== agentCommandExists.claude) {
+    const missing = agentCommandExists.codex ? "claude" : "codex";
+    const remaining = agentCommandExists.codex ? "codex" : "claude";
+    lines.push(`  single-agent mode: set agents.${missing}.enabled: false to use ${remaining} only; the remaining agent will cover both review roles.`);
+  }
   const judgeProvider = loaded.config.judge.mode === "deterministic_only" ? "deterministic_fallback" : resolveJudgeProvider(loaded.config.judge.provider, env);
   lines.push("", "Judge");
   lines.push(`  provider: ${judgeProvider}`);
@@ -184622,8 +185118,8 @@ function formatClaudeDualAuthWarning(preferApiKey) {
 function hasEnv2(env, key) {
   return typeof env[key] === "string" && env[key].trim().length > 0;
 }
-function commandExists(command, env) {
-  const paths = env.PATH?.split(delimiter) ?? [];
+function commandExists2(command, env) {
+  const paths = env.PATH?.split(delimiter2) ?? [];
   return paths.some((path) => {
     try {
       accessSync(`${path}/${command}`);
@@ -184635,12 +185131,12 @@ function commandExists(command, env) {
 }
 
 // src/cli/init.ts
-import { readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 async function runInit(options) {
-  const configPath = join2(options.cwd, "kyoso.config.ts");
-  const skillPath = join2(options.cwd, ".agents/skills/kyoso-review/SKILL.md");
-  const gitignorePath = join2(options.cwd, ".gitignore");
+  const configPath = join3(options.cwd, "kyoso.config.ts");
+  const skillPath = join3(options.cwd, ".agents/skills/kyoso-review/SKILL.md");
+  const gitignorePath = join3(options.cwd, ".gitignore");
   const configResult = await writeFileWithOverwritePrompt(configPath, CONFIG_TEMPLATE, options.force);
   const skillResult = await writeFileWithOverwritePrompt(skillPath, SKILL_TEMPLATE, options.force);
   const gitignoreResult = await ensureGitignoreEntry(gitignorePath, ".kyoso/");
@@ -184654,11 +185150,11 @@ async function runInit(options) {
 async function ensureGitignoreEntry(path, entry) {
   let content = "";
   try {
-    content = await readFile4(path, "utf8");
+    content = await readFile5(path, "utf8");
   } catch (error51) {
-    if (!isMissingPathError2(error51))
+    if (!isMissingPathError3(error51))
       throw error51;
-    await writeFile3(path, `${entry}
+    await writeFile4(path, `${entry}
 `, "utf8");
     return "created";
   }
@@ -184668,11 +185164,11 @@ async function ensureGitignoreEntry(path, entry) {
   const separator = content.length > 0 && !content.endsWith(`
 `) ? `
 ` : "";
-  await writeFile3(path, `${content}${separator}${entry}
+  await writeFile4(path, `${content}${separator}${entry}
 `, "utf8");
   return "updated";
 }
-function isMissingPathError2(error51) {
+function isMissingPathError3(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 var CONFIG_TEMPLATE = `import { defineConfig } from "@kyo-so/cli";
@@ -186479,7 +186975,7 @@ var Protocol = class {
     const { relatedRequestId, resumptionToken, onresumptiontoken } = options ?? {};
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -186539,7 +187035,7 @@ var Protocol = class {
           return reject(response);
         validateStandardSchema(resultSchema, response.result).then((parseResult) => {
           if (parseResult.success)
-            resolve3(parseResult.data);
+            resolve4(parseResult.data);
           else
             reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
@@ -189617,7 +190113,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve3.call(this, root, ref);
+    let _sch = resolve4.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a3 = root.localRefs) === null || _a3 === undefined ? undefined : _a3[ref];
       const { schemaId } = this.opts;
@@ -189648,7 +190144,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve3(root, ref) {
+  function resolve4(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -190154,7 +190650,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin((exports, module) => {
       uri = parse5(serialize(uri, options), options);
     return uri;
   }
-  function resolve3(baseURI, relativeURI, options) {
+  function resolve4(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -190365,7 +190861,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve3,
+    resolve: resolve4,
     resolveComponent,
     equal,
     serialize,
@@ -194087,7 +194583,7 @@ var StdioServerTransport = class {
   send(message) {
     if (this._closed)
       return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error51) => {
@@ -194104,7 +194600,7 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve3();
+        resolve4();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
@@ -194112,7 +194608,7 @@ var StdioServerTransport = class {
           return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve3();
+        resolve4();
       } else if (!settled)
         this._stdout.once("drain", onDrain);
     });
@@ -194120,12 +194616,12 @@ var StdioServerTransport = class {
 };
 
 // src/core/runReview.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 
 // src/acp/AcpAgentProcess.ts
 import { spawn } from "node:child_process";
-import { readFile as readFile5, realpath } from "node:fs/promises";
-import { isAbsolute, relative, resolve as resolve3 } from "node:path";
+import { readFile as readFile6, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve as resolve4 } from "node:path";
 import { Readable, Writable } from "node:stream";
 
 // node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -195999,14 +196495,14 @@ function ndJsonStream(output2, input2) {
 }
 // node_modules/@agentclientprotocol/sdk/dist/jsonrpc.js
 var CANCEL_REQUEST_METHOD = "$/cancel_request";
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null;
 }
 function isJsonRpcId(value) {
   return value === null || typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 }
 function cancelRequestId(params) {
-  if (!isRecord4(params) || !isJsonRpcId(params["requestId"])) {
+  if (!isRecord5(params) || !isJsonRpcId(params["requestId"])) {
     return;
   }
   return params["requestId"];
@@ -196230,12 +196726,12 @@ class Connection {
     }
     const id = this.nextRequestId++;
     let cancel = () => {};
-    const responsePromise = new Promise((resolve3, reject) => {
+    const responsePromise = new Promise((resolve4, reject) => {
       const pendingResponse = {
         resolve: (response) => {
           try {
             const value = mapResponse ? mapResponse(response) : response;
-            resolve3(value);
+            resolve4(value);
           } catch (error51) {
             reject(error51);
           }
@@ -196300,8 +196796,8 @@ class Connection {
   initialize(stream, handlers) {
     this.stream = stream;
     this.staticHandlers = handlers;
-    this.closedPromise = new Promise((resolve3) => {
-      this.abortController.signal.addEventListener("abort", () => resolve3());
+    this.closedPromise = new Promise((resolve4) => {
+      this.abortController.signal.addEventListener("abort", () => resolve4());
     });
     this.receive();
   }
@@ -196871,8 +197367,8 @@ class AsyncQueue {
     if (this.failed) {
       return Promise.reject(this.failure);
     }
-    return new Promise((resolve3, reject) => {
-      this.waiters.push({ resolve: resolve3, reject });
+    return new Promise((resolve4, reject) => {
+      this.waiters.push({ resolve: resolve4, reject });
     });
   }
 }
@@ -197558,7 +198054,7 @@ function isSeverity(value) {
   return typeof value === "string" && severities.includes(value);
 }
 function normalizeCisaSecureByDesign(value) {
-  if (!isRecord5(value))
+  if (!isRecord6(value))
     return;
   const normalized = {};
   const customerSecurityOutcomes = normalizeGateStatus(value.customerSecurityOutcomes);
@@ -197599,7 +198095,7 @@ function normalizeFindingFiles(value) {
   if (!Array.isArray(value))
     return;
   const files = value.flatMap((item) => {
-    if (!isRecord5(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
+    if (!isRecord6(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
       return [];
     }
     const file2 = {
@@ -197618,7 +198114,7 @@ function normalizeFindingFiles(value) {
 function normalizeLineNumber(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -197806,7 +198302,7 @@ async function readWorkspaceFile(workspaceDir, requestedPath, line, limit) {
     const readablePath = await resolveReadableFile(workspaceRoot, absolute);
     if (!readablePath)
       continue;
-    content = await readFile5(readablePath, "utf8").catch(() => {
+    content = await readFile6(readablePath, "utf8").catch(() => {
       return;
     });
     if (content !== undefined)
@@ -197823,7 +198319,7 @@ async function readWorkspaceFile(workspaceDir, requestedPath, line, limit) {
 }
 async function resolveReadableFile(workspaceRoot, absolute) {
   const realPath = await realpath(absolute).catch((error51) => {
-    if (isMissingPathError3(error51))
+    if (isMissingPathError4(error51))
       return;
     throw error51;
   });
@@ -197833,13 +198329,13 @@ async function resolveReadableFile(workspaceRoot, absolute) {
   return realPath;
 }
 function resolveReadablePaths(workspaceRoot, requestedPath) {
-  const primary = resolve3(workspaceRoot, requestedPath);
+  const primary = resolve4(workspaceRoot, requestedPath);
   assertWithinWorkspace(workspaceRoot, primary);
   const relativePath = relative(workspaceRoot, primary).replaceAll("\\", "/");
   if (relativePath.startsWith("context/") || relativePath.startsWith("repo/")) {
     return [primary];
   }
-  const repoPath = resolve3(workspaceRoot, "repo", relativePath);
+  const repoPath = resolve4(workspaceRoot, "repo", relativePath);
   assertWithinWorkspace(workspaceRoot, repoPath);
   return isAbsolute(requestedPath) ? [primary, repoPath] : [repoPath, primary];
 }
@@ -197861,7 +198357,7 @@ function terminateChild(child) {
   }, 2000);
   killTimer.unref();
 }
-function isMissingPathError3(error51) {
+function isMissingPathError4(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 function buildAgentFailure(rawDetail, fallbackMessage) {
@@ -198010,7 +198506,7 @@ function buildOpinion(agent, role, tool) {
 }
 
 // src/acp/prompts.ts
-function buildAgentPrompt(tool, request, agent) {
+function buildAgentPrompt(tool, request, agent, role) {
   const shared = [
     "You are running as a Kyoso child reviewer.",
     "Do not edit files.",
@@ -198023,15 +198519,26 @@ function buildAgentPrompt(tool, request, agent) {
     "Use empty arrays when no finding, test, risk, or question exists; do not copy the example finding."
   ].join(`
 `);
-  const role = agent === "codex" ? [
-    "You are the Codex implementation reviewer in Kyoso.",
-    "Focus on feasibility, minimal change, existing code consistency, regression risk, tests, migration risk, and maintainability."
-  ].join(`
-`) : [
-    "You are the Claude architecture and security reviewer in Kyoso.",
-    "Focus on architecture, threat modeling, authn/authz, secrets, privacy, secure defaults, CISA Secure by Design, and edge cases."
-  ].join(`
-`);
+  const roleInstructions = {
+    implementation_reviewer: [
+      "You are the implementation reviewer role in Kyoso.",
+      "Focus on feasibility, minimal change, existing code consistency, regression risk, tests, migration risk, and maintainability."
+    ].join(`
+`),
+    architecture_security_reviewer: [
+      "You are the architecture and security reviewer role in Kyoso.",
+      "Focus on architecture, threat modeling, authn/authz, secrets, privacy, secure defaults, CISA Secure by Design, and edge cases."
+    ].join(`
+`),
+    combined_reviewer: [
+      "You are the combined reviewer role in Kyoso.",
+      "Cover both implementation review and architecture/security review in one pass.",
+      "First assess feasibility, minimal change, existing code consistency, regression risk, tests, migration risk, and maintainability.",
+      "Then assess architecture, threat modeling, authn/authz, secrets, privacy, secure defaults, CISA Secure by Design, and edge cases.",
+      "Use finding category values so readers can distinguish implementation, architecture, and security concerns."
+    ].join(`
+`)
+  };
   const cisaInstruction = tool === "security_review" ? [
     "For security_review, include cisaMapping on each security-relevant finding when applicable.",
     "Also include cisaSecureByDesign with all four gate dimensions."
@@ -198039,7 +198546,9 @@ function buildAgentPrompt(tool, request, agent) {
 `) : "For plan_review and diff_review, include cisaMapping and cisaSecureByDesign only when relevant.";
   return `${shared}
 
-${role}
+Agent: ${agent}
+Role: ${role}
+${roleInstructions[role]}
 
 Tool: ${tool}
 ${cisaInstruction}
@@ -198382,8 +198891,8 @@ function normalizeTitle(value) {
 }
 
 // src/audit/trace.ts
-import { mkdir as mkdir3, appendFile } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join3 } from "node:path";
+import { mkdir as mkdir4, appendFile } from "node:fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join4 } from "node:path";
 
 // src/context/pathPolicy.ts
 import { normalize, sep } from "node:path";
@@ -198477,13 +198986,13 @@ function createTraceWriter(options) {
   }
   const date5 = new Date().toISOString().slice(0, 10);
   const directory = validateAuditDirectory(options.directory, warnings);
-  const tracePath = join3(options.cwd, directory, date5, `${options.traceId}.jsonl`);
+  const tracePath = join4(options.cwd, directory, date5, `${options.traceId}.jsonl`);
   return {
     tracePath,
     warnings,
     async write(event) {
       try {
-        await mkdir3(dirname4(tracePath), { recursive: true });
+        await mkdir4(dirname5(tracePath), { recursive: true });
         await appendFile(tracePath, `${JSON.stringify(sanitizeForAudit(event, {
           includeRawAgentOutput: options.includeRawAgentOutput
         }))}
@@ -198626,6 +199135,7 @@ function renderMarkdownResult(tool, result, options = {}) {
     `**Decision:** ${result.decision}`,
     `**Mode:** ${tool}`,
     `**Agents:** ${result.agentOpinions.map((opinion) => `${title(opinion.agent)} ${opinion.status}`).join(", ")}`,
+    `**Review mode:** ${formatReviewMode(result)}`,
     `**Degraded:** ${String(result.degraded)}`,
     "",
     "## Summary",
@@ -198652,7 +199162,11 @@ function renderMarkdownResult(tool, result, options = {}) {
     lines.push(`### ${title(opinion.agent)}`, "", `${opinion.summary} (${opinion.status})`, "");
   }
   lines.push("", "## Disagreements", "");
-  lines.push(...result.disagreements.length > 0 ? result.disagreements.map((item) => `- ${item.topic}: ${item.judgeComment}`) : ["- None."]);
+  if (result.reviewMode === "single_agent") {
+    lines.push("- N/A - single-agent review.");
+  } else {
+    lines.push(...result.disagreements.length > 0 ? result.disagreements.map((item) => `- ${item.topic}: ${item.judgeComment}`) : ["- None."]);
+  }
   lines.push("", "## Notes", "", "Kyoso did not modify files. Review was performed on a temporary snapshot.");
   if (result.audit.networkMode === "unrestricted") {
     lines.push("Network mode was unrestricted. File modification policy remained denied.");
@@ -198666,6 +199180,14 @@ function defaultSummaryText(result) {
 function title(value) {
   return value.slice(0, 1).toUpperCase() + value.slice(1);
 }
+function formatReviewMode(result) {
+  if (result.reviewMode !== "single_agent")
+    return "multi-agent";
+  const opinion = result.agentOpinions[0];
+  const agent = opinion ? title(opinion.agent) : "single agent";
+  const role = opinion?.role === "combined_reviewer" ? "combined role" : "configured role";
+  return `single-agent (${agent}, ${role}; cross-model verification was not performed)`;
+}
 function notes(items) {
   return (items[0] ?? "No notes.").replaceAll("|", "\\|");
 }
@@ -198866,15 +199388,15 @@ function decide(input2) {
 }
 
 // src/workspace/createSnapshot.ts
-import { chmod, mkdir as mkdir4, mkdtemp, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { chmod, mkdir as mkdir5, mkdtemp, writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname6, join as join5 } from "node:path";
 import { tmpdir } from "node:os";
 async function createSnapshot(traceId, tool, request, options = {}) {
-  const root = await mkdtemp(join4(tmpdir(), `kyoso-${traceId}-`));
-  const repoDir = join4(root, "repo");
-  const contextDir = join4(root, "context");
-  await mkdir4(repoDir, { recursive: true });
-  await mkdir4(contextDir, { recursive: true });
+  const root = await mkdtemp(join5(tmpdir(), `kyoso-${traceId}-`));
+  const repoDir = join5(root, "repo");
+  const contextDir = join5(root, "context");
+  await mkdir5(repoDir, { recursive: true });
+  await mkdir5(contextDir, { recursive: true });
   let fileCount = 0;
   for (const file2 of request.selectedFiles ?? []) {
     const relative2 = normalizeRelativePath(file2.path);
@@ -198882,24 +199404,24 @@ async function createSnapshot(traceId, tool, request, options = {}) {
       continue;
     if (!isAllowedPath(relative2, options.allowPatterns ?? []))
       continue;
-    const dest = join4(repoDir, relative2);
-    await mkdir4(dirname5(dest), { recursive: true });
-    await writeFile4(dest, file2.content, "utf8");
+    const dest = join5(repoDir, relative2);
+    await mkdir5(dirname6(dest), { recursive: true });
+    await writeFile5(dest, file2.content, "utf8");
     await chmod(dest, 292).catch(() => {
       return;
     });
     fileCount += 1;
   }
-  await writeFile4(join4(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
-  await writeFile4(join4(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
-  await writeFile4(join4(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex"), "utf8");
-  await writeFile4(join4(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude"), "utf8");
+  await writeFile5(join5(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
+  await writeFile5(join5(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
+  await writeFile5(join5(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
+  await writeFile5(join5(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
   if (request.repoSummary)
-    await writeFile4(join4(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
+    await writeFile5(join5(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
   if (request.currentPlan)
-    await writeFile4(join4(contextDir, "current_plan.md"), request.currentPlan, "utf8");
+    await writeFile5(join5(contextDir, "current_plan.md"), request.currentPlan, "utf8");
   if (request.diff?.unifiedDiff)
-    await writeFile4(join4(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
+    await writeFile5(join5(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
   return { root, repoDir, contextDir, fileCount };
 }
 function stripContents(request) {
@@ -199055,9 +199577,11 @@ async function runReview(tool, request, options = {}) {
       allowPatterns
     });
     warnings.push(...built.warnings);
+    const agentRoles = resolveAgentRoles(loaded.config);
     snapshot = await createSnapshot(traceId, tool, built.request, {
       denyPatterns,
-      allowPatterns
+      allowPatterns,
+      agentRoles
     });
     await trace.write({
       type: "snapshot_created",
@@ -199077,6 +199601,8 @@ async function runReview(tool, request, options = {}) {
       trace
     });
     const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
+    const agentsUsed = normalizedAgentResults.map((result2) => result2.agent);
+    const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
     const completed = normalizedAgentResults.filter((result2) => result2.status === "completed");
     const degraded = completed.length !== agentResults.length;
     let aggregate = aggregateAgentResults(normalizedAgentResults);
@@ -199128,6 +199654,8 @@ async function runReview(tool, request, options = {}) {
     const resultWithoutMarkdown = {
       decision,
       degraded,
+      agentsUsed,
+      reviewMode,
       findings: aggregate.findings,
       cisaSecureByDesign: cisa,
       disagreements: aggregate.disagreements,
@@ -199140,7 +199668,7 @@ async function runReview(tool, request, options = {}) {
         traceId,
         startedAt,
         completedAt,
-        agentsUsed: normalizedAgentResults.map((result2) => result2.agent),
+        agentsUsed,
         redactionsApplied: secretScan.redactions,
         networkMode,
         workspaceMode: "temp_snapshot",
@@ -199199,12 +199727,13 @@ async function runReview(tool, request, options = {}) {
   }
 }
 async function runAgents(input2) {
+  const agentRoles = resolveAgentRoles(input2.config);
   const agentInputs = ["codex", "claude"].filter((agent) => input2.config.agents[agent].enabled).map((agent) => ({
     traceId: input2.traceId,
     agent,
-    role: input2.config.agents[agent].role,
+    role: agentRoles[agent] ?? input2.config.agents[agent].role,
     tool: input2.tool,
-    prompt: buildAgentPrompt(input2.tool, input2.request, agent),
+    prompt: buildAgentPrompt(input2.tool, input2.request, agent, agentRoles[agent] ?? input2.config.agents[agent].role),
     workspaceDir: input2.workspaceDir,
     timeoutMs: input2.request.options?.maxAgentTimeoutMs ?? input2.config.agents[agent].timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
     networkMode: input2.networkMode
@@ -199213,6 +199742,7 @@ async function runAgents(input2) {
     type: "agent_started",
     traceId: input2.traceId,
     agent: agentInput.agent,
+    role: agentInput.role,
     timestamp: new Date().toISOString()
   })));
   const results = await input2.manager.runAll(agentInputs);
@@ -199221,6 +199751,7 @@ async function runAgents(input2) {
       type: "agent_completed",
       traceId: input2.traceId,
       agent: result.agent,
+      role: result.role,
       status: result.status,
       startedAt: result.startedAt,
       completedAt: result.completedAt,
@@ -199237,6 +199768,15 @@ async function runAgents(input2) {
   }));
   return results;
 }
+function resolveAgentRoles(config2) {
+  const enabledAgents = ["codex", "claude"].filter((agent) => config2.agents[agent].enabled);
+  const singleAgentMode = enabledAgents.length === 1;
+  const roles = {};
+  for (const agent of enabledAgents) {
+    roles[agent] = singleAgentMode ? "combined_reviewer" : config2.agents[agent].role;
+  }
+  return roles;
+}
 function defaultAgentManager(config2) {
   if (process.env.KYOSO_TEST_FAKE_AGENTS === "1")
     return new FakeAgentManager;
@@ -199274,6 +199814,8 @@ async function buildSecretBlockResult(input2) {
   const resultWithoutMarkdown = {
     decision: "block",
     degraded: false,
+    agentsUsed: [],
+    reviewMode: "multi_agent",
     findings: [finding],
     cisaSecureByDesign: cisa,
     disagreements: [],
@@ -199354,6 +199896,8 @@ async function buildPolicyBlockResult(input2) {
   const resultWithoutMarkdown = {
     decision: "block",
     degraded: false,
+    agentsUsed: [],
+    reviewMode: "multi_agent",
     findings: [input2.finding],
     cisaSecureByDesign: input2.tool === "security_review" ? computeCisaGate([input2.finding], []) : undefined,
     disagreements: [],
@@ -199395,7 +199939,7 @@ function mergeDenyPatterns(configDeny, requestDeny) {
 function assertTrustedWorkspaceRoot(requestRoot, configRoot, cwd) {
   if (!requestRoot)
     return;
-  if (resolve4(cwd, requestRoot) !== resolve4(cwd, configRoot)) {
+  if (resolve5(cwd, requestRoot) !== resolve5(cwd, configRoot)) {
     throw new KyosoRequestError("workspace.root is not trusted by config", "UNTRUSTED_WORKSPACE_ROOT");
   }
 }
@@ -199503,6 +200047,17 @@ async function main() {
     console.log(await runInit({ cwd, force: booleanFlag(parsed.flags, "force") }));
     return;
   }
+  if (parsed.command === "setup") {
+    console.log(await runSetup({
+      cwd,
+      client: parsed.positionals[0],
+      write: booleanFlag(parsed.flags, "write"),
+      global: booleanFlag(parsed.flags, "global"),
+      runner: stringFlag(parsed.flags, "runner"),
+      command: stringFlag(parsed.flags, "command")
+    }));
+    return;
+  }
   if (parsed.command === "plan" || parsed.command === "security" || parsed.command === "diff") {
     const tool = commandToTool(parsed.command);
     const request = await buildReviewRequest(tool, parsed.flags);
@@ -199554,7 +200109,7 @@ async function buildDiff(tool, flags) {
     return;
   const base = stringFlag(flags, "base") ?? "main";
   const head = stringFlag(flags, "head") ?? "HEAD";
-  const result = spawnSync("git", ["diff", base, head], { encoding: "utf8" });
+  const result = spawnSync2("git", ["diff", base, head], { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(result.stderr || `git diff failed for ${base}..${head}`);
   }
@@ -199594,6 +200149,7 @@ var HELP = `Kyoso
 
 Usage:
   kyoso mcp [--config kyoso.config.ts] [--ignore-config] [--trust-config] [--network model_only|unrestricted]
+  kyoso setup [codex|claude-code] [--write] [--runner npx|bunx] [--command <command>] [--global]
   kyoso plan --goal <text> [--plan <path-or-text>] [--file <path>] [--json] [--trust-config]
   kyoso security --goal <text> [--diff <path>] [--file <path>] [--allow-secret-redaction] [--trust-config]
   kyoso diff --base main --head HEAD [--json] [--trust-config]