@kyo-so/cli 0.1.0

package/dist/cli/args.d.ts

@@ -0,0 +1,8 @@
+export type ParsedArgs = {
+    command: string;
+    flags: Record<string, string | boolean | string[]>;
+};
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function stringFlag(flags: ParsedArgs["flags"], key: string): string | undefined;
+export declare function booleanFlag(flags: ParsedArgs["flags"], key: string): boolean;
+export declare function stringArrayFlag(flags: ParsedArgs["flags"], key: string): string[];

package/dist/cli/doctor.d.ts

@@ -0,0 +1,9 @@
+export declare function runDoctor(options: {
+    cwd: string;
+    configPath?: string;
+    ignoreConfig?: boolean;
+    trustConfig?: boolean;
+    promptForTrust?: boolean;
+    trustStorePath?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<string>;

package/dist/cli/init.d.ts

@@ -0,0 +1,4 @@
+export declare function runInit(options: {
+    cwd: string;
+    force: boolean;
+}): Promise<string>;

package/dist/cli/io.d.ts

@@ -0,0 +1,7 @@
+export declare function readPathOrText(value: string | undefined): Promise<string | undefined>;
+export declare function readSelectedFiles(paths: string[]): Promise<Array<{
+    path: string;
+    language?: string;
+    content: string;
+}>>;
+export declare function writeFileWithOverwritePrompt(path: string, content: string, force: boolean): Promise<"created" | "skipped">;

package/dist/cli/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/defaultConfig.d.ts

@@ -0,0 +1,2 @@
+import type { KyosoConfigInput } from "./schema.js";
+export declare const defaultConfig: KyosoConfigInput;

package/dist/config/defineConfig.d.ts

@@ -0,0 +1,2 @@
+import type { KyosoConfigInput } from "./schema.js";
+export declare function defineConfig(config: KyosoConfigInput): KyosoConfigInput;

package/dist/config/loadConfig.d.ts

@@ -0,0 +1,22 @@
+import { type KyosoConfig } from "./schema.js";
+import { type ConfigTrustStatus } from "./trustedConfig.js";
+export type LoadConfigOptions = {
+    cwd?: string;
+    configPath?: string;
+    ignoreConfig?: boolean;
+    trustConfig?: boolean;
+    promptForTrust?: boolean;
+    trustStorePath?: string;
+    trustPrompt?: (config: {
+        configPath: string;
+        configHash: string;
+    }) => Promise<boolean>;
+};
+export type LoadedConfig = {
+    config: KyosoConfig;
+    configPath?: string;
+    configHash?: string;
+    configTrustStatus: ConfigTrustStatus;
+    warnings: string[];
+};
+export declare function loadConfig(options?: LoadConfigOptions): Promise<LoadedConfig>;

package/dist/config/schema.d.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+type PartialDeep<T> = {
+    [K in keyof T]?: T[K] extends Record<string, unknown> ? PartialDeep<T[K]> : T[K];
+};
+export declare const kyosoConfigSchema: z.ZodObject<{
+    entrypoints: z.ZodObject<{
+        mcp: z.ZodBoolean;
+        cli: z.ZodBoolean;
+    }, z.core.$strip>;
+    firstClassClient: z.ZodString;
+    tools: z.ZodObject<{
+        planReview: z.ZodBoolean;
+        securityReview: z.ZodBoolean;
+        diffReview: z.ZodBoolean;
+    }, z.core.$strip>;
+    agents: z.ZodObject<{
+        codex: z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            type: z.ZodDefault<z.ZodLiteral<"acp">>;
+            command: z.ZodString;
+            args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            model: z.ZodOptional<z.ZodString>;
+            role: z.ZodEnum<{
+                implementation_reviewer: "implementation_reviewer";
+                architecture_security_reviewer: "architecture_security_reviewer";
+            }>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            auth: z.ZodObject<{
+                mode: z.ZodDefault<z.ZodLiteral<"passthrough">>;
+                preferExistingLogin: z.ZodDefault<z.ZodBoolean>;
+                preferApiKey: z.ZodDefault<z.ZodBoolean>;
+                recommendedEnv: z.ZodArray<z.ZodString>;
+                envWhitelist: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        claude: z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            type: z.ZodDefault<z.ZodLiteral<"acp">>;
+            command: z.ZodString;
+            args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            model: z.ZodOptional<z.ZodString>;
+            role: z.ZodEnum<{
+                implementation_reviewer: "implementation_reviewer";
+                architecture_security_reviewer: "architecture_security_reviewer";
+            }>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            auth: z.ZodObject<{
+                mode: z.ZodDefault<z.ZodLiteral<"passthrough">>;
+                preferExistingLogin: z.ZodDefault<z.ZodBoolean>;
+                preferApiKey: z.ZodDefault<z.ZodBoolean>;
+                recommendedEnv: z.ZodArray<z.ZodString>;
+                envWhitelist: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    workspace: z.ZodObject<{
+        mode: z.ZodLiteral<"temp_snapshot">;
+        root: z.ZodString;
+        readOnly: z.ZodBoolean;
+        maxContextBytes: z.ZodNumber;
+        maxDiffBytes: z.ZodNumber;
+        deny: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    secrets: z.ZodObject<{
+        mode: z.ZodLiteral<"redact_and_block">;
+        blockOnDetectedSecret: z.ZodBoolean;
+        allowOverride: z.ZodBoolean;
+    }, z.core.$strip>;
+    network: z.ZodObject<{
+        defaultMode: z.ZodEnum<{
+            model_only: "model_only";
+            unrestricted: "unrestricted";
+        }>;
+        allowUnrestricted: z.ZodBoolean;
+        warnOnUnrestricted: z.ZodBoolean;
+        mediatedWeb: z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    securityReview: z.ZodObject<{
+        cisaSecureByDesign: z.ZodObject<{
+            enabled: z.ZodBoolean;
+            gate: z.ZodBoolean;
+            dimensions: z.ZodObject<{
+                customerSecurityOutcomes: z.ZodBoolean;
+                secureByDefault: z.ZodBoolean;
+                transparencyAndAccountability: z.ZodBoolean;
+                governance: z.ZodBoolean;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    judge: z.ZodObject<{
+        mode: z.ZodEnum<{
+            deterministic_plus_llm: "deterministic_plus_llm";
+            deterministic_only: "deterministic_only";
+        }>;
+        provider: z.ZodEnum<{
+            auto: "auto";
+            openai: "openai";
+            anthropic: "anthropic";
+            none: "none";
+        }>;
+        timeoutMs: z.ZodNumber;
+    }, z.core.$strip>;
+    audit: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        format: z.ZodLiteral<"jsonl">;
+        directory: z.ZodString;
+        includeRawAgentOutput: z.ZodBoolean;
+        includeFileContents: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KyosoConfig = z.infer<typeof kyosoConfigSchema>;
+export type KyosoConfigInput = PartialDeep<KyosoConfig>;
+export {};

package/dist/config/trustedConfig.d.ts

@@ -0,0 +1,5 @@
+export type ConfigTrustStatus = "ignored" | "not_found" | "trusted" | "trusted_by_flag" | "trusted_interactively" | "untrusted_skipped";
+export declare function hashConfigSource(source: string): string;
+export declare function defaultTrustedConfigStorePath(env?: NodeJS.ProcessEnv): string;
+export declare function isTrustedConfig(storePath: string, configPath: string, configHash: string): Promise<boolean>;
+export declare function trustConfig(storePath: string, configPath: string, configHash: string): Promise<void>;

package/dist/config/tsConfigLoader.d.ts

@@ -0,0 +1,7 @@
+type ConfigModule = {
+    default?: unknown;
+    config?: unknown;
+    [key: string]: unknown;
+};
+export declare function loadConfigModule(filePath: string, source: string): Promise<ConfigModule>;
+export {};

package/dist/context/buildContext.d.ts

@@ -0,0 +1,11 @@
+import type { KyosoReviewRequest } from "../core/types.js";
+export type BuiltContext = {
+    request: KyosoReviewRequest;
+    warnings: string[];
+};
+export declare function buildContext(request: KyosoReviewRequest, options: {
+    maxContextBytes: number;
+    maxDiffBytes: number;
+    denyPatterns: string[];
+    allowPatterns?: string[];
+}): BuiltContext;

package/dist/context/pathPolicy.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeRelativePath(path: string): string;
+export declare function isDeniedPath(path: string, denyPatterns: string[]): boolean;
+export declare function isAllowedPath(path: string, allowPatterns: string[]): boolean;

package/dist/context/truncate.d.ts

@@ -0,0 +1,6 @@
+export type TruncationResult = {
+    content: string;
+    truncated: boolean;
+    bytes: number;
+};
+export declare function truncateUtf8(input: string, maxBytes: number): TruncationResult;

package/dist/core/constants.d.ts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_AGENT_TIMEOUT_MS = 120000;
+export declare const DEFAULT_MAX_CONTEXT_BYTES = 500000;
+export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
+export declare const RAW_OUTPUT_MAX_CHARS = 16384;
+export declare const TRACE_DIR = ".kyoso/traces";
+export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
+export declare const KYOSO_VERSION = "0.1.0";

package/dist/core/errors.d.ts

@@ -0,0 +1,4 @@
+export declare class KyosoRequestError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}

package/dist/core/runReview.d.ts

@@ -0,0 +1,12 @@
+import { type KyosoConfig } from "../config/schema.js";
+import { type LoadConfigOptions } from "../config/loadConfig.js";
+import type { AcpAgentManager } from "../acp/AcpAgentManager.js";
+import type { KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool } from "./types.js";
+export type RunReviewOptions = LoadConfigOptions & {
+    config?: KyosoConfig;
+    configHash?: string;
+    agentManager?: AcpAgentManager;
+    env?: NodeJS.ProcessEnv;
+    mcpNetworkMode?: NetworkMode;
+};
+export declare function runReview(tool: ReviewTool, request: KyosoReviewRequest, options?: RunReviewOptions): Promise<KyosoResult>;

package/dist/core/types.d.ts

@@ -0,0 +1,154 @@
+export type ReviewTool = "plan_review" | "security_review" | "diff_review";
+export type KyosoDecision = "approve" | "approve_with_changes" | "block";
+export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
+export type NetworkMode = "model_only" | "unrestricted";
+export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
+export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss" | "ssrf" | "injection" | "secret" | "supply_chain" | "privacy" | "data_loss" | "test" | "maintainability" | "cisa_secure_by_design" | "other";
+export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
+export type KyosoReviewRequest = {
+    goal: string;
+    repoSummary?: string;
+    currentPlan?: string;
+    selectedFiles?: Array<{
+        path: string;
+        language?: string;
+        content: string;
+        truncated?: boolean;
+    }>;
+    diff?: {
+        baseRef?: string;
+        headRef?: string;
+        unifiedDiff: string;
+    };
+    constraints?: string[];
+    workspace?: {
+        root?: string;
+        allowRead?: string[];
+        denyRead?: string[];
+    };
+    options?: {
+        network?: NetworkMode;
+        maxAgentTimeoutMs?: number;
+        includeAgentRawOutputs?: boolean;
+        judgeProvider?: JudgeProvider;
+        allowSecretRedaction?: boolean;
+    };
+};
+export type KyosoFinding = {
+    id: string;
+    severity: Severity;
+    category: FindingCategory;
+    title: string;
+    evidence: string;
+    recommendation: string;
+    files?: Array<{
+        path: string;
+        lineStart?: number;
+        lineEnd?: number;
+    }>;
+    sourceAgents: Array<AgentName | "judge" | "kyoso_policy">;
+    confidence: "high" | "medium" | "low";
+    cisaMapping?: CisaDimension[];
+};
+export type CisaSecureByDesignResult = {
+    customerSecurityOutcomes: GateStatus;
+    secureByDefault: GateStatus;
+    transparencyAndAccountability: GateStatus;
+    governance: GateStatus;
+    notes: string[];
+};
+export type AgentName = "codex" | "claude";
+export type AgentRole = "implementation_reviewer" | "architecture_security_reviewer";
+export type NormalizedAgentOpinion = {
+    agent: AgentName;
+    role: string;
+    summary: string;
+    findings: Array<{
+        severity: Severity;
+        category: FindingCategory | string;
+        title: string;
+        evidence: string;
+        recommendation: string;
+        files?: Array<{
+            path: string;
+            lineStart?: number;
+            lineEnd?: number;
+        }>;
+        confidence: "high" | "medium" | "low";
+        cisaMapping?: string[];
+    }>;
+    testsToAdd: string[];
+    residualRisks: string[];
+    openQuestions: string[];
+    cisaSecureByDesign?: Partial<CisaSecureByDesignResult>;
+};
+export type AgentRunInput = {
+    traceId: string;
+    agent: AgentName;
+    role: AgentRole;
+    tool: ReviewTool;
+    prompt: string;
+    workspaceDir: string;
+    timeoutMs: number;
+    networkMode: NetworkMode;
+};
+export type AgentRunResult = {
+    agent: AgentName;
+    role: AgentRole;
+    status: "completed" | "failed" | "timeout" | "skipped";
+    rawText?: string;
+    normalized?: NormalizedAgentOpinion;
+    error?: {
+        code: string;
+        message: string;
+        detail?: string;
+    };
+    startedAt: string;
+    completedAt?: string;
+};
+export type KyosoResult = {
+    decision: KyosoDecision;
+    degraded: boolean;
+    summaryMarkdown: string;
+    findings: KyosoFinding[];
+    cisaSecureByDesign?: CisaSecureByDesignResult;
+    disagreements: Array<{
+        topic: string;
+        positions: Array<{
+            agent: AgentName;
+            opinion: string;
+        }>;
+        judgeComment: string;
+    }>;
+    testsToAdd: string[];
+    residualRisks: string[];
+    agentOpinions: Array<{
+        agent: AgentName;
+        role: string;
+        summary: string;
+        status: "completed" | "failed" | "timeout" | "skipped";
+        errorCode?: string;
+        rawText?: string;
+    }>;
+    audit: {
+        traceId: string;
+        startedAt: string;
+        completedAt: string;
+        agentsUsed: string[];
+        redactionsApplied: number;
+        networkMode: NetworkMode;
+        workspaceMode: "temp_snapshot";
+        configHash?: string;
+        warnings?: string[];
+    };
+};
+export type SecretScanResult = {
+    detected: boolean;
+    redactions: number;
+    matches: Array<{
+        kind: string;
+        location: string;
+    }>;
+    redactedRequest: KyosoReviewRequest;
+};

package/dist/core/validateRequest.d.ts

@@ -0,0 +1,2 @@
+import type { KyosoReviewRequest, ReviewTool } from "./types.js";
+export declare function validateReviewRequest(tool: ReviewTool, request: KyosoReviewRequest): void;

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { defineConfig } from "./config/defineConfig.js";
+export { runReview } from "./core/runReview.js";
+export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool, } from "./core/types.js";