@kyo-so/cli 0.10.0 → 0.11.0

package/dist/cli/knownSkillDigests.d.ts

@@ -1,4 +1,4 @@
-export declare const CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+export declare const CURRENT_SKILL_DIGEST = "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
 export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
     readonly "0.8.0": readonly [{
         readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.3.1";
+        readonly pluginVersion: "0.4.0";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.9.1";
+        readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
     };
     readonly marketplace: {
         readonly name: "kyoso";
@@ -47,7 +47,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: true;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -56,7 +56,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: false;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -100,6 +100,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly OPENAI_API_KEY: true;
             readonly CODEX_API_KEY: true;
             readonly CODEX_ACCESS_TOKEN: true;
+            readonly OPENROUTER_API_KEY: true;
             readonly ANTHROPIC_API_KEY: true;
             readonly CLAUDE_CODE_OAUTH_TOKEN: true;
         };
@@ -129,9 +130,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.3.1";
+            readonly pluginVersion: "0.4.0";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.9.1";
+            readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
         };
         readonly marketplace: {
             readonly name: "kyoso";
@@ -166,7 +167,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: true;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -175,7 +176,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: false;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -219,6 +220,7 @@ export declare const pluginRuntimeContract: {
                 readonly OPENAI_API_KEY: true;
                 readonly CODEX_API_KEY: true;
                 readonly CODEX_ACCESS_TOKEN: true;
+                readonly OPENROUTER_API_KEY: true;
                 readonly ANTHROPIC_API_KEY: true;
                 readonly CLAUDE_CODE_OAUTH_TOKEN: true;
             };

package/dist/config/schema.d.ts

@@ -123,6 +123,13 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         allowDemotion: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>;
+    reviewBudget: z.ZodObject<{
+        maxModelCalls: z.ZodNumber;
+        maxTotalWallTimeMs: z.ZodNumber;
+        maxAgentOutputBytes: z.ZodNumber;
+        maxFindingsPerAgent: z.ZodNumber;
+        skipOptionalPhasesWhenTokenUsageUnknown: z.ZodBoolean;
+    }, z.core.$strip>;
     audit: z.ZodObject<{
         enabled: z.ZodBoolean;
         format: z.ZodLiteral<"jsonl">;

package/dist/core/constants.d.ts

@@ -1,7 +1,9 @@
 export declare const DEFAULT_AGENT_TIMEOUT_MS = 120000;
 export declare const DEFAULT_MAX_CONTEXT_BYTES = 500000;
 export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
+export declare const MAX_AGENT_OUTPUT_BYTES = 1048576;
+export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.10.0";
+export declare const KYOSO_VERSION = "0.11.0";

package/dist/core/requestFingerprint.d.ts

@@ -0,0 +1,11 @@
+import type { KyosoConfig } from "../config/schema.js";
+import type { AgentRole, KyosoReviewRequest, ReviewBudget, ReviewTool } from "./types.js";
+export declare const REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+export declare function createRequestFingerprint(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    config: KyosoConfig;
+    roles: Partial<Record<"codex" | "claude", AgentRole>>;
+    budget: ReviewBudget;
+}): string;
+export declare function canonicalJson(value: unknown): string;

package/dist/core/reviewBudget.d.ts

@@ -0,0 +1,68 @@
+import type { AgentName, ModelCallKind, ModelTokenUsage, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewCompletionReason, ReviewExecutionBudget, ReviewModelCallAudit } from "./types.js";
+type ReservationStatus = "reserved" | "started" | "completed" | "skipped";
+type Reservation = {
+    id: number;
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: ReservationStatus;
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
+export type ModelCallReservation = Pick<Reservation, "id" | "kind" | "agent">;
+export type BudgetReservationFailure = {
+    reason: "model_call_budget" | "deadline";
+};
+export declare function resolveReviewBudget(ceiling: ReviewBudget, requested: ReviewBudgetRequest | undefined): ReviewBudget;
+export declare class ReviewBudgetTracker {
+    readonly budget: ReviewBudget;
+    readonly startedAtEpochMs: number;
+    readonly deadlineAtEpochMs: number;
+    private readonly reservations;
+    private readonly skippedCalls;
+    private readonly incompleteReasons;
+    private nextReservationId;
+    constructor(budget: ReviewBudget, startedAtEpochMs?: number);
+    remainingWallTimeMs(now?: number): number;
+    hasDeadlineExpired(now?: number): boolean;
+    reserveMany(inputs: Array<{
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }>): {
+        reservations: ModelCallReservation[];
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    reserve(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }): {
+        reservation: ModelCallReservation;
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    markStarted(reservation: ModelCallReservation): void;
+    hasStarted(reservation: ModelCallReservation): boolean;
+    complete(reservation: ModelCallReservation, values?: {
+        outputBytes?: number;
+        usage?: ModelTokenUsage;
+        stopReason?: string;
+    }): void;
+    skip(reservation: ModelCallReservation, reason: string): void;
+    recordSkipped(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+        reason: string;
+    }): void;
+    markIncomplete(reason: ReviewCompletionReason): void;
+    isTokenUsageUnknown(): boolean;
+    snapshot(now?: number): {
+        completion: ReviewCompletion;
+        executionBudget: ReviewExecutionBudget;
+        modelCalls: ReviewModelCallAudit[];
+    };
+    private usedCapacity;
+    private modelCalls;
+}
+export {};

package/dist/core/tokenUsage.d.ts

@@ -0,0 +1,2 @@
+import type { ModelTokenUsage } from "./types.js";
+export declare function normalizeModelTokenUsage(usage: unknown): ModelTokenUsage | undefined;

package/dist/core/types.d.ts

@@ -4,6 +4,29 @@ export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
 export type NetworkMode = "model_only" | "unrestricted";
 export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type ReviewBudget = {
+    maxModelCalls: number;
+    maxTotalWallTimeMs: number;
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+};
+export type ReviewBudgetRequest = Partial<ReviewBudget>;
+export type ReviewCompletionReason = "model_call_budget" | "deadline" | "agent_output_limit" | "token_usage_unknown" | "coverage_incomplete" | "disputed_finding";
+export type ReviewCompletion = {
+    status: "complete" | "incomplete";
+    reasons: ReviewCompletionReason[];
+    retryable: false;
+};
+export type ModelCallKind = "primary" | "verifier" | "judge";
+export type ModelTokenUsage = {
+    totalTokens?: number;
+    inputTokens?: number;
+    outputTokens?: number;
+    thoughtTokens?: number;
+    cachedReadTokens?: number;
+    cachedWriteTokens?: number;
+};
 export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss" | "ssrf" | "injection" | "secret" | "supply_chain" | "privacy" | "data_loss" | "test" | "maintainability" | "cisa_secure_by_design" | "other";
 export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
 export type KyosoReviewRequest = {
@@ -30,6 +53,7 @@ export type KyosoReviewRequest = {
     options?: {
         network?: NetworkMode;
         maxAgentTimeoutMs?: number;
+        reviewBudget?: ReviewBudgetRequest;
         includeAgentRawOutputs?: boolean;
         judgeProvider?: JudgeProvider;
         allowSecretRedaction?: boolean;
@@ -110,6 +134,8 @@ export type AgentRunInput = {
     prompt: string;
     workspaceDir: string;
     timeoutMs: number;
+    deadlineAtEpochMs?: number;
+    maxOutputBytes?: number;
     networkMode: NetworkMode;
     onStarted?: (() => void) | (() => Promise<void>);
 };
@@ -125,11 +151,54 @@ export type AgentRunResult = {
         detail?: string;
     };
     warnings?: string[];
+    usage?: ModelTokenUsage;
+    outputBytes?: number;
+    stopReason?: string;
     startedAt: string;
     completedAt?: string;
 };
+export type ReviewExecutionBudget = {
+    maxModelCalls: number;
+    modelCalls: {
+        planned: number;
+        consumed: number;
+        skipped: number;
+        byKind: Record<ModelCallKind, {
+            planned: number;
+            consumed: number;
+            skipped: number;
+        }>;
+    };
+    wallTime: {
+        limitMs: number;
+        consumedMs: number;
+        remainingMs: number;
+    };
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+    agentOutputBytes: Partial<Record<AgentName, number>>;
+    tokenUsage: {
+        status: "reported" | "partial" | "unknown";
+        reportedCalls: number;
+        unknownCalls: number;
+        totals: ModelTokenUsage;
+    };
+};
+export type ReviewModelCallAudit = {
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: "completed" | "skipped";
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
 export type KyosoResult = {
     decision: KyosoDecision;
+    completion: ReviewCompletion;
+    executionBudget: ReviewExecutionBudget;
+    requestFingerprint: string;
     degraded: boolean;
     agentsUsed: AgentName[];
     reviewMode: ReviewMode;
@@ -166,6 +235,7 @@ export type KyosoResult = {
         workspaceMode: "temp_snapshot";
         configHash?: string;
         warnings?: string[];
+        modelCalls: ReviewModelCallAudit[];
     };
 };
 export type SecretScanResult = {

package/dist/core/verification.d.ts

@@ -18,7 +18,7 @@ export declare function groupVerificationTargetsByVerifier(targets: Verification
     verifier: AgentName;
     findings: KyosoFinding[];
 }>;
-export declare function markVerificationOverflow(targets: VerificationTarget[]): void;
+export declare function markVerificationOverflow(targets: VerificationTarget[], reason?: string): void;
 export declare function parseVerificationVerdicts(rawText: string | undefined): VerificationVerdict[] | undefined;
 export declare function applyVerificationVerdicts(targets: VerificationTarget[], verifier: AgentName, verdicts: VerificationVerdict[] | undefined): Record<"confirmed" | "refuted" | "uncertain", number>;
 export declare function countVerificationStatuses(findings: KyosoFinding[]): Record<"confirmed" | "refuted" | "uncertain" | "not_verified", number>;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { defineConfig } from "./config/defineConfig.js";
 export { runReview } from "./core/runReview.js";
-export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool, } from "./core/types.js";
+export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewExecutionBudget, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";