@kyo-so/cli 0.11.0 → 0.12.0

package/dist/cli/knownSkillDigests.d.ts

@@ -1,5 +1,12 @@
-export declare const CURRENT_SKILL_DIGEST = "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
+export declare const CURRENT_SKILL_DIGEST = "sha256:8654e68ea61f2acea29027056802bf627ad737f084c9a86ab052946943538409";
 export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
+    readonly "0.11.0": readonly [{
+        readonly digest: "sha256:110dd872a3d1c8a71474a0eadb226f51a6addd86f9d4f3ed17b73678b3179a4e";
+        readonly kind: "historical";
+    }, {
+        readonly digest: "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
+        readonly kind: "historical";
+    }];
     readonly "0.8.0": readonly [{
         readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";
         readonly kind: "historical";

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.4.0";
+        readonly pluginVersion: "0.5.0";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
+        readonly mcpPackagePin: "@kyo-so/cli@0.11.0";
     };
     readonly marketplace: {
         readonly name: "kyoso";
@@ -130,9 +130,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.4.0";
+            readonly pluginVersion: "0.5.0";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
+            readonly mcpPackagePin: "@kyo-so/cli@0.11.0";
         };
         readonly marketplace: {
             readonly name: "kyoso";

package/dist/config/schema.d.ts

@@ -11,12 +11,31 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         mcp: z.ZodBoolean;
         cli: z.ZodBoolean;
     }, z.core.$strip>;
-    firstClassClient: z.ZodString;
+    firstClassClient: z.ZodLiteral<"codex">;
     tools: z.ZodObject<{
         planReview: z.ZodBoolean;
         securityReview: z.ZodBoolean;
         diffReview: z.ZodBoolean;
     }, z.core.$strip>;
+    reviewPolicy: z.ZodObject<{
+        additionalLenses: z.ZodArray<z.ZodEnum<{
+            correctness: "correctness";
+            regression: "regression";
+            security_boundaries: "security_boundaries";
+            secrets_and_injection: "secrets_and_injection";
+            data_integrity: "data_integrity";
+            public_contract: "public_contract";
+            supply_chain: "supply_chain";
+            privacy: "privacy";
+            resource_amplification: "resource_amplification";
+            architecture: "architecture";
+            performance: "performance";
+            tests: "tests";
+            documentation: "documentation";
+            maintainability: "maintainability";
+        }>>;
+        multiAgentRequired: z.ZodBoolean;
+    }, z.core.$strip>;
     agents: z.ZodObject<{
         codex: z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -71,7 +90,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     workspace: z.ZodObject<{
         mode: z.ZodLiteral<"temp_snapshot">;
         root: z.ZodString;
-        readOnly: z.ZodBoolean;
+        readOnly: z.ZodLiteral<true>;
         maxContextBytes: z.ZodNumber;
         maxDiffBytes: z.ZodNumber;
         deny: z.ZodArray<z.ZodString>;
@@ -89,7 +108,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         allowUnrestricted: z.ZodBoolean;
         warnOnUnrestricted: z.ZodBoolean;
         mediatedWeb: z.ZodObject<{
-            enabled: z.ZodBoolean;
+            enabled: z.ZodLiteral<false>;
         }, z.core.$strip>;
     }, z.core.$strip>;
     securityReview: z.ZodObject<{
@@ -135,7 +154,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         format: z.ZodLiteral<"jsonl">;
         directory: z.ZodString;
         includeRawAgentOutput: z.ZodBoolean;
-        includeFileContents: z.ZodBoolean;
+        includeFileContents: z.ZodLiteral<false>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export declare const kyosoConfigKnownLeafPaths: string[];

package/dist/core/constants.d.ts

@@ -6,4 +6,4 @@ export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.11.0";
+export declare const KYOSO_VERSION = "0.12.0";

package/dist/core/findingAdmission.d.ts

@@ -0,0 +1,10 @@
+import type { EvidenceRef, KyosoFinding, KyosoReviewRequest, ReviewMode, ReviewTool } from "./types.js";
+export declare function admitFindings(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    findings: KyosoFinding[];
+    reviewMode: ReviewMode;
+}): KyosoFinding[];
+export declare function selectRegressionTests(tests: string[]): string[];
+export declare function buildAdmissionOpenQuestions(findings: KyosoFinding[]): string[];
+export declare function findingFingerprint(finding: Pick<KyosoFinding, "category" | "title">, evidenceRefs: EvidenceRef[]): string;

package/dist/core/requestFingerprint.d.ts

@@ -1,11 +1,12 @@
 import type { KyosoConfig } from "../config/schema.js";
 import type { AgentRole, KyosoReviewRequest, ReviewBudget, ReviewTool } from "./types.js";
-export declare const REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+export declare const REVIEW_CONTRACT_VERSION = "2026-07-16-v3";
 export declare function createRequestFingerprint(input: {
     tool: ReviewTool;
     request: KyosoReviewRequest;
     config: KyosoConfig;
     roles: Partial<Record<"codex" | "claude", AgentRole>>;
     budget: ReviewBudget;
+    entrypoint?: "cli" | "mcp" | "core";
 }): string;
 export declare function canonicalJson(value: unknown): string;

package/dist/core/reviewPolicy.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRole, AgentRunResult, KyosoReviewRequest, ReviewCoverage, ReviewLens } from "./types.js";
+export declare const REVIEW_LENSES: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract", "supply_chain", "privacy", "resource_amplification", "architecture", "performance", "tests", "documentation", "maintainability"];
+export declare const BUILT_IN_SAFETY_FLOOR: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract"];
+export declare const REQUIRED_REVIEW_PERSPECTIVES: AgentRole[];
+export declare function isReviewLens(value: unknown): value is ReviewLens;
+export declare function resolveRequiredLenses(request: KyosoReviewRequest, additionalLenses?: ReviewLens[]): ReviewLens[];
+export declare function buildReviewCoverage(input: {
+    request: KyosoReviewRequest;
+    additionalLenses?: ReviewLens[];
+    agentResults: AgentRunResult[];
+}): ReviewCoverage;
+export declare function isCoverageIncomplete(coverage: ReviewCoverage, options: {
+    multiAgentRequired: boolean;
+}): boolean;
+export declare function unavailableReviewCoverage(request: KyosoReviewRequest, reason: string, additionalLenses?: ReviewLens[]): ReviewCoverage;
+export declare function renderTrustedReviewContract(request: KyosoReviewRequest, requiredLenses?: ReviewLens[]): string;

package/dist/core/runReview.d.ts

@@ -10,6 +10,7 @@ export type RunReviewOptions = LoadConfigOptions & {
     agentManager?: AcpAgentManager;
     env?: NodeJS.ProcessEnv;
     mcpNetworkMode?: NetworkMode;
+    entrypoint?: "cli" | "mcp" | "core";
     traceWriterFactory?: (options: TraceWriterOptions) => TraceWriter;
 };
 export declare function runReview(tool: ReviewTool, request: KyosoReviewRequest, options?: RunReviewOptions): Promise<KyosoResult>;

package/dist/core/types.d.ts

@@ -4,6 +4,25 @@ export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
 export type NetworkMode = "model_only" | "unrestricted";
 export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type ReviewLens = "correctness" | "regression" | "security_boundaries" | "secrets_and_injection" | "data_integrity" | "public_contract" | "supply_chain" | "privacy" | "resource_amplification" | "architecture" | "performance" | "tests" | "documentation" | "maintainability";
+export type ReviewContract = {
+    focus?: ReviewLens[];
+    nonGoals?: string[];
+    acceptedRisks?: Array<{
+        findingFingerprint: string;
+        rationale: string;
+    }>;
+};
+export type FindingDisposition = "gate" | "actionable" | "advisory" | "disputed";
+export type ChangeRelation = "introduced" | "worsened" | "pre_existing" | "unknown";
+export type EvidenceQuality = "concrete" | "partial" | "insufficient";
+export type EvidenceRef = {
+    kind: "file" | "diff_hunk" | "plan_clause";
+    path?: string;
+    lineStart?: number;
+    lineEnd?: number;
+    label?: string;
+};
 export type ReviewBudget = {
     maxModelCalls: number;
     maxTotalWallTimeMs: number;
@@ -31,6 +50,7 @@ export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss
 export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
 export type KyosoReviewRequest = {
     goal: string;
+    reviewContract?: ReviewContract;
     repoSummary?: string;
     currentPlan?: string;
     selectedFiles?: Array<{
@@ -66,6 +86,12 @@ export type KyosoFinding = {
     title: string;
     evidence: string;
     recommendation: string;
+    disposition: FindingDisposition;
+    changeRelation: ChangeRelation;
+    evidenceQuality: EvidenceQuality;
+    evidenceRefs: EvidenceRef[];
+    policyReasons: string[];
+    fingerprint: string;
     files?: Array<{
         path: string;
         lineStart?: number;
@@ -82,6 +108,8 @@ export type KyosoFinding = {
     };
 };
 export type CisaSecureByDesignResult = {
+    gateEnabled: boolean;
+    enabledDimensions: CisaDimension[];
     customerSecurityOutcomes: GateStatus;
     secureByDefault: GateStatus;
     transparencyAndAccountability: GateStatus;
@@ -91,6 +119,17 @@ export type CisaSecureByDesignResult = {
 export type AgentName = "codex" | "claude";
 export type AgentRole = "implementation_reviewer" | "architecture_security_reviewer" | "combined_reviewer" | "finding_verifier";
 export type ReviewMode = "multi_agent" | "single_agent";
+export type ReviewCoverage = {
+    requiredLenses: ReviewLens[];
+    attemptedLenses: ReviewLens[];
+    missingLenses: Array<{
+        lens: ReviewLens;
+        reason: string;
+    }>;
+    requiredPerspectives: AgentRole[];
+    completedPerspectives: AgentRole[];
+    independentReview: boolean;
+};
 export type NormalizedAgentOpinion = {
     agent: AgentName;
     role: string;
@@ -101,6 +140,10 @@ export type NormalizedAgentOpinion = {
         title: string;
         evidence: string;
         recommendation: string;
+        disposition?: FindingDisposition;
+        changeRelation?: ChangeRelation;
+        evidenceQuality?: EvidenceQuality;
+        evidenceRefs?: EvidenceRef[];
         files?: Array<{
             path: string;
             lineStart?: number;
@@ -202,6 +245,7 @@ export type KyosoResult = {
     degraded: boolean;
     agentsUsed: AgentName[];
     reviewMode: ReviewMode;
+    coverage: ReviewCoverage;
     verificationMode?: "cross_agent" | "skipped_single_agent";
     summaryMarkdown: string;
     findings: KyosoFinding[];
@@ -217,6 +261,7 @@ export type KyosoResult = {
     crossModelAnalysis?: CrossModelAnalysis;
     testsToAdd: string[];
     residualRisks: string[];
+    openQuestions: string[];
     agentOpinions: Array<{
         agent: AgentName;
         role: string;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { defineConfig } from "./config/defineConfig.js";
 export { runReview } from "./core/runReview.js";
-export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewExecutionBudget, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";
+export type { ChangeRelation, CisaSecureByDesignResult, EvidenceQuality, EvidenceRef, FindingDisposition, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewContract, ReviewCoverage, ReviewExecutionBudget, ReviewLens, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";