@kyo-so/cli 0.11.0 → 0.13.0

package/dist/cli/knownSkillDigests.d.ts

@@ -1,5 +1,12 @@
-export declare const CURRENT_SKILL_DIGEST = "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
+export declare const CURRENT_SKILL_DIGEST = "sha256:8654e68ea61f2acea29027056802bf627ad737f084c9a86ab052946943538409";
 export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
+    readonly "0.11.0": readonly [{
+        readonly digest: "sha256:110dd872a3d1c8a71474a0eadb226f51a6addd86f9d4f3ed17b73678b3179a4e";
+        readonly kind: "historical";
+    }, {
+        readonly digest: "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
+        readonly kind: "historical";
+    }];
     readonly "0.8.0": readonly [{
         readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";
         readonly kind: "historical";

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.4.0";
+        readonly pluginVersion: "0.6.0";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
+        readonly mcpPackagePin: "@kyo-so/cli@0.12.0";
     };
     readonly marketplace: {
         readonly name: "kyoso";
@@ -50,7 +50,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
-            readonly toolTimeoutSec: 360;
+            readonly toolTimeoutSec: 2160;
         };
         readonly pluginOverride: {
             readonly enabled: false;
@@ -59,7 +59,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
-            readonly toolTimeoutSec: 360;
+            readonly toolTimeoutSec: 2160;
         };
         readonly manualOverride: {
             readonly enabled: true;
@@ -130,9 +130,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.4.0";
+            readonly pluginVersion: "0.6.0";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
+            readonly mcpPackagePin: "@kyo-so/cli@0.12.0";
         };
         readonly marketplace: {
             readonly name: "kyoso";
@@ -170,7 +170,7 @@ export declare const pluginRuntimeContract: {
                 readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
-                readonly toolTimeoutSec: 360;
+                readonly toolTimeoutSec: 2160;
             };
             readonly pluginOverride: {
                 readonly enabled: false;
@@ -179,7 +179,7 @@ export declare const pluginRuntimeContract: {
                 readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
-                readonly toolTimeoutSec: 360;
+                readonly toolTimeoutSec: 2160;
             };
             readonly manualOverride: {
                 readonly enabled: true;

package/dist/config/schema.d.ts

@@ -11,12 +11,31 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         mcp: z.ZodBoolean;
         cli: z.ZodBoolean;
     }, z.core.$strip>;
-    firstClassClient: z.ZodString;
+    firstClassClient: z.ZodLiteral<"codex">;
     tools: z.ZodObject<{
         planReview: z.ZodBoolean;
         securityReview: z.ZodBoolean;
         diffReview: z.ZodBoolean;
     }, z.core.$strip>;
+    reviewPolicy: z.ZodObject<{
+        additionalLenses: z.ZodArray<z.ZodEnum<{
+            correctness: "correctness";
+            regression: "regression";
+            security_boundaries: "security_boundaries";
+            secrets_and_injection: "secrets_and_injection";
+            data_integrity: "data_integrity";
+            public_contract: "public_contract";
+            supply_chain: "supply_chain";
+            privacy: "privacy";
+            resource_amplification: "resource_amplification";
+            architecture: "architecture";
+            performance: "performance";
+            tests: "tests";
+            documentation: "documentation";
+            maintainability: "maintainability";
+        }>>;
+        multiAgentRequired: z.ZodBoolean;
+    }, z.core.$strip>;
     agents: z.ZodObject<{
         codex: z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -71,7 +90,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     workspace: z.ZodObject<{
         mode: z.ZodLiteral<"temp_snapshot">;
         root: z.ZodString;
-        readOnly: z.ZodBoolean;
+        readOnly: z.ZodLiteral<true>;
         maxContextBytes: z.ZodNumber;
         maxDiffBytes: z.ZodNumber;
         deny: z.ZodArray<z.ZodString>;
@@ -89,7 +108,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         allowUnrestricted: z.ZodBoolean;
         warnOnUnrestricted: z.ZodBoolean;
         mediatedWeb: z.ZodObject<{
-            enabled: z.ZodBoolean;
+            enabled: z.ZodLiteral<false>;
         }, z.core.$strip>;
     }, z.core.$strip>;
     securityReview: z.ZodObject<{
@@ -126,6 +145,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     reviewBudget: z.ZodObject<{
         maxModelCalls: z.ZodNumber;
         maxTotalWallTimeMs: z.ZodNumber;
+        warnAgentOutputBytes: z.ZodNumber;
         maxAgentOutputBytes: z.ZodNumber;
         maxFindingsPerAgent: z.ZodNumber;
         skipOptionalPhasesWhenTokenUsageUnknown: z.ZodBoolean;
@@ -135,7 +155,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         format: z.ZodLiteral<"jsonl">;
         directory: z.ZodString;
         includeRawAgentOutput: z.ZodBoolean;
-        includeFileContents: z.ZodBoolean;
+        includeFileContents: z.ZodLiteral<false>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export declare const kyosoConfigKnownLeafPaths: string[];

package/dist/core/constants.d.ts

@@ -1,9 +1,10 @@
-export declare const DEFAULT_AGENT_TIMEOUT_MS = 120000;
+export declare const DEFAULT_AGENT_TIMEOUT_MS = 600000;
 export declare const DEFAULT_MAX_CONTEXT_BYTES = 500000;
 export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
+export declare const DEFAULT_WARN_AGENT_OUTPUT_BYTES = 524288;
 export declare const MAX_AGENT_OUTPUT_BYTES = 1048576;
 export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.11.0";
+export declare const KYOSO_VERSION = "0.13.0";

package/dist/core/findingAdmission.d.ts

@@ -0,0 +1,10 @@
+import type { EvidenceRef, KyosoFinding, KyosoReviewRequest, ReviewMode, ReviewTool } from "./types.js";
+export declare function admitFindings(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    findings: KyosoFinding[];
+    reviewMode: ReviewMode;
+}): KyosoFinding[];
+export declare function selectRegressionTests(tests: string[]): string[];
+export declare function buildAdmissionOpenQuestions(findings: KyosoFinding[]): string[];
+export declare function findingFingerprint(finding: Pick<KyosoFinding, "category" | "title">, evidenceRefs: EvidenceRef[]): string;

package/dist/core/modelExecutionIdentity.d.ts

@@ -0,0 +1,9 @@
+import type { ModelExecutionIdentity, ModelProviderRoute } from "./types.js";
+export declare const MODEL_EXECUTION_IDENTITY_MAX_CHARS = 160;
+export declare function createModelExecutionIdentity(input: {
+    providerRoute: ModelProviderRoute;
+    requestedModel?: unknown;
+    reportedProvider?: unknown;
+    reportedModel?: unknown;
+}): ModelExecutionIdentity;
+export declare function normalizeModelExecutionIdentity(value: unknown): ModelExecutionIdentity | undefined;

package/dist/core/requestFingerprint.d.ts

@@ -1,11 +1,12 @@
 import type { KyosoConfig } from "../config/schema.js";
-import type { AgentRole, KyosoReviewRequest, ReviewBudget, ReviewTool } from "./types.js";
-export declare const REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+import type { AgentRole, KyosoReviewRequest, ResolvedReviewBudget, ReviewTool } from "./types.js";
+export declare const REVIEW_CONTRACT_VERSION = "2026-07-16-v3";
 export declare function createRequestFingerprint(input: {
     tool: ReviewTool;
     request: KyosoReviewRequest;
     config: KyosoConfig;
     roles: Partial<Record<"codex" | "claude", AgentRole>>;
-    budget: ReviewBudget;
+    budget: ResolvedReviewBudget;
+    entrypoint?: "cli" | "mcp" | "core";
 }): string;
 export declare function canonicalJson(value: unknown): string;

package/dist/core/reviewBudget.d.ts

@@ -1,4 +1,4 @@
-import type { AgentName, ModelCallKind, ModelTokenUsage, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewCompletionReason, ReviewExecutionBudget, ReviewModelCallAudit } from "./types.js";
+import type { AgentName, ModelExecutionIdentity, ModelCallKind, ModelTokenUsage, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewCompletionReason, ReviewExecutionBudget, ReviewModelCallPlan, ReviewModelCallAudit, ResolvedReviewBudget } from "./types.js";
 type ReservationStatus = "reserved" | "started" | "completed" | "skipped";
 type Reservation = {
     id: number;
@@ -6,24 +6,39 @@ type Reservation = {
     agent?: AgentName;
     status: ReservationStatus;
     reason?: string;
+    messageBytes?: number;
+    thoughtBytes?: number;
     outputBytes?: number;
+    outputWarningTriggered?: boolean;
+    salvaged?: boolean;
+    reportedFindings?: number;
+    findingsTargetExceeded?: boolean;
     usage?: ModelTokenUsage;
+    executionIdentity?: ModelExecutionIdentity;
     stopReason?: string;
 };
 export type ModelCallReservation = Pick<Reservation, "id" | "kind" | "agent">;
 export type BudgetReservationFailure = {
     reason: "model_call_budget" | "deadline";
 };
-export declare function resolveReviewBudget(ceiling: ReviewBudget, requested: ReviewBudgetRequest | undefined): ReviewBudget;
+export declare function resolveReviewBudget(ceiling: ReviewBudget, requested: ReviewBudgetRequest | undefined): ResolvedReviewBudget;
+export declare function buildReviewModelCallPlan(input: {
+    maxModelCalls: number;
+    requiredPrimaryCalls: number;
+    verificationEnabled: boolean;
+    verificationMaxFindings: number;
+    llmJudgeAvailable: boolean;
+}): ReviewModelCallPlan;
 export declare class ReviewBudgetTracker {
-    readonly budget: ReviewBudget;
+    readonly budget: ResolvedReviewBudget;
     readonly startedAtEpochMs: number;
+    readonly modelCallPlan: ReviewModelCallPlan;
     readonly deadlineAtEpochMs: number;
     private readonly reservations;
     private readonly skippedCalls;
     private readonly incompleteReasons;
     private nextReservationId;
-    constructor(budget: ReviewBudget, startedAtEpochMs?: number);
+    constructor(budget: ResolvedReviewBudget, startedAtEpochMs?: number, modelCallPlan?: ReviewModelCallPlan);
     remainingWallTimeMs(now?: number): number;
     hasDeadlineExpired(now?: number): boolean;
     reserveMany(inputs: Array<{
@@ -42,11 +57,19 @@ export declare class ReviewBudgetTracker {
     } | {
         failure: BudgetReservationFailure;
     };
-    markStarted(reservation: ModelCallReservation): void;
+    markStarted(reservation: ModelCallReservation, executionIdentity?: ModelExecutionIdentity): void;
     hasStarted(reservation: ModelCallReservation): boolean;
+    executionIdentity(reservation: ModelCallReservation): ModelExecutionIdentity | undefined;
     complete(reservation: ModelCallReservation, values?: {
+        messageBytes?: number;
+        thoughtBytes?: number;
         outputBytes?: number;
+        outputWarningTriggered?: boolean;
+        salvaged?: boolean;
+        reportedFindings?: number;
+        findingsTargetExceeded?: boolean;
         usage?: ModelTokenUsage;
+        executionIdentity?: ModelExecutionIdentity;
         stopReason?: string;
     }): void;
     skip(reservation: ModelCallReservation, reason: string): void;

package/dist/core/reviewPolicy.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRole, AgentRunResult, KyosoReviewRequest, ReviewCoverage, ReviewLens } from "./types.js";
+export declare const REVIEW_LENSES: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract", "supply_chain", "privacy", "resource_amplification", "architecture", "performance", "tests", "documentation", "maintainability"];
+export declare const BUILT_IN_SAFETY_FLOOR: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract"];
+export declare const REQUIRED_REVIEW_PERSPECTIVES: AgentRole[];
+export declare function isReviewLens(value: unknown): value is ReviewLens;
+export declare function resolveRequiredLenses(request: KyosoReviewRequest, additionalLenses?: ReviewLens[]): ReviewLens[];
+export declare function buildReviewCoverage(input: {
+    request: KyosoReviewRequest;
+    additionalLenses?: ReviewLens[];
+    agentResults: AgentRunResult[];
+}): ReviewCoverage;
+export declare function isCoverageIncomplete(coverage: ReviewCoverage, options: {
+    multiAgentRequired: boolean;
+}): boolean;
+export declare function unavailableReviewCoverage(request: KyosoReviewRequest, reason: string, additionalLenses?: ReviewLens[]): ReviewCoverage;
+export declare function renderTrustedReviewContract(request: KyosoReviewRequest, requiredLenses?: ReviewLens[]): string;

package/dist/core/runReview.d.ts

@@ -10,6 +10,7 @@ export type RunReviewOptions = LoadConfigOptions & {
     agentManager?: AcpAgentManager;
     env?: NodeJS.ProcessEnv;
     mcpNetworkMode?: NetworkMode;
+    entrypoint?: "cli" | "mcp" | "core";
     traceWriterFactory?: (options: TraceWriterOptions) => TraceWriter;
 };
 export declare function runReview(tool: ReviewTool, request: KyosoReviewRequest, options?: RunReviewOptions): Promise<KyosoResult>;

package/dist/core/types.d.ts

@@ -4,14 +4,37 @@ export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
 export type NetworkMode = "model_only" | "unrestricted";
 export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type ReviewLens = "correctness" | "regression" | "security_boundaries" | "secrets_and_injection" | "data_integrity" | "public_contract" | "supply_chain" | "privacy" | "resource_amplification" | "architecture" | "performance" | "tests" | "documentation" | "maintainability";
+export type ReviewContract = {
+    focus?: ReviewLens[];
+    nonGoals?: string[];
+    acceptedRisks?: Array<{
+        findingFingerprint: string;
+        rationale: string;
+    }>;
+};
+export type FindingDisposition = "gate" | "actionable" | "advisory" | "disputed";
+export type ChangeRelation = "introduced" | "worsened" | "pre_existing" | "unknown";
+export type EvidenceQuality = "concrete" | "partial" | "insufficient";
+export type EvidenceRef = {
+    kind: "file" | "diff_hunk" | "plan_clause";
+    path?: string;
+    lineStart?: number;
+    lineEnd?: number;
+    label?: string;
+};
 export type ReviewBudget = {
     maxModelCalls: number;
     maxTotalWallTimeMs: number;
+    warnAgentOutputBytes: number;
     maxAgentOutputBytes: number;
     maxFindingsPerAgent: number;
     skipOptionalPhasesWhenTokenUsageUnknown: boolean;
 };
-export type ReviewBudgetRequest = Partial<ReviewBudget>;
+export type ReviewBudgetRequest = Partial<Omit<ReviewBudget, "warnAgentOutputBytes">>;
+export type ResolvedReviewBudget = ReviewBudget & {
+    effectiveWarnAgentOutputBytes?: number;
+};
 export type ReviewCompletionReason = "model_call_budget" | "deadline" | "agent_output_limit" | "token_usage_unknown" | "coverage_incomplete" | "disputed_finding";
 export type ReviewCompletion = {
     status: "complete" | "incomplete";
@@ -19,6 +42,26 @@ export type ReviewCompletion = {
     retryable: false;
 };
 export type ModelCallKind = "primary" | "verifier" | "judge";
+export type ModelProviderRoute = "codex_default" | "claude_default" | "openrouter" | "openai" | "anthropic";
+export type ModelExecutionIdentity = {
+    providerRoute: ModelProviderRoute;
+    requestedModel?: string;
+    reportedProvider?: string;
+    reportedModel?: string;
+    reportingStatus: "reported" | "requested_only" | "unknown";
+};
+export type ReviewModelCallPlan = {
+    requiredPrimaryCalls: number;
+    potentialVerifierCalls: number;
+    potentialJudgeCalls: number;
+    potentialTotalCalls: number;
+    ceilingEffects: Array<{
+        kind: ModelCallKind;
+        action: "skip" | "deterministic_fallback";
+        calls: number;
+        reason: "model_call_budget";
+    }>;
+};
 export type ModelTokenUsage = {
     totalTokens?: number;
     inputTokens?: number;
@@ -31,6 +74,7 @@ export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss
 export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
 export type KyosoReviewRequest = {
     goal: string;
+    reviewContract?: ReviewContract;
     repoSummary?: string;
     currentPlan?: string;
     selectedFiles?: Array<{
@@ -66,6 +110,12 @@ export type KyosoFinding = {
     title: string;
     evidence: string;
     recommendation: string;
+    disposition: FindingDisposition;
+    changeRelation: ChangeRelation;
+    evidenceQuality: EvidenceQuality;
+    evidenceRefs: EvidenceRef[];
+    policyReasons: string[];
+    fingerprint: string;
     files?: Array<{
         path: string;
         lineStart?: number;
@@ -82,6 +132,8 @@ export type KyosoFinding = {
     };
 };
 export type CisaSecureByDesignResult = {
+    gateEnabled: boolean;
+    enabledDimensions: CisaDimension[];
     customerSecurityOutcomes: GateStatus;
     secureByDefault: GateStatus;
     transparencyAndAccountability: GateStatus;
@@ -91,6 +143,17 @@ export type CisaSecureByDesignResult = {
 export type AgentName = "codex" | "claude";
 export type AgentRole = "implementation_reviewer" | "architecture_security_reviewer" | "combined_reviewer" | "finding_verifier";
 export type ReviewMode = "multi_agent" | "single_agent";
+export type ReviewCoverage = {
+    requiredLenses: ReviewLens[];
+    attemptedLenses: ReviewLens[];
+    missingLenses: Array<{
+        lens: ReviewLens;
+        reason: string;
+    }>;
+    requiredPerspectives: AgentRole[];
+    completedPerspectives: AgentRole[];
+    independentReview: boolean;
+};
 export type NormalizedAgentOpinion = {
     agent: AgentName;
     role: string;
@@ -101,6 +164,10 @@ export type NormalizedAgentOpinion = {
         title: string;
         evidence: string;
         recommendation: string;
+        disposition?: FindingDisposition;
+        changeRelation?: ChangeRelation;
+        evidenceQuality?: EvidenceQuality;
+        evidenceRefs?: EvidenceRef[];
         files?: Array<{
             path: string;
             lineStart?: number;
@@ -135,9 +202,10 @@ export type AgentRunInput = {
     workspaceDir: string;
     timeoutMs: number;
     deadlineAtEpochMs?: number;
+    warnOutputBytes?: number;
     maxOutputBytes?: number;
     networkMode: NetworkMode;
-    onStarted?: (() => void) | (() => Promise<void>);
+    onStarted?: (executionIdentity?: ModelExecutionIdentity) => unknown;
 };
 export type AgentRunResult = {
     agent: AgentName;
@@ -152,13 +220,21 @@ export type AgentRunResult = {
     };
     warnings?: string[];
     usage?: ModelTokenUsage;
+    executionIdentity?: ModelExecutionIdentity;
+    messageBytes?: number;
+    thoughtBytes?: number;
     outputBytes?: number;
+    outputWarningTriggered?: boolean;
+    salvaged?: boolean;
+    reportedFindings?: number;
+    findingsTargetExceeded?: boolean;
     stopReason?: string;
     startedAt: string;
     completedAt?: string;
 };
 export type ReviewExecutionBudget = {
     maxModelCalls: number;
+    modelCallPlan: ReviewModelCallPlan;
     modelCalls: {
         planned: number;
         consumed: number;
@@ -174,6 +250,7 @@ export type ReviewExecutionBudget = {
         consumedMs: number;
         remainingMs: number;
     };
+    effectiveWarnAgentOutputBytes?: number;
     maxAgentOutputBytes: number;
     maxFindingsPerAgent: number;
     skipOptionalPhasesWhenTokenUsageUnknown: boolean;
@@ -190,8 +267,15 @@ export type ReviewModelCallAudit = {
     agent?: AgentName;
     status: "completed" | "skipped";
     reason?: string;
+    messageBytes?: number;
+    thoughtBytes?: number;
     outputBytes?: number;
+    outputWarningTriggered?: boolean;
+    salvaged?: boolean;
+    reportedFindings?: number;
+    findingsTargetExceeded?: boolean;
     usage?: ModelTokenUsage;
+    executionIdentity?: ModelExecutionIdentity;
     stopReason?: string;
 };
 export type KyosoResult = {
@@ -202,6 +286,7 @@ export type KyosoResult = {
     degraded: boolean;
     agentsUsed: AgentName[];
     reviewMode: ReviewMode;
+    coverage: ReviewCoverage;
     verificationMode?: "cross_agent" | "skipped_single_agent";
     summaryMarkdown: string;
     findings: KyosoFinding[];
@@ -217,12 +302,14 @@ export type KyosoResult = {
     crossModelAnalysis?: CrossModelAnalysis;
     testsToAdd: string[];
     residualRisks: string[];
+    openQuestions: string[];
     agentOpinions: Array<{
         agent: AgentName;
         role: string;
         summary: string;
         status: "completed" | "failed" | "timeout" | "skipped";
         errorCode?: string;
+        salvaged?: boolean;
         rawText?: string;
     }>;
     audit: {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { defineConfig } from "./config/defineConfig.js";
 export { runReview } from "./core/runReview.js";
-export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewExecutionBudget, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";
+export type { ChangeRelation, CisaSecureByDesignResult, EvidenceQuality, EvidenceRef, FindingDisposition, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelExecutionIdentity, ModelProviderRoute, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewContract, ReviewCoverage, ReviewExecutionBudget, ReviewLens, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";