@kyo-so/cli 0.14.0 → 0.15.1

package/CHANGELOG.md

@@ -7,6 +7,67 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.1] - 2026-07-24
+
+### Fixed
+
+- Restore Claude Code authentication for Marketplace Plugin launches by
+  explicitly forwarding optional `ANTHROPIC_API_KEY`,
+  `CLAUDE_CODE_OAUTH_TOKEN`, and `OPENROUTER_API_KEY` placeholders into the MCP
+  subprocess.
+- Run the exact published first-party CLI smoke before Safe-chain CI shims are
+  installed, preventing wrapper metadata notices from contaminating MCP NDJSON.
+
+### Changed
+
+- Promote the Marketplace Plugin to `0.7.5` while retaining
+  `@kyo-so/cli@0.15.0` in its Codex and Claude Code MCP definitions and Skill
+  fallbacks.
+- Allow Plugin-only promotion to retain the current CLI pin while rejecting a
+  pin rollback and preserving exact published-CLI runtime verification.
+- Update the default ACP adapters to
+  `@agentclientprotocol/codex-acp@1.1.5` and
+  `@agentclientprotocol/claude-agent-acp@0.60.0`.
+- Update CI and development dependencies to `actions/setup-node@v7`,
+  `@aikidosec/safe-chain@1.5.13`, and `prettier@3.9.6`.
+
+## [0.15.0] - 2026-07-21
+
+### Added
+
+- Add `agents.codex.openRouter` retry configuration for OpenRouter Codex
+  reviews. It maps idle timeout, stream retries, and request retries to the
+  fixed provider preset without changing omitted Codex runtime defaults.
+- Record observed ACP stream retries, discarded retry-message bytes, and ACP
+  output timestamps in model-call audit records and JSONL trace events.
+- Add typed core review-progress events, bounded non-blocking progress delivery,
+  CLI stderr renderers (`auto`, `plain`, `jsonl`, and `off`), and graceful
+  SIGINT cancellation through primary and verifier ACP subprocesses.
+- Add MCP `notifications/progress` support when a client provides a
+  `progressToken`, with per-request monotonic sequences and fixed-field messages.
+  Whether progress is displayed remains client-dependent.
+- Propagate MCP cancellation through primary and verification ACP subprocesses
+  and in-flight OpenAI or Anthropic judge calls without converting cancellation
+  into a normal result or judge fallback.
+- Add a release-gated mock Responses SSE integration suite for the pinned Codex
+  ACP adapter, covering stream retries and exhaustion without credentials or an
+  externally configurable provider base URL.
+
+### Fixed
+
+- Prevent incomplete Codex message chunks from leaking into final agent output
+  after a structured stream retry, while retaining full wire-byte accounting
+  and output-limit enforcement.
+- Bound retry-progress trace writes per primary agent and preserve retry
+  metrics when an output cap stops a session.
+- Treat a terminal Codex ACP system error as a failed agent result even when
+  the adapter returns an ACP `end_turn` response.
+
+### Changed
+
+- Promote the Marketplace Plugin to `0.7.3` and pin its Codex and Claude Code
+  MCP definitions and Skill fallbacks to `@kyo-so/cli@0.14.0`.
+
 ## [0.14.0] - 2026-07-19
 
 ### Changed

package/README.ja.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner の実行経路では、package と executable を必ず別指定します: `npx -y --package=@kyo-so/cli kyoso` と `bunx --package @kyo-so/cli kyoso` です。workflowで固定する場合は、`@kyo-so/cli@0.13.1` のようにpackage名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応) で、インストールされる CLI コマンドは短い `kyoso` です。
+package-runner の実行経路では、package と executable を必ず別指定します: `npx -y --package=@kyo-so/cli kyoso` と `bunx --package @kyo-so/cli kyoso` です。workflowで固定する場合は、`@kyo-so/cli@0.15.0` のようにpackage名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応) で、インストールされる CLI コマンドは短い `kyoso` です。
 
 Bun fallback は Bun `1.3.14` で検証済みです。古い Bun では npx 形式またはインストール済みの `kyoso` を使い、複数bin packageからの Bun のbinary推論に依存しないでください。
 
@@ -170,6 +170,23 @@ kyoso setup codex --write --skill-only
 kyoso setup claude-code --write --skill-only
 ```
 
+### Progress and cancellation
+
+review の結果は常に stdout を使用します。既定では Markdown、`--json` では JSON です。進捗と error は stderr を使用するため、structured output は pipe-safe のままです。
+
+```bash
+kyoso plan --goal "Review this plan" --plan plan.md --json --progress jsonl \
+  >result.json 2>progress.jsonl
+```
+
+`--progress auto|plain|jsonl|off` の既定は `auto` で、stderr が TTY の場合だけ plain の行単位進捗を表示します。`plain` は human-readable な stderr 出力を強制し、`jsonl` は stderr 1行につき typed event を1つ出力し、`off` は進捗を抑止します。進捗には prompt、選択した file の内容、diff、model の message / thought テキストを含めません。
+
+Ctrl-C を1回押すと、review とその ACP child agents の graceful cancellation を要求し、Kyoso は cleanup 後に status 130 で終了します。2回目で即時終了します。
+
+MCP tools では、client が request metadata に `progressToken` を渡した場合だけ `notifications/progress` を送信します。sequence は request ごとに単調増加し、review の作業量は動的なため `total` は送りません。Kyoso は client が要求した場合に MCP progress notification を送信しますが、進捗を表示するかどうかは MCP client 側が制御します。
+
+MCP の `notifications/cancelled` は、primary と verification の ACP subprocess、実行中の LLM judge を含めて review を中断します。cancel された tool call は通常の review result へ変換されません。MCP の stdout は JSON-RPC 専用のままです。
+
 ## Usage Examples
 
 選択したコードと一緒に implementation plan をレビューします。
@@ -293,7 +310,7 @@ Kyoso は次の順に config を load します。
 
 未知の key は拒否されます。boolean / numeric config keys は schema の型へ変換し、string keys は文字列のまま保持した後、config 全体を再検証します。
 
-Project `kyoso.toml` は declarative で、trust approval は不要です。agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、user global authorization後のCodex専用`provider`または継承したOpenRouterのmodel上書き、workspace byte limits と additive `workspace.deny`、verification settings、advisory judge settings、tightening-only security/network/CISA settings を設定できます。
+Project `kyoso.toml` は declarative で、trust approval は不要です。agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、user global authorization後のCodex専用`provider`、継承したOpenRouterのmodel上書きまたはretry-policy上書き、workspace byte limits と additive `workspace.deny`、verification settings、advisory judge settings、tightening-only security/network/CISA settings を設定できます。
 
 `entrypoints.*`、`tools.*`、`reviewPolicy.*` は user-global policy です。entrypoint または tool が disabled の場合、agents の起動前に structured policy block を返します。`firstClassClient = "codex"`、`workspace.readOnly = true`、`network.mediatedWeb.enabled = false`、`audit.includeFileContents = false` は fixed / reserved value であり、未対応値は no-op にせず拒否します。
 
@@ -312,7 +329,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codexには`agents.codex.provider`もあり、`"openrouter"`はexternal providerを選択し、`"default"`は継承したOpenRouter選択を通常のCodex behaviorへ戻します。Claudeにprovider設定はありません。projectから`provider`を選択するには、global config専用の`agents.codex.allowProjectProvider` allowlistが必要です。詳細な規則は [Codex の OpenRouter project opt-in](#codex-の-openrouter-project-opt-in) を参照してください。`command` / `args` / `env`もglobal config専用です([Files and precedence](#files-and-precedence) を参照)。
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codexには`agents.codex.provider`もあり、`"openrouter"`はexternal providerを選択し、`"default"`は継承したOpenRouter選択を通常のCodex behaviorへ戻します。Claudeにprovider設定はありません。`agents.codex.openRouter.streamIdleTimeoutMs`、`streamMaxRetries`、`requestMaxRetries`は、選択したOpenRouter transportだけを設定します。projectから`provider`を選択、またはそのretry policyを変更するには、global config専用の`agents.codex.allowProjectProvider` allowlistが必要です。詳細な規則は [Codex の OpenRouter project opt-in](#codex-の-openrouter-project-opt-in) を参照してください。`command` / `args` / `env`もglobal config専用です([Files and precedence](#files-and-precedence) を参照)。
 
 `agents.<name>.model` または `agents.<name>.effort` を省略すると、各 agent 独自の default を使用します。Codex は `~/.codex/config.toml`（`CODEX_HOME`を設定している場合は`$CODEX_HOME/config.toml`）などの local Codex config を使用し、Claude は adapter default を使用します。
 
@@ -352,13 +369,20 @@ allowProjectProvider = ["/absolute/path/to/project"]
 [agents.codex]
 provider = "openrouter"
 model = "openai/o4-mini"
+
+[agents.codex.openRouter]
+streamIdleTimeoutMs = 90000
+streamMaxRetries = 3
+requestMaxRetries = 2
 ```
 
 `provider = "openrouter"` の場合、`model`は空白でない値が必須です。これはOpenRouterのmodel IDです。Kyosoはcatalogやtool calling対応を検証しないため、利用するmodelのtool supportはproviderで確認してください。
 
-`allowProjectProvider`はprojectの`provider`と、OpenRouterを継承中のproject `model`上書きに必要で、listには解決後のproject config fileを含むcanonical directoryのabsolute pathを完全一致で指定します。invocationのcwdやlexical pathではありません。descendantやglobには一致しません。trusted `kyoso.config.ts`を含むproject config fileとallowlist entryの両方をsymlink経由も含めて同じdirectoryのreal pathへ解決して比較するため、そのdirectoryへ解決されるentryは一致し、別の場所へ解決されるentryまたは解決できないpathはfail closedです。user globalの`provider = "openrouter"`にはallowlist entryは不要です。CLIで選択する場合は、同一 invocation に`--set agents.codex.provider=openrouter`と`--set agents.codex.model=<model>`の両方が必要であり、project modelで前者を補完することはできません。`allowProjectProvider`は`--set` pathではなく、legacy boolean値は拒否されます。
+`agents.codex.openRouter` は experimental です。`streamIdleTimeoutMs` は `1000` 以上の整数、`streamMaxRetries` と `requestMaxRetries` は `0` から `100` の整数で、`0` はそのretry classを無効化します。これらのfieldには `provider = "openrouter"` が必須で、省略したfieldは対応するCodex runtime defaultsを変更しません。retryはCodex turnのbyte単位のresumeではなく未完了turnの再生成であり、retry前のpartial outputは破棄され最終結果には決して含まれません。
+
+`allowProjectProvider`はprojectの`provider`、OpenRouterを継承中のproject `model`上書き、OpenRouterを継承中のproject `agents.codex.openRouter.*`上書きに必要で、listには解決後のproject config fileを含むcanonical directoryのabsolute pathを完全一致で指定します。invocationのcwdやlexical pathではありません。descendantやglobには一致しません。trusted `kyoso.config.ts`を含むproject config fileとallowlist entryの両方をsymlink経由も含めて同じdirectoryのreal pathへ解決して比較するため、そのdirectoryへ解決されるentryは一致し、別の場所へ解決されるentryまたは解決できないpathはfail closedです。user globalの`provider = "openrouter"`にはallowlist entryは不要です。CLIで選択する場合は、同一 invocation に`--set agents.codex.provider=openrouter`と`--set agents.codex.model=<model>`の両方が必要であり、project modelで前者を補完することはできません。`allowProjectProvider`は`--set` pathではなく、legacy boolean値は拒否されます。
 
-user global configがOpenRouterを選択している場合、projectは`provider = "default"`で明示的にopt-outできます。このresetにはmodelもauthorizationも不要で、同じlayerで通常のCodex modelを明示しない限り継承したOpenRouter modelも消去し、そのprojectではOpenRouter keyをforwardしません。
+user global configがOpenRouterを選択している場合、projectは`provider = "default"`で明示的にopt-outできます。このresetにはmodelもauthorizationも不要で、同じlayerで通常のCodex modelを明示しない限り継承したOpenRouter modelも消去し、継承したOpenRouter retry policyも消去し、そのprojectではOpenRouter keyをforwardしません。同じreset layerにあるretry policyは`provider = "openrouter"`を要求するため引き続きinvalidです。
 
 Kyosoを起動するCodexまたはClaude client processのenvironmentにkeyを設定します。直接のenvironment variableをprimary pathとし、1Passwordなどのsecret managerはoptionalでKyosoの依存ではありません。
 
@@ -372,7 +396,7 @@ Marketplace PluginはMCP processへ`OPENROUTER_API_KEY`の変数名を公開し
 
 新規manual MCP registrationは既定で`OPENROUTER_API_KEY`を含めません。providerを意図して選択した後だけ`--with-openrouter`で追加し、既存registrationは書換えません。`kyoso setup ... --with-openrouter` の出力と手動セットアップ例は、引き続き利用者が管理するクライアント登録テンプレートです。Claude Code registrationの`${OPENROUTER_API_KEY}`はclientが展開する必要があり、Kyosoは`${NAME}`、`$NAME`、`%NAME%`（前後の空白は許容）だけから成る未展開credential placeholderだけを無視し、変数名だけを含むsanitized warningを出します。ほかの文字列を含む値は維持します。custom credential-like nameの末尾が`_KEY`、`_TOKEN`、`_SECRET`、`_PASSWORD`である場合にも同じ規則を適用し、credentialではないtemplateは維持されます。
 
-このuser-authorized project-scoped opt-inを推奨します。global `provider = "openrouter"`は、projectが`provider = "default"`を設定するまで継承されます。`provider`の省略だけでは解除されません。固定のOpenRouter Responses API presetはbetaです。custom endpoint、provider routing、fallback、judge integrationは公開しません。keyをこのpresetに束縛するため、OpenRouter modeではtop-levelの`profile`または`profiles`を含む`CODEX_CONFIG`と、objectではない`model_providers` valueをchild起動前に拒否します。objectの場合は`model_providers`を固定の`kyoso-openrouter` entryだけに置換し、破棄したentry数だけを含むsanitized warningを出します。provider IDやconfig valueは出力しません。拒否するfield以外では、`model`、`model_provider`、`model_providers`以外のunrelatedな`CODEX_CONFIG` fieldを維持するため、foreign provider configurationがkey付きのendpointを選択することはできません。Claudeは設定済みproviderのままで、judgeは`OPENROUTER_API_KEY`を使用しません。
+このuser-authorized project-scoped opt-inを推奨します。global `provider = "openrouter"`は、projectが`provider = "default"`を設定するまで継承されます。`provider`の省略だけでは解除されません。固定のOpenRouter Responses API presetはbetaです。custom endpoint、provider routing、fallback、judge integrationは公開しません。設定した場合、`streamIdleTimeoutMs`、`streamMaxRetries`、`requestMaxRetries`は`stream_idle_timeout_ms`、`stream_max_retries`、`request_max_retries`だけへmappingされ、省略したfieldは`CODEX_CONFIG`に現れません。keyをこのpresetに束縛するため、OpenRouter modeではtop-levelの`profile`または`profiles`を含む`CODEX_CONFIG`と、objectではない`model_providers` valueをchild起動前に拒否します。objectの場合は`model_providers`を固定の`kyoso-openrouter` entryだけに置換し、破棄したentry数だけを含むsanitized warningを出します。provider IDやconfig valueは出力しません。拒否するfield以外では、`model`、`model_provider`、`model_providers`以外のunrelatedな`CODEX_CONFIG` fieldを維持するため、foreign provider configurationがkey付きのendpointを選択することはできません。Claudeは設定済みproviderのままで、judgeは`OPENROUTER_API_KEY`を使用しません。
 
 user global authorization後、projectの`kyoso.toml`はexternal providerを選択、または継承したOpenRouter modelを上書きし、review contextをそこへ送ることがあります。untrusted repositoryでは`--ignore-config`を使用し、必要なCLI optionsだけを明示してください。
 
@@ -382,7 +406,7 @@ user global authorization後、projectの`kyoso.toml`はexternal providerを選
 KYOSO_OPENROUTER_ACP_SMOKE=release KYOSO_OPENROUTER_MODEL=<model> safe-chain bun run smoke:openrouter:codex-acp
 ```
 
-このcommandはCLI argumentsを受け付けず、pinしたCodex ACP adapterを使います。呼び出し元のrepositoryやcached Codex loginを利用しないよう、空のtemporary workspace、`HOME`、`CODEX_HOME`を新規作成し、key/modelをconfig・temporary artifact・outputへ書かずに固定の成功または失敗メッセージだけを返します。
+このcommandはCLI argumentsを受け付けず、pinしたCodex ACP adapterを使います。呼び出し元のrepositoryやcached Codex loginを利用しないよう、空のtemporary workspace、`HOME`、`CODEX_HOME`を新規作成し、key/modelをconfig・temporary artifact・outputへ書かずに固定の成功または失敗メッセージだけを返します。このcredentialed smokeはinteroperabilityだけを確認します。retryのcorrectnessはrelease専用の`KYOSO_CODEX_ACP_MOCK_SSE=1` local mock SSE integration gateがカバーします。
 
 ### Agent auth
 

package/README.md

@@ -152,7 +152,7 @@ Manual setup examples are kept in `examples/codex-config.toml` and `examples/cla
 
 ## CLI
 
-The package-runner execution paths always select the package and executable separately: `npx -y --package=@kyo-so/cli kyoso` and `bunx --package @kyo-so/cli kyoso`. Add a complete SemVer pin after the package name when a workflow needs one, for example `@kyo-so/cli@0.13.1`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), while the installed CLI command is the shorter `kyoso`.
+The package-runner execution paths always select the package and executable separately: `npx -y --package=@kyo-so/cli kyoso` and `bunx --package @kyo-so/cli kyoso`. Add a complete SemVer pin after the package name when a workflow needs one, for example `@kyo-so/cli@0.15.0`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), while the installed CLI command is the shorter `kyoso`.
 
 The Bun fallback is verified on Bun `1.3.14`. On an older Bun, use the npx form or an installed `kyoso`; do not rely on Bun inferring a binary from a multi-bin package.
 
@@ -168,6 +168,36 @@ kyoso setup codex --write --skill-only
 kyoso setup claude-code --write --skill-only
 ```
 
+### Progress and cancellation
+
+Review results always use stdout: Markdown by default and JSON with `--json`.
+Progress and errors use stderr, so structured output remains pipe-safe.
+
+```bash
+kyoso plan --goal "Review this plan" --plan plan.md --json --progress jsonl \
+  >result.json 2>progress.jsonl
+```
+
+`--progress auto|plain|jsonl|off` defaults to `auto`: it shows plain,
+line-oriented progress only when stderr is a TTY. Use `plain` to force
+human-readable stderr output, `jsonl` for one typed event per stderr line, or
+`off` to suppress progress. Progress never includes prompts, selected-file
+contents, diffs, or model message/thought text.
+
+Press Ctrl-C once to request graceful cancellation of the review and its ACP
+child agents; Kyoso exits with status 130 after cleanup. Press it a second time
+to force immediate exit.
+
+For MCP tools, Kyoso sends `notifications/progress` only when the client supplies
+a `progressToken` in request metadata. Each request receives its own monotonically
+increasing sequence and no `total`, because review work is dynamic. Kyoso supports
+MCP progress notifications when the client requests them; whether progress is
+displayed is controlled by the MCP client.
+
+An MCP `notifications/cancelled` request aborts the review, including primary and
+verification ACP subprocesses and an in-flight LLM judge. A cancelled tool call is
+not converted into a normal review result. MCP stdout remains JSON-RPC only.
+
 ## Usage Examples
 
 Review an implementation plan with selected code:
@@ -291,7 +321,7 @@ Kyoso loads config in this order:
 
 Unknown keys are rejected. Boolean and numeric config keys are converted to their schema types; string keys remain strings. The complete config is then validated.
 
-Project `kyoso.toml` is declarative and does not require trust approval. It can set safe project-scoped keys such as agent `enabled` / `model` / `effort` / `role` / `timeoutMs`, the Codex-only `provider` or a model override while OpenRouter is inherited after user-global authorization, workspace byte limits and additive `workspace.deny`, verification settings, advisory judge settings, and tightening-only security/network/CISA settings.
+Project `kyoso.toml` is declarative and does not require trust approval. It can set safe project-scoped keys such as agent `enabled` / `model` / `effort` / `role` / `timeoutMs`, the Codex-only `provider`, OpenRouter model, or retry-policy override after user-global authorization, workspace byte limits and additive `workspace.deny`, verification settings, advisory judge settings, and tightening-only security/network/CISA settings.
 
 `entrypoints.*`, `tools.*`, and `reviewPolicy.*` are user-global policy. A disabled entrypoint or tool returns a structured policy block before agents start. `firstClassClient = "codex"`, `workspace.readOnly = true`, `network.mediatedWeb.enabled = false`, and `audit.includeFileContents = false` are fixed or reserved values; unsupported values are rejected instead of acting as no-ops.
 
@@ -310,7 +340,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`. Codex also supports `agents.codex.provider`: `"openrouter"` selects the external provider, while `"default"` resets an inherited OpenRouter selection to normal Codex behavior; Claude has no provider setting. Selecting the provider from a project requires the global-config-only `agents.codex.allowProjectProvider` allowlist; see [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in) for the full rules. The `command`, `args`, and `env` keys are also global-config-only (see [Files and precedence](#files-and-precedence)).
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`. Codex also supports `agents.codex.provider`: `"openrouter"` selects the external provider, while `"default"` resets an inherited OpenRouter selection to normal Codex behavior; Claude has no provider setting. `agents.codex.openRouter.streamIdleTimeoutMs`, `streamMaxRetries`, and `requestMaxRetries` configure the selected OpenRouter transport only. Selecting the provider or changing that retry policy from a project requires the global-config-only `agents.codex.allowProjectProvider` allowlist; see [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in) for the full rules. The `command`, `args`, and `env` keys are also global-config-only (see [Files and precedence](#files-and-precedence)).
 
 Omit `agents.<name>.model` or `agents.<name>.effort` to use each agent's own default. Codex uses the local Codex config, such as `~/.codex/config.toml` (or `$CODEX_HOME/config.toml` when `CODEX_HOME` is set); Claude uses the adapter default.
 
@@ -350,13 +380,20 @@ Then opt in only in the project that needs OpenRouter:
 [agents.codex]
 provider = "openrouter"
 model = "openai/o4-mini"
+
+[agents.codex.openRouter]
+streamIdleTimeoutMs = 90000
+streamMaxRetries = 3
+requestMaxRetries = 2
 ```
 
 `model` is required and must not be blank when `provider = "openrouter"`. It is an OpenRouter model ID; Kyoso does not validate the catalog or whether that model supports tool calling, so confirm tool support with the provider.
 
-`allowProjectProvider` applies to a project `provider` and to a project `model` override while OpenRouter is inherited; its list must contain the absolute canonical directory containing the resolved project configuration file, not the invocation cwd or a lexical path, with no descendant or glob matching. A project configuration file (including trusted `kyoso.config.ts`) and an allowlist entry that resolve through symlinks to that directory match; entries resolving elsewhere, or unresolvable paths, fail closed. A user-global `provider = "openrouter"` needs no allowlist entry. An explicit CLI pair of `--set agents.codex.provider=openrouter` and `--set agents.codex.model=<model>` in the same invocation is also allowed without it; a project model cannot supply the CLI override's model. `allowProjectProvider` is not a `--set` path and legacy boolean values are rejected.
+`agents.codex.openRouter` is experimental. `streamIdleTimeoutMs` is an integer of at least `1000`; `streamMaxRetries` and `requestMaxRetries` are integers from `0` through `100`, where `0` disables that retry class. These fields require `provider = "openrouter"`; omitting them leaves the corresponding Codex runtime defaults unchanged. Retry regenerates an unfinished Codex turn rather than resuming its bytes; pre-retry partial output is discarded and never reaches final results.
+
+`allowProjectProvider` applies to a project `provider`, a project `model` override while OpenRouter is inherited, and a project `agents.codex.openRouter.*` override while OpenRouter is inherited; its list must contain the absolute canonical directory containing the resolved project configuration file, not the invocation cwd or a lexical path, with no descendant or glob matching. A project configuration file (including trusted `kyoso.config.ts`) and an allowlist entry that resolve through symlinks to that directory match; entries resolving elsewhere, or unresolvable paths, fail closed. A user-global `provider = "openrouter"` needs no allowlist entry. An explicit CLI pair of `--set agents.codex.provider=openrouter` and `--set agents.codex.model=<model>` in the same invocation is also allowed without it; a project model cannot supply the CLI override's model. `allowProjectProvider` is not a `--set` path and legacy boolean values are rejected.
 
-When a user-global config selects OpenRouter, a project can explicitly opt out with `provider = "default"`. This reset needs neither a model nor authorization, clears the inherited OpenRouter model unless the same layer explicitly supplies a normal Codex model, and prevents OpenRouter key forwarding for that project.
+When a user-global config selects OpenRouter, a project can explicitly opt out with `provider = "default"`. This reset needs neither a model nor authorization, clears the inherited OpenRouter model unless the same layer explicitly supplies a normal Codex model, clears inherited OpenRouter retry policy, and prevents OpenRouter key forwarding for that project. A retry policy in the same reset layer remains invalid because it requires `provider = "openrouter"`.
 
 Set the key in the process environment that starts the Codex or Claude client running Kyoso. A direct environment variable is the primary path; a secret manager such as 1Password is optional and is not a Kyoso dependency:
 
@@ -370,7 +407,7 @@ The Marketplace Plugin exposes the `OPENROUTER_API_KEY` variable name to its MCP
 
 New manual MCP registrations omit `OPENROUTER_API_KEY` by default. Add it only with `--with-openrouter` after intentionally selecting the provider; existing registrations are never rewritten. The `kyoso setup ... --with-openrouter` output and the manual setup examples remain user-managed client-registration templates. In a Claude Code registration, `${OPENROUTER_API_KEY}` must be expanded by the client; Kyoso ignores only a whole unexpanded credential placeholder — `${NAME}`, `$NAME`, or `%NAME%`, with optional surrounding whitespace — and emits a sanitized warning containing only the variable name. Values with any other text are preserved. The same rule applies to custom credential-like names ending in `_KEY`, `_TOKEN`, `_SECRET`, or `_PASSWORD`; non-credential templates are preserved.
 
-Prefer this user-authorized project-scoped opt-in. A global `provider = "openrouter"` is inherited by projects until a project sets `provider = "default"`; merely omitting `provider` does not unset it. The fixed OpenRouter Responses API preset is beta; custom endpoints, provider routing, fallbacks, and judge integration are not exposed. To keep the key bound to that preset, OpenRouter mode rejects a `CODEX_CONFIG` with a top-level `profile` or `profiles` field and rejects a non-object `model_providers` value before launching the child. For an object value, it replaces `model_providers` with only the fixed `kyoso-openrouter` entry and emits a sanitized warning with the discarded-entry count only; provider IDs and configuration values never appear. Apart from those rejected fields, it preserves unrelated `CODEX_CONFIG` fields outside `model`, `model_provider`, and `model_providers`, so no foreign provider configuration can select an endpoint with the key. Claude remains on its configured provider, and the judge does not use `OPENROUTER_API_KEY`.
+Prefer this user-authorized project-scoped opt-in. A global `provider = "openrouter"` is inherited by projects until a project sets `provider = "default"`; merely omitting `provider` does not unset it. The fixed OpenRouter Responses API preset is beta; custom endpoints, provider routing, fallbacks, and judge integration are not exposed. When configured, `streamIdleTimeoutMs`, `streamMaxRetries`, and `requestMaxRetries` map only to `stream_idle_timeout_ms`, `stream_max_retries`, and `request_max_retries`; omitted fields are absent from `CODEX_CONFIG`. To keep the key bound to that preset, OpenRouter mode rejects a `CODEX_CONFIG` with a top-level `profile` or `profiles` field and rejects a non-object `model_providers` value before launching the child. For an object value, it replaces `model_providers` with only the fixed `kyoso-openrouter` entry and emits a sanitized warning with the discarded-entry count only; provider IDs and configuration values never appear. Apart from those rejected fields, it preserves unrelated `CODEX_CONFIG` fields outside `model`, `model_provider`, and `model_providers`, so no foreign provider configuration can select an endpoint with the key. Claude remains on its configured provider, and the judge does not use `OPENROUTER_API_KEY`.
 
 After user-global authorization, a project `kyoso.toml` can select the external provider or override its inherited OpenRouter model and route review context to it. For an untrusted repository, use `--ignore-config` and pass only the needed CLI options explicitly.
 
@@ -380,7 +417,7 @@ The real Codex ACP/OpenRouter smoke is release-gated and never runs in tests. On
 KYOSO_OPENROUTER_ACP_SMOKE=release KYOSO_OPENROUTER_MODEL=<model> safe-chain bun run smoke:openrouter:codex-acp
 ```
 
-It accepts no CLI arguments, uses the pinned Codex ACP adapter, and creates fresh empty temporary workspace, `HOME`, and `CODEX_HOME` directories so it cannot use the calling repository or cached Codex login. It returns only a fixed success or failure message without writing the key or model to config, temporary artifacts, or output.
+It accepts no CLI arguments, uses the pinned Codex ACP adapter, and creates fresh empty temporary workspace, `HOME`, and `CODEX_HOME` directories so it cannot use the calling repository or cached Codex login. It returns only a fixed success or failure message without writing the key or model to config, temporary artifacts, or output. This credentialed smoke checks only interoperability; retry correctness is covered by the release-only `KYOSO_CODEX_ACP_MOCK_SSE=1` local mock SSE integration gate.
 
 ### Agent auth
 

package/README.zh-CN.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner 执行路径始终分别指定 package 和 executable：`npx -y --package=@kyo-so/cli kyoso` 与 `bunx --package @kyo-so/cli kyoso`。需要固定 workflow 时，在 package 名后加 complete SemVer pin，例如 `@kyo-so/cli@0.13.1`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，安装后的 CLI command 是更短的 `kyoso`。
+package-runner 执行路径始终分别指定 package 和 executable：`npx -y --package=@kyo-so/cli kyoso` 与 `bunx --package @kyo-so/cli kyoso`。需要固定 workflow 时，在 package 名后加 complete SemVer pin，例如 `@kyo-so/cli@0.15.0`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，安装后的 CLI command 是更短的 `kyoso`。
 
 Bun fallback 已在 Bun `1.3.14` 上验证。旧版 Bun 请使用 npx 形式或已安装的 `kyoso`，不要依赖 Bun 从多 bin package 推断 binary。
 
@@ -170,6 +170,23 @@ kyoso setup codex --write --skill-only
 kyoso setup claude-code --write --skill-only
 ```
 
+### Progress and cancellation
+
+review 结果始终使用 stdout：默认是 Markdown，`--json` 时是 JSON。进度与 error 使用 stderr，因此 structured output 保持 pipe-safe。
+
+```bash
+kyoso plan --goal "Review this plan" --plan plan.md --json --progress jsonl \
+  >result.json 2>progress.jsonl
+```
+
+`--progress auto|plain|jsonl|off` 默认是 `auto`：仅当 stderr 是 TTY 时显示 plain 的按行进度。`plain` 强制 human-readable 的 stderr 输出，`jsonl` 在 stderr 每行输出一个 typed event，`off` 关闭进度。进度中绝不包含 prompt、选定 file 的内容、diff，以及 model 的 message / thought 文本。
+
+按一次 Ctrl-C 会请求 review 及其 ACP child agents 的 graceful cancellation，Kyoso 在 cleanup 后以 status 130 退出。再按一次会强制立即退出。
+
+对于 MCP tools，仅当 client 在 request metadata 中提供 `progressToken` 时，Kyoso 才发送 `notifications/progress`。每个 request 拥有独立的单调递增 sequence，且由于 review 的工作量是动态的，不发送 `total`。Kyoso 在 client 请求时支持 MCP progress notification；进度是否显示由 MCP client 控制。
+
+MCP 的 `notifications/cancelled` 会中断 review，包括 primary 与 verification 的 ACP subprocess 以及执行中的 LLM judge。被 cancel 的 tool call 不会被转换成正常的 review result。MCP 的 stdout 仍仅用于 JSON-RPC。
+
 ## Usage Examples
 
 使用选定代码 review implementation plan：
@@ -293,7 +310,7 @@ Kyoso 按以下顺序 load config：
 
 未知 key 会被拒绝。Boolean / numeric config keys 会转换为 schema 类型，string keys 保持字符串，然后重新验证完整 config。
 
-Project `kyoso.toml` 是 declarative config，不需要 trust approval。它可以设置 agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、经过 user global authorization 的 Codex `provider` 或继承 OpenRouter 时的 model 覆盖、workspace byte limits 和 additive `workspace.deny`、verification settings、advisory judge settings，以及 tightening-only security/network/CISA settings。
+Project `kyoso.toml` 是 declarative config，不需要 trust approval。它可以设置 agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、经过 user global authorization 的 Codex `provider`、继承 OpenRouter 时的 model 覆盖或 retry-policy 覆盖、workspace byte limits 和 additive `workspace.deny`、verification settings、advisory judge settings，以及 tightening-only security/network/CISA settings。
 
 `entrypoints.*`、`tools.*` 和 `reviewPolicy.*` 是 user-global policy。entrypoint 或 tool 被禁用时，Kyoso 会在启动 agents 前返回 structured policy block。`firstClassClient = "codex"`、`workspace.readOnly = true`、`network.mediatedWeb.enabled = false` 和 `audit.includeFileContents = false` 是 fixed / reserved values；不支持的值会被拒绝，而不是成为 no-op。
 
@@ -312,7 +329,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codex 还支持 `agents.codex.provider`：`"openrouter"` 选择 external provider，而 `"default"` 会将继承的 OpenRouter 选择重置为正常 Codex behavior；Claude 没有 provider 设置。从 project 选择 provider 需要只能在 global config 中设置的 `agents.codex.allowProjectProvider` allowlist；完整规则请参阅 [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in)。`command` / `args` / `env` 也只能在 global config 中设置（参见 [Files and precedence](#files-and-precedence)）。
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codex 还支持 `agents.codex.provider`：`"openrouter"` 选择 external provider，而 `"default"` 会将继承的 OpenRouter 选择重置为正常 Codex behavior；Claude 没有 provider 设置。`agents.codex.openRouter.streamIdleTimeoutMs`、`streamMaxRetries` 与 `requestMaxRetries` 仅配置所选的 OpenRouter transport。从 project 选择 provider 或更改该 retry policy 需要只能在 global config 中设置的 `agents.codex.allowProjectProvider` allowlist；完整规则请参阅 [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in)。`command` / `args` / `env` 也只能在 global config 中设置（参见 [Files and precedence](#files-and-precedence)）。
 
 省略 `agents.<name>.model` 或 `agents.<name>.effort` 时，会使用各 agent 自身的 default。Codex 使用 local Codex config，例如 `~/.codex/config.toml`（若已设置`CODEX_HOME`，则为`$CODEX_HOME/config.toml`）；Claude 使用 adapter default。
 
@@ -352,13 +369,20 @@ allowProjectProvider = ["/absolute/path/to/project"]
 [agents.codex]
 provider = "openrouter"
 model = "openai/o4-mini"
+
+[agents.codex.openRouter]
+streamIdleTimeoutMs = 90000
+streamMaxRetries = 3
+requestMaxRetries = 2
 ```
 
 当 `provider = "openrouter"` 时，`model` 必须存在且不能是空白。它是 OpenRouter model ID；Kyoso 不会 validate model catalog 或该 model 是否支持 tool calling，请向 provider 确认 tool support。
 
-`allowProjectProvider` 适用于 project `provider`，以及继承 OpenRouter 时 project 对 `model` 的覆盖；list 必须完全匹配包含已解析 project config file 的 canonical directory 的 absolute path，而不是 invocation cwd 或 lexical path。不匹配子目录或 glob。project config file（包括受信任的 `kyoso.config.ts`）与 allowlist entry 都会通过 symlink 解析到该 directory；解析到同一 directory 的 entry 会匹配，解析到其他位置或无法解析的 path 会 fail closed。user-global `provider = "openrouter"` 不需要 allowlist entry。直接选择 CLI 时，必须在同一 invocation 中同时使用 `--set agents.codex.provider=openrouter` 和 `--set agents.codex.model=<model>`；project model 不能为该 CLI provider override 补足 model。`allowProjectProvider` 不是 `--set` path，legacy boolean 值会被拒绝。
+`agents.codex.openRouter` 是 experimental 的。`streamIdleTimeoutMs` 是不小于 `1000` 的整数；`streamMaxRetries` 与 `requestMaxRetries` 是 `0` 到 `100` 的整数，`0` 表示禁用该 retry class。这些 field 要求 `provider = "openrouter"`；省略的 field 不会改变对应的 Codex runtime defaults。retry 是重新生成未完成的 Codex turn 而不是按 byte 恢复；retry 之前的 partial output 会被丢弃，绝不会进入最终结果。
+
+`allowProjectProvider` 适用于 project `provider`、继承 OpenRouter 时 project 对 `model` 的覆盖，以及继承 OpenRouter 时 project 对 `agents.codex.openRouter.*` 的覆盖；list 必须完全匹配包含已解析 project config file 的 canonical directory 的 absolute path，而不是 invocation cwd 或 lexical path。不匹配子目录或 glob。project config file（包括受信任的 `kyoso.config.ts`）与 allowlist entry 都会通过 symlink 解析到该 directory；解析到同一 directory 的 entry 会匹配，解析到其他位置或无法解析的 path 会 fail closed。user-global `provider = "openrouter"` 不需要 allowlist entry。直接选择 CLI 时，必须在同一 invocation 中同时使用 `--set agents.codex.provider=openrouter` 和 `--set agents.codex.model=<model>`；project model 不能为该 CLI provider override 补足 model。`allowProjectProvider` 不是 `--set` path，legacy boolean 值会被拒绝。
 
-当 user-global config 选择 OpenRouter 时，project 可以用 `provider = "default"` 显式 opt-out。这个 reset 不需要 model 或 authorization；除非同一 layer 明确提供普通 Codex model，它还会清除继承的 OpenRouter model，并且不会为该 project forward OpenRouter key。
+当 user-global config 选择 OpenRouter 时，project 可以用 `provider = "default"` 显式 opt-out。这个 reset 不需要 model 或 authorization；除非同一 layer 明确提供普通 Codex model，它还会清除继承的 OpenRouter model，清除继承的 OpenRouter retry policy，并且不会为该 project forward OpenRouter key。同一 reset layer 中的 retry policy 仍然 invalid，因为它要求 `provider = "openrouter"`。
 
 在启动 Kyoso 的 Codex 或 Claude client process 的 environment 中设置 key。直接设置 environment variable 是 primary path；1Password 等 secret manager 是 optional，不是 Kyoso dependency。
 
@@ -372,7 +396,7 @@ Marketplace Plugin 会向其 MCP process 暴露 `OPENROUTER_API_KEY` 变量名
 
 新的 manual MCP registration 默认不包含 `OPENROUTER_API_KEY`。仅在有意选择 provider 后使用 `--with-openrouter` 添加它；已有 registration 永不重写。`kyoso setup ... --with-openrouter` 的输出和手动 setup 示例仍是用户管理的客户端注册模板。Claude Code registration 中的 `${OPENROUTER_API_KEY}` 必须由 client 展开；Kyoso 只会忽略完全由 `${NAME}`、`$NAME` 或 `%NAME%`（允许前后空白）构成的未展开 credential placeholder，并且只输出含变量名的 sanitized warning。含有其他文字的值会被保留。对于以 `_KEY`、`_TOKEN`、`_SECRET` 或 `_PASSWORD` 结尾的 custom credential-like name，也适用同一规则；非 credential template 会被保留。
 
-推荐使用这种经过 user authorization 的 project-scoped opt-in。global `provider = "openrouter"` 会被 project 继承，直到 project 设置 `provider = "default"`；仅省略 `provider` 不会将其 unset。固定的 OpenRouter Responses API preset 为 beta；不开放 custom endpoint、provider routing、fallback 或 judge integration。为将 key 绑定到该 preset，OpenRouter mode 会拒绝含 top-level `profile` 或 `profiles` 的 `CODEX_CONFIG`，并会在启动 child 前拒绝非 object 的 `model_providers` value。对于 object，它会将 `model_providers` 替换为仅含固定 `kyoso-openrouter` entry 的对象，并发出只包含已丢弃 entry 数量的 sanitized warning；不会显示 provider ID 或 config value。除这些被拒绝的 field 外，它会保留 `model`、`model_provider` 和 `model_providers` 之外无关的 `CODEX_CONFIG` field，因此 foreign provider configuration 无法选择使用该 key 的 endpoint。Claude 仍使用已配置的 provider，judge 不会使用 `OPENROUTER_API_KEY`。
+推荐使用这种经过 user authorization 的 project-scoped opt-in。global `provider = "openrouter"` 会被 project 继承，直到 project 设置 `provider = "default"`；仅省略 `provider` 不会将其 unset。固定的 OpenRouter Responses API preset 为 beta；不开放 custom endpoint、provider routing、fallback 或 judge integration。配置后，`streamIdleTimeoutMs`、`streamMaxRetries` 与 `requestMaxRetries` 只映射到 `stream_idle_timeout_ms`、`stream_max_retries` 与 `request_max_retries`；省略的 field 不会出现在 `CODEX_CONFIG` 中。为将 key 绑定到该 preset，OpenRouter mode 会拒绝含 top-level `profile` 或 `profiles` 的 `CODEX_CONFIG`，并会在启动 child 前拒绝非 object 的 `model_providers` value。对于 object，它会将 `model_providers` 替换为仅含固定 `kyoso-openrouter` entry 的对象，并发出只包含已丢弃 entry 数量的 sanitized warning；不会显示 provider ID 或 config value。除这些被拒绝的 field 外，它会保留 `model`、`model_provider` 和 `model_providers` 之外无关的 `CODEX_CONFIG` field，因此 foreign provider configuration 无法选择使用该 key 的 endpoint。Claude 仍使用已配置的 provider，judge 不会使用 `OPENROUTER_API_KEY`。
 
 经过 user-global authorization 后，project `kyoso.toml` 可以选择 external provider，或覆盖继承的 OpenRouter model，并将 review context 路由给它。对于 untrusted repository，请使用 `--ignore-config`，并只显式传入所需的 CLI options。
 
@@ -382,7 +406,7 @@ Marketplace Plugin 会向其 MCP process 暴露 `OPENROUTER_API_KEY` 变量名
 KYOSO_OPENROUTER_ACP_SMOKE=release KYOSO_OPENROUTER_MODEL=<model> safe-chain bun run smoke:openrouter:codex-acp
 ```
 
-该 command 不接受 CLI arguments，使用固定版本的 Codex ACP adapter，并创建全新的空 temporary workspace、`HOME` 和 `CODEX_HOME`，不会使用调用方 repository 或 cached Codex login。它只返回固定的成功或失败消息，不会将 key 或 model 写入 config、temporary artifact 或 output。
+该 command 不接受 CLI arguments，使用固定版本的 Codex ACP adapter，并创建全新的空 temporary workspace、`HOME` 和 `CODEX_HOME`，不会使用调用方 repository 或 cached Codex login。它只返回固定的成功或失败消息，不会将 key 或 model 写入 config、temporary artifact 或 output。这个 credentialed smoke 只检查 interoperability；retry 的 correctness 由 release 专用的 `KYOSO_CODEX_ACP_MOCK_SSE=1` local mock SSE integration gate 覆盖。
 
 ### Agent auth
 

package/dist/acp/AcpAgentProcess.d.ts

@@ -4,7 +4,10 @@ import { BaseAcpAgentManager } from "./AcpAgentManager.js";
 export declare class SubprocessAcpAgentManager extends BaseAcpAgentManager {
     private readonly config;
     private readonly parentEnv;
-    constructor(config: KyosoConfig, parentEnv?: NodeJS.ProcessEnv);
+    private readonly internalOptions;
+    constructor(config: KyosoConfig, parentEnv?: NodeJS.ProcessEnv, internalOptions?: {
+        openRouterBaseUrlForTest?: string;
+    });
     runAgent(input: AgentRunInput): Promise<AgentRunResult>;
 }
 export declare function readWorkspaceFile(workspaceDir: string, requestedPath: string, line?: number | null, limit?: number | null): Promise<string>;

package/dist/acp/AgentOutputAccumulator.d.ts

@@ -0,0 +1,29 @@
+export type MessagePhase = "commentary" | "final_answer" | "unknown";
+export type AgentOutputMetrics = {
+    observedStreamRetries: number;
+    discardedRetryMessageBytes: number;
+    firstOutputAt?: string;
+    lastAcpUpdateAt?: string;
+};
+export declare class AgentOutputAccumulator {
+    private readonly segments;
+    private readonly messageChunks;
+    private retryEpoch;
+    private observedStreamRetries;
+    private discardedRetryMessageBytes;
+    private firstOutputAt;
+    private lastAcpUpdateAt;
+    private nextChunkSequence;
+    addMessageChunk(text: string, meta: {
+        messageId?: string;
+        phase?: MessagePhase;
+    }): void;
+    addThoughtChunk(_text: string): void;
+    noteUpdate(): void;
+    markRetryBoundary(): {
+        discardedMessageBytes: number;
+    };
+    finalRawText(): string;
+    metrics(): AgentOutputMetrics;
+    private noteOutput;
+}

package/dist/acp/codexRetryUpdate.d.ts

@@ -0,0 +1,6 @@
+export type CodexRetryUpdate = {
+    message: string;
+    attempt?: number;
+    maxRetries?: number;
+};
+export declare function parseCodexRetryUpdate(update: unknown): CodexRetryUpdate | undefined;