@kyo-so/cli 0.15.2 → 0.16.0

package/.agents/skills/kyoso-review/SKILL.md

@@ -46,7 +46,7 @@ Do not use this skill for every coding task. It is intended for deliberate revie
      - `plan_review` -> `plan --goal <text> [--plan <path-or-text>] [--file <path>] --json`
      - `security_review` -> `security --goal <text> [--diff <path>] [--file <path>] --json`
      - `diff_review` -> `diff --base <ref> --head <ref> --json`
-   - The CLI also accepts `--repo-summary`, repeatable `--focus`, `--constraint`, and `--file` flags. For a large review, adjust an agent timeout with `--set agents.<agent>.timeoutMs=<ms>`.
+   - The CLI also accepts `--repo-summary`, repeatable `--focus`, `--constraint`, and `--file` flags. For a large review, adjust an agent timeout with `--set agents.<agent>.timeoutS=<seconds>`.
    - Run the CLI without a config trust flag first. Inspect `audit.warnings` in the JSON result; if it contains `untrusted config was not executed`, or the command fails with an untrusted-config message, ask the user whether to rerun with `--trust-config` to use it or `--ignore-config` to skip it. Never add `--trust-config` without confirmation.
    - Keep `--json` enabled and interpret the returned `decision` exactly like the MCP result.
 5. Check `coverage` before acting. If required lenses or perspectives are missing, stop and present the incomplete review.

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-07-27
+
+### Added
+
+- Accept numeric seconds aliases for public config, CLI overrides, MCP/library
+  request timeouts and review budgets, and the `runReview()` progress heartbeat
+  while preserving millisecond inputs and canonical millisecond outputs.
+
+### Changed
+
+- Close machine-marked Plugin promotion reminders with an audit comment only
+  after complete verification succeeds on `main`, while keeping pull requests
+  and non-`main` manual runs read-only.
+- Promote the Marketplace Plugin to `0.7.7` and pin its Codex and Claude Code
+  MCP definitions and Skill fallbacks to `@kyo-so/cli@0.15.2`.
+
 ## [0.15.2] - 2026-07-26
 
 ### Fixed

package/README.ja.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner の実行経路では、package と executable を必ず別指定します: `npx -y --package=@kyo-so/cli kyoso` と `bunx --package @kyo-so/cli kyoso` です。workflowで固定する場合は、`@kyo-so/cli@0.15.1` のようにpackage名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応) で、インストールされる CLI コマンドは短い `kyoso` です。
+package-runner の実行経路では、package と executable を必ず別指定します: `npx -y --package=@kyo-so/cli kyoso` と `bunx --package @kyo-so/cli kyoso` です。workflowで固定する場合は、`@kyo-so/cli@0.15.2` のようにpackage名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応) で、インストールされる CLI コマンドは短い `kyoso` です。
 
 Bun fallback は Bun `1.3.14` で検証済みです。古い Bun では npx 形式またはインストール済みの `kyoso` を使い、複数bin packageからの Bun のbinary推論に依存しないでください。
 
@@ -310,7 +310,7 @@ Kyoso は次の順に config を load します。
 
 未知の key は拒否されます。boolean / numeric config keys は schema の型へ変換し、string keys は文字列のまま保持した後、config 全体を再検証します。
 
-Project `kyoso.toml` は declarative で、trust approval は不要です。agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、user global authorization後のCodex専用`provider`、継承したOpenRouterのmodel上書きまたはretry-policy上書き、workspace byte limits と additive `workspace.deny`、verification settings、advisory judge settings、tightening-only security/network/CISA settings を設定できます。
+Project `kyoso.toml` は declarative で、trust approval は不要です。agent `enabled` / `model` / `effort` / `role` / `timeoutS`、user global authorization後のCodex専用`provider`、継承したOpenRouterのmodel上書きまたはretry-policy上書き、workspace byte limits と additive `workspace.deny`、verification settings、advisory judge settings、tightening-only security/network/CISA settings を設定できます。
 
 `entrypoints.*`、`tools.*`、`reviewPolicy.*` は user-global policy です。entrypoint または tool が disabled の場合、agents の起動前に structured policy block を返します。`firstClassClient = "codex"`、`workspace.readOnly = true`、`network.mediatedWeb.enabled = false`、`audit.includeFileContents = false` は fixed / reserved value であり、未対応値は no-op にせず拒否します。
 
@@ -329,7 +329,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codexには`agents.codex.provider`もあり、`"openrouter"`はexternal providerを選択し、`"default"`は継承したOpenRouter選択を通常のCodex behaviorへ戻します。Claudeにprovider設定はありません。`agents.codex.openRouter.streamIdleTimeoutMs`、`streamMaxRetries`、`requestMaxRetries`は、選択したOpenRouter transportだけを設定します。projectから`provider`を選択、またはそのretry policyを変更するには、global config専用の`agents.codex.allowProjectProvider` allowlistが必要です。詳細な規則は [Codex の OpenRouter project opt-in](#codex-の-openrouter-project-opt-in) を参照してください。`command` / `args` / `env`もglobal config専用です([Files and precedence](#files-and-precedence) を参照)。
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutS>`。legacy-compatibleな`timeoutMs` inputも引き続き受理します。Codexには`agents.codex.provider`もあり、`"openrouter"`はexternal providerを選択し、`"default"`は継承したOpenRouter選択を通常のCodex behaviorへ戻します。Claudeにprovider設定はありません。`agents.codex.openRouter.streamIdleTimeoutS`、`streamMaxRetries`、`requestMaxRetries`は、選択したOpenRouter transportだけを設定し、`streamIdleTimeoutMs`も引き続き受理します。projectから`provider`を選択、またはそのretry policyを変更するには、global config専用の`agents.codex.allowProjectProvider` allowlistが必要です。詳細な規則は [Codex の OpenRouter project opt-in](#codex-の-openrouter-project-opt-in) を参照してください。`command` / `args` / `env`もglobal config専用です([Files and precedence](#files-and-precedence) を参照)。
 
 `agents.<name>.model` または `agents.<name>.effort` を省略すると、各 agent 独自の default を使用します。Codex は `~/.codex/config.toml`（`CODEX_HOME`を設定している場合は`$CODEX_HOME/config.toml`）などの local Codex config を使用し、Claude は adapter default を使用します。
 
@@ -371,14 +371,14 @@ provider = "openrouter"
 model = "openai/o4-mini"
 
 [agents.codex.openRouter]
-streamIdleTimeoutMs = 90000
+streamIdleTimeoutS = 90
 streamMaxRetries = 3
 requestMaxRetries = 2
 ```
 
 `provider = "openrouter"` の場合、`model`は空白でない値が必須です。これはOpenRouterのmodel IDです。Kyosoはcatalogやtool calling対応を検証しないため、利用するmodelのtool supportはproviderで確認してください。
 
-`agents.codex.openRouter` は experimental です。`streamIdleTimeoutMs` は `1000` 以上の整数、`streamMaxRetries` と `requestMaxRetries` は `0` から `100` の整数で、`0` はそのretry classを無効化します。これらのfieldには `provider = "openrouter"` が必須で、省略したfieldは対応するCodex runtime defaultsを変更しません。retryはCodex turnのbyte単位のresumeではなく未完了turnの再生成であり、retry前のpartial outputは破棄され最終結果には決して含まれません。
+`agents.codex.openRouter` は experimental です。`streamIdleTimeoutS` は1秒以上で、整数millisecondへ正確に変換できるnumberです。`streamMaxRetries` と `requestMaxRetries` は `0` から `100` の整数で、`0` はそのretry classを無効化します。これらのfieldには `provider = "openrouter"` が必須で、省略したfieldは対応するCodex runtime defaultsを変更しません。retryはCodex turnのbyte単位のresumeではなく未完了turnの再生成であり、retry前のpartial outputは破棄され最終結果には決して含まれません。
 
 `allowProjectProvider`はprojectの`provider`、OpenRouterを継承中のproject `model`上書き、OpenRouterを継承中のproject `agents.codex.openRouter.*`上書きに必要で、listには解決後のproject config fileを含むcanonical directoryのabsolute pathを完全一致で指定します。invocationのcwdやlexical pathではありません。descendantやglobには一致しません。trusted `kyoso.config.ts`を含むproject config fileとallowlist entryの両方をsymlink経由も含めて同じdirectoryのreal pathへ解決して比較するため、そのdirectoryへ解決されるentryは一致し、別の場所へ解決されるentryまたは解決できないpathはfail closedです。user globalの`provider = "openrouter"`にはallowlist entryは不要です。CLIで選択する場合は、同一 invocation に`--set agents.codex.provider=openrouter`と`--set agents.codex.model=<model>`の両方が必要であり、project modelで前者を補完することはできません。`allowProjectProvider`は`--set` pathではなく、legacy boolean値は拒否されます。
 
@@ -396,7 +396,7 @@ Marketplace PluginはMCP processへ`OPENROUTER_API_KEY`の変数名を公開し
 
 新規manual MCP registrationは既定で`OPENROUTER_API_KEY`を含めません。providerを意図して選択した後だけ`--with-openrouter`で追加し、既存registrationは書換えません。`kyoso setup ... --with-openrouter` の出力と手動セットアップ例は、引き続き利用者が管理するクライアント登録テンプレートです。Claude Code registrationの`${OPENROUTER_API_KEY}`はclientが展開する必要があり、Kyosoは`${NAME}`、`$NAME`、`%NAME%`（前後の空白は許容）だけから成る未展開credential placeholderだけを無視し、変数名だけを含むsanitized warningを出します。ほかの文字列を含む値は維持します。custom credential-like nameの末尾が`_KEY`、`_TOKEN`、`_SECRET`、`_PASSWORD`である場合にも同じ規則を適用し、credentialではないtemplateは維持されます。
 
-このuser-authorized project-scoped opt-inを推奨します。global `provider = "openrouter"`は、projectが`provider = "default"`を設定するまで継承されます。`provider`の省略だけでは解除されません。固定のOpenRouter Responses API presetはbetaです。custom endpoint、provider routing、fallback、judge integrationは公開しません。設定した場合、`streamIdleTimeoutMs`、`streamMaxRetries`、`requestMaxRetries`は`stream_idle_timeout_ms`、`stream_max_retries`、`request_max_retries`だけへmappingされ、省略したfieldは`CODEX_CONFIG`に現れません。keyをこのpresetに束縛するため、OpenRouter modeではtop-levelの`profile`または`profiles`を含む`CODEX_CONFIG`と、objectではない`model_providers` valueをchild起動前に拒否します。objectの場合は`model_providers`を固定の`kyoso-openrouter` entryだけに置換し、破棄したentry数だけを含むsanitized warningを出します。provider IDやconfig valueは出力しません。拒否するfield以外では、`model`、`model_provider`、`model_providers`以外のunrelatedな`CODEX_CONFIG` fieldを維持するため、foreign provider configurationがkey付きのendpointを選択することはできません。Claudeは設定済みproviderのままで、judgeは`OPENROUTER_API_KEY`を使用しません。
+このuser-authorized project-scoped opt-inを推奨します。global `provider = "openrouter"`は、projectが`provider = "default"`を設定するまで継承されます。`provider`の省略だけでは解除されません。固定のOpenRouter Responses API presetはbetaです。custom endpoint、provider routing、fallback、judge integrationは公開しません。設定した`streamIdleTimeoutS`は内部の`streamIdleTimeoutMs`へ正規化され、その値と`streamMaxRetries`、`requestMaxRetries`は`stream_idle_timeout_ms`、`stream_max_retries`、`request_max_retries`だけへmappingされます。省略したfieldは`CODEX_CONFIG`に現れません。keyをこのpresetに束縛するため、OpenRouter modeではtop-levelの`profile`または`profiles`を含む`CODEX_CONFIG`と、objectではない`model_providers` valueをchild起動前に拒否します。objectの場合は`model_providers`を固定の`kyoso-openrouter` entryだけに置換し、破棄したentry数だけを含むsanitized warningを出します。provider IDやconfig valueは出力しません。拒否するfield以外では、`model`、`model_provider`、`model_providers`以外のunrelatedな`CODEX_CONFIG` fieldを維持するため、foreign provider configurationがkey付きのendpointを選択することはできません。Claudeは設定済みproviderのままで、judgeは`OPENROUTER_API_KEY`を使用しません。
 
 user global authorization後、projectの`kyoso.toml`はexternal providerを選択、または継承したOpenRouter modelを上書きし、review contextをそこへ送ることがあります。untrusted repositoryでは`--ignore-config`を使用し、必要なCLI optionsだけを明示してください。
 
@@ -456,7 +456,7 @@ single-agent mode では、残った backend が `combined_reviewer` として1
 ```toml
 [reviewBudget]
 maxModelCalls = 4
-maxTotalWallTimeMs = 660000
+maxTotalWallTimeS = 660
 warnAgentOutputBytes = 524288
 maxAgentOutputBytes = 1048576
 maxFindingsPerAgent = 10
@@ -469,13 +469,17 @@ skipOptionalPhasesWhenTokenUsageUnknown = false
 
 ### Timeouts
 
-Default agent timeout は Codex / Claude ともに600秒です。verification round の default は 90 秒です。review全体のdeadlineは既定660秒(`reviewBudget.maxTotalWallTimeMs`)で、defaultの並列primary phase後に標準の60秒のfinalization余裕を確保します。各phaseはdeadlineを延長せず残り時間を使います。`kyoso doctor` は設定済みの直列phase時間と、10%または60秒の大きい方を余裕として加えたreview-wide推奨値を表示します。LLM judge timeoutは、judge modeが許し、direct provider credentialが利用できる場合だけ加算します。
+人が指定する時間値にはnumeric seconds inputを推奨します。agent `timeoutS`、OpenRouter `streamIdleTimeoutS`、`verification.timeoutS`、`judge.timeoutS`、user-global `reviewBudget.maxTotalWallTimeS`、request `options.maxAgentTimeoutS`、request `options.reviewBudget.maxTotalWallTimeS`、library option `progressHeartbeatS`を使用できます。既存の`*Ms` inputもruntime warningなしで受理し、resolved config、execution、result、Auditはmillisecondのままです。
+
+secondsの小数は、1,000倍した値がsafe integer millisecondになる場合だけ受理します。`1.5`と`0.001`は有効ですが、`0.0001`は無効です。timeoutは正数で、`progressHeartbeatS = 0`だけがheartbeat無効化を表します。同じlayerまたはrequest objectに両unitがある場合は両方をvalidationして`S`を優先します。config layer precedenceを先に適用するため、後段のprojectまたはCLIの`Ms`は、前段globalの`S`より優先されます。
+
+Default agent timeout は Codex / Claude ともに600秒です。verification round の default は 90 秒です。review全体のdeadlineは既定660秒(`reviewBudget.maxTotalWallTimeS`)で、defaultの並列primary phase後に標準の60秒のfinalization余裕を確保します。各phaseはdeadlineを延長せず残り時間を使います。`kyoso doctor` は設定済みの直列phase時間と、10%または60秒の大きい方を余裕として加えたreview-wide推奨値を表示します。LLM judge timeoutは、judge modeが許し、direct provider credentialが利用できる場合だけ加算します。
 
 このrepositoryのprimary 15分＋verification 15分のdogfooding presetでは、次のuser-global overrideを使います。
 
 ```toml
 [reviewBudget]
-maxTotalWallTimeMs = 2100000
+maxTotalWallTimeS = 2100
 ```
 
 Codex Pluginと新規生成するmanual Codex registrationは`tool_timeout_sec = 2160`を使い、Kyosoの35分deadlineより60秒長く待機します。既存manual registrationは`kyoso setup`が保持するため、手動更新が必要です。Claude Code Plugin manifestはclient tool timeoutを設定しないため、同値をミリ秒で指定してClaude Codeを起動し、clientを再起動してください。
@@ -484,17 +488,17 @@ Codex Pluginと新規生成するmanual Codex registrationは`tool_timeout_sec =
 MCP_TOOL_TIMEOUT=2160000 claude
 ```
 
-client timeoutを延ばしてもKyoso内部のreview-wide deadlineは延長されません。ほかのpresetでは、client timeoutを`reviewBudget.maxTotalWallTimeMs`より長くしてください。
+client timeoutを延ばしてもKyoso内部のreview-wide deadlineは延長されません。ほかのpresetでは、client timeoutを`reviewBudget.maxTotalWallTimeS`より長くしてください。
 
 ### Verification
 
-Verification keys: `verification.<enabled|maxFindings|timeoutMs>`。Optional finding verification は default で disabled です:
+Verification keys: `verification.<enabled|maxFindings|timeoutS>`。legacy-compatibleな`timeoutMs` inputも引き続き受理します。Optional finding verification は default で disabled です:
 
 ```toml
 [verification]
 enabled = false
 maxFindings = 5
-timeoutMs = 90000
+timeoutS = 90
 # global config only; project kyoso.toml cannot set this
 allowDemotion = false
 ```
@@ -503,7 +507,7 @@ Enabled の場合、Kyoso は high/critical かつ single-source の各 finding
 
 ### Judge
 
-Judge keys: `judge.<mode|provider|timeoutMs>`。Judge LLMs は optional で、default は `mode = "deterministic_only"` です。credential だけでは judge call を開始しません。OpenAI judge は `mode = "deterministic_plus_llm"` と `OPENAI_API_KEY` または `CODEX_API_KEY`、Anthropic judge は同modeと `ANTHROPIC_API_KEY` を設定します。Optional overrides:
+Judge keys: `judge.<mode|provider|timeoutS>`。legacy-compatibleな`timeoutMs` inputも引き続き受理します。Judge LLMs は optional で、default は `mode = "deterministic_only"` です。credential だけでは judge call を開始しません。OpenAI judge は `mode = "deterministic_plus_llm"` と `OPENAI_API_KEY` または `CODEX_API_KEY`、Anthropic judge は同modeと `ANTHROPIC_API_KEY` を設定します。Optional overrides:
 
 - `OPENAI_BASE_URL`: OpenAI-compatible API base URL
 - `KYOSO_OPENAI_JUDGE_MODEL`: OpenAI judge model, default `gpt-5.4-mini`

package/README.md

@@ -152,7 +152,7 @@ Manual setup examples are kept in `examples/codex-config.toml` and `examples/cla
 
 ## CLI
 
-The package-runner execution paths always select the package and executable separately: `npx -y --package=@kyo-so/cli kyoso` and `bunx --package @kyo-so/cli kyoso`. Add a complete SemVer pin after the package name when a workflow needs one, for example `@kyo-so/cli@0.15.1`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), while the installed CLI command is the shorter `kyoso`.
+The package-runner execution paths always select the package and executable separately: `npx -y --package=@kyo-so/cli kyoso` and `bunx --package @kyo-so/cli kyoso`. Add a complete SemVer pin after the package name when a workflow needs one, for example `@kyo-so/cli@0.15.2`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), while the installed CLI command is the shorter `kyoso`.
 
 The Bun fallback is verified on Bun `1.3.14`. On an older Bun, use the npx form or an installed `kyoso`; do not rely on Bun inferring a binary from a multi-bin package.
 
@@ -321,7 +321,7 @@ Kyoso loads config in this order:
 
 Unknown keys are rejected. Boolean and numeric config keys are converted to their schema types; string keys remain strings. The complete config is then validated.
 
-Project `kyoso.toml` is declarative and does not require trust approval. It can set safe project-scoped keys such as agent `enabled` / `model` / `effort` / `role` / `timeoutMs`, the Codex-only `provider`, OpenRouter model, or retry-policy override after user-global authorization, workspace byte limits and additive `workspace.deny`, verification settings, advisory judge settings, and tightening-only security/network/CISA settings.
+Project `kyoso.toml` is declarative and does not require trust approval. It can set safe project-scoped keys such as agent `enabled` / `model` / `effort` / `role` / `timeoutS`, the Codex-only `provider`, OpenRouter model, or retry-policy override after user-global authorization, workspace byte limits and additive `workspace.deny`, verification settings, advisory judge settings, and tightening-only security/network/CISA settings.
 
 `entrypoints.*`, `tools.*`, and `reviewPolicy.*` are user-global policy. A disabled entrypoint or tool returns a structured policy block before agents start. `firstClassClient = "codex"`, `workspace.readOnly = true`, `network.mediatedWeb.enabled = false`, and `audit.includeFileContents = false` are fixed or reserved values; unsupported values are rejected instead of acting as no-ops.
 
@@ -340,7 +340,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`. Codex also supports `agents.codex.provider`: `"openrouter"` selects the external provider, while `"default"` resets an inherited OpenRouter selection to normal Codex behavior; Claude has no provider setting. `agents.codex.openRouter.streamIdleTimeoutMs`, `streamMaxRetries`, and `requestMaxRetries` configure the selected OpenRouter transport only. Selecting the provider or changing that retry policy from a project requires the global-config-only `agents.codex.allowProjectProvider` allowlist; see [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in) for the full rules. The `command`, `args`, and `env` keys are also global-config-only (see [Files and precedence](#files-and-precedence)).
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutS>`. The legacy-compatible `timeoutMs` input remains accepted. Codex also supports `agents.codex.provider`: `"openrouter"` selects the external provider, while `"default"` resets an inherited OpenRouter selection to normal Codex behavior; Claude has no provider setting. `agents.codex.openRouter.streamIdleTimeoutS`, `streamMaxRetries`, and `requestMaxRetries` configure the selected OpenRouter transport only; `streamIdleTimeoutMs` remains accepted. Selecting the provider or changing that retry policy from a project requires the global-config-only `agents.codex.allowProjectProvider` allowlist; see [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in) for the full rules. The `command`, `args`, and `env` keys are also global-config-only (see [Files and precedence](#files-and-precedence)).
 
 Omit `agents.<name>.model` or `agents.<name>.effort` to use each agent's own default. Codex uses the local Codex config, such as `~/.codex/config.toml` (or `$CODEX_HOME/config.toml` when `CODEX_HOME` is set); Claude uses the adapter default.
 
@@ -382,14 +382,14 @@ provider = "openrouter"
 model = "openai/o4-mini"
 
 [agents.codex.openRouter]
-streamIdleTimeoutMs = 90000
+streamIdleTimeoutS = 90
 streamMaxRetries = 3
 requestMaxRetries = 2
 ```
 
 `model` is required and must not be blank when `provider = "openrouter"`. It is an OpenRouter model ID; Kyoso does not validate the catalog or whether that model supports tool calling, so confirm tool support with the provider.
 
-`agents.codex.openRouter` is experimental. `streamIdleTimeoutMs` is an integer of at least `1000`; `streamMaxRetries` and `requestMaxRetries` are integers from `0` through `100`, where `0` disables that retry class. These fields require `provider = "openrouter"`; omitting them leaves the corresponding Codex runtime defaults unchanged. Retry regenerates an unfinished Codex turn rather than resuming its bytes; pre-retry partial output is discarded and never reaches final results.
+`agents.codex.openRouter` is experimental. `streamIdleTimeoutS` is a number of at least `1` second that converts exactly to integer milliseconds; `streamMaxRetries` and `requestMaxRetries` are integers from `0` through `100`, where `0` disables that retry class. These fields require `provider = "openrouter"`; omitting them leaves the corresponding Codex runtime defaults unchanged. Retry regenerates an unfinished Codex turn rather than resuming its bytes; pre-retry partial output is discarded and never reaches final results.
 
 `allowProjectProvider` applies to a project `provider`, a project `model` override while OpenRouter is inherited, and a project `agents.codex.openRouter.*` override while OpenRouter is inherited; its list must contain the absolute canonical directory containing the resolved project configuration file, not the invocation cwd or a lexical path, with no descendant or glob matching. A project configuration file (including trusted `kyoso.config.ts`) and an allowlist entry that resolve through symlinks to that directory match; entries resolving elsewhere, or unresolvable paths, fail closed. A user-global `provider = "openrouter"` needs no allowlist entry. An explicit CLI pair of `--set agents.codex.provider=openrouter` and `--set agents.codex.model=<model>` in the same invocation is also allowed without it; a project model cannot supply the CLI override's model. `allowProjectProvider` is not a `--set` path and legacy boolean values are rejected.
 
@@ -407,7 +407,7 @@ The Marketplace Plugin exposes the `OPENROUTER_API_KEY` variable name to its MCP
 
 New manual MCP registrations omit `OPENROUTER_API_KEY` by default. Add it only with `--with-openrouter` after intentionally selecting the provider; existing registrations are never rewritten. The `kyoso setup ... --with-openrouter` output and the manual setup examples remain user-managed client-registration templates. In a Claude Code registration, `${OPENROUTER_API_KEY}` must be expanded by the client; Kyoso ignores only a whole unexpanded credential placeholder — `${NAME}`, `$NAME`, or `%NAME%`, with optional surrounding whitespace — and emits a sanitized warning containing only the variable name. Values with any other text are preserved. The same rule applies to custom credential-like names ending in `_KEY`, `_TOKEN`, `_SECRET`, or `_PASSWORD`; non-credential templates are preserved.
 
-Prefer this user-authorized project-scoped opt-in. A global `provider = "openrouter"` is inherited by projects until a project sets `provider = "default"`; merely omitting `provider` does not unset it. The fixed OpenRouter Responses API preset is beta; custom endpoints, provider routing, fallbacks, and judge integration are not exposed. When configured, `streamIdleTimeoutMs`, `streamMaxRetries`, and `requestMaxRetries` map only to `stream_idle_timeout_ms`, `stream_max_retries`, and `request_max_retries`; omitted fields are absent from `CODEX_CONFIG`. To keep the key bound to that preset, OpenRouter mode rejects a `CODEX_CONFIG` with a top-level `profile` or `profiles` field and rejects a non-object `model_providers` value before launching the child. For an object value, it replaces `model_providers` with only the fixed `kyoso-openrouter` entry and emits a sanitized warning with the discarded-entry count only; provider IDs and configuration values never appear. Apart from those rejected fields, it preserves unrelated `CODEX_CONFIG` fields outside `model`, `model_provider`, and `model_providers`, so no foreign provider configuration can select an endpoint with the key. Claude remains on its configured provider, and the judge does not use `OPENROUTER_API_KEY`.
+Prefer this user-authorized project-scoped opt-in. A global `provider = "openrouter"` is inherited by projects until a project sets `provider = "default"`; merely omitting `provider` does not unset it. The fixed OpenRouter Responses API preset is beta; custom endpoints, provider routing, fallbacks, and judge integration are not exposed. When configured, `streamIdleTimeoutS` is normalized to internal `streamIdleTimeoutMs`; that value, `streamMaxRetries`, and `requestMaxRetries` map only to `stream_idle_timeout_ms`, `stream_max_retries`, and `request_max_retries`. Omitted fields are absent from `CODEX_CONFIG`. To keep the key bound to that preset, OpenRouter mode rejects a `CODEX_CONFIG` with a top-level `profile` or `profiles` field and rejects a non-object `model_providers` value before launching the child. For an object value, it replaces `model_providers` with only the fixed `kyoso-openrouter` entry and emits a sanitized warning with the discarded-entry count only; provider IDs and configuration values never appear. Apart from those rejected fields, it preserves unrelated `CODEX_CONFIG` fields outside `model`, `model_provider`, and `model_providers`, so no foreign provider configuration can select an endpoint with the key. Claude remains on its configured provider, and the judge does not use `OPENROUTER_API_KEY`.
 
 After user-global authorization, a project `kyoso.toml` can select the external provider or override its inherited OpenRouter model and route review context to it. For an untrusted repository, use `--ignore-config` and pass only the needed CLI options explicitly.
 
@@ -467,7 +467,7 @@ Every review has user-global hard ceilings for model calls, total wall time, and
 ```toml
 [reviewBudget]
 maxModelCalls = 4
-maxTotalWallTimeMs = 660000
+maxTotalWallTimeS = 660
 warnAgentOutputBytes = 524288
 maxAgentOutputBytes = 1048576
 maxFindingsPerAgent = 10
@@ -480,13 +480,17 @@ The result includes `completion`, `executionBudget`, and `requestFingerprint`; M
 
 ### Timeouts
 
-Default agent timeouts are 600 seconds for both Codex and Claude; the verification round defaults to 90 seconds. The review-wide deadline defaults to 660 seconds (`reviewBudget.maxTotalWallTimeMs`), leaving the standard 60-second finalization margin after the default parallel primary phase. Each phase uses the remaining deadline rather than extending it. `kyoso doctor` reports the configured sequential phase time and a recommended review-wide deadline with a 10% or 60-second margin, whichever is larger. It includes an LLM judge timeout only when the judge mode permits it and a direct-provider credential is available.
+Prefer numeric seconds inputs: agent `timeoutS`, OpenRouter `streamIdleTimeoutS`, `verification.timeoutS`, `judge.timeoutS`, user-global `reviewBudget.maxTotalWallTimeS`, request `options.maxAgentTimeoutS`, request `options.reviewBudget.maxTotalWallTimeS`, and library option `progressHeartbeatS`. Existing `*Ms` inputs remain accepted without a runtime warning, while resolved config, execution, results, and Audit remain in milliseconds.
+
+Seconds may be fractional only when multiplication by 1,000 produces a safe integer number of milliseconds: `1.5` and `0.001` are valid, while `0.0001` is not. Timeouts are positive; only `progressHeartbeatS = 0` disables heartbeat. When both units appear in one layer or request object, both values are validated and `S` wins. Config layer precedence is applied first, so a later project or CLI `Ms` value still overrides an earlier global `S` value.
+
+Default agent timeouts are 600 seconds for both Codex and Claude; the verification round defaults to 90 seconds. The review-wide deadline defaults to 660 seconds (`reviewBudget.maxTotalWallTimeS`), leaving the standard 60-second finalization margin after the default parallel primary phase. Each phase uses the remaining deadline rather than extending it. `kyoso doctor` reports the configured sequential phase time and a recommended review-wide deadline with a 10% or 60-second margin, whichever is larger. It includes an LLM judge timeout only when the judge mode permits it and a direct-provider credential is available.
 
 This repository's 15-minute primary plus 15-minute verification dogfooding preset uses the following user-global override:
 
 ```toml
 [reviewBudget]
-maxTotalWallTimeMs = 2100000
+maxTotalWallTimeS = 2100
 ```
 
 The Codex Plugin and newly generated manual Codex registrations use `tool_timeout_sec = 2160`, leaving 60 seconds beyond that 35-minute Kyoso deadline. Existing manual registrations are preserved by `kyoso setup` and must be updated manually. The Claude Code Plugin manifest does not set a client tool timeout; launch Claude Code with the equivalent millisecond value, then restart the client:
@@ -495,17 +499,17 @@ The Codex Plugin and newly generated manual Codex registrations use `tool_timeou
 MCP_TOOL_TIMEOUT=2160000 claude
 ```
 
-Increasing the client timeout does not extend Kyoso's internal review-wide deadline. For other presets, keep the client timeout longer than `reviewBudget.maxTotalWallTimeMs`.
+Increasing the client timeout does not extend Kyoso's internal review-wide deadline. For other presets, keep the client timeout longer than `reviewBudget.maxTotalWallTimeS`.
 
 ### Verification
 
-Verification keys: `verification.<enabled|maxFindings|timeoutMs>`. Optional finding verification is disabled by default:
+Verification keys: `verification.<enabled|maxFindings|timeoutS>`. The legacy-compatible `timeoutMs` input remains accepted. Optional finding verification is disabled by default:
 
 ```toml
 [verification]
 enabled = false
 maxFindings = 5
-timeoutMs = 90000
+timeoutS = 90
 # global config only; project kyoso.toml cannot set this
 allowDemotion = false
 ```
@@ -514,7 +518,7 @@ When enabled, Kyoso asks the agent that did not report each high/critical single
 
 ### Judge
 
-Judge keys: `judge.<mode|provider|timeoutMs>`. Judge LLMs are optional and default to `mode = "deterministic_only"`; credentials alone do not start a judge call. Set `mode = "deterministic_plus_llm"` plus `OPENAI_API_KEY` or `CODEX_API_KEY` for OpenAI, or `ANTHROPIC_API_KEY` for Anthropic. Optional overrides:
+Judge keys: `judge.<mode|provider|timeoutS>`. The legacy-compatible `timeoutMs` input remains accepted. Judge LLMs are optional and default to `mode = "deterministic_only"`; credentials alone do not start a judge call. Set `mode = "deterministic_plus_llm"` plus `OPENAI_API_KEY` or `CODEX_API_KEY` for OpenAI, or `ANTHROPIC_API_KEY` for Anthropic. Optional overrides:
 
 - `OPENAI_BASE_URL`: OpenAI-compatible API base URL
 - `KYOSO_OPENAI_JUDGE_MODEL`: OpenAI judge model, default `gpt-5.4-mini`

package/README.zh-CN.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner 执行路径始终分别指定 package 和 executable：`npx -y --package=@kyo-so/cli kyoso` 与 `bunx --package @kyo-so/cli kyoso`。需要固定 workflow 时，在 package 名后加 complete SemVer pin，例如 `@kyo-so/cli@0.15.1`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，安装后的 CLI command 是更短的 `kyoso`。
+package-runner 执行路径始终分别指定 package 和 executable：`npx -y --package=@kyo-so/cli kyoso` 与 `bunx --package @kyo-so/cli kyoso`。需要固定 workflow 时，在 package 名后加 complete SemVer pin，例如 `@kyo-so/cli@0.15.2`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，安装后的 CLI command 是更短的 `kyoso`。
 
 Bun fallback 已在 Bun `1.3.14` 上验证。旧版 Bun 请使用 npx 形式或已安装的 `kyoso`，不要依赖 Bun 从多 bin package 推断 binary。
 
@@ -310,7 +310,7 @@ Kyoso 按以下顺序 load config：
 
 未知 key 会被拒绝。Boolean / numeric config keys 会转换为 schema 类型，string keys 保持字符串，然后重新验证完整 config。
 
-Project `kyoso.toml` 是 declarative config，不需要 trust approval。它可以设置 agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、经过 user global authorization 的 Codex `provider`、继承 OpenRouter 时的 model 覆盖或 retry-policy 覆盖、workspace byte limits 和 additive `workspace.deny`、verification settings、advisory judge settings，以及 tightening-only security/network/CISA settings。
+Project `kyoso.toml` 是 declarative config，不需要 trust approval。它可以设置 agent `enabled` / `model` / `effort` / `role` / `timeoutS`、经过 user global authorization 的 Codex `provider`、继承 OpenRouter 时的 model 覆盖或 retry-policy 覆盖、workspace byte limits 和 additive `workspace.deny`、verification settings、advisory judge settings，以及 tightening-only security/network/CISA settings。
 
 `entrypoints.*`、`tools.*` 和 `reviewPolicy.*` 是 user-global policy。entrypoint 或 tool 被禁用时，Kyoso 会在启动 agents 前返回 structured policy block。`firstClassClient = "codex"`、`workspace.readOnly = true`、`network.mediatedWeb.enabled = false` 和 `audit.includeFileContents = false` 是 fixed / reserved values；不支持的值会被拒绝，而不是成为 no-op。
 
@@ -329,7 +329,7 @@ CODEX_CONFIG = '{"model":"gpt-5.5"}'
 
 ### Agents
 
-Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`。Codex 还支持 `agents.codex.provider`：`"openrouter"` 选择 external provider，而 `"default"` 会将继承的 OpenRouter 选择重置为正常 Codex behavior；Claude 没有 provider 设置。`agents.codex.openRouter.streamIdleTimeoutMs`、`streamMaxRetries` 与 `requestMaxRetries` 仅配置所选的 OpenRouter transport。从 project 选择 provider 或更改该 retry policy 需要只能在 global config 中设置的 `agents.codex.allowProjectProvider` allowlist；完整规则请参阅 [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in)。`command` / `args` / `env` 也只能在 global config 中设置（参见 [Files and precedence](#files-and-precedence)）。
+Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutS>`。legacy-compatible 的 `timeoutMs` input 仍然可用。Codex 还支持 `agents.codex.provider`：`"openrouter"` 选择 external provider，而 `"default"` 会将继承的 OpenRouter 选择重置为正常 Codex behavior；Claude 没有 provider 设置。`agents.codex.openRouter.streamIdleTimeoutS`、`streamMaxRetries` 与 `requestMaxRetries` 仅配置所选的 OpenRouter transport；`streamIdleTimeoutMs` 仍然可用。从 project 选择 provider 或更改该 retry policy 需要只能在 global config 中设置的 `agents.codex.allowProjectProvider` allowlist；完整规则请参阅 [Codex OpenRouter project opt-in](#codex-openrouter-project-opt-in)。`command` / `args` / `env` 也只能在 global config 中设置（参见 [Files and precedence](#files-and-precedence)）。
 
 省略 `agents.<name>.model` 或 `agents.<name>.effort` 时，会使用各 agent 自身的 default。Codex 使用 local Codex config，例如 `~/.codex/config.toml`（若已设置`CODEX_HOME`，则为`$CODEX_HOME/config.toml`）；Claude 使用 adapter default。
 
@@ -371,14 +371,14 @@ provider = "openrouter"
 model = "openai/o4-mini"
 
 [agents.codex.openRouter]
-streamIdleTimeoutMs = 90000
+streamIdleTimeoutS = 90
 streamMaxRetries = 3
 requestMaxRetries = 2
 ```
 
 当 `provider = "openrouter"` 时，`model` 必须存在且不能是空白。它是 OpenRouter model ID；Kyoso 不会 validate model catalog 或该 model 是否支持 tool calling，请向 provider 确认 tool support。
 
-`agents.codex.openRouter` 是 experimental 的。`streamIdleTimeoutMs` 是不小于 `1000` 的整数；`streamMaxRetries` 与 `requestMaxRetries` 是 `0` 到 `100` 的整数，`0` 表示禁用该 retry class。这些 field 要求 `provider = "openrouter"`；省略的 field 不会改变对应的 Codex runtime defaults。retry 是重新生成未完成的 Codex turn 而不是按 byte 恢复；retry 之前的 partial output 会被丢弃，绝不会进入最终结果。
+`agents.codex.openRouter` 是 experimental 的。`streamIdleTimeoutS` 必须不小于1秒，并且能精确转换为整数millisecond；`streamMaxRetries` 与 `requestMaxRetries` 是 `0` 到 `100` 的整数，`0` 表示禁用该 retry class。这些 field 要求 `provider = "openrouter"`；省略的 field 不会改变对应的 Codex runtime defaults。retry 是重新生成未完成的 Codex turn 而不是按 byte 恢复；retry 之前的 partial output 会被丢弃，绝不会进入最终结果。
 
 `allowProjectProvider` 适用于 project `provider`、继承 OpenRouter 时 project 对 `model` 的覆盖，以及继承 OpenRouter 时 project 对 `agents.codex.openRouter.*` 的覆盖；list 必须完全匹配包含已解析 project config file 的 canonical directory 的 absolute path，而不是 invocation cwd 或 lexical path。不匹配子目录或 glob。project config file（包括受信任的 `kyoso.config.ts`）与 allowlist entry 都会通过 symlink 解析到该 directory；解析到同一 directory 的 entry 会匹配，解析到其他位置或无法解析的 path 会 fail closed。user-global `provider = "openrouter"` 不需要 allowlist entry。直接选择 CLI 时，必须在同一 invocation 中同时使用 `--set agents.codex.provider=openrouter` 和 `--set agents.codex.model=<model>`；project model 不能为该 CLI provider override 补足 model。`allowProjectProvider` 不是 `--set` path，legacy boolean 值会被拒绝。
 
@@ -396,7 +396,7 @@ Marketplace Plugin 会向其 MCP process 暴露 `OPENROUTER_API_KEY` 变量名
 
 新的 manual MCP registration 默认不包含 `OPENROUTER_API_KEY`。仅在有意选择 provider 后使用 `--with-openrouter` 添加它；已有 registration 永不重写。`kyoso setup ... --with-openrouter` 的输出和手动 setup 示例仍是用户管理的客户端注册模板。Claude Code registration 中的 `${OPENROUTER_API_KEY}` 必须由 client 展开；Kyoso 只会忽略完全由 `${NAME}`、`$NAME` 或 `%NAME%`（允许前后空白）构成的未展开 credential placeholder，并且只输出含变量名的 sanitized warning。含有其他文字的值会被保留。对于以 `_KEY`、`_TOKEN`、`_SECRET` 或 `_PASSWORD` 结尾的 custom credential-like name，也适用同一规则；非 credential template 会被保留。
 
-推荐使用这种经过 user authorization 的 project-scoped opt-in。global `provider = "openrouter"` 会被 project 继承，直到 project 设置 `provider = "default"`；仅省略 `provider` 不会将其 unset。固定的 OpenRouter Responses API preset 为 beta；不开放 custom endpoint、provider routing、fallback 或 judge integration。配置后，`streamIdleTimeoutMs`、`streamMaxRetries` 与 `requestMaxRetries` 只映射到 `stream_idle_timeout_ms`、`stream_max_retries` 与 `request_max_retries`；省略的 field 不会出现在 `CODEX_CONFIG` 中。为将 key 绑定到该 preset，OpenRouter mode 会拒绝含 top-level `profile` 或 `profiles` 的 `CODEX_CONFIG`，并会在启动 child 前拒绝非 object 的 `model_providers` value。对于 object，它会将 `model_providers` 替换为仅含固定 `kyoso-openrouter` entry 的对象，并发出只包含已丢弃 entry 数量的 sanitized warning；不会显示 provider ID 或 config value。除这些被拒绝的 field 外，它会保留 `model`、`model_provider` 和 `model_providers` 之外无关的 `CODEX_CONFIG` field，因此 foreign provider configuration 无法选择使用该 key 的 endpoint。Claude 仍使用已配置的 provider，judge 不会使用 `OPENROUTER_API_KEY`。
+推荐使用这种经过 user authorization 的 project-scoped opt-in。global `provider = "openrouter"` 会被 project 继承，直到 project 设置 `provider = "default"`；仅省略 `provider` 不会将其 unset。固定的 OpenRouter Responses API preset 为 beta；不开放 custom endpoint、provider routing、fallback 或 judge integration。配置的 `streamIdleTimeoutS` 会先规范化为内部 `streamIdleTimeoutMs`；该值、`streamMaxRetries` 与 `requestMaxRetries` 只映射到 `stream_idle_timeout_ms`、`stream_max_retries` 与 `request_max_retries`。省略的 field 不会出现在 `CODEX_CONFIG` 中。为将 key 绑定到该 preset，OpenRouter mode 会拒绝含 top-level `profile` 或 `profiles` 的 `CODEX_CONFIG`，并会在启动 child 前拒绝非 object 的 `model_providers` value。对于 object，它会将 `model_providers` 替换为仅含固定 `kyoso-openrouter` entry 的对象，并发出只包含已丢弃 entry 数量的 sanitized warning；不会显示 provider ID 或 config value。除这些被拒绝的 field 外，它会保留 `model`、`model_provider` 和 `model_providers` 之外无关的 `CODEX_CONFIG` field，因此 foreign provider configuration 无法选择使用该 key 的 endpoint。Claude 仍使用已配置的 provider，judge 不会使用 `OPENROUTER_API_KEY`。
 
 经过 user-global authorization 后，project `kyoso.toml` 可以选择 external provider，或覆盖继承的 OpenRouter model，并将 review context 路由给它。对于 untrusted repository，请使用 `--ignore-config`，并只显式传入所需的 CLI options。
 
@@ -456,7 +456,7 @@ Kyoso 可以在只有 Claude 或只有 Codex 可用时运行。请在 `kyoso.tom
 ```toml
 [reviewBudget]
 maxModelCalls = 4
-maxTotalWallTimeMs = 660000
+maxTotalWallTimeS = 660
 warnAgentOutputBytes = 524288
 maxAgentOutputBytes = 1048576
 maxFindingsPerAgent = 10
@@ -469,13 +469,17 @@ skipOptionalPhasesWhenTokenUsageUnknown = false
 
 ### Timeouts
 
-Codex 和 Claude 的default agent timeout均为600秒；verification round 默认90秒。review-wide deadline 默认660秒(`reviewBudget.maxTotalWallTimeMs`)，在default并行primary phase后保留标准的60秒finalization余量。各 phase 使用剩余 deadline 而不会延长它。`kyoso doctor` 会显示已配置的顺序phase时间，以及加入10%或60秒（取较大值）余量后的review-wide建议值。只有当judge mode允许且direct provider credential可用时，才会计入LLM judge timeout。
+建议为人工输入的时间值使用numeric seconds field：agent `timeoutS`、OpenRouter `streamIdleTimeoutS`、`verification.timeoutS`、`judge.timeoutS`、user-global `reviewBudget.maxTotalWallTimeS`、request `options.maxAgentTimeoutS`、request `options.reviewBudget.maxTotalWallTimeS` 和 library option `progressHeartbeatS`。现有 `*Ms` input 仍可使用且不会产生 runtime warning；resolved config、execution、result 与 Audit 继续使用millisecond。
+
+seconds可以是小数，但乘以1,000后必须得到safe integer millisecond。`1.5`与`0.001`有效，`0.0001`无效。timeout必须为正数；只有`progressHeartbeatS = 0`表示禁用heartbeat。同一layer或request object同时提供两种unit时，两者都会validation，并由`S`优先。config layer precedence先执行，因此后续project或CLI的`Ms`仍会覆盖较早global的`S`。
+
+Codex 和 Claude 的default agent timeout均为600秒；verification round 默认90秒。review-wide deadline 默认660秒(`reviewBudget.maxTotalWallTimeS`)，在default并行primary phase后保留标准的60秒finalization余量。各 phase 使用剩余 deadline 而不会延长它。`kyoso doctor` 会显示已配置的顺序phase时间，以及加入10%或60秒（取较大值）余量后的review-wide建议值。只有当judge mode允许且direct provider credential可用时，才会计入LLM judge timeout。
 
 本repository的primary 15分钟＋verification 15分钟dogfooding preset使用以下user-global override：
 
 ```toml
 [reviewBudget]
-maxTotalWallTimeMs = 2100000
+maxTotalWallTimeS = 2100
 ```
 
 Codex Plugin和新生成的manual Codex registration使用`tool_timeout_sec = 2160`，比Kyoso的35分钟deadline多保留60秒。`kyoso setup`会保留已有manual registration，因此需要手动更新。Claude Code Plugin manifest不设置client tool timeout；请用等效的毫秒值启动Claude Code，然后重启client：
@@ -484,17 +488,17 @@ Codex Plugin和新生成的manual Codex registration使用`tool_timeout_sec = 21
 MCP_TOOL_TIMEOUT=2160000 claude
 ```
 
-延长client timeout不会延长Kyoso内部的review-wide deadline。对于其他preset，请确保client timeout大于`reviewBudget.maxTotalWallTimeMs`。
+延长client timeout不会延长Kyoso内部的review-wide deadline。对于其他preset，请确保client timeout大于`reviewBudget.maxTotalWallTimeS`。
 
 ### Verification
 
-Verification keys: `verification.<enabled|maxFindings|timeoutMs>`。Optional finding verification 默认 disabled:
+Verification keys: `verification.<enabled|maxFindings|timeoutS>`。legacy-compatible 的 `timeoutMs` input 仍然可用。Optional finding verification 默认 disabled:
 
 ```toml
 [verification]
 enabled = false
 maxFindings = 5
-timeoutMs = 90000
+timeoutS = 90
 # global config only; project kyoso.toml cannot set this
 allowDemotion = false
 ```
@@ -503,7 +507,7 @@ allowDemotion = false
 
 ### Judge
 
-Judge keys: `judge.<mode|provider|timeoutMs>`。Judge LLMs 是 optional，默认 `mode = "deterministic_only"`；仅设置 credential 不会启动 judge call。OpenAI judge 需要 `mode = "deterministic_plus_llm"` 与 `OPENAI_API_KEY` 或 `CODEX_API_KEY`；Anthropic judge 需要同一 mode 与 `ANTHROPIC_API_KEY`。Optional overrides:
+Judge keys: `judge.<mode|provider|timeoutS>`。legacy-compatible 的 `timeoutMs` input 仍然可用。Judge LLMs 是 optional，默认 `mode = "deterministic_only"`；仅设置 credential 不会启动 judge call。OpenAI judge 需要 `mode = "deterministic_plus_llm"` 与 `OPENAI_API_KEY` 或 `CODEX_API_KEY`；Anthropic judge 需要同一 mode 与 `ANTHROPIC_API_KEY`。Optional overrides:
 
 - `OPENAI_BASE_URL`: OpenAI-compatible API base URL
 - `KYOSO_OPENAI_JUDGE_MODEL`: OpenAI judge model, default `gpt-5.4-mini`