@kyo-so/cli 0.16.10 → 0.16.11

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.11] - 2026-08-27
+
+### Changed
+
+- Promote the Marketplace Plugin to `0.7.19` and pin its Codex and Claude Code
+  MCP definitions and Skill fallbacks to `@kyo-so/cli@0.16.10`.
+- Migrate the build and typecheck toolchain to TypeScript 7.
+- Update GitHub Actions to Node.js 24 and generalize packed-config verification
+  across the supported Node.js 22, 24, and 26 runtimes.
+- Update Safe Chain to `1.5.15`.
+
 ## [0.16.10] - 2026-08-24
 
 ### Changed

package/README.ja.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner の実行経路では、npm package をローカル alias `kyoso-cli` としてインストールします: `npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` と `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso` です。いずれも package と executable を別指定するため multi-bin package の binary 推測に依存せず、alias によって package 名が `@kyo-so/cli` である checkout が公開 package を隠すことも防ぎます。workflowで固定する場合は、`kyoso-cli@npm:@kyo-so/cli@0.16.9` のように実 package 名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応)、package-runner の alias は `kyoso-cli`、インストールされる CLI コマンドは短い `kyoso` です。
+package-runner の実行経路では、npm package をローカル alias `kyoso-cli` としてインストールします: `npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` と `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso` です。いずれも package と executable を別指定するため multi-bin package の binary 推測に依存せず、alias によって package 名が `@kyo-so/cli` である checkout が公開 package を隠すことも防ぎます。workflowで固定する場合は、`kyoso-cli@npm:@kyo-so/cli@0.16.10` のように実 package 名へcomplete SemVer pinを付けます。以下の例の `kyoso` は、すでにインストールされた executable の省略形です。Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応)、package-runner の alias は `kyoso-cli`、インストールされる CLI コマンドは短い `kyoso` です。
 
 alias 導入前に書かれた登録は引き続きサポートされ、`current` として分類されます。npx が利用可能な npx 登録は `ready` のままですが、bunx 登録は setup が必要な Bun capability を検証するまで `unverified` のままです。`kyoso doctor` は alias が無いことを警告して書き換え先の spec を示します。setup はこの登録を保持するため、修復は手動編集になります。
 

package/README.md

@@ -152,7 +152,7 @@ Manual setup examples are kept in `examples/codex-config.toml` and `examples/cla
 
 ## CLI
 
-The package-runner execution paths install the npm package under the local alias `kyoso-cli`: `npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` and `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso`. Both forms select the package and the executable separately, so neither relies on binary inference from a multi-bin package, and the alias prevents a checkout whose own package name is `@kyo-so/cli` from shadowing the published package. Add a complete SemVer pin after the real package name when a workflow needs one, for example `kyoso-cli@npm:@kyo-so/cli@0.16.9`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), the package-runner alias is `kyoso-cli`, and the installed CLI command is the shorter `kyoso`.
+The package-runner execution paths install the npm package under the local alias `kyoso-cli`: `npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` and `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso`. Both forms select the package and the executable separately, so neither relies on binary inference from a multi-bin package, and the alias prevents a checkout whose own package name is `@kyo-so/cli` from shadowing the published package. Add a complete SemVer pin after the real package name when a workflow needs one, for example `kyoso-cli@npm:@kyo-so/cli@0.16.10`. The examples below abbreviate an already installed executable as `kyoso`. Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so), the package-runner alias is `kyoso-cli`, and the installed CLI command is the shorter `kyoso`.
 
 Registrations written before the alias remain supported and classified as `current`. An available npx registration remains `ready`; a bunx registration remains `unverified` until its Bun capability is verified by setup. `kyoso doctor` warns that the alias is missing and names the spec to write; setup preserves such an entry, so that repair is a hand edit.
 

package/README.zh-CN.md

@@ -154,7 +154,7 @@ Use Kyoso diff_review on the current diff. I need a second opinion before mergin
 
 ## CLI
 
-package-runner 执行路径会把 npm package 安装为本地 alias `kyoso-cli`：`npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` 与 `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso`。两种形式都分别指定 package 和 executable，因此都不依赖 multi-bin package 的 binary 推断；alias 还能防止 package 名同为 `@kyo-so/cli` 的 checkout 遮蔽已发布的 package。需要固定 workflow 时，在真实 package 名后加 complete SemVer pin，例如 `kyoso-cli@npm:@kyo-so/cli@0.16.9`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，package-runner alias 是 `kyoso-cli`，安装后的 CLI command 是更短的 `kyoso`。
+package-runner 执行路径会把 npm package 安装为本地 alias `kyoso-cli`：`npx -y --package=kyoso-cli@npm:@kyo-so/cli kyoso` 与 `bunx --package kyoso-cli@npm:@kyo-so/cli kyoso`。两种形式都分别指定 package 和 executable，因此都不依赖 multi-bin package 的 binary 推断；alias 还能防止 package 名同为 `@kyo-so/cli` 的 checkout 遮蔽已发布的 package。需要固定 workflow 时，在真实 package 名后加 complete SemVer pin，例如 `kyoso-cli@npm:@kyo-so/cli@0.16.10`。下面的示例把已安装 executable 简写为 `kyoso`。Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，package-runner alias 是 `kyoso-cli`，安装后的 CLI command 是更短的 `kyoso`。
 
 alias 之前写入的注册仍然受支持，并被分类为 `current`。npx 可用时 npx 注册保持 `ready`；bunx 注册在 setup 验证其所需的 Bun capability 之前保持 `unverified`。`kyoso doctor` 会警告缺少 alias 并给出应写入的 spec；setup 会保留该 entry，因此这项修复需手动编辑。
 

package/dist/bin/kyoso.js

@@ -48,9 +48,9 @@ var __export = (target, all) => {
 };
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// node_modules/typescript/lib/typescript.js
+// node_modules/@typescript/old/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/home/runner/work/kyoso/kyoso/node_modules/typescript/lib", __filename = "/home/runner/work/kyoso/kyoso/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/home/runner/work/kyoso/kyoso/node_modules/@typescript/old/lib", __filename = "/home/runner/work/kyoso/kyoso/node_modules/@typescript/old/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -183966,7 +183966,7 @@ var JUDGE_MAX_OUTPUT_TOKENS = 4096;
 var RAW_OUTPUT_MAX_CHARS = 16384;
 var TRACE_DIR = ".kyoso/traces";
 var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-var KYOSO_VERSION = "0.16.10";
+var KYOSO_VERSION = "0.16.11";
 
 // src/utils/pathContainment.ts
 import { resolve, sep as sep2 } from "node:path";
@@ -185911,7 +185911,7 @@ function formatTomlError(configPath, error51) {
 }
 
 // src/config/tsConfigLoader.ts
-var import_typescript = __toESM(require_typescript(), 1);
+var import_typescript6 = __toESM(require_typescript(), 1);
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname3, extname as extname2 } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -185932,12 +185932,12 @@ async function loadConfigModule(filePath, source) {
 }
 function loadTypeScriptConfig(filePath, source) {
   const sourceWithoutSelfImport = source.replace(/^\s*import\s+\{[^}]*defineConfig[^}]*\}\s+from\s+["']@kyo-so\/cli["'];?\s*$/gm, "");
-  const transpiled = import_typescript.default.transpileModule(sourceWithoutSelfImport, {
+  const transpiled = import_typescript6.default.transpileModule(sourceWithoutSelfImport, {
     compilerOptions: {
-      module: import_typescript.default.ModuleKind.CommonJS,
-      target: import_typescript.default.ScriptTarget.ES2022,
+      module: import_typescript6.default.ModuleKind.CommonJS,
+      target: import_typescript6.default.ScriptTarget.ES2022,
       esModuleInterop: true,
-      moduleResolution: import_typescript.default.ModuleResolutionKind.NodeNext
+      moduleResolution: import_typescript6.default.ModuleResolutionKind.NodeNext
     },
     fileName: filePath
   }).outputText;
@@ -187260,9 +187260,9 @@ var PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 2;
 var MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
   distribution: {
-    pluginVersion: "0.7.18",
+    pluginVersion: "0.7.19",
     mcpCommand: "npx",
-    mcpPackagePin: "@kyo-so/cli@0.16.9",
+    mcpPackagePin: "@kyo-so/cli@0.16.10",
     mcpExecutable: "kyoso"
   },
   marketplace: {

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 2;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.7.18";
+        readonly pluginVersion: "0.7.19";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.16.9";
+        readonly mcpPackagePin: "@kyo-so/cli@0.16.10";
         readonly mcpExecutable: "kyoso";
     };
     readonly marketplace: {
@@ -131,9 +131,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.7.18";
+            readonly pluginVersion: "0.7.19";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.16.9";
+            readonly mcpPackagePin: "@kyo-so/cli@0.16.10";
             readonly mcpExecutable: "kyoso";
         };
         readonly marketplace: {

package/dist/config/schema.d.ts

@@ -20,20 +20,20 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     }, z.core.$strip>;
     reviewPolicy: z.ZodObject<{
         additionalLenses: z.ZodArray<z.ZodEnum<{
+            architecture: "architecture";
             correctness: "correctness";
-            regression: "regression";
-            security_boundaries: "security_boundaries";
-            secrets_and_injection: "secrets_and_injection";
             data_integrity: "data_integrity";
-            public_contract: "public_contract";
-            supply_chain: "supply_chain";
+            documentation: "documentation";
+            maintainability: "maintainability";
+            performance: "performance";
             privacy: "privacy";
+            public_contract: "public_contract";
+            regression: "regression";
             resource_amplification: "resource_amplification";
-            architecture: "architecture";
-            performance: "performance";
+            secrets_and_injection: "secrets_and_injection";
+            security_boundaries: "security_boundaries";
+            supply_chain: "supply_chain";
             tests: "tests";
-            documentation: "documentation";
-            maintainability: "maintainability";
         }>>;
         multiAgentRequired: z.ZodBoolean;
     }, z.core.$strip>;
@@ -46,9 +46,9 @@ export declare const kyosoConfigSchema: z.ZodObject<{
             model: z.ZodOptional<z.ZodString>;
             effort: z.ZodOptional<z.ZodString>;
             role: z.ZodEnum<{
-                implementation_reviewer: "implementation_reviewer";
                 architecture_security_reviewer: "architecture_security_reviewer";
                 combined_reviewer: "combined_reviewer";
+                implementation_reviewer: "implementation_reviewer";
             }>;
             timeoutMs: z.ZodDefault<z.ZodNumber>;
             env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -60,8 +60,8 @@ export declare const kyosoConfigSchema: z.ZodObject<{
                 envWhitelist: z.ZodArray<z.ZodString>;
             }, z.core.$strip>;
             provider: z.ZodOptional<z.ZodEnum<{
-                openrouter: "openrouter";
                 default: "default";
+                openrouter: "openrouter";
             }>>;
             allowProjectProvider: z.ZodDefault<z.ZodArray<z.ZodString>>;
             openRouter: z.ZodDefault<z.ZodObject<{
@@ -78,9 +78,9 @@ export declare const kyosoConfigSchema: z.ZodObject<{
             model: z.ZodOptional<z.ZodString>;
             effort: z.ZodOptional<z.ZodString>;
             role: z.ZodEnum<{
-                implementation_reviewer: "implementation_reviewer";
                 architecture_security_reviewer: "architecture_security_reviewer";
                 combined_reviewer: "combined_reviewer";
+                implementation_reviewer: "implementation_reviewer";
             }>;
             timeoutMs: z.ZodDefault<z.ZodNumber>;
             env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -131,14 +131,14 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     }, z.core.$strip>;
     judge: z.ZodObject<{
         mode: z.ZodEnum<{
-            deterministic_plus_llm: "deterministic_plus_llm";
             deterministic_only: "deterministic_only";
+            deterministic_plus_llm: "deterministic_plus_llm";
         }>;
         provider: z.ZodEnum<{
-            auto: "auto";
-            openai: "openai";
             anthropic: "anthropic";
+            auto: "auto";
             none: "none";
+            openai: "openai";
         }>;
         timeoutMs: z.ZodNumber;
     }, z.core.$strip>;

package/dist/core/constants.d.ts

@@ -7,4 +7,4 @@ export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.16.10";
+export declare const KYOSO_VERSION = "0.16.11";

package/dist/index.js

@@ -47,9 +47,9 @@ var __export = (target, all) => {
 };
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// node_modules/typescript/lib/typescript.js
+// node_modules/@typescript/old/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/home/runner/work/kyoso/kyoso/node_modules/typescript/lib", __filename = "/home/runner/work/kyoso/kyoso/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/home/runner/work/kyoso/kyoso/node_modules/@typescript/old/lib", __filename = "/home/runner/work/kyoso/kyoso/node_modules/@typescript/old/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -185452,7 +185452,7 @@ function formatTomlError(configPath, error51) {
 }
 
 // src/config/tsConfigLoader.ts
-var import_typescript = __toESM(require_typescript(), 1);
+var import_typescript6 = __toESM(require_typescript(), 1);
 import { createRequire as createRequire2 } from "node:module";
 import { dirname, extname } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -185466,12 +185466,12 @@ async function loadConfigModule(filePath, source) {
 }
 function loadTypeScriptConfig(filePath, source) {
   const sourceWithoutSelfImport = source.replace(/^\s*import\s+\{[^}]*defineConfig[^}]*\}\s+from\s+["']@kyo-so\/cli["'];?\s*$/gm, "");
-  const transpiled = import_typescript.default.transpileModule(sourceWithoutSelfImport, {
+  const transpiled = import_typescript6.default.transpileModule(sourceWithoutSelfImport, {
     compilerOptions: {
-      module: import_typescript.default.ModuleKind.CommonJS,
-      target: import_typescript.default.ScriptTarget.ES2022,
+      module: import_typescript6.default.ModuleKind.CommonJS,
+      target: import_typescript6.default.ScriptTarget.ES2022,
       esModuleInterop: true,
-      moduleResolution: import_typescript.default.ModuleResolutionKind.NodeNext
+      moduleResolution: import_typescript6.default.ModuleResolutionKind.NodeNext
     },
     fileName: filePath
   }).outputText;

package/dist/mcp/schemas.d.ts

@@ -3,20 +3,20 @@ export declare const kyosoReviewRequestSchema: z.ZodObject<{
     goal: z.ZodString;
     reviewContract: z.ZodOptional<z.ZodObject<{
         focus: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            architecture: "architecture";
             correctness: "correctness";
-            regression: "regression";
-            security_boundaries: "security_boundaries";
-            secrets_and_injection: "secrets_and_injection";
             data_integrity: "data_integrity";
-            public_contract: "public_contract";
-            supply_chain: "supply_chain";
+            documentation: "documentation";
+            maintainability: "maintainability";
+            performance: "performance";
             privacy: "privacy";
+            public_contract: "public_contract";
+            regression: "regression";
             resource_amplification: "resource_amplification";
-            architecture: "architecture";
-            performance: "performance";
+            secrets_and_injection: "secrets_and_injection";
+            security_boundaries: "security_boundaries";
+            supply_chain: "supply_chain";
             tests: "tests";
-            documentation: "documentation";
-            maintainability: "maintainability";
         }>>>;
         nonGoals: z.ZodOptional<z.ZodArray<z.ZodString>>;
         acceptedRisks: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -60,10 +60,10 @@ export declare const kyosoReviewRequestSchema: z.ZodObject<{
         }, z.core.$strict>>;
         includeAgentRawOutputs: z.ZodOptional<z.ZodBoolean>;
         judgeProvider: z.ZodOptional<z.ZodEnum<{
-            auto: "auto";
-            openai: "openai";
             anthropic: "anthropic";
+            auto: "auto";
             none: "none";
+            openai: "openai";
         }>>;
         allowSecretRedaction: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kyo-so/cli",
-  "version": "0.16.10",
+  "version": "0.16.11",
   "description": "Kyo-so: MCP-native, ACP-powered multi-agent review gates for AI coding workflows.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -13,7 +13,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": "^22.0.0 || ^24.0.0 || ^26.0.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -39,10 +39,10 @@
   ],
   "scripts": {
     "dev": "bun run src/cli/main.ts",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "node node_modules/typescript/bin/tsc --noEmit",
     "test": "bun test",
-    "build": "bun build src/index.ts --target=node --outfile dist/index.js && bun build src/cli/main.ts --target=node --outfile dist/bin/kyoso.js --banner '#!/usr/bin/env node' && node -e \"require('node:fs').chmodSync('dist/bin/kyoso.js', 0o755)\" && tsc -p tsconfig.build.json",
-    "lint": "tsc --noEmit",
+    "build": "bun build src/index.ts --target=node --outfile dist/index.js && bun build src/cli/main.ts --target=node --outfile dist/bin/kyoso.js --banner '#!/usr/bin/env node' && node -e \"require('node:fs').chmodSync('dist/bin/kyoso.js', 0o755)\" && node node_modules/typescript/bin/tsc -p tsconfig.build.json",
+    "lint": "node node_modules/typescript/bin/tsc --noEmit",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "smoke:openrouter:codex-acp": "bun run src/cli/main.ts openrouter-acp-smoke",
@@ -64,11 +64,12 @@
     "@agentclientprotocol/sdk": "1.4.0",
     "@modelcontextprotocol/server": "2.0.0",
     "smol-toml": "1.8.0",
-    "typescript": "6.0.3",
     "zod": "4.4.3"
   },
   "devDependencies": {
     "@types/bun": "1.4.0",
-    "prettier": "3.9.6"
+    "@typescript/typescript6": "6.0.2",
+    "prettier": "3.9.6",
+    "typescript": "7.0.2"
   }
 }