@kyo-so/cli 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,109 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.5.0] - 2026-07-08
+
+### Added
+
+- Cross-validation classification on aggregated findings: findings backed by
+  both agents are marked `corroborated`, single-agent findings `single_source`.
+- Fusion-style cross-model analysis from the advisory judge: blind spots,
+  semantic contradictions, and partial coverage are reported as advisory
+  metadata (`crossModelAnalysis`); the deterministic decision is unchanged.
+- Optional adversarial verification round (`verification.enabled`, default
+  off): single-source high/critical findings are sent to the other agent with
+  a skeptical refute-first prompt. Annotate-only: verdicts adjust confidence
+  and notes, never severity or the decision.
+- CI-ready MCP stdio and ACP subprocess integration tests now cover the real
+  protocol boundaries without live LLM credentials. `pack:verify` also starts
+  the packed CLI bin as an MCP server and checks its version and tool list.
+- Nix development shell pinning Node.js and Bun for reproducible local setups.
+
+### Changed
+
+- Reviewer prompts now require concise English finding titles (evidence,
+  recommendations, and summaries may stay in the user's language) and clarify
+  that selected files show the pre-change base state during diff reviews.
+- Same-category findings that reference overlapping line ranges in the same
+  file now merge regardless of title wording, so cross-model corroboration no
+  longer depends on title phrasing.
+
+## [0.4.1] - 2026-07-07
+
+### Changed
+
+- Updated `@modelcontextprotocol/server` to 2.0.0-beta.2 and
+  `@agentclientprotocol/sdk` to 1.1.0. Before release, the MCP stdio server
+  handshake was smoke-tested against beta.2 and a full multi-agent review run
+  was verified with real Codex and Claude agents on the updated ACP stack.
+
+## [0.4.0] - 2026-07-07
+
+### Added
+
+- Pinned default ACP adapter versions (`@agentclientprotocol/codex-acp@1.1.0`,
+  `@agentclientprotocol/claude-agent-acp@0.57.0`) so adapter updates ship
+  through deliberate Kyoso releases instead of being fetched as `latest` at
+  runtime. Overrides via `kyoso.config.ts` still work.
+- Version consistency enforcement: `bun test` and `pack:verify` fail when the
+  MCP server version constant drifts from `package.json`, and release builds
+  fail when the git tag does not match the package version.
+- CI and release workflows install dependencies through Aikido safe-chain,
+  blocking known-malicious package versions before they execute.
+- `repository`, `homepage`, and `bugs` metadata in `package.json` (required
+  for provenance validation).
+
+### Changed
+
+- Releases are now published via npm trusted publishing (OIDC) from GitHub
+  Actions with provenance attestation. Verify with `npm audit signatures`.
+
+## [0.3.0] - 2026-07-07
+
+### Added
+
+- Single-agent mode: Kyoso now works when only Claude or only Codex is
+  available. The remaining backend runs once as `combined_reviewer`, covering
+  both implementation and architecture/security focus areas.
+- `reviewMode` (`multi_agent` / `single_agent`) and `agentsUsed` in JSON
+  output; Markdown output states when cross-model verification was not
+  performed and marks Disagreements as N/A.
+- `kyoso doctor` and `kyoso setup` suggest a single-agent config when only
+  one backend command is found on PATH.
+- `examples/claude-only.config.ts` and `examples/codex-only.config.ts`.
+
+### Changed
+
+- Agent role prompts are driven by `agents.<name>.role` in `kyoso.config.ts`
+  instead of being hardcoded per agent name. Default configs behave the same;
+  customized `role` values now take effect.
+
+### Fixed
+
+- The MCP server reports the correct package version (previously stuck at
+  0.1.0).
+
+## [0.2.0] - 2026-07-05
+
+### Added
+
+- `kyoso setup codex` / `kyoso setup claude-code` for one-command MCP
+  registration and review-skill installation.
+- Quick Start documentation and expanded `kyoso doctor` diagnostics.
+- Japanese and Simplified Chinese READMEs.
+
+## [0.1.0] - 2026-07-05
+
+### Added
+
+- Initial public release: MCP-native, ACP-powered multi-agent review gate
+  coordinating Codex and Claude reviewers for plan review, CISA Secure by
+  Design security review, and diff review.
+- Deterministic decision gates, secret scanning with redaction, read-only
+  temp-snapshot workspaces, and JSONL audit traces.

package/README.ja.md

@@ -1,5 +1,7 @@
 # Kyo-so
 
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/hokupod/kyoso)
+
 [English](README.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
 
 この翻訳は英語版より古い場合があります。最新の情報は英語版 README を参照してください。
@@ -100,6 +102,7 @@ Naming note: npm パッケージは `@kyo-so/cli` (製品名 Kyo-so に対応)
 ローカル開発:
 
 ```bash
+nix develop
 safe-chain bun install
 safe-chain bun run typecheck
 safe-chain bun test
@@ -108,6 +111,8 @@ safe-chain bun run build
 
 パッケージ化された CLI を実行するには Node.js 20 以降が必要です。
 
+Nix dev shell は Node.js 24 と nixpkgs が提供する Bun version を固定します。`.envrc` を確認してから `direnv allow` を一度実行すると、自動で shell を読み込めます。CI は Bun 1.3.14 に pin したままです。現在の nixpkgs Bun version は少し異なる場合がありますが、`flake.lock` により local shell の再現性を保ちます。
+
 既知の配布リスク: `@modelcontextprotocol/server` にはまだ stable release がありません。Kyoso は現在 prerelease API を pin しているため、MCP SDK API の変更に追従する follow-up release が必要になる場合があります。
 
 ## CLI
@@ -198,6 +203,8 @@ Kyoso は provider credentials を保存しません。Child agent environment v
 
 Repository content、plans、diffs、selected files は backend prompts 内で untrusted data として扱われます。Kyoso はそれらを `<untrusted-content>` tags で包み、その中にある instructions に従わないよう agents に指示します。最終判断は schema-constrained findings から導出されます。agents は files の書き込みや commands の実行ができず、judge は deterministic decision を変更できません。
 
+Finding title は aggregation のため簡潔な英語に正規化されます。evidence、recommendations、summaries はユーザーの言語のままで構いません。
+
 ## Agent Auth
 
 Codex は利用可能な場合、local `codex` login を使用します。既定の subscription-backed path では API key は不要です。
@@ -258,7 +265,20 @@ Raw agent output と raw file contents は既定で無効です。
 
 TypeScript config files は任意の code を実行できます。TTY では、untrusted config を実行する前に Kyoso が確認します。MCP や CI のような non-interactive mode では、untrusted config は skip され、defaults が使われます。現在の config hash を明示的に trust するには `--trust-config` を渡し、常に defaults を使うには `--ignore-config` を渡してください。
 
-Default agent timeouts は Codex 120 秒、Claude 240 秒です。MCP clients は tool calls に少なくとも 360 秒を許可してください。
+Default agent timeouts は Codex 120 秒、Claude 240 秒です。MCP clients は tool calls に少なくとも 360 秒を許可してください。`verification.enabled` が true の場合、Kyoso は追加の cross-agent verification round を実行することがあるため、少なくとも 480 秒を許可してください。
+
+Optional finding verification は default で disabled です:
+
+```ts
+verification: {
+  enabled: false,
+  maxFindings: 5,
+  timeoutMs: 90_000,
+  allowDemotion: false,
+}
+```
+
+Enabled の場合、Kyoso は high/critical かつ single-source の各 finding について、その finding を報告していない agent に反証を試みさせます。Phase 1 は annotate-only です。verification は finding confidence と notes を更新できますが、severity や final decision は変更しません。`allowDemotion` は future opt-in phase 用に予約されており、現時点では no-op です。
 
 Judge LLMs は optional です。OpenAI judge を使うには `OPENAI_API_KEY` または `CODEX_API_KEY` を設定し、Anthropic judge を使うには `ANTHROPIC_API_KEY` を設定します。Optional overrides:
 
@@ -279,7 +299,7 @@ Team admins は organization Usage credits も確認してください。Credits
 
 ## Troubleshooting
 
-- MCP timeout: client tool timeouts を少なくとも 360 秒に設定してください。Kyoso defaults は Codex 120 秒、Claude 240 秒です。
+- MCP timeout: client tool timeouts を少なくとも 360 秒、`verification.enabled` が true の場合は少なくとも 480 秒に設定してください。Kyoso defaults は Codex 120 秒、Claude 240 秒、verification 90 秒です。
 - Fresh npm release: safe-chain などの minimum-package-age protection により、publish 直後は `npx @kyo-so/cli` の解決が一時的に block される場合があります。
 - Non-interactive config: `--trust-config` を渡さない限り、untrusted `kyoso.config.ts` は skip されます。
 

package/README.md

@@ -1,5 +1,7 @@
 # Kyo-so
 
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/hokupod/kyoso)
+
 [English](README.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
 
 Kyo-so (Kyoso / 協奏) is an MCP-native, ACP-powered multi-agent review gate for AI coding workflows.
@@ -98,15 +100,21 @@ Naming note: the npm package is `@kyo-so/cli` (matching the product name Kyo-so)
 For local development:
 
 ```bash
+nix develop
 safe-chain bun install
 safe-chain bun run typecheck
 safe-chain bun test
 safe-chain bun run build
+safe-chain bun run pack:verify
 ```
 
 Requires Node.js 20 or newer when running the packaged CLI.
 
-Known distribution risk: `@modelcontextprotocol/server` has no stable release yet; Kyoso currently pins a prerelease API, so MCP SDK API changes may require a follow-up release.
+The Nix dev shell pins Node.js 24 and the nixpkgs-provided Bun version. After reviewing `.envrc`, you can also run `direnv allow` once and let it load the shell automatically. CI remains pinned to Bun 1.3.14; the current nixpkgs Bun version may differ slightly, but `flake.lock` keeps local shells reproducible.
+
+The test suite includes credential-free MCP stdio and ACP subprocess integration coverage. `pack:verify` additionally starts the packed `dist/bin/kyoso.js` MCP server and checks the published bundle's protocol handshake.
+
+Known distribution risk: `@modelcontextprotocol/server` has no stable release yet; Kyoso currently pins a prerelease API, so MCP SDK API changes may require a follow-up release. Run manual real-agent dogfooding before releases that bump `@modelcontextprotocol/server`, `@agentclientprotocol/sdk`, or pinned ACP adapters.
 
 ## CLI
 
@@ -196,6 +204,8 @@ Kyoso does not store provider credentials. Child agent environment variables are
 
 Repository content, plans, diffs, and selected files are treated as untrusted data in backend prompts. Kyoso wraps them in `<untrusted-content>` tags and tells agents not to follow instructions found inside. Final decisions are derived from schema-constrained findings; agents cannot write files or run commands, and the judge cannot change the deterministic decision.
 
+Finding titles are normalized to concise English for aggregation; evidence, recommendations, and summaries can remain in the user's language.
+
 ## Agent Auth
 
 Codex uses the local `codex` login when available. No API key is required for the default subscription-backed path.
@@ -256,7 +266,20 @@ Keep `.kyoso/traces/` out of Git. `kyoso init` adds `.kyoso/` to `.gitignore`, a
 
 TypeScript config files can execute arbitrary code. In a TTY, Kyoso prompts before executing an untrusted config. In non-interactive mode such as MCP or CI, untrusted config is skipped and defaults are used. Pass `--trust-config` to explicitly trust the current config hash, or `--ignore-config` to always use defaults.
 
-Default agent timeouts are Codex 120 seconds and Claude 240 seconds. MCP clients should allow at least 360 seconds for tool calls.
+Default agent timeouts are Codex 120 seconds and Claude 240 seconds. MCP clients should allow at least 360 seconds for tool calls. If `verification.enabled` is true, allow at least 480 seconds because Kyoso may run an additional cross-agent verification round.
+
+Optional finding verification is disabled by default:
+
+```ts
+verification: {
+  enabled: false,
+  maxFindings: 5,
+  timeoutMs: 90_000,
+  allowDemotion: false,
+}
+```
+
+When enabled, Kyoso asks the agent that did not report each high/critical single-source finding to try to refute it. Phase 1 is annotate-only: verification can update finding confidence and notes, but it does not change severity or the final decision. `allowDemotion` is reserved for a future opt-in phase and is currently a no-op.
 
 Judge LLMs are optional. Set `OPENAI_API_KEY` or `CODEX_API_KEY` to use the OpenAI judge, or `ANTHROPIC_API_KEY` to use the Anthropic judge. Optional overrides:
 
@@ -277,7 +300,7 @@ Team admins should also check organization Usage credits. If credits are enabled
 
 ## Troubleshooting
 
-- MCP timeout: set client tool timeouts to at least 360 seconds. Kyoso defaults are Codex 120 seconds and Claude 240 seconds.
+- MCP timeout: set client tool timeouts to at least 360 seconds, or at least 480 seconds when `verification.enabled` is true. Kyoso defaults are Codex 120 seconds, Claude 240 seconds, and verification 90 seconds.
 - Fresh npm release: minimum-package-age protection in tools such as safe-chain may briefly block `npx @kyo-so/cli` resolution after publish.
 - Non-interactive config: untrusted `kyoso.config.ts` is skipped unless you pass `--trust-config`.
 

package/README.zh-CN.md

@@ -1,5 +1,7 @@
 # Kyo-so
 
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/hokupod/kyoso)
+
 [English](README.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
 
 此翻译可能落后于英文版。请参阅英文 README 获取最新信息。
@@ -100,6 +102,7 @@ Naming note: npm package 是 `@kyo-so/cli` (对应产品名 Kyo-so)，安装后
 本地开发：
 
 ```bash
+nix develop
 safe-chain bun install
 safe-chain bun run typecheck
 safe-chain bun test
@@ -108,6 +111,8 @@ safe-chain bun run build
 
 运行打包后的 CLI 需要 Node.js 20 或更高版本。
 
+Nix dev shell 会 pin Node.js 24 和 nixpkgs 提供的 Bun version。确认 `.envrc` 后，也可以运行一次 `direnv allow`，让它自动加载 shell。CI 仍然 pin 到 Bun 1.3.14；当前 nixpkgs Bun version 可能略有不同，但 `flake.lock` 会保证 local shell 可复现。
+
 已知分发风险：`@modelcontextprotocol/server` 目前还没有 stable release；Kyoso 当前 pin 了 prerelease API，因此 MCP SDK API 变更可能需要后续 release。
 
 ## CLI
@@ -198,6 +203,8 @@ Kyoso 不存储 provider credentials。Child agent environment variables 使用
 
 Repository content、plans、diffs 和 selected files 在 backend prompts 中被视为 untrusted data。Kyoso 会用 `<untrusted-content>` tags 包裹它们，并告诉 agents 不要遵循其中的 instructions。最终 decisions 来自 schema-constrained findings；agents 不能写 files 或运行 commands，judge 不能改变 deterministic decision。
 
+Finding title 会为 aggregation 规范化为简洁英文；evidence、recommendations 和 summaries 可以继续使用用户的语言。
+
 ## Agent Auth
 
 可用时，Codex 使用 local `codex` login。默认 subscription-backed path 不需要 API key。
@@ -258,7 +265,20 @@ Raw agent output 和 raw file contents 默认禁用。
 
 TypeScript config files 可以执行任意 code。在 TTY 中，Kyoso 会在执行 untrusted config 前提示确认。在 MCP 或 CI 等 non-interactive mode 中，untrusted config 会被 skip，并使用 defaults。传入 `--trust-config` 可明确 trust 当前 config hash；传入 `--ignore-config` 可始终使用 defaults。
 
-Default agent timeouts 是 Codex 120 秒、Claude 240 秒。MCP clients 应允许 tool calls 至少运行 360 秒。
+Default agent timeouts 是 Codex 120 秒、Claude 240 秒。MCP clients 应允许 tool calls 至少运行 360 秒。如果 `verification.enabled` 为 true，Kyoso 可能会运行额外的 cross-agent verification round，因此建议至少允许 480 秒。
+
+Optional finding verification 默认 disabled:
+
+```ts
+verification: {
+  enabled: false,
+  maxFindings: 5,
+  timeoutMs: 90_000,
+  allowDemotion: false,
+}
+```
+
+启用后，Kyoso 会让没有报告该 finding 的 agent 对 high/critical 且 single-source 的 finding 尝试反驳。Phase 1 是 annotate-only：verification 可以更新 finding confidence 和 notes，但不会改变 severity 或 final decision。`allowDemotion` 为未来的 opt-in phase 保留，目前是 no-op。
 
 Judge LLMs 是 optional。设置 `OPENAI_API_KEY` 或 `CODEX_API_KEY` 可使用 OpenAI judge，设置 `ANTHROPIC_API_KEY` 可使用 Anthropic judge。Optional overrides:
 
@@ -279,7 +299,7 @@ Team admins 还应检查 organization Usage credits。如果启用了 credits，
 
 ## Troubleshooting
 
-- MCP timeout: 将 client tool timeouts 设置为至少 360 秒。Kyoso defaults 是 Codex 120 秒、Claude 240 秒。
+- MCP timeout: 将 client tool timeouts 设置为至少 360 秒；当 `verification.enabled` 为 true 时，设置为至少 480 秒。Kyoso defaults 是 Codex 120 秒、Claude 240 秒、verification 90 秒。
 - Fresh npm release: safe-chain 等 minimum-package-age protection 可能会在 publish 后短时间内 block `npx @kyo-so/cli` resolution。
 - Non-interactive config: 除非传入 `--trust-config`，否则 untrusted `kyoso.config.ts` 会被 skip。
 

package/dist/acp/FakeAgentManager.d.ts

@@ -1,9 +1,21 @@
 import type { AgentRunInput, AgentRunResult } from "../core/types.js";
 import { BaseAcpAgentManager } from "./AcpAgentManager.js";
 export type FakeAgentScenario = "success" | "markdown_json" | "timeout" | "malformed" | "auth_failure" | "permission_request" | "write_attempt";
+export type FakeVerifierVerdict = {
+    findingId: string;
+    verdict: "confirmed" | "refuted" | "uncertain";
+    reasoning?: string;
+    evidence?: string;
+};
+export type FakeVerifierScenario = "confirmed" | "refuted" | "uncertain" | "malformed" | "timeout" | {
+    rawText: string;
+} | {
+    verdicts: FakeVerifierVerdict[];
+};
 export declare class FakeAgentManager extends BaseAcpAgentManager {
     private readonly scenarios;
+    private readonly verifierScenarios;
     readonly calls: AgentRunInput[];
-    constructor(scenarios?: Partial<Record<"codex" | "claude", FakeAgentScenario>>);
+    constructor(scenarios?: Partial<Record<"codex" | "claude", FakeAgentScenario>>, verifierScenarios?: Partial<Record<"codex" | "claude", FakeVerifierScenario>>);
     runAgent(input: AgentRunInput): Promise<AgentRunResult>;
 }

package/dist/acp/prompts.d.ts

@@ -1,2 +1,3 @@
-import type { AgentName, AgentRole, KyosoReviewRequest, ReviewTool } from "../core/types.js";
+import type { AgentName, AgentRole, KyosoFinding, KyosoReviewRequest, ReviewTool } from "../core/types.js";
 export declare function buildAgentPrompt(tool: ReviewTool, request: KyosoReviewRequest, agent: AgentName, role: AgentRole): string;
+export declare function buildFindingVerifierPrompt(tool: ReviewTool, request: KyosoReviewRequest, verifier: AgentName, findings: KyosoFinding[]): string;

package/dist/aggregate/aggregateFindings.d.ts

@@ -1,4 +1,4 @@
-import type { AgentRunResult, KyosoFinding } from "../core/types.js";
+import type { AgentRunResult, KyosoFinding, ReviewMode } from "../core/types.js";
 export type AggregatedReview = {
     findings: KyosoFinding[];
     testsToAdd: string[];
@@ -12,4 +12,7 @@ export type AggregatedReview = {
         judgeComment: string;
     }>;
 };
-export declare function aggregateAgentResults(results: AgentRunResult[]): AggregatedReview;
+export declare function aggregateAgentResults(results: AgentRunResult[], options?: {
+    reviewMode?: ReviewMode;
+}): AggregatedReview;
+export declare function realSourceAgentCount(sourceAgents: KyosoFinding["sourceAgents"]): number;