@kyo-so/cli 0.7.0 → 0.8.0

package/.agents/skills/kyoso-review/SKILL.md

@@ -29,10 +29,19 @@ Do not use this skill for every coding task. It is intended for deliberate revie
    - selected files
    - unified diff if available
    - constraints
-4. Call the appropriate Kyoso MCP tool:
-   - `plan_review`
-   - `security_review`
-   - `diff_review`
+4. Run the review through the first available path:
+   - Prefer the corresponding Kyoso MCP tool when it is available:
+     - `plan_review`
+     - `security_review`
+     - `diff_review`
+   - If the MCP tools are unavailable, use the CLI fallback with JSON output:
+     - `plan_review` -> `npx -y @kyo-so/cli plan --goal <text> [--plan <path-or-text>] [--file <path>] --json`
+     - `security_review` -> `npx -y @kyo-so/cli security --goal <text> [--diff <path>] [--file <path>] --json`
+     - `diff_review` -> `npx -y @kyo-so/cli diff --base <ref> --head <ref> --json`
+   - `bunx @kyo-so/cli` may be used instead of `npx -y @kyo-so/cli`.
+   - The CLI also accepts `--repo-summary`, repeatable `--constraint`, and repeatable `--file` flags. For a large review, adjust an agent timeout with `--set agents.<agent>.timeoutMs=<ms>`.
+   - Run the CLI without a config trust flag first. Inspect `audit.warnings` in the JSON result; if it contains `untrusted config was not executed`, or the command fails with an untrusted-config message, ask the user whether to rerun with `--trust-config` to use it or `--ignore-config` to skip it. Never add `--trust-config` without confirmation.
+   - Keep `--json` enabled and interpret the returned `decision` exactly like the MCP result.
 5. Treat `decision: block` as a stop signal. Present the result to the user before implementing.
 6. Treat `decision: approve_with_changes` as requiring changes to the plan or implementation.
 7. Do not claim Kyoso modified files. Kyoso only reviews.

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-07-10
+
+### Added
+
+- Repeatable `--set <config-key>=<value>` option on the `plan`, `security`,
+  and `diff` commands for overriding config values such as
+  `agents.<agent>.model`, `agents.<agent>.effort`, and `timeoutMs` from the
+  command line. Overrides are restricted to the shared project-scope
+  allowlist, applied after config files (including with `--ignore-config`),
+  and schema-validated.
+- CLI fallback in the bundled `kyoso-review` skill: when the Kyoso MCP
+  server is not registered, the skill falls back to
+  `npx`/`bunx @kyo-so/cli plan|security|diff --json`. The fallback runs
+  without config trust flags first and requires user confirmation before
+  `--trust-config` or `--ignore-config`. Documented in all README languages.
+
+## [0.7.1] - 2026-07-09
+
+### Changed
+
+- Update `@agentclientprotocol/sdk` from 1.1.0 to 1.2.0: ACP schema 1.19.0,
+  linear-time `ndJsonStream` receive path, and unified JSON-RPC message
+  validation across transports.
+
 ## [0.7.0] - 2026-07-09
 
 ### Added

package/README.ja.md

@@ -136,7 +136,7 @@ Nix dev shell は Node.js 24 と nixpkgs が提供する Bun version を固定
 ```bash
 kyoso plan --goal "Review this OAuth callback plan" --plan plan.md
 kyoso security --goal "Review this auth diff" --diff changes.patch
-kyoso diff --base main --head HEAD
+kyoso diff --base main --head HEAD --set agents.claude.effort=high
 kyoso doctor
 kyoso init
 kyoso setup codex
@@ -203,6 +203,8 @@ MCP stdout は protocol messages 専用です。logs は stderr または local
 
 同梱の `kyoso-review` skill は意図的に狭い用途にしています。Kyoso、multi-agent review、plan review、security review、CISA Secure by Design review、diff review を明示的に依頼したときだけ trigger されるべきです。
 
+skill は、利用可能な場合は Kyoso MCP tools を優先します。MCP server が未登録の場合は、記載された CLI fallback に従い、`npx -y @kyo-so/cli` または `bunx @kyo-so/cli` から JSON output を取得します。
+
 `npx @kyo-so/cli setup codex --write` と `bunx @kyo-so/cli setup codex --write` は、既定で `.agents/skills/kyoso-review/` にコピーします。`--global` を追加すると `~/.agents/skills/kyoso-review/` にコピーします。
 
 `npx @kyo-so/cli setup claude-code --write` と `bunx @kyo-so/cli setup claude-code --write` は、既定で `.claude/skills/kyoso-review/` にコピーします。`--global` を追加すると `~/.claude/skills/kyoso-review/` にコピーします。
@@ -281,7 +283,15 @@ Kyoso は次の順に config を load します。
 - built-in defaults
 - user global TOML: `$XDG_CONFIG_HOME/kyoso/config.toml`、または `~/.config/kyoso/config.toml`
 - project TOML: `<cwd>/kyoso.toml`
-- `--network` などの CLI flags
+- `--network` などの CLI flags と `--set agents.claude.effort=high` などの反復可能な overrides
+
+`plan`、`security`、`diff` は、反復可能な `--set <key>=<value>` overrides を受け付けます。CLI で指定した値は config files より優先され、`--ignore-config` との併用も可能です。
+
+- Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`
+- Verification keys: `verification.<enabled|maxFindings|timeoutMs>`
+- Judge keys: `judge.<mode|provider|timeoutMs>`
+
+未知の key は拒否されます。boolean / numeric config keys は schema の型へ変換し、string keys は文字列のまま保持した後、config 全体を再検証します。
 
 Project `kyoso.toml` は declarative で、trust approval は不要です。tools toggles、agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、workspace byte limits と additive `workspace.deny`、verification settings、advisory judge settings、tightening-only security/network settings を設定できます。
 

package/README.md

@@ -137,7 +137,7 @@ Known distribution risk: `@modelcontextprotocol/server` has no stable release ye
 ```bash
 kyoso plan --goal "Review this OAuth callback plan" --plan plan.md
 kyoso security --goal "Review this auth diff" --diff changes.patch
-kyoso diff --base main --head HEAD
+kyoso diff --base main --head HEAD --set agents.claude.effort=high
 kyoso doctor
 kyoso init
 kyoso setup codex
@@ -204,6 +204,8 @@ MCP stdout is reserved for protocol messages. Logs go to stderr or local audit t
 
 The bundled `kyoso-review` skill is intentionally narrow. It should trigger only when you explicitly ask for Kyoso, multi-agent review, plan review, security review, CISA Secure by Design review, or diff review.
 
+The skill prefers the Kyoso MCP tools when available. If the MCP server is not registered, it follows its documented CLI fallback and requests JSON output from `npx -y @kyo-so/cli` or `bunx @kyo-so/cli`.
+
 `npx @kyo-so/cli setup codex --write` and `bunx @kyo-so/cli setup codex --write` copy it to `.agents/skills/kyoso-review/` by default. Add `--global` to copy it to `~/.agents/skills/kyoso-review/`.
 
 `npx @kyo-so/cli setup claude-code --write` and `bunx @kyo-so/cli setup claude-code --write` copy it to `.claude/skills/kyoso-review/` by default. Add `--global` to copy it to `~/.claude/skills/kyoso-review/`.
@@ -282,7 +284,15 @@ Kyoso loads config in this order:
 - built-in defaults
 - user global TOML: `$XDG_CONFIG_HOME/kyoso/config.toml`, or `~/.config/kyoso/config.toml`
 - project TOML: `<cwd>/kyoso.toml`
-- CLI flags such as `--network`
+- CLI flags such as `--network` and repeatable overrides such as `--set agents.claude.effort=high`
+
+`plan`, `security`, and `diff` accept repeatable `--set <key>=<value>` overrides. Values set on the CLI take precedence over config files, including when `--ignore-config` is used.
+
+- Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`
+- Verification keys: `verification.<enabled|maxFindings|timeoutMs>`
+- Judge keys: `judge.<mode|provider|timeoutMs>`
+
+Unknown keys are rejected. Boolean and numeric config keys are converted to their schema types; string keys remain strings. The complete config is then validated.
 
 Project `kyoso.toml` is declarative and does not require trust approval. It can set safe project-scoped keys such as tool toggles, agent `enabled` / `model` / `effort` / `role` / `timeoutMs`, workspace byte limits and additive `workspace.deny`, verification settings, advisory judge settings, and tightening-only security/network settings.
 

package/README.zh-CN.md

@@ -136,7 +136,7 @@ Nix dev shell 会 pin Node.js 24 和 nixpkgs 提供的 Bun version。确认 `.en
 ```bash
 kyoso plan --goal "Review this OAuth callback plan" --plan plan.md
 kyoso security --goal "Review this auth diff" --diff changes.patch
-kyoso diff --base main --head HEAD
+kyoso diff --base main --head HEAD --set agents.claude.effort=high
 kyoso doctor
 kyoso init
 kyoso setup codex
@@ -203,6 +203,8 @@ MCP stdout 专用于 protocol messages。Logs 会写到 stderr 或 local audit t
 
 内置的 `kyoso-review` skill 有意保持范围很窄。只有当你明确请求 Kyoso、multi-agent review、plan review、security review、CISA Secure by Design review 或 diff review 时，才应触发它。
 
+当 Kyoso MCP tools 可用时，skill 会优先使用它们。如果尚未注册 MCP server，skill 会按照文档中的 CLI fallback，通过 `npx -y @kyo-so/cli` 或 `bunx @kyo-so/cli` 获取 JSON output。
+
 `npx @kyo-so/cli setup codex --write` 和 `bunx @kyo-so/cli setup codex --write` 默认将其复制到 `.agents/skills/kyoso-review/`。添加 `--global` 会复制到 `~/.agents/skills/kyoso-review/`。
 
 `npx @kyo-so/cli setup claude-code --write` 和 `bunx @kyo-so/cli setup claude-code --write` 默认将其复制到 `.claude/skills/kyoso-review/`。添加 `--global` 会复制到 `~/.claude/skills/kyoso-review/`。
@@ -281,7 +283,15 @@ Kyoso 按以下顺序 load config：
 - built-in defaults
 - user global TOML: `$XDG_CONFIG_HOME/kyoso/config.toml`，或 `~/.config/kyoso/config.toml`
 - project TOML: `<cwd>/kyoso.toml`
-- `--network` 等 CLI flags
+- `--network` 等 CLI flags，以及 `--set agents.claude.effort=high` 等可重复的 overrides
+
+`plan`、`security` 和 `diff` 接受可重复的 `--set <key>=<value>` overrides。CLI 指定的值优先于 config files，也可以与 `--ignore-config` 一起使用。
+
+- Agent keys: `agents.<codex|claude>.<enabled|model|effort|role|timeoutMs>`
+- Verification keys: `verification.<enabled|maxFindings|timeoutMs>`
+- Judge keys: `judge.<mode|provider|timeoutMs>`
+
+未知 key 会被拒绝。Boolean / numeric config keys 会转换为 schema 类型，string keys 保持字符串，然后重新验证完整 config。
 
 Project `kyoso.toml` 是 declarative config，不需要 trust approval。它可以设置 tools toggles、agent `enabled` / `model` / `effort` / `role` / `timeoutMs`、workspace byte limits 和 additive `workspace.deny`、verification settings、advisory judge settings，以及 tightening-only security/network settings。